feat(android): connection security indicator across all surfaces

Implements the spec in docs/plans/2026-06-24-connection-security-indicator.md
(decisions: Tailscale=green, ship all surfaces, "Encrypted · <mechanism>").

Single source of truth: data/ConnectionSecurity.kt computes a per-surface +
rollup verdict (TLS / Overlay / Mixed / Plain) from the active route's
schemes; ConnectionViewModel exposes it as a StateFlow. Overlay transports
(Tailscale/WireGuard/plugin proxy) count as encrypted, not just TLS — so a
ws:// route over a tailnet reads "Encrypted · Tailscale" (green), fixing the
old badge's hardcoded "Secure — TLS" lie.

Surfaces (all read the one flow):
- Chat status chip: leading security glyph (RelayStatusStrip slot).
- Connection card: full-width badge promoted out of the Advanced fold.
- Route picker: per-route glyph on each candidate.
- New ConnectionSecuritySheet: tap any badge for the per-transport
  breakdown + mechanism explainer + docs link.

Removed the duplicated, buried security computation from
ActiveConnectionSections (now delegates to the shared model).

Docs: new user-docs "Is my connection secure?" page; fixes the
Tailscale=TLS conflation in decisions.md / security.md / remote-access.md;
first user-facing mention of TOFU cert pinning.

Verified: ./gradlew :app:testSideloadDebugUnitTest (ConnectionSecurityTest
7/7) + :app:lintSideloadDebug both green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.gitattributes

@@ -0,0 +1 @@
+*.sh text eol=lf

.githooks/pre-commit

@@ -0,0 +1,40 @@
+#!/bin/bash
+# @subframe-version 0.15.1-beta
+# @subframe-managed
+#
+# SubFrame pre-commit hook
+# Auto-updates STRUCTURE.json when JS files in src/ are committed.
+#
+
+# Check if any JS files in src/ are staged
+STAGED_JS=$(git diff --cached --name-only --diff-filter=ACMRD | grep -E '^src/.*\.(js|ts|tsx|jsx)$' || true)
+
+# Also check for deleted source files
+DELETED_JS=$(git diff --cached --name-only --diff-filter=D | grep -E '^src/.*\.(js|ts|tsx|jsx)$' || true)
+
+if [ -z "$STAGED_JS" ] && [ -z "$DELETED_JS" ]; then
+  exit 0
+fi
+
+# Only update if .subframe/STRUCTURE.json exists (SubFrame project)
+if [ ! -f ".subframe/STRUCTURE.json" ]; then
+  exit 0
+fi
+
+# Only update if the updater script exists
+UPDATER=".githooks/update-structure.js"
+if [ ! -f "$UPDATER" ]; then
+  exit 0
+fi
+
+echo "[SubFrame] Source files changed, updating .subframe/STRUCTURE.json..."
+
+# Run the updater with staged/deleted file lists as env vars
+STAGED_FILES="$STAGED_JS" DELETED_FILES="$DELETED_JS" node "$UPDATER"
+
+# Stage the updated .subframe/STRUCTURE.json
+git add .subframe/STRUCTURE.json
+
+echo "[SubFrame] .subframe/STRUCTURE.json updated and staged."
+
+exit 0

.githooks/pre-push

@@ -0,0 +1,22 @@
+#!/bin/bash
+# @subframe-version 0.15.1-beta
+# @subframe-managed
+# SubFrame pre-push hook
+# Triggers pipeline workflows configured with "on: { push: true }"
+# To bypass: git push --no-verify
+
+SUBFRAME_DIR=".subframe"
+PIPELINES_DIR="$SUBFRAME_DIR/pipelines"
+TRIGGER_FILE="$PIPELINES_DIR/.pre-push-trigger"
+
+# Only trigger if SubFrame is initialized
+if [ ! -d "$SUBFRAME_DIR" ]; then
+  exit 0
+fi
+
+# Write trigger file for SubFrame to detect
+mkdir -p "$PIPELINES_DIR"
+echo "{\"trigger\": \"pre-push\", \"timestamp\": \"$(date -u +%Y-%m-%dT%H:%M:%SZ)\"}" > "$TRIGGER_FILE"
+
+# Don't block the push — pipeline runs async via SubFrame UI
+exit 0

.githooks/update-structure.js

@@ -0,0 +1,127 @@
+#!/usr/bin/env node
+// @subframe-version 0.15.1-beta
+// @subframe-managed
+/**
+ * SubFrame STRUCTURE.json Updater
+ * Called by .githooks/pre-commit when source files in src/ are staged.
+ * Reads STAGED_FILES and DELETED_FILES from environment variables.
+ */
+
+const fs = require('fs');
+const path = require('path');
+
+const ROOT = process.cwd();
+const STRUCTURE_FILE = path.join(ROOT, '.subframe', 'STRUCTURE.json');
+const SRC_DIR = path.join(ROOT, 'src');
+
+// Strip any JS/TS extension for module key
+function stripExt(p) {
+  return p.replace(/\.(js|ts|tsx|jsx)$/, '');
+}
+
+// Load existing STRUCTURE.json
+let structure;
+try {
+  structure = JSON.parse(fs.readFileSync(STRUCTURE_FILE, 'utf-8'));
+} catch (e) {
+  process.exit(0);
+}
+
+if (!structure.modules) {
+  structure.modules = {};
+}
+
+const files = (process.env.STAGED_FILES || '').split('\n').filter(Boolean);
+const deleted = (process.env.DELETED_FILES || '').split('\n').filter(Boolean);
+
+// Remove deleted modules
+for (const file of deleted) {
+  const key = stripExt(path.relative(SRC_DIR, path.join(ROOT, file)))
+    .replace(/\\/g, '/');
+  if (structure.modules[key]) {
+    delete structure.modules[key];
+  }
+}
+
+// Parse each staged file
+for (const file of files) {
+  const fullPath = path.join(ROOT, file);
+  if (!fs.existsSync(fullPath)) continue;
+
+  let content;
+  try {
+    content = fs.readFileSync(fullPath, 'utf-8');
+  } catch (e) {
+    continue;
+  }
+
+  const key = stripExt(path.relative(SRC_DIR, fullPath))
+    .replace(/\\/g, '/');
+
+  // Extract description from top JSDoc comment
+  let description = '';
+  const docMatch = content.match(/^\/\*\*\s*\n\s*\*\s*([^\n]+)/);
+  if (docMatch) description = docMatch[1].trim();
+
+  // Extract exports — CJS (module.exports) and ESM (export { ... }, export function)
+  const xports = [];
+  const cjsMatch = content.match(/module\.exports\s*=\s*\{([^}]+)\}/);
+  if (cjsMatch) {
+    cjsMatch[1].split(',').forEach(function(s) {
+      const name = s.trim().split(':')[0].trim();
+      if (name && !name.startsWith('//')) xports.push(name);
+    });
+  }
+  // ESM named exports: export { foo, bar } or export function foo
+  const esmExportRe = /^export\s+(?:function|const|let|class|async\s+function)\s+(\w+)/gm;
+  let em;
+  while ((em = esmExportRe.exec(content)) !== null) {
+    if (!xports.includes(em[1])) xports.push(em[1]);
+  }
+
+  // Extract dependencies — CJS require() and ESM import
+  const deps = [];
+  const reqRe = /require\s*\(\s*['"]([^'"]+)['"]\s*\)/g;
+  let m;
+  while ((m = reqRe.exec(content)) !== null) {
+    const dep = m[1];
+    if (dep.startsWith('./') || dep.startsWith('../')) {
+      deps.push(stripExt(dep.replace(/^\.+\//, '')));
+    } else {
+      deps.push(dep);
+    }
+  }
+  const importRe = /import\s+.*?from\s+['"]([^'"]+)['"]/g;
+  while ((m = importRe.exec(content)) !== null) {
+    const dep = m[1];
+    if (dep.startsWith('./') || dep.startsWith('../')) {
+      deps.push(stripExt(dep.replace(/^\.+\//, '')));
+    } else {
+      deps.push(dep);
+    }
+  }
+
+  // Extract function names with line numbers
+  const functions = {};
+  const fnRe = /^(?:export\s+)?(?:async\s+)?function\s+(\w+)\s*\(/gm;
+  while ((m = fnRe.exec(content)) !== null) {
+    const lineNum = content.substring(0, m.index).split('\n').length;
+    functions[m[1]] = { line: lineNum };
+  }
+
+  const existing = structure.modules[key] || {};
+  structure.modules[key] = {
+    file: file,
+    description: description || existing.description || '',
+    exports: xports,
+    depends: deps.filter(function(v, i, a) { return a.indexOf(v) === i; }),
+    functions: Object.keys(functions).length > 0 ? functions : (existing.functions || {})
+  };
+}
+
+// Update timestamp and save
+structure.lastUpdated = new Date().toISOString().split('T')[0];
+if (structure._frame_metadata) {
+  structure._frame_metadata.lastUpdated = structure.lastUpdated;
+}
+fs.writeFileSync(STRUCTURE_FILE, JSON.stringify(structure, null, 2) + '\n');

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,90 @@
+name: Bug report
+description: Report a reproducible problem in Hermes-Relay.
+title: "[Bug]: "
+labels: ["bug"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Before submitting, remove secrets, access tokens, real hostnames/IPs, private deployment names, and personal names. Public example IPs such as `192.168.1.100` are fine.
+
+  - type: dropdown
+    id: area
+    attributes:
+      label: Affected area
+      description: Pick the closest surface.
+      options:
+        - Android app
+        - Standard Hermes chat or voice
+        - Relay plugin or server
+        - Desktop CLI or tray
+        - Dashboard plugin
+        - Docs or installer
+        - CI, release, or packaging
+        - Unsure
+    validations:
+      required: true
+
+  - type: textarea
+    id: summary
+    attributes:
+      label: What happened?
+      description: State the behavior you saw and what you expected instead.
+      placeholder: |
+        Observed:
+
+        Expected:
+    validations:
+      required: true
+
+  - type: textarea
+    id: steps
+    attributes:
+      label: Reproduction steps
+      description: Include the smallest sequence that reproduces the issue.
+      placeholder: |
+        1. Pair or configure...
+        2. Open...
+        3. Tap or run...
+        4. See...
+    validations:
+      required: true
+
+  - type: textarea
+    id: environment
+    attributes:
+      label: Environment
+      description: Include only the fields that apply.
+      value: |
+        - Hermes-Relay version/tag:
+        - Install surface: Google Play / sideload APK / local build / plugin / desktop CLI
+        - Android device and OS:
+        - hermes-agent version or commit:
+        - Connection mode: LAN / Tailscale / public TLS / other
+    validations:
+      required: true
+
+  - type: textarea
+    id: logs
+    attributes:
+      label: Sanitized logs, screenshots, or traces
+      description: Paste the smallest useful log excerpt. Remove tokens, private URLs, hostnames, IPs, and user-identifying data.
+      render: shell
+
+  - type: textarea
+    id: upstream
+    attributes:
+      label: Upstream or standard-path notes
+      description: If relevant, note whether this reproduces against unmodified upstream hermes-agent or only with the relay plugin enabled.
+
+  - type: checkboxes
+    id: checklist
+    attributes:
+      label: Checklist
+      options:
+        - label: I searched existing issues first.
+          required: true
+        - label: I removed secrets, tokens, private infrastructure, and personal names.
+          required: true
+        - label: I included the affected version or install surface where known.
+          required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,11 @@
+blank_issues_enabled: true
+contact_links:
+  - name: Report a security vulnerability (private)
+    url: https://github.com/Codename-11/hermes-relay/security/advisories/new
+    about: Report privately via GitHub Security Advisories — do not open a public issue. See SECURITY.md for the full policy.
+  - name: User documentation
+    url: https://codename-11.github.io/hermes-relay/
+    about: Read setup, pairing, remote access, and troubleshooting docs.
+  - name: Contributing guide
+    url: https://github.com/Codename-11/hermes-relay/blob/main/CONTRIBUTING.md
+    about: Review local setup, branch, commit, changelog, and test conventions.

.github/ISSUE_TEMPLATE/docs.yml

@@ -0,0 +1,64 @@
+name: Documentation or setup issue
+description: Report unclear, stale, or missing docs and setup guidance.
+title: "[Docs]: "
+labels: ["documentation"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Use this for docs, installer, setup, release-note, or contribution-guide problems. Remove private hostnames/IPs, tokens, and personal names before posting.
+
+  - type: dropdown
+    id: area
+    attributes:
+      label: Documentation area
+      options:
+        - README
+        - User docs site
+        - Android setup
+        - Relay plugin setup
+        - Desktop CLI or tray setup
+        - Release notes or changelog
+        - Contributor docs
+        - Other
+    validations:
+      required: true
+
+  - type: input
+    id: location
+    attributes:
+      label: Page, file, or section
+      description: Link the page or name the file and heading.
+      placeholder: user-docs/guide/getting-started.md, README install section, etc.
+    validations:
+      required: true
+
+  - type: textarea
+    id: issue
+    attributes:
+      label: What is wrong or missing?
+      description: Explain what was unclear, outdated, misleading, or absent.
+    validations:
+      required: true
+
+  - type: textarea
+    id: expected
+    attributes:
+      label: Suggested correction
+      description: Optional. Include the wording, command, screenshot need, or structure that would help.
+
+  - type: textarea
+    id: context
+    attributes:
+      label: Context
+      description: Optional. Include the version, install path, device, or command you were following.
+
+  - type: checkboxes
+    id: checklist
+    attributes:
+      label: Checklist
+      options:
+        - label: I checked that this is not already covered in current docs.
+          required: true
+        - label: I removed secrets, private hostnames/IPs, internal deployment names, and personal names.
+          required: true

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,78 @@
+name: Feature request
+description: Propose a product, workflow, or platform improvement.
+title: "[Feature]: "
+labels: ["enhancement"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Keep requests focused on user-visible outcomes. Do not include private infrastructure, secrets, personal names, or branch/workspace plumbing.
+
+  - type: dropdown
+    id: area
+    attributes:
+      label: Affected area
+      options:
+        - Android app
+        - Standard Hermes chat or voice
+        - Relay plugin or server
+        - Desktop CLI or tray
+        - Dashboard plugin
+        - Docs or installer
+        - CI, release, or packaging
+        - Unsure
+    validations:
+      required: true
+
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem or workflow
+      description: What is hard, missing, slow, confusing, or unsafe today?
+      placeholder: Describe the concrete user workflow this would improve.
+    validations:
+      required: true
+
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed behavior
+      description: Describe the outcome, not just an implementation detail.
+      placeholder: After this change, a user should be able to...
+    validations:
+      required: true
+
+  - type: textarea
+    id: standard_path
+    attributes:
+      label: Standard upstream compatibility
+      description: If this touches chat, voice, dashboard, API routes, or server behavior, note whether it can work against unmodified upstream hermes-agent.
+      placeholder: This should work on vanilla upstream because... / This requires the relay plugin because...
+
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+      description: Optional. Mention current workarounds or related approaches.
+
+  - type: textarea
+    id: acceptance
+    attributes:
+      label: Acceptance criteria
+      description: What would make the request complete?
+      placeholder: |
+        - Users can...
+        - The app/server handles...
+        - Documentation covers...
+
+  - type: checkboxes
+    id: checklist
+    attributes:
+      label: Checklist
+      options:
+        - label: I searched existing issues first.
+          required: true
+        - label: I described the user outcome and affected surface.
+          required: true
+        - label: I removed private infrastructure details and personal names.
+          required: true

.github/PULL_REQUEST_TEMPLATE.md

@@ -6,11 +6,20 @@
 
 -
 
+## Verification
+
+<!-- List the checks you ran, or explain why a check is not applicable. -->
+
+-
+
 ## Checklist
 
-- [ ] `./gradlew assembleDebug` succeeds
-- [ ] `./gradlew test` passes
-- [ ] Tested on emulator or device (if UI change)
+- [ ] Target branch is `dev` unless this is a release PR
+- [ ] Android changes: lint and focused unit tests ran, or rationale is listed above
+- [ ] Server changes: focused `python -m unittest ...` checks ran, or rationale is listed above
+- [ ] Desktop changes: `npm run build` or a narrower documented check ran, or rationale is listed above
+- [ ] Docs/site changes: docs build or link check ran, or rationale is listed above
+- [ ] UI changes were tested on emulator/device or desktop surface when applicable
 - [ ] Commit messages follow [Conventional Commits](https://www.conventionalcommits.org/)
 - [ ] CHANGELOG.md updated (if user-facing)
-- [ ] No credentials or secrets in committed files
+- [ ] Public writing hygiene checked: no secrets, private infrastructure, personal names, or AI/process narration

.github/copilot-instructions.md

@@ -0,0 +1,22 @@
+# GitHub Copilot instructions — Hermes-Relay
+
+This file exists so GitHub Copilot (which reads `.github/copilot-instructions.md`,
+not `AGENTS.md`) picks up the project's agent guidance.
+
+**Read [AGENTS.md](../AGENTS.md) first — it is the single source of truth**
+for agent guidance: the entry point, the non-negotiables, and the public-repo
+writing hygiene. It links on to `CLAUDE.md` for the deep reference
+(architecture, upstream Hermes API, repository layout, per-language code style,
+the dev loop, and the Key Files map). Follow those; don't restate them here.
+
+Quick non-negotiables (the full list and rationale are in `AGENTS.md`):
+
+- **Standard path = vanilla upstream only.** The default no-plugin connection
+  must work against unmodified upstream hermes-agent; server-side needs go
+  through upstream PRs or the optional relay plugin, never fork patches.
+- **Conventional Commits**, `main`/`dev` branching — feature branches off
+  `dev`, `--no-ff` merges, tags cut from `main`.
+- **Android:** Jetpack Compose (no XML), kotlinx.serialization (no Gson),
+  OkHttp (no Ktor), `wss://` only; run `./gradlew lint` before pushing Kotlin.
+- **Public repo:** no personal names, no private infrastructure, no
+  AI/assistant self-narration in committed prose.

.github/workflows/ci-android.yml

@@ -0,0 +1,194 @@
+# Hermes-Relay — Android CI Pipeline
+#
+# Runs on pushes to main/dev and on PRs targeting main/dev, scoped to
+# Android-affecting paths so Python-only changes don't spin up the JVM.
+#
+# Pipeline: lint, build, and focused tests run concurrently. PRs build debug
+# APKs before merge; dev pushes keep lint/tests only to avoid duplicate
+# post-merge packaging. Main pushes keep APK artifacts.
+#
+# A release-build smoke (bundleRelease assembleRelease) runs on dev/main pushes
+# and on the dev→main release PR so release-only breakage (R8/minify rules,
+# resource shrinking, bundletool OOM) is caught BEFORE the android-v* tag,
+# instead of mid-release. It is debug-signed, so it needs no signing secrets.
+
+name: CI — Android
+
+on:
+  push:
+    branches: [main, dev]
+    paths:
+      - "app/**"
+      - "gradle/**"
+      - "build.gradle.kts"
+      - "settings.gradle.kts"
+      - "gradle.properties"
+      - "gradlew"
+      - "gradlew.bat"
+      - ".github/workflows/ci-android.yml"
+  pull_request:
+    branches: [main, dev]
+    paths:
+      - "app/**"
+      - "gradle/**"
+      - "build.gradle.kts"
+      - "settings.gradle.kts"
+      - "gradle.properties"
+      - "gradlew"
+      - "gradlew.bat"
+      - ".github/workflows/ci-android.yml"
+
+# Cancel in-progress runs for the same branch/PR, but let main and dev finish
+concurrency:
+  group: ci-android-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' && github.ref != 'refs/heads/dev' }}
+
+jobs:
+  # ──────────────────────────────────────────────
+  # Android Lint
+  # ──────────────────────────────────────────────
+  lint:
+    name: Lint (Android)
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Set up JDK 17
+        uses: actions/setup-java@v5
+        with:
+          distribution: temurin
+          java-version: 17
+
+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@v6
+        with:
+          cache-read-only: ${{ github.ref != 'refs/heads/main' && github.ref != 'refs/heads/dev' }}
+
+      - name: Run Android lint
+        run: ./gradlew lint --console=plain
+
+  # ──────────────────────────────────────────────
+  # Android Build — assembleDebug for PRs and main pushes
+  # ──────────────────────────────────────────────
+  build:
+    name: Build (Android)
+    if: ${{ github.event_name == 'pull_request' || github.ref == 'refs/heads/main' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 25
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Set up JDK 17
+        uses: actions/setup-java@v5
+        with:
+          distribution: temurin
+          java-version: 17
+
+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@v6
+        with:
+          cache-read-only: ${{ github.ref != 'refs/heads/main' && github.ref != 'refs/heads/dev' }}
+
+      - name: Build debug APK
+        run: ./gradlew assembleDebug --console=plain
+
+      - name: Upload debug APK
+        uses: actions/upload-artifact@v7
+        if: ${{ github.ref == 'refs/heads/main' }}
+        with:
+          name: debug-apk
+          # Product flavors (googlePlay, sideload) nest APKs under
+          # app/build/outputs/apk/<flavor>/debug/ — the `*` matches both.
+          path: app/build/outputs/apk/*/debug/*.apk
+          if-no-files-found: error
+          retention-days: 14
+
+  # ──────────────────────────────────────────────
+  # Android Tests — unit tests + report upload
+  #
+  # Tests run on every branch but are ADVISORY on dev (push or PR) so WIP
+  # commits don't block the merge queue. Strict on main — any PR retargeted
+  # from dev → main will surface the real failures before release-merge.
+  # ──────────────────────────────────────────────
+  test:
+    name: Test (Android)
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    # Advisory on dev, strict on main. Evaluates to false (= strict) for
+    # pushes to main and PRs whose base branch is main; true (= advisory)
+    # for everything else (dev pushes, dev-targeted PRs, feature branches).
+    continue-on-error: ${{ github.ref != 'refs/heads/main' && github.base_ref != 'main' }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Set up JDK 17
+        uses: actions/setup-java@v5
+        with:
+          distribution: temurin
+          java-version: 17
+
+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@v6
+        with:
+          cache-read-only: ${{ github.ref != 'refs/heads/main' && github.ref != 'refs/heads/dev' }}
+
+      # The broad Gradle `test` aggregate currently hangs in deferred JVM test
+      # suites tracked by issue #32. Keep CI release-relevant until that suite is
+      # split: pairing URL derivation plus connection switching are the stable
+      # Android regression slice for the active release work.
+      - name: Run focused Android unit tests
+        run: |
+          ./gradlew :app:testSideloadDebugUnitTest \
+            --tests com.hermesandroid.relay.network.ArchitectureBoundaryTest \
+            --tests com.hermesandroid.relay.network.relay.RelayUrlDeriverTest \
+            --tests com.hermesandroid.relay.viewmodel.ConnectionSwitchTest \
+            --console=plain
+
+      # Upload reports only for failures. Successful PR report uploads add
+      # noticeable latency and are rarely inspected.
+      - name: Upload test reports
+        uses: actions/upload-artifact@v7
+        if: failure()
+        with:
+          name: test-reports
+          path: app/build/reports/tests/
+          retention-days: 7
+
+  # ──────────────────────────────────────────────
+  # Release build smoke — exercises the release variant the android-v* tag
+  # build runs (./gradlew bundleRelease assembleRelease, both flavors), so
+  # release-only breakage (R8/minify, resource shrinking, bundletool OOM) is
+  # caught BEFORE the tag instead of mid-release. Debug-signed — no secrets,
+  # so it also runs on fork PRs. Runs on dev/main pushes (early signal after
+  # each merge) and on the dev→main release PR (hard pre-tag gate); skipped on
+  # dev-targeted feature PRs to avoid re-running a ~12-min build per iteration.
+  # ──────────────────────────────────────────────
+  release-smoke:
+    name: Release build smoke (Android)
+    if: ${{ github.ref == 'refs/heads/dev' || github.ref == 'refs/heads/main' || (github.event_name == 'pull_request' && github.base_ref == 'main') }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 35
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Set up JDK 17
+        uses: actions/setup-java@v5
+        with:
+          distribution: temurin
+          java-version: 17
+
+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@v6
+        with:
+          cache-read-only: ${{ github.ref != 'refs/heads/main' && github.ref != 'refs/heads/dev' }}
+
+      # Mirrors release-android.yml's build step. No keystore is provided here,
+      # so app/build.gradle.kts falls back to debug signing — fine for a build
+      # smoke; the goal is to exercise the build, not to produce a shippable AAB.
+      - name: Build release bundles + APKs (both flavors, debug-signed)
+        run: ./gradlew bundleRelease assembleRelease --console=plain

.github/workflows/ci-contract.yml

@@ -0,0 +1,89 @@
+# Hermes-Relay — Vanilla-Upstream Route Contract (ADR 34)
+#
+# Proves the Android *standard path* (no-plugin) route surface exists on
+# UNMODIFIED NousResearch/hermes-agent — the invariant CLAUDE.md asserts but
+# that was never tested. Source-parses upstream's declared routes (no server
+# boot, no pip install, no model keys); see scripts/check-upstream-route-contract.py
+# for the design + tradeoff (catches renamed/removed routes; not runtime auth).
+#
+# PR/push runs check a pinned ref (non-flaky); the weekly schedule tracks
+# upstream `main` as a drift siren so a route rename surfaces on our clock.
+
+name: CI — Upstream Contract
+
+on:
+  push:
+    branches: [main, dev]
+    paths:
+      - "scripts/check-upstream-route-contract.py"
+      - ".github/workflows/ci-contract.yml"
+      - "app/src/main/kotlin/com/hermesandroid/relay/network/upstream/**"
+  pull_request:
+    branches: [main, dev]
+    paths:
+      - "scripts/check-upstream-route-contract.py"
+      - ".github/workflows/ci-contract.yml"
+      - "app/src/main/kotlin/com/hermesandroid/relay/network/upstream/**"
+  schedule:
+    - cron: "0 6 * * 1" # Mondays 06:00 UTC — upstream-drift siren (tracks main)
+  workflow_dispatch:
+    inputs:
+      upstream_ref:
+        description: "NousResearch/hermes-agent ref to check (branch, tag, or SHA)"
+        required: false
+        default: ""
+
+concurrency:
+  group: ci-contract-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' && github.ref != 'refs/heads/dev' }}
+
+jobs:
+  route-contract:
+    name: Vanilla-upstream route contract
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Checkout hermes-relay
+        uses: actions/checkout@v6
+
+      - name: Resolve upstream ref
+        id: ref
+        run: |
+          # PR/push runs use a known-good NousResearch/hermes-agent commit so
+          # normal CI is stable. The weekly schedule below intentionally tracks
+          # main as the upstream-drift siren.
+          DEFAULT_REF="ef4b897a1843cd32c4f141f55db60f0f0602cc98"
+          if [ "${{ github.event_name }}" = "schedule" ]; then
+            REF="main"                                   # weekly drift siren
+          elif [ -n "${{ github.event.inputs.upstream_ref }}" ]; then
+            REF="${{ github.event.inputs.upstream_ref }}" # manual override
+          else
+            REF="$DEFAULT_REF"
+          fi
+          echo "ref=$REF" >> "$GITHUB_OUTPUT"
+          echo "Checking standard-path route contract against upstream ref: $REF"
+
+      - name: Checkout vanilla upstream (no plugin, no bootstrap)
+        uses: actions/checkout@v6
+        with:
+          repository: NousResearch/hermes-agent
+          ref: ${{ steps.ref.outputs.ref }}
+          path: _upstream
+          fetch-depth: 1
+
+      - name: Set up Python 3.11
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.11"
+
+      - name: Assert upstream checkout is vanilla (no relay bootstrap/plugin)
+        run: |
+          if [ -e "_upstream/hermes_relay_bootstrap" ] || \
+             [ -e "_upstream/plugin/hermes_relay_bootstrap" ] || \
+             find _upstream -name "hermes_relay_bootstrap.pth" 2>/dev/null | grep -q .; then
+            echo "FAIL: upstream checkout contains a relay bootstrap — not vanilla."; exit 1
+          fi
+          echo "OK: upstream checkout carries no relay plugin/bootstrap."
+
+      - name: Run route-surface contract
+        run: python scripts/check-upstream-route-contract.py "_upstream"

.github/workflows/ci-dashboard.yml

@@ -0,0 +1,67 @@
+name: CI dashboard plugin
+
+on:
+  push:
+    branches: [main, dev]
+    paths:
+      - "plugin/dashboard/**"
+      - ".github/workflows/ci-dashboard.yml"
+  pull_request:
+    branches: [main, dev]
+    paths:
+      - "plugin/dashboard/**"
+      - ".github/workflows/ci-dashboard.yml"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-dashboard-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' && github.ref != 'refs/heads/dev' }}
+
+jobs:
+  build-and-test:
+    name: Build and test dashboard plugin
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: "22"
+          cache: npm
+          cache-dependency-path: plugin/dashboard/package-lock.json
+
+      - name: Install dashboard deps
+        working-directory: plugin/dashboard
+        run: npm ci
+
+      - name: Build dashboard bundle
+        working-directory: plugin/dashboard
+        run: npm run build
+
+      - name: Setup Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.11"
+
+      - name: Verify plugin-owned version metadata
+        run: python scripts/check-plugin-version-sync.py
+
+      - name: Install dashboard API test deps
+        # The suite imports the `plugin` package transitively: __init__ loads
+        # android_tool/desktop_tool (`import requests`), and one test imports
+        # `plugin.relay`, whose server.py needs `aiohttp` (+ pyyaml) from
+        # relay_server/requirements.txt. fastapi+httpx cover plugin_api itself.
+        run: pip install -r relay_server/requirements.txt fastapi httpx requests
+
+      - name: Run dashboard API tests
+        run: python -m unittest plugin.dashboard.test_plugin_api
+
+      - name: Verify dashboard bundle outputs
+        run: |
+          test -s plugin/dashboard/dist/index.js
+          test -s plugin/dashboard/dist/style.css
+          grep -q "hr-modal-card" plugin/dashboard/dist/style.css

.github/workflows/ci-desktop.yml

@@ -0,0 +1,112 @@
+name: CI desktop
+
+on:
+  push:
+    branches: [main, dev]
+    paths:
+      - 'desktop/**'
+      - '.github/workflows/ci-desktop.yml'
+  pull_request:
+    paths:
+      - 'desktop/**'
+      - '.github/workflows/ci-desktop.yml'
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-desktop-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' && github.ref != 'refs/heads/dev' }}
+
+jobs:
+  typecheck-and-build:
+    name: Type-check + build
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: desktop
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: '22'
+          cache: npm
+          cache-dependency-path: desktop/package-lock.json
+
+      - name: Install deps
+        run: npm ci
+
+      - name: Type-check
+        run: npm run type-check
+
+      - name: Build (tsc → dist/)
+        run: npm run build
+
+      - name: Verify bin shim is executable
+        # The published tarball depends on bin/hermes-relay.js having a valid
+        # shebang + importing the freshly built dist/cli.js. Smoke the actual
+        # invocation so we catch broken imports, missing main export, or a
+        # prebuilt dist/ that references a source file that moved.
+        run: node bin/hermes-relay.js --version
+
+  smoke-help:
+    name: Smoke — --help + --version work on every target OS
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+    runs-on: ${{ matrix.os }}
+    defaults:
+      run:
+        working-directory: desktop
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: '22'
+          cache: npm
+          cache-dependency-path: desktop/package-lock.json
+
+      - name: Install deps
+        run: npm ci
+
+      - name: Build
+        run: npm run build
+
+      - name: --version
+        run: node bin/hermes-relay.js --version
+
+      - name: --help
+        run: node bin/hermes-relay.js --help
+
+  tray-shell:
+    name: Tray shell checks
+    runs-on: windows-latest
+    defaults:
+      run:
+        working-directory: desktop
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          cache: npm
+          cache-dependency-path: desktop/package-lock.json
+
+      - name: Setup Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Install deps
+        run: npm ci
+
+      - name: Cargo check tray shell
+        run: npm run tray:check
+
+      - name: Test tray shell
+        run: npm run tray:test

.github/workflows/ci-plugin.yml

@@ -0,0 +1,122 @@
+# Hermes-Relay — Plugin CI Pipeline
+#
+# Runs on pushes to main/dev and on PRs targeting main/dev, scoped to
+# plugin-affecting paths so Android-only changes don't spin up the
+# Python toolchain.
+#
+# Pipeline: syntax-check and focused plugin tests run concurrently.
+
+name: CI — Plugin
+
+on:
+  push:
+    branches: [main, dev]
+    paths:
+      - "plugin/__init__.py"
+      - "plugin/android_tool.py"
+      - "plugin/cli.py"
+      - "plugin/pair.py"
+      - "plugin/plugin.yaml"
+      - "plugin/relay/**"
+      - "plugin/tools/**"
+      - "plugin/tests/**"
+      - "relay_server/**"
+      - "hermes_relay_bootstrap/**"
+      - "pyproject.toml"
+      - "scripts/check-plugin-version-sync.py"
+      - "scripts/check-server-version-sync.py"
+      - "scripts/bump-plugin-version.sh"
+      - "scripts/bump-server-version.sh"
+      - ".github/workflows/ci-plugin.yml"
+  pull_request:
+    branches: [main, dev]
+    paths:
+      - "plugin/__init__.py"
+      - "plugin/android_tool.py"
+      - "plugin/cli.py"
+      - "plugin/pair.py"
+      - "plugin/plugin.yaml"
+      - "plugin/relay/**"
+      - "plugin/tools/**"
+      - "plugin/tests/**"
+      - "relay_server/**"
+      - "hermes_relay_bootstrap/**"
+      - "pyproject.toml"
+      - "scripts/check-plugin-version-sync.py"
+      - "scripts/check-server-version-sync.py"
+      - "scripts/bump-plugin-version.sh"
+      - "scripts/bump-server-version.sh"
+      - ".github/workflows/ci-plugin.yml"
+
+# Cancel in-progress runs for the same branch/PR, but let main and dev finish
+concurrency:
+  group: ci-plugin-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' && github.ref != 'refs/heads/dev' }}
+
+jobs:
+  # ──────────────────────────────────────────────
+  # Python Plugin — py_compile syntax sanity
+  # ──────────────────────────────────────────────
+  syntax-check:
+    name: Syntax check (Python)
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Set up Python 3.11
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.11"
+
+      - name: Syntax check (plugin relay — canonical location)
+        run: |
+          python -m py_compile plugin/relay/server.py
+          python -m py_compile plugin/relay/channels/terminal.py
+          python -m py_compile plugin/relay/channels/chat.py
+          python -m py_compile plugin/relay/channels/bridge.py
+          python -m py_compile plugin/relay/voice.py
+          python -m py_compile plugin/relay/upstream_voice.py
+
+      - name: Syntax check (relay_server shim)
+        run: python -m py_compile relay_server/__init__.py relay_server/__main__.py
+
+      - name: Validate Plugin version metadata
+        run: python scripts/check-plugin-version-sync.py
+
+  # ──────────────────────────────────────────────
+  # Python Plugin — focused route/auth/session tests
+  #
+  # Tests are ADVISORY on dev (push or PR) so WIP commits don't block the
+  # merge queue. Strict on main — the dev → main release-merge PR surfaces
+  # any real failures before release.
+  # ──────────────────────────────────────────────
+  unit-tests:
+    name: Focused Plugin tests (Python)
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    # Advisory on dev, strict on main. Evaluates to false (= strict) for
+    # pushes to main and PRs whose base branch is main; true (= advisory)
+    # for everything else (dev pushes, dev-targeted PRs, feature branches).
+    continue-on-error: ${{ github.ref != 'refs/heads/main' && github.base_ref != 'main' }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Set up Python 3.11
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.11"
+
+      - name: Install dependencies
+        run: |
+          pip install -r relay_server/requirements.txt
+          pip install pytest responses
+
+      - name: Run focused Plugin tests
+        run: |
+          python -m pytest \
+            plugin/tests/test_relay_security.py \
+            plugin/tests/test_voice_routes.py \
+            plugin/tests/test_session_grants.py

.github/workflows/ci-required.yml

@@ -0,0 +1,49 @@
+# Required-checks sentinel — always runs on every PR + push to main/dev so
+# branch protection on `main` has a check name it can rely on, regardless
+# of which paths the PR touches.
+#
+# Why this exists. The other CI workflows (`ci-android.yml`, `ci-plugin.yml`,
+# `ci-desktop.yml`) are scoped via `paths:` filters so a docs-only or
+# desktop-only PR doesn't spin up the Android toolchain. Branch protection's
+# "required status checks" treat a check that doesn't run as failing — so
+# any PR that didn't touch the protected paths was blocked from merging,
+# even with all the relevant gates green. We were admin-overriding every
+# desktop-only PR. Same for relay-touching PRs (the protection rule named
+# `Relay Check (Python)` didn't even match any actual job — broken since
+# day one).
+#
+# This sentinel + claude-review become the only required checks. The
+# path-filtered workflows still run when relevant and surface their
+# results on the PR — visible, clickable, but advisory rather than
+# blocking. Reviewers (human + claude-review) eyeball them. This is the
+# standard pattern for monorepos with path-filtered CI.
+#
+# Trade-off acknowledged: a broken Android build on an Android-touching
+# PR could merge if the reviewer ignores the failing CI badge. Mitigation:
+# claude-review reads CI conclusions in its review prompt + the project's
+# release-merge cadence catches issues before they reach a tag. If a
+# stricter gate is later wanted, fold it into this workflow as a job that
+# fans out to the path-filtered work — but the simplest version (just an
+# `echo`) is what's needed to make branch protection useful again today.
+
+name: Required checks
+
+on:
+  push:
+    branches: [main, dev]
+  pull_request:
+    branches: [main, dev]
+
+# Cancel in-progress runs for the same branch/PR. Doesn't matter much for
+# a 5-second job, but matches every other workflow's concurrency shape.
+concurrency:
+  group: ci-required-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' && github.ref != 'refs/heads/dev' }}
+
+jobs:
+  guard:
+    name: Required checks
+    runs-on: ubuntu-latest
+    steps:
+      - name: OK
+        run: echo "Required-checks sentinel — see ci-required.yml header for context."

.github/workflows/ci.yml

@@ -1,138 +0,0 @@
-# Hermes-Relay — CI Pipeline
-#
-# Runs on every push to main and on pull requests targeting main.
-# Pipeline: lint -> build + test (parallel) -> upload artifacts
-#
-# Android: Kotlin + Jetpack Compose (root Gradle project)
-# Python:  aiohttp relay server (relay_server/)
-
-name: CI
-
-on:
-  push:
-    branches: [main]
-  pull_request:
-    branches: [main]
-
-# Cancel in-progress runs for the same branch/PR, but let main finish
-concurrency:
-  group: ci-${{ github.ref }}
-  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
-
-jobs:
-  # ──────────────────────────────────────────────
-  # Android Lint — gate for build and test jobs
-  # ──────────────────────────────────────────────
-  lint:
-    name: Lint (Android)
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v6
-
-      - name: Set up JDK 17
-        uses: actions/setup-java@v5
-        with:
-          distribution: temurin
-          java-version: 17
-
-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v6
-
-      # Prefer ktlintCheck if configured; fall back to Android lint
-      - name: Run lint checks
-        run: |
-          if ./gradlew tasks --all 2>/dev/null | grep -q "ktlintCheck"; then
-            echo "Running ktlintCheck..."
-            ./gradlew ktlintCheck
-          else
-            echo "ktlintCheck not found, falling back to Android lint..."
-            ./gradlew lint
-          fi
-
-  # ──────────────────────────────────────────────
-  # Android Build — assembleDebug + upload APK
-  # ──────────────────────────────────────────────
-  build:
-    name: Build (Android)
-    needs: lint
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v6
-
-      - name: Set up JDK 17
-        uses: actions/setup-java@v5
-        with:
-          distribution: temurin
-          java-version: 17
-
-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v6
-
-      - name: Build debug APK
-        run: ./gradlew assembleDebug
-
-      - name: Upload debug APK
-        uses: actions/upload-artifact@v7
-        with:
-          name: debug-apk
-          path: app/build/outputs/apk/debug/*.apk
-          retention-days: 14
-
-  # ──────────────────────────────────────────────
-  # Android Tests — unit tests + report upload
-  # ──────────────────────────────────────────────
-  test:
-    name: Test (Android)
-    needs: lint
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v6
-
-      - name: Set up JDK 17
-        uses: actions/setup-java@v5
-        with:
-          distribution: temurin
-          java-version: 17
-
-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v6
-
-      - name: Run unit tests
-        run: ./gradlew test
-
-      # Upload test reports even if tests fail, for debugging
-      - name: Upload test reports
-        uses: actions/upload-artifact@v7
-        if: always()
-        with:
-          name: test-reports
-          path: app/build/reports/tests/
-          retention-days: 7
-
-  # ──────────────────────────────────────────────
-  # Python Relay — syntax check + future tests
-  # ──────────────────────────────────────────────
-  relay-check:
-    name: Relay Check (Python)
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v6
-
-      - name: Set up Python 3.11
-        uses: actions/setup-python@v6
-        with:
-          python-version: "3.11"
-
-      - name: Install dependencies
-        run: pip install -r relay_server/requirements.txt
-
-      - name: Syntax check
-        run: python -m py_compile relay_server/relay.py
-
-      # TODO: Add pytest step when relay tests exist
-      # - name: Run tests
-      #   run: pytest relay_server/tests/

.github/workflows/claude-code-review.yml

@@ -3,22 +3,88 @@ name: Claude Code Review
 on:
   pull_request:
     types: [opened, synchronize, ready_for_review, reopened]
+    # Optional: Only run on specific file changes
+    # paths:
+    #   - "src/**/*.ts"
+    #   - "src/**/*.tsx"
+    #   - "src/**/*.js"
+    #   - "src/**/*.jsx"
 
 jobs:
   claude-review:
+    # Optional: Filter by PR author
+    # if: |
+    #   github.event.pull_request.user.login == 'external-contributor' ||
+    #   github.event.pull_request.user.login == 'new-developer' ||
+    #   github.event.pull_request.author_association == 'FIRST_TIME_CONTRIBUTOR'
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     permissions:
       contents: read
       pull-requests: read
       issues: read
       id-token: write
+    env:
+      # Any dev -> main PR is, by the branching model, the aggregate release PR
+      # (main only ever receives release merges from dev). Detect it by base+head
+      # alone — a title-format match (e.g. "release:") is fragile and silently
+      # let a "Release v1.0.0 …"-titled PR run the full review and time out.
+      IS_RELEASE_PR: ${{ github.event.pull_request.base.ref == 'main' && github.event.pull_request.head.ref == 'dev' }}
+      # Bot-authored PRs such as Dependabot do not receive the same secret
+      # surface as human-authored PRs, and Claude Code rejects bot actors unless
+      # explicitly allow-listed. Keep the required check green with a no-op and
+      # rely on the dependency CI/status checks for those PRs.
+      IS_BOT_PR: ${{ github.event.pull_request.user.type == 'Bot' }}
+
     steps:
-      - uses: actions/checkout@v6
+      - name: Skip aggregate release PR review
+        if: env.IS_RELEASE_PR == 'true'
+        run: |
+          echo "Skipping Claude Code Review for aggregate dev -> main release PR."
+          echo "Feature work is reviewed before it lands on dev; release PRs are gated by CI and release metadata checks."
+
+      - name: Skip bot-authored PR review
+        if: env.IS_BOT_PR == 'true'
+        run: |
+          echo "Skipping Claude Code Review for bot-authored PR."
+          echo "Bot PRs are gated by Required checks plus their path-specific CI jobs."
+
+      - name: Checkout repository
+        if: env.IS_RELEASE_PR != 'true' && env.IS_BOT_PR != 'true'
+        uses: actions/checkout@v4
         with:
-          fetch-depth: 1
-      - uses: anthropics/claude-code-action@v1
+          # Depth 2 includes the pull_request merge commit's first parent, which
+          # lets the next step detect whether this PR changes the workflow file.
+          fetch-depth: 2
+
+      - name: Detect Claude review workflow changes
+        if: env.IS_RELEASE_PR != 'true' && env.IS_BOT_PR != 'true'
+        id: changed-workflow
+        shell: bash
+        run: |
+          if git rev-parse --verify HEAD^1 >/dev/null 2>&1 &&
+             git diff --name-only HEAD^1 HEAD | grep -Fxq ".github/workflows/claude-code-review.yml"; then
+            echo "claude_review_workflow=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "claude_review_workflow=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Skip Claude review workflow self-change
+        if: env.IS_RELEASE_PR != 'true' && env.IS_BOT_PR != 'true' && steps.changed-workflow.outputs.claude_review_workflow == 'true'
+        run: |
+          echo "Skipping Claude Code Review because this PR changes the review workflow itself."
+          echo "The Claude action requires this workflow file to match the default branch before it can exchange the app token."
+
+      - name: Run Claude Code Review
+        if: env.IS_RELEASE_PR != 'true' && env.IS_BOT_PR != 'true' && steps.changed-workflow.outputs.claude_review_workflow != 'true'
+        timeout-minutes: 15
+        id: claude-review
+        uses: anthropics/claude-code-action@v1
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           plugin_marketplaces: 'https://github.com/anthropics/claude-code.git'
           plugins: 'code-review@claude-code-plugins'
           prompt: '/code-review:code-review ${{ github.repository }}/pull/${{ github.event.pull_request.number }}'
+          # See https://github.com/anthropics/claude-code-action/blob/main/docs/usage.md
+          # or https://code.claude.com/docs/en/cli-reference for available options
+

.github/workflows/claude.yml

@@ -6,134 +6,45 @@ on:
   pull_request_review_comment:
     types: [created]
   issues:
-    types: [opened, assigned, labeled]
+    types: [opened, assigned]
   pull_request_review:
     types: [submitted]
 
 jobs:
-  auth:
-    runs-on: ubuntu-latest
-    outputs:
-      authorized: ${{ steps.check.outputs.authorized }}
-    steps:
-      - name: Check collaborator status
-        id: check
-        uses: actions/github-script@v8
-        with:
-          script: |
-            if (context.eventName === 'issues' && ['opened', 'labeled'].includes(context.payload.action)) {
-              core.setOutput('authorized', 'true');
-              return;
-            }
-            const sender = context.payload.sender?.login;
-            if (!sender) { core.setOutput('authorized', 'false'); return; }
-            try {
-              const { data } = await github.rest.repos.getCollaboratorPermissionLevel({
-                owner: context.repo.owner, repo: context.repo.repo, username: sender,
-              });
-              const allowed = ['admin', 'write', 'maintain'].includes(data.permission);
-              core.setOutput('authorized', allowed ? 'true' : 'false');
-            } catch {
-              core.setOutput('authorized', 'false');
-            }
-
-  triage:
-    needs: auth
+  claude:
     if: |
-      needs.auth.outputs.authorized == 'true' && (
-        (github.event_name == 'issues' && github.event.action == 'labeled' && github.event.label.name == 'claude') ||
-        (github.event_name == 'issues' && github.event.action == 'opened')
-      )
+      (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
+      (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
+      (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||
+      (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
     runs-on: ubuntu-latest
     permissions:
       contents: read
       pull-requests: read
-      issues: write
+      issues: read
       id-token: write
-      actions: read
+      actions: read # Required for Claude to read CI results on PRs
     steps:
-      - uses: actions/checkout@v6
+      - name: Checkout repository
+        uses: actions/checkout@v4
         with:
           fetch-depth: 1
-      - uses: anthropics/claude-code-action@v1
+
+      - name: Run Claude Code
+        id: claude
+        uses: anthropics/claude-code-action@v1
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
-          prompt: |
-            Triage this GitHub issue. Analysis-only — do NOT write code or create PRs.
 
-            1. **Classify** — bug, feature request, question, or docs issue?
-            2. **Priority** — critical, high, medium, low based on impact.
-            3. **Affected area** — which module(s)? Check CLAUDE.md for architecture.
-               (ui/, network/, viewmodel/, auth/, data/, relay_server/, plugin/)
-            4. **Reproduction** — for bugs, is there enough info? Ask for device, Android version, steps.
-            5. **Suggested approach** — brief outline (files, strategy).
-            6. **Labels** — suggest appropriate labels.
+          # This is an optional setting that allows Claude to read CI results on PRs
+          additional_permissions: |
+            actions: read
 
-            Keep it concise and actionable.
-          claude_args: "--max-turns 5"
+          # Optional: Give a custom prompt to Claude. If this is not specified, Claude will perform the instructions specified in the comment that tagged it.
+          # prompt: 'Update the pull request description to include a summary of changes.'
 
-  fix:
-    needs: auth
-    if: |
-      needs.auth.outputs.authorized == 'true' &&
-      github.event_name == 'issues' &&
-      github.event.action == 'labeled' &&
-      github.event.label.name == 'claude-fix'
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-      pull-requests: write
-      issues: write
-      id-token: write
-      actions: read
-    steps:
-      - uses: actions/checkout@v6
-        with:
-          fetch-depth: 0
-      - uses: anthropics/claude-code-action@v1
-        with:
-          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
-          prompt: |
-            Implement a fix for this GitHub issue. Read CLAUDE.md for project conventions.
+          # Optional: Add claude_args to customize behavior and configuration
+          # See https://github.com/anthropics/claude-code-action/blob/main/docs/usage.md
+          # or https://code.claude.com/docs/en/cli-reference for available options
+          # claude_args: '--allowed-tools Bash(gh pr *)'
 
-            1. Understand the issue — read relevant source files.
-            2. Implement the minimal fix.
-            3. Follow conventions: Kotlin + Jetpack Compose, kotlinx.serialization, Conventional Commits.
-            4. Run `./gradlew assembleDebug` and fix any errors.
-            5. Create a PR with Conventional Commits format title.
-
-            Do NOT over-engineer. Only change what is needed.
-          claude_args: "--max-turns 25"
-
-  chat:
-    needs: auth
-    if: |
-      needs.auth.outputs.authorized == 'true' && (
-        (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
-        (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
-        (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||
-        (github.event_name == 'issues' && github.event.action == 'assigned' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
-      )
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      pull-requests: write
-      issues: write
-      id-token: write
-      actions: read
-    steps:
-      - uses: actions/checkout@v6
-        with:
-          fetch-depth: 1
-      - uses: anthropics/claude-code-action@v1
-        with:
-          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
-          prompt: |
-            Responding to a collaborator comment. Read CLAUDE.md for project context.
-
-            Default mode is analysis — investigate, explain, suggest. Do NOT write code
-            unless explicitly asked ("fix this", "implement", "create a PR").
-
-            If asked to fix: follow conventions (Kotlin, Compose, Conventional Commits),
-            run `./gradlew assembleDebug`, and create a PR.
-          claude_args: "--max-turns 15"

.github/workflows/docs.yml

@@ -36,14 +36,18 @@ jobs:
           fetch-depth: 0  # Full history for lastUpdated timestamps
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
-          node-version: 20
+          # Node 24 ships npm 11, matching the npm that generates
+          # user-docs/package-lock.json. On npm 10 (Node 20), `npm ci` rejects
+          # the lock over the optional `search-insights` peer dep of bundled
+          # docsearch. Keep this aligned with the npm used to write the lock.
+          node-version: 24
           cache: npm
           cache-dependency-path: user-docs/package-lock.json
 
       - name: Install dependencies
-        run: npm install
+        run: npm ci
         working-directory: user-docs
 
       - name: Build VitePress site
@@ -51,10 +55,10 @@ jobs:
         working-directory: user-docs
 
       - name: Setup Pages
-        uses: actions/configure-pages@v5
+        uses: actions/configure-pages@v6
 
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@v3
+        uses: actions/upload-pages-artifact@v5
         with:
           path: user-docs/.vitepress/dist
 
@@ -68,4 +72,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@v5

.github/workflows/play-listing.yml

@@ -0,0 +1,104 @@
+name: Play Store Listing
+
+on:
+  pull_request:
+    paths:
+      - "assets/screenshots/**"
+      - "assets/play-store-icon-512.png"
+      - "assets/play-store-feature-1024x500.png"
+      - "docs/media/screenshots.json"
+      - "app/src/googlePlay/play/default-language.txt"
+      - "app/src/googlePlay/play/listings/**"
+      - "scripts/screenshots.py"
+      - ".github/workflows/play-listing.yml"
+  push:
+    branches:
+      - main
+      - dev
+    paths:
+      - "assets/screenshots/**"
+      - "assets/play-store-icon-512.png"
+      - "assets/play-store-feature-1024x500.png"
+      - "docs/media/screenshots.json"
+      - "app/src/googlePlay/play/default-language.txt"
+      - "app/src/googlePlay/play/listings/**"
+      - "scripts/screenshots.py"
+      - ".github/workflows/play-listing.yml"
+  workflow_dispatch:
+    inputs:
+      publish_listing:
+        description: "Publish Play Store listing metadata after validation"
+        required: true
+        default: false
+        type: boolean
+
+permissions:
+  contents: read
+
+jobs:
+  validate:
+    name: Validate Listing Assets
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+
+      - name: Install image tooling
+        run: python -m pip install --upgrade rich Pillow
+
+      - name: Validate screenshots and listing metadata
+        run: python scripts/screenshots.py validate
+
+  publish-listing:
+    name: Publish Listing Metadata
+    needs: validate
+    # Auto-publish the listing when its assets change on `main` (the release
+    # branch; the path filters above already scope this to screenshot/graphic/
+    # text changes). `dev` pushes and PRs validate only. A manual dispatch with
+    # `publish_listing` still works as an on-demand republish.
+    if: >-
+      ${{ (github.event_name == 'workflow_dispatch' && inputs.publish_listing)
+          || (github.event_name == 'push' && github.ref == 'refs/heads/main') }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Set up JDK 17
+        uses: actions/setup-java@v5
+        with:
+          distribution: temurin
+          java-version: 17
+
+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@v6
+        with:
+          cache-read-only: false
+
+      - name: Write Play service account
+        id: sa
+        env:
+          PLAY_SERVICE_ACCOUNT_JSON: ${{ secrets.PLAY_SERVICE_ACCOUNT_JSON }}
+        run: |
+          if [ -z "$PLAY_SERVICE_ACCOUNT_JSON" ]; then
+            # Skip gracefully (no red CI) when the secret isn't configured — e.g.
+            # an auto-publish push to main before the service account is set up.
+            echo "::notice::PLAY_SERVICE_ACCOUNT_JSON not configured — skipping listing publish."
+            echo "configured=false" >> "$GITHUB_OUTPUT"
+          else
+            printf '%s' "$PLAY_SERVICE_ACCOUNT_JSON" > play-service-account.json
+            echo "configured=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Publish Play Store listing
+        if: ${{ steps.sa.outputs.configured == 'true' }}
+        run: ./gradlew publishGooglePlayReleaseListing
+
+      - name: Remove Play service account
+        if: always()
+        run: rm -f play-service-account.json

.github/workflows/release-android.yml

@@ -0,0 +1,203 @@
+# Hermes-Relay-Android — Release Pipeline
+#
+# Triggered when an Android release tag (android-v*) is pushed.
+# Validates the tag matches the app version in libs.versions.toml,
+# runs focused Android checks, builds release APK/AAB artifacts, and creates a
+# GitHub Release. Plugin/Python package releases use plugin-v* tags.
+
+name: Release Android
+
+on:
+  push:
+    tags:
+      - "android-v*"
+
+permissions:
+  contents: write
+  id-token: write
+
+jobs:
+  validate:
+    name: Validate Release
+    runs-on: ubuntu-latest
+    outputs:
+      version: ${{ steps.version.outputs.version }}
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Extract version from tag
+        id: version
+        run: echo "version=${GITHUB_REF#refs/tags/android-v}" >> $GITHUB_OUTPUT
+
+      - name: Verify version sync
+        run: |
+          TAG_VERSION="${{ steps.version.outputs.version }}"
+          TOML_VERSION=$(grep -oP 'appVersionName\s*=\s*"\K[^"]+' gradle/libs.versions.toml)
+
+          echo "Tag version: $TAG_VERSION"
+          echo "libs.versions.toml version: $TOML_VERSION"
+
+          if [ "$TAG_VERSION" != "$TOML_VERSION" ]; then
+            echo "::error::Tag version ($TAG_VERSION) does not match appVersionName ($TOML_VERSION) in gradle/libs.versions.toml"
+            exit 1
+          fi
+
+          echo "Version validated: $TAG_VERSION"
+
+  ci:
+    name: CI Checks
+    needs: validate
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Set up JDK 17
+        uses: actions/setup-java@v5
+        with:
+          distribution: temurin
+          java-version: 17
+
+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@v6
+        with:
+          cache-read-only: false
+
+      # Keep the tag release gate aligned with CI — Android's broad Gradle
+      # `test` aggregate currently hangs in deferred JVM suites tracked by
+      # issue #32, so the release gate runs the stable connection/pairing slice.
+      - name: Run focused Android unit tests
+        run: |
+          ./gradlew :app:testSideloadDebugUnitTest \
+            --tests com.hermesandroid.relay.network.RelayUrlDeriverTest \
+            --tests com.hermesandroid.relay.viewmodel.ConnectionSwitchTest \
+            --console=plain
+
+  release:
+    name: Build & Publish Release
+    needs: [validate, ci]
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Set up JDK 17
+        uses: actions/setup-java@v5
+        with:
+          distribution: temurin
+          java-version: 17
+
+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@v6
+        with:
+          cache-read-only: false
+
+      - name: Decode release keystore
+        env:
+          HERMES_KEYSTORE_BASE64: ${{ secrets.HERMES_KEYSTORE_BASE64 }}
+        if: env.HERMES_KEYSTORE_BASE64 != ''
+        run: |
+          echo "$HERMES_KEYSTORE_BASE64" | base64 -d > "$RUNNER_TEMP/release.keystore"
+          echo "HERMES_KEYSTORE_PATH=$RUNNER_TEMP/release.keystore" >> "$GITHUB_ENV"
+
+      - name: Build release artifacts (APK + AAB)
+        env:
+          HERMES_KEYSTORE_PASSWORD: ${{ secrets.HERMES_KEYSTORE_PASSWORD }}
+          HERMES_KEY_ALIAS: ${{ secrets.HERMES_KEY_ALIAS }}
+          HERMES_KEY_PASSWORD: ${{ secrets.HERMES_KEY_PASSWORD }}
+        # `assembleRelease` and `bundleRelease` are flavor-wide task aliases
+        # (added by `flavorDimensions += "track"` in app/build.gradle.kts), so
+        # this one line builds ALL four artifacts at once. Filenames come from
+        # `archivesName` (set in app/build.gradle.kts) which injects the app
+        # version, so `<version>` below is `libs.versions.appVersionName`:
+        #   app/build/outputs/apk/googlePlay/release/hermes-relay-<version>-googlePlay-release.apk
+        #   app/build/outputs/apk/sideload/release/hermes-relay-<version>-sideload-release.apk
+        #   app/build/outputs/bundle/googlePlayRelease/hermes-relay-<version>-googlePlay-release.aab
+        #   app/build/outputs/bundle/sideloadRelease/hermes-relay-<version>-sideload-release.aab
+        run: ./gradlew bundleRelease assembleRelease
+
+      - name: List produced artifacts (debug aid)
+        run: |
+          echo "=== APK outputs ==="
+          find app/build/outputs/apk -name '*.apk' -print 2>/dev/null || true
+          echo "=== AAB outputs ==="
+          find app/build/outputs/bundle -name '*.aab' -print 2>/dev/null || true
+
+      - name: Generate checksums
+        # Flavor dimension adds an extra path segment to the AGP output layout.
+        # APKs live under `apk/<flavor>/release/`, AABs under `bundle/<flavor>Release/`
+        # (note the concatenated camelCase — AGP path quirk, documented but
+        # different between APK and AAB). The globs below match both flavors.
+        run: |
+          cd app/build/outputs
+          sha256sum apk/*/release/*.apk bundle/*Release/*.aab > SHA256SUMS.txt
+          cat SHA256SUMS.txt
+
+      - name: Create GitHub Release
+        uses: softprops/action-gh-release@v3
+        with:
+          name: Hermes-Relay-Android v${{ needs.validate.outputs.version }}
+          tag_name: android-v${{ needs.validate.outputs.version }}
+          body_path: RELEASE_NOTES.md
+          prerelease: ${{ contains(needs.validate.outputs.version, '-') }}
+          # Attach all four flavored artifacts — users sideload the
+          # `hermes-relay-<version>-sideload-release.apk` for the full
+          # Phase 3 / Tier 3/4/6 feature set; the
+          # `hermes-relay-<version>-googlePlay-release.aab` is what gets
+          # uploaded to Play Console. APK twin of the googlePlay flavor
+          # and AAB twin of the sideload flavor are included for parity
+          # (useful for diff tooling, not primary downloads).
+          files: |
+            app/build/outputs/apk/*/release/*.apk
+            app/build/outputs/bundle/*Release/*.aab
+            app/build/outputs/SHA256SUMS.txt
+
+      - name: Upload to Play Console (production draft)
+        env:
+          PLAY_SERVICE_ACCOUNT_JSON: ${{ secrets.PLAY_SERVICE_ACCOUNT_JSON }}
+          HERMES_KEYSTORE_PASSWORD: ${{ secrets.HERMES_KEYSTORE_PASSWORD }}
+          HERMES_KEY_ALIAS: ${{ secrets.HERMES_KEY_ALIAS }}
+          HERMES_KEY_PASSWORD: ${{ secrets.HERMES_KEY_PASSWORD }}
+        # Runs only when the Play service-account secret is configured AND this is
+        # a stable tag (prereleases — versions containing a dash — are skipped so
+        # an `-rc.N` build never lands on the production listing). HERMES_KEYSTORE_PATH
+        # was exported into $GITHUB_ENV by the "Decode release keystore" step above
+        # and persists across steps in this job, so the AAB is release-signed.
+        #
+        # `publishGooglePlayReleaseBundle` is the flavor-scoped task — only the
+        # googlePlay AAB is uploaded (sideload is disabled via playConfigs in
+        # app/build.gradle.kts). The play{} block pins releaseStatus = DRAFT, so the
+        # build lands on the Production track as a DRAFT: CI does the upload, a human
+        # clicks "Start rollout" in Play Console. A bad tag can never auto-go-live.
+        if: ${{ env.PLAY_SERVICE_ACCOUNT_JSON != '' && !contains(needs.validate.outputs.version, '-') }}
+        run: |
+          printf '%s' "$PLAY_SERVICE_ACCOUNT_JSON" > play-service-account.json
+          ./gradlew publishGooglePlayReleaseBundle --track=production
+          rm -f play-service-account.json
+
+      - name: Play upload skipped (no secret)
+        env:
+          PLAY_SERVICE_ACCOUNT_JSON: ${{ secrets.PLAY_SERVICE_ACCOUNT_JSON }}
+        if: ${{ env.PLAY_SERVICE_ACCOUNT_JSON == '' }}
+        run: |
+          echo "ℹ️  PLAY_SERVICE_ACCOUNT_JSON not set — skipped Play Console upload." \
+            "GitHub Release artifacts are still published; upload to Play manually" \
+            "(see RELEASE.md §5)." >> "$GITHUB_STEP_SUMMARY"
+
+      - name: Release summary
+        env:
+          HERMES_KEYSTORE_BASE64: ${{ secrets.HERMES_KEYSTORE_BASE64 }}
+        run: |
+          echo "## Hermes-Relay-Android v${{ needs.validate.outputs.version }}" >> "$GITHUB_STEP_SUMMARY"
+          echo "" >> "$GITHUB_STEP_SUMMARY"
+          if [ -n "$HERMES_KEYSTORE_BASE64" ]; then
+            echo "✅ **Signed with release keystore** — suitable for Play Store upload" >> "$GITHUB_STEP_SUMMARY"
+          else
+            echo "⚠️ **Debug-signed** (no \`HERMES_KEYSTORE_BASE64\` secret) — NOT suitable for Play Store. Add the secret in repo settings to enable release signing." >> "$GITHUB_STEP_SUMMARY"
+          fi
+          echo "" >> "$GITHUB_STEP_SUMMARY"
+          echo "### Artifacts" >> "$GITHUB_STEP_SUMMARY"
+          echo '```' >> "$GITHUB_STEP_SUMMARY"
+          find app/build/outputs/apk -name '*.apk' -exec ls -la {} + >> "$GITHUB_STEP_SUMMARY" 2>/dev/null || true
+          find app/build/outputs/bundle -name '*.aab' -exec ls -la {} + >> "$GITHUB_STEP_SUMMARY" 2>/dev/null || true
+          echo '```' >> "$GITHUB_STEP_SUMMARY"

.github/workflows/release-cli.yml

@@ -0,0 +1,225 @@
+name: Release CLI
+
+on:
+  push:
+    tags: ['cli-v*']
+
+permissions:
+  contents: write
+
+jobs:
+  build-cli-binaries:
+    name: Build cross-platform CLI binaries via Bun compile
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: desktop
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Node.js (for npm ci + tsc)
+        uses: actions/setup-node@v6
+        with:
+          node-version: '22'
+          cache: npm
+          cache-dependency-path: desktop/package-lock.json
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: '1.3.x'
+
+      - name: Install deps
+        run: npm ci
+
+      - name: Type-check
+        run: npm run type-check
+
+      - name: Build dist/ (tsc)
+        run: npm run build
+
+      - name: Print Bun version (diagnostics)
+        run: bun --version
+
+      - name: Prepare binary output dir
+        run: mkdir -p dist/bin
+
+      # Keep the package.json scripts as the single source of truth for Bun
+      # compile flags so release and local smoke builds cannot diverge.
+      - name: Build Windows x64
+        run: npm run build:bin:win
+
+      - name: Build Linux x64
+        run: npm run build:bin:linux
+
+      - name: Build macOS x64
+        run: npm run build:bin:mac-x64
+
+      - name: Build macOS arm64
+        run: npm run build:bin:mac-arm
+
+      - name: Size guard (<150 MB each)
+        run: |
+          set -e
+          for f in dist/bin/hermes-relay-*; do
+            sz=$(stat -c%s "$f")
+            mb=$(( sz / 1024 / 1024 ))
+            echo "  $f - ${mb} MB"
+            if [ "$sz" -gt 157286400 ]; then
+              echo "FAIL: $f exceeds 150 MB - Bun likely shipped a debug build or we added a large dep."
+              exit 1
+            fi
+          done
+
+      - name: Smoke-test Linux binary
+        run: |
+          set -e
+          chmod +x dist/bin/hermes-relay-linux-x64
+          for cmd in --version --help doctor; do
+            out=$(./dist/bin/hermes-relay-linux-x64 "$cmd" 2>&1 || true)
+            exit_code=$?
+            if [ -z "$out" ] || [ ${#out} -lt 10 ]; then
+              echo "SMOKE FAIL: './hermes-relay-linux-x64 $cmd' produced no output (exit=$exit_code)"
+              echo "Raw output was: [$out]"
+              exit 1
+            fi
+            echo "  smoke OK: $cmd -> $(echo "$out" | head -1)"
+          done
+
+      - name: Upload CLI release assets
+        uses: actions/upload-artifact@v4
+        with:
+          name: cli-binaries
+          path: |
+            desktop/dist/bin/hermes-relay-win-x64.exe
+            desktop/dist/bin/hermes-relay-linux-x64
+            desktop/dist/bin/hermes-relay-darwin-x64
+            desktop/dist/bin/hermes-relay-darwin-arm64
+          retention-days: 7
+
+  build-windows-tray-installer:
+    name: Build Windows tray installer
+    runs-on: windows-latest
+    defaults:
+      run:
+        working-directory: desktop
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          cache: npm
+          cache-dependency-path: desktop/package-lock.json
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: '1.3.x'
+
+      - name: Setup Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Install deps
+        run: npm ci
+
+      - name: Type-check
+        run: npm run type-check
+
+      - name: Build dist/ (tsc)
+        run: npm run build
+
+      - name: Test tray shell
+        run: npm run tray:test
+
+      - name: Build tray installer
+        run: npm run tray:build
+
+      - name: Normalize installer asset name
+        shell: pwsh
+        run: |
+          New-Item -ItemType Directory -Force -Path dist/tray | Out-Null
+          $installer = Get-ChildItem -Path tray/src-tauri/target/release/bundle/nsis -Filter '*_x64-setup.exe' | Select-Object -First 1
+          if (-not $installer) { throw 'NSIS installer was not produced' }
+          Copy-Item -Force $installer.FullName dist/tray/hermes-relay-desktop-windows-x64-setup.exe
+
+      - name: Smoke-test tray exe launch
+        shell: pwsh
+        run: |
+          # $HOME is a read-only automatic variable in PowerShell (names are
+          # case-insensitive), so use a distinct scratch name; only the
+          # $env:HOME / $env:USERPROFILE environment vars are writable.
+          $smokeHome = Join-Path $env:RUNNER_TEMP 'hermes-tray-smoke-home'
+          New-Item -ItemType Directory -Force -Path $smokeHome | Out-Null
+          $env:USERPROFILE = $smokeHome
+          $env:HOME = $smokeHome
+          $proc = Start-Process -FilePath tray/src-tauri/target/release/hermes-relay-desktop.exe -WindowStyle Hidden -PassThru
+          Start-Sleep -Seconds 5
+          if ($proc.HasExited) { throw "tray app exited early with code $($proc.ExitCode)" }
+          Stop-Process -Id $proc.Id -Force
+          Write-Host "tray launch smoke OK pid=$($proc.Id)"
+
+      - name: Upload Windows tray release asset
+        uses: actions/upload-artifact@v4
+        with:
+          name: cli-windows-tray-installer
+          path: desktop/dist/tray/hermes-relay-desktop-windows-x64-setup.exe
+          retention-days: 7
+
+  publish-release:
+    name: Publish GitHub Release
+    runs-on: ubuntu-latest
+    needs:
+      - build-cli-binaries
+      - build-windows-tray-installer
+    steps:
+      # Needed so CLI_RELEASE_NOTES.md is available to render into the release body
+      # (the other publish-release steps only consume downloaded build artifacts).
+      - uses: actions/checkout@v4
+
+      - name: Extract CLI version
+        id: version
+        run: echo "version=${GITHUB_REF_NAME#cli-v}" >> "$GITHUB_OUTPUT"
+
+      - uses: actions/download-artifact@v4
+        with:
+          path: release-assets
+
+      - name: Generate SHA256SUMS
+        run: |
+          set -e
+          find release-assets -type f ! -name SHA256SUMS.txt -print0 \
+            | sort -z \
+            | xargs -0 sha256sum \
+            | sed -E 's#release-assets/[^/]+/##' > release-assets/SHA256SUMS.txt
+          cat release-assets/SHA256SUMS.txt
+
+      # Render CLI_RELEASE_NOTES.md (hand-written per release) into the GitHub
+      # Release body. __VERSION__ = bare version (0.3.0), __TAG__ = full tag
+      # (cli-v0.3.0) so the install/pin commands stay accurate without manual edits.
+      - name: Render release notes
+        env:
+          VERSION: ${{ steps.version.outputs.version }}
+          TAG: ${{ github.ref_name }}
+        run: |
+          sed -e "s/__VERSION__/${VERSION}/g" -e "s/__TAG__/${TAG}/g" \
+            CLI_RELEASE_NOTES.md > cli_release_notes_rendered.md
+          echo "=== rendered release body ===" && cat cli_release_notes_rendered.md
+
+      - name: Publish GitHub Release
+        uses: softprops/action-gh-release@v3
+        with:
+          name: Hermes-Relay-CLI v${{ steps.version.outputs.version }}
+          tag_name: ${{ github.ref_name }}
+          draft: false
+          prerelease: ${{ contains(steps.version.outputs.version, 'alpha') || contains(steps.version.outputs.version, 'beta') || contains(steps.version.outputs.version, 'rc') }}
+          fail_on_unmatched_files: true
+          body_path: cli_release_notes_rendered.md
+          files: |
+            release-assets/cli-binaries/hermes-relay-win-x64.exe
+            release-assets/cli-binaries/hermes-relay-linux-x64
+            release-assets/cli-binaries/hermes-relay-darwin-x64
+            release-assets/cli-binaries/hermes-relay-darwin-arm64
+            release-assets/cli-windows-tray-installer/hermes-relay-desktop-windows-x64-setup.exe
+            release-assets/SHA256SUMS.txt

.github/workflows/release-plugin.yml

@@ -0,0 +1,111 @@
+name: Release Plugin
+
+on:
+  push:
+    tags:
+      - "plugin-v*"
+
+permissions:
+  contents: write
+
+jobs:
+  validate:
+    name: Validate Plugin release
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    outputs:
+      version: ${{ steps.version.outputs.version }}
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Extract version from tag
+        id: version
+        run: echo "version=${GITHUB_REF#refs/tags/plugin-v}" >> "$GITHUB_OUTPUT"
+
+      - name: Verify Plugin version sync
+        run: python scripts/check-plugin-version-sync.py --expect "$TAG_VERSION"
+        env:
+          TAG_VERSION: ${{ steps.version.outputs.version }}
+
+  test:
+    name: Test Plugin package
+    needs: validate
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Set up Python 3.11
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.11"
+
+      - name: Install test dependencies
+        run: |
+          pip install -r relay_server/requirements.txt
+          pip install pytest responses
+
+      - name: Syntax check
+        run: |
+          python -m py_compile plugin/relay/server.py
+          python -m py_compile plugin/relay/voice.py
+          python -m py_compile plugin/relay/upstream_voice.py
+          python -m py_compile plugin/relay/voice_auth.py
+          python -m py_compile plugin/tools/android_tool.py
+          python -m py_compile plugin/tools/desktop_tool.py
+          python -m py_compile relay_server/__init__.py relay_server/__main__.py
+
+      - name: Run focused Plugin tests
+        run: |
+          python -m pytest \
+            plugin/tests/test_relay_security.py \
+            plugin/tests/test_voice_routes.py \
+            plugin/tests/test_session_grants.py
+
+  package:
+    name: Build and publish Plugin package
+    needs: [validate, test]
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Set up Python 3.11
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.11"
+
+      - name: Build wheel and sdist
+        run: |
+          pip install build
+          python -m build
+
+      - name: Generate checksums
+        run: |
+          cd dist
+          sha256sum * > SHA256SUMS.txt
+          cat SHA256SUMS.txt
+
+      # Render PLUGIN_RELEASE_NOTES.md (hand-written per release) into the GitHub
+      # Release body, substituting the version token so the Install command stays
+      # accurate without a manual edit. The file is the single source of the notes;
+      # see RELEASE.md "Plugin / Python package release".
+      - name: Render release notes
+        env:
+          VERSION: ${{ needs.validate.outputs.version }}
+        run: |
+          sed "s/__VERSION__/${VERSION}/g" PLUGIN_RELEASE_NOTES.md > release_notes_rendered.md
+          echo "=== rendered release body ===" && cat release_notes_rendered.md
+
+      - name: Publish GitHub Release
+        uses: softprops/action-gh-release@v3
+        with:
+          name: Hermes-Relay-Plugin v${{ needs.validate.outputs.version }}
+          tag_name: plugin-v${{ needs.validate.outputs.version }}
+          prerelease: ${{ contains(needs.validate.outputs.version, '-') }}
+          fail_on_unmatched_files: true
+          body_path: release_notes_rendered.md
+          files: |
+            dist/*.whl
+            dist/*.tar.gz
+            dist/SHA256SUMS.txt

.github/workflows/release.yml

@@ -1,131 +0,0 @@
-# Hermes-Relay — Release Pipeline
-#
-# Triggered when a version tag (v*) is pushed.
-# Validates the tag matches the app version in libs.versions.toml,
-# runs CI checks, builds a release APK, and creates a GitHub Release.
-
-name: Release
-
-on:
-  push:
-    tags:
-      - "v*"
-
-permissions:
-  contents: write
-  id-token: write
-
-jobs:
-  validate:
-    name: Validate Release
-    runs-on: ubuntu-latest
-    outputs:
-      version: ${{ steps.version.outputs.version }}
-    steps:
-      - uses: actions/checkout@v6
-
-      - name: Extract version from tag
-        id: version
-        run: echo "version=${GITHUB_REF#refs/tags/v}" >> $GITHUB_OUTPUT
-
-      - name: Verify version sync
-        run: |
-          TAG_VERSION="${{ steps.version.outputs.version }}"
-          TOML_VERSION=$(grep -oP 'appVersionName\s*=\s*"\K[^"]+' gradle/libs.versions.toml)
-
-          echo "Tag version: $TAG_VERSION"
-          echo "libs.versions.toml version: $TOML_VERSION"
-
-          if [ "$TAG_VERSION" != "$TOML_VERSION" ]; then
-            echo "::error::Tag version ($TAG_VERSION) does not match appVersionName ($TOML_VERSION) in gradle/libs.versions.toml"
-            exit 1
-          fi
-
-          echo "Version validated: $TAG_VERSION"
-
-  ci:
-    name: CI Checks
-    needs: validate
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
-
-      - name: Set up JDK 17
-        uses: actions/setup-java@v5
-        with:
-          distribution: temurin
-          java-version: 17
-
-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v6
-
-      - name: Build debug APK
-        run: ./gradlew assembleDebug
-
-      - name: Run unit tests
-        run: ./gradlew test
-
-  release:
-    name: Build & Publish Release
-    needs: [validate, ci]
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
-
-      - name: Set up JDK 17
-        uses: actions/setup-java@v5
-        with:
-          distribution: temurin
-          java-version: 17
-
-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v6
-
-      - name: Decode release keystore
-        env:
-          HERMES_KEYSTORE_BASE64: ${{ secrets.HERMES_KEYSTORE_BASE64 }}
-        if: env.HERMES_KEYSTORE_BASE64 != ''
-        run: |
-          echo "$HERMES_KEYSTORE_BASE64" | base64 -d > "$RUNNER_TEMP/release.keystore"
-          echo "HERMES_KEYSTORE_PATH=$RUNNER_TEMP/release.keystore" >> "$GITHUB_ENV"
-
-      - name: Build release artifacts (APK + AAB)
-        env:
-          HERMES_KEYSTORE_PASSWORD: ${{ secrets.HERMES_KEYSTORE_PASSWORD }}
-          HERMES_KEY_ALIAS: ${{ secrets.HERMES_KEY_ALIAS }}
-          HERMES_KEY_PASSWORD: ${{ secrets.HERMES_KEY_PASSWORD }}
-        run: ./gradlew bundleRelease assembleRelease
-
-      - name: Generate checksums
-        run: |
-          cd app/build/outputs
-          sha256sum apk/release/*.apk bundle/release/*.aab > SHA256SUMS.txt
-          cat SHA256SUMS.txt
-
-      - name: Create GitHub Release
-        uses: softprops/action-gh-release@v2
-        with:
-          name: v${{ needs.validate.outputs.version }}
-          body_path: RELEASE_NOTES.md
-          prerelease: ${{ contains(needs.validate.outputs.version, '-') }}
-          files: |
-            app/build/outputs/apk/release/*.apk
-            app/build/outputs/bundle/release/*.aab
-            app/build/outputs/SHA256SUMS.txt
-
-      - name: Release summary
-        env:
-          HERMES_KEYSTORE_BASE64: ${{ secrets.HERMES_KEYSTORE_BASE64 }}
-        run: |
-          echo "## Release v${{ needs.validate.outputs.version }}" >> "$GITHUB_STEP_SUMMARY"
-          echo "" >> "$GITHUB_STEP_SUMMARY"
-          if [ -n "$HERMES_KEYSTORE_BASE64" ]; then
-            echo "✅ **Signed with release keystore** — suitable for Play Store upload" >> "$GITHUB_STEP_SUMMARY"
-          else
-            echo "⚠️ **Debug-signed** (no \`HERMES_KEYSTORE_BASE64\` secret) — NOT suitable for Play Store. Add the secret in repo settings to enable release signing." >> "$GITHUB_STEP_SUMMARY"
-          fi
-          echo "" >> "$GITHUB_STEP_SUMMARY"
-          echo "### Artifacts" >> "$GITHUB_STEP_SUMMARY"
-          echo '```' >> "$GITHUB_STEP_SUMMARY"
-          ls -la app/build/outputs/apk/release/ app/build/outputs/bundle/release/ >> "$GITHUB_STEP_SUMMARY"
-          echo '```' >> "$GITHUB_STEP_SUMMARY"

.gitignore

@@ -24,9 +24,17 @@ Thumbs.db
 local.properties
 /build/
 /app/build/
+/relay-core/build/
+/relay-ui/build/
+/ui-preview/build/
+/quest/build/
 /app/release/
 *.apk
 *.aab
+
+# Scratch / working directory (local pet packs, generated test assets, etc.)
+/tmp/
+/build-*.log
 *.jks
 *.keystore
 /captures
@@ -43,19 +51,31 @@ certs/
 
 # Local tools
 .subframe/
+voice-lab-runs/
+realtime-voice-runs/
+realtime-agent-runs/
+voice_rec_*.wav
+
+# Ad-hoc debugging artifacts (logcat dumps, screenshots, UI XMLs)
+.scratch/
 
 # VitePress
 user-docs/.vitepress/cache/
 user-docs/.vitepress/dist/
 node_modules/
-package.json
-package-lock.json
+# Anchor VitePress-only npm manifests to root/user-docs so desktop/package.json is tracked.
+/package.json
+/package-lock.json
+/user-docs/package.json
+/user-docs/package-lock.json
 
-# Local upstream reference
+# Local upstream references (not shipped in this repo)
 hermes-agent-upstream/
+hermes-agent-fork/
 
-# Captured screenshots (may contain sensitive server IPs/keys — curate manually before committing)
-assets/screenshots/
+# Claude Code internal state (worktrees, image cache, conversation logs)
+.claude/
+.claude-launcher/
 
 # Kotlin compiler cache
 .kotlin/
@@ -63,3 +83,10 @@ assets/screenshots/
 # Release signing & Play Store credentials — never commit these
 play-service-account.json
 keystore.properties
+
+# Desktop TUI smoke harness runtime artifacts
+.smoke-relay.pid
+.smoke-relay.log
+
+# Generated tray frontend vendor assets copied from desktop/node_modules
+desktop/tray/ui/vendor/

.mcp.json

@@ -0,0 +1,8 @@
+{
+  "mcpServers": {
+    "mobile-mcp": {
+      "command": "npx",
+      "args": ["-y", "@mobilenext/mobile-mcp@latest"]
+    }
+  }
+}

AGENTS.md

@@ -1,53 +1,49 @@
-# hermes-android
+# AGENTS.md
 
-## Overview
-This extension adds Android device control to hermes-agent via the `android` toolset.
-It communicates with the Hermes-Relay app running on an Android device over WSS.
+Universal agent instructions for **Hermes-Relay**. This is the entry point for any
+coding agent (Claude Code, Codex, Cursor, etc.).
 
-## Setup
+## Read this first
 
-### Quick start (relay + plugin)
+The detailed, authoritative context lives in **[CLAUDE.md](CLAUDE.md)** —
+architecture, the upstream Hermes API reference, repository layout, per-language
+code style, the dev loop, and the Key Files map. Read it before touching code,
+then `docs/spec.md` and `docs/decisions.md`.
 
-```bash
-pip install aiohttp pyyaml && python -m relay_server --no-ssl   # start relay
-cp -r plugin ~/.hermes/plugins/hermes-android                    # install plugin
-```
+- Release process → **[RELEASE.md](RELEASE.md)**
+- Contributor setup → **[CONTRIBUTING.md](CONTRIBUTING.md)**
+- `android_*` toolset + MCP → **[docs/mcp-tooling.md](docs/mcp-tooling.md)**
+- Follow-ups / deferred work / known gaps → **[TODO.md](TODO.md)** (the single home for "what's next" — never DEVLOG, never scattered code comments)
 
-Then restart hermes-agent. See [docs/relay-server.md](docs/relay-server.md) for Docker, systemd, TLS, and configuration options.
+## Non-negotiables (the short list)
 
-### Full setup
-1. Install the Hermes-Relay APK on the Android device (build via `scripts/dev.bat build`)
-2. Grant the app Accessibility Service permission in Settings > Accessibility
-3. Grant SYSTEM_ALERT_WINDOW permission
-4. Start the relay server: `pip install aiohttp pyyaml && python -m relay_server --no-ssl`
-5. Install the plugin: `cp -r plugin ~/.hermes/plugins/hermes-android`
-6. Restart hermes-agent
+- **Vanilla Hermes path = upstream-only.** The default (no-plugin) connection —
+  chat via the API server, Vanilla Hermes voice via the Hermes dashboard — must work
+  against unmodified upstream hermes-agent. Server-side needs go through upstream
+  PRs or the optional relay plugin, never fork patches.
+- **Verify endpoints against upstream** (`gateway/platforms/api_server.py` /
+  `tui_gateway/server.py` in hermes-agent) before assuming a route exists.
+- **Conventional Commits + `main`/`dev` branching.** Feature branches off `dev`,
+  `--no-ff` merges, version bumps at release-prep on `dev`, tags cut from `main`.
+- **Android:** Jetpack Compose only (no XML), kotlinx.serialization (no Gson),
+  OkHttp (no Ktor), `wss://` only. Run `./gradlew lint` before pushing Kotlin.
+- **Plugin (Python 3.11+):** aiohttp + asyncio (no threading), type hints
+  everywhere, structured `logging` (no `print`). **Desktop CLI (Node ≥21):**
+  zero runtime deps, strict TS + ES modules, ship compiled `dist/`. Full
+  per-language style and the dev loop live in CLAUDE.md → "Code Style".
 
-## Tool usage patterns
+## Public-repo writing hygiene
 
-### Read before act
-ALWAYS call android_read_screen before tapping. Never guess coordinates.
+Everything committed is public. In CHANGELOG, DEVLOG, README, docs, and release
+notes:
 
-### Prefer text over coordinates
-Use android_tap_text("Continue") over android_tap(x=540, y=1200).
-
-### Wait after navigation
-After opening an app or tapping a button that triggers loading,
-always call android_wait with expected text before next action.
-
-### Confirmation pattern for destructive actions
-Before confirming a purchase, ride, or send action — always report
-to the user what you're about to do and wait for approval.
-Example: "I'm about to confirm an Uber ride to [destination] for [price].
-Reply 'yes' to confirm."
-
-## Common package names
-- com.ubercab — Uber
-- com.bolt.client — Bolt
-- com.whatsapp — WhatsApp
-- com.spotify.music — Spotify
-- com.google.android.apps.maps — Google Maps
-- com.android.chrome — Chrome
-- com.google.android.gm — Gmail
-- com.instagram.android — Instagram
-- com.twitter.android — X/Twitter
+- **No personal names** — attribute impersonally; identity lives in git + the
+  signing cert.
+- **No private infrastructure** — real hostnames/IPs, internal deployment names,
+  `~/SYSTEM.md`. (Generic example IPs in setup docs are fine.)
+- **No AI/assistant process self-narration** ("I should have…", course
+  corrections) — state the technical conclusion only.
+- **No internal jargon or fork/branch plumbing** in user-facing notes.
+- **CHANGELOG** uses Keep-a-Changelog grouping; condense the version block to
+  crisp public bullets at release-prep (see RELEASE.md §2 "Scrub for public
+  distribution"). **DEVLOG** is a depersonalized, factual engineering log.

CLAUDE.md

@@ -4,24 +4,26 @@
 
 ## What This Is
 
-A native Android app for Hermes agent. Chat connects directly to the Hermes API Server. Bridge and terminal channels use a relay server over WSS. The app is Kotlin + Jetpack Compose. The server relay is Python + aiohttp.
+A native Android app (Kotlin + Jetpack Compose) paired with an optional Python relay plugin/server (aiohttp) for the Hermes agent platform. Vanilla Hermes chat, Manage, and dashboard voice work against unmodified upstream Hermes. Relay adds phone control, terminal, remote desktop tooling, extra voice engines, and dashboard Relay management.
 
-**Current state:** v0.1.0 (Google Play). Phase 0 + Phase 1 complete with direct API chat, session management, markdown rendering, messaging-style chat header (avatar + agent name + model subtitle), personality picker with agent name on bubbles, searchable command palette (29 gateway commands + dynamic personalities + server skills), QR code pairing, ConnectionStatusBadge (animated pulse ring), in-app analytics (Stats for Nerds with reset, peak times, tokens/msg), animated splash screen, tool display configuration, client-side message queuing (send while streaming), file attachments (images, documents, any file type via base64), configurable limits (attachment size, message length), feature gating with Developer Options, ASCII morphing sphere animation (empty chat state + ambient mode + behind-messages background), and animation settings in Settings. The relay server handles bridge (Phase 3) and terminal (Phase 2) via WSS. Auth uses optional Bearer token for API, pairing code for relay. Relay/pairing settings are hidden in production behind Developer Options (tap version 7x to unlock).
+**Current state:** v1.0.0 stable. The default no-plugin path supports chat, Manage, and voice on vanilla upstream Hermes. Chat auto-prefers the dashboard `/api/ws` gateway transport when Manage auth is ready, then falls back to API-server SSE routes. Vanilla Hermes voice uses dashboard `/api/audio/*` with the Manage session. Relay remains an additive power path for terminal, bridge/device control, notification companion, extra/provider-native voice, remote access, and desktop tooling. Two Android product flavors ship: `googlePlay` (conservative, no unattended Device Control surface) and `sideload` (full-capability).
 
 ## Architecture
 
 ```
-Phone (HTTP/SSE) → Hermes API Server (:8642)   [chat — direct]
-Phone (WSS)      → Relay Server (:8767)          [bridge, terminal]
+Phone (WS)       -> Hermes dashboard (:9119)     [vanilla Hermes gateway chat, live thinking]
+Phone (HTTP/SSE) -> Hermes API Server (:8642)    [vanilla Hermes chat fallback, sessions, runs]
+Phone (HTTP)     -> Hermes dashboard (:9119)     [vanilla Hermes Manage + voice]
+Phone (WSS/HTTP) -> Relay plugin/server (:8767)  [optional bridge, terminal, relay voice, remote tools]
 ```
 
-Chat goes directly to the API server via HTTP/SSE. The API key (Bearer token) is optional — most local setups run without one. Terminal will go through tmux via the relay. Bridge wraps existing relay protocol. See docs/decisions.md for why.
+The Vanilla Hermes path must stay upstream-only. API-server bearer auth and dashboard cookie auth are separate. Terminal and bridge require Relay pairing; Vanilla Hermes chat, Manage, and dashboard voice must not.
 
 ### Upstream Hermes API Reference
 
 **IMPORTANT:** Always verify endpoints against the actual hermes-agent source (`gateway/platforms/api_server.py`). The upstream repo is the source of truth — not our docs, not our memory, not assumptions from other frontends.
 
-**Standard endpoints (confirmed in hermes-agent source):**
+**Vanilla Hermes endpoints (confirmed in hermes-agent source):**
 
 | Endpoint | Purpose | Tool Call Format |
 |----------|---------|-----------------|
@@ -29,94 +31,157 @@ Chat goes directly to the API server via HTTP/SSE. The API key (Bearer token) is
 | `POST /v1/runs` | Start an agent run | Returns `run_id` |
 | `GET /v1/runs/{run_id}/events` | SSE stream of run lifecycle events | **Structured events**: `tool.started`, `tool.completed`, `message.delta`, `reasoning.available`, `run.completed`, `run.failed` |
 | `POST /v1/responses` | OpenAI Responses API format | Structured `function_call` objects (non-streaming only) |
+| `GET /v1/capabilities` | Machine-readable feature + endpoint discovery | Use before assuming optional surfaces exist |
 | `GET /v1/models` | List available models | — |
+| `GET /v1/skills` | Read-only skill list for the API-server agent | `{"object":"list","data":[...]}` |
+| `GET /v1/toolsets` | Read-only API-server toolset inventory | `{"object":"list","platform":"api_server","data":[...]}` |
+| `GET/POST/PATCH/DELETE /api/sessions/*` | Native session CRUD, messages, fork, sync chat, SSE chat | Upstream merged via NousResearch/hermes-agent PR #33134 |
 | `GET /health` | Health check | — |
-| `GET/POST/PATCH/DELETE /api/jobs/*` | Cron job management | — |
+| `GET/POST/PATCH/DELETE /api/jobs/*` | Cron job management (api_server surface) | — |
 
-**Non-standard endpoints (may be version-specific):**
+**Compatibility endpoints (not all native upstream API-server routes):**
 
-These endpoints work on our hermes-agent v0.7.0 but are **not in the upstream source**. They may be fork-specific, version-specific, or added by plugins. Always use `detectChatMode()` to probe availability.
+Upstream main now contains the focused session-control API (`#33134`) and read-only skills/toolsets (`#33016`). The original broad PR [#8556](https://github.com/NousResearch/hermes-agent/pull/8556) was closed as superseded. Keep these distinctions straight:
 
-| Endpoint | Purpose | Fallback |
-|----------|---------|----------|
-| `POST /api/sessions/{id}/chat/stream` | Session-based SSE chat | Use `/v1/runs` or `/v1/chat/completions` |
-| `GET/POST/PATCH/DELETE /api/sessions` | Session CRUD | Use `X-Hermes-Session-Id` header with `/v1/chat/completions` |
-| `GET /api/skills` | Skill discovery | Hardcoded command list |
-| `GET /api/config` | Server config (personalities, model) | No fallback — personality picker empty |
+1. **Native upstream** — `/api/sessions`, `/api/sessions/{id}/messages`, `/api/sessions/{id}/chat`, `/api/sessions/{id}/chat/stream`, `/v1/capabilities`, `/v1/skills`, and `/v1/toolsets` exist in current `gateway/platforms/api_server.py`.
+2. **Bootstrap compatibility** (`plugin/hermes_relay_bootstrap/`) — monkey-patches aiohttp on startup via `.pth` file for older or partial core builds. It skips native routes per method/path and should be retired per surface, not treated as the preferred path. The repo-root `hermes_relay_bootstrap/` package is a legacy import shim.
+3. **Legacy fork branches** — useful as lineage only. Do not cite `feat/session-api` / `#8556` as the current upstream contract.
+
+| Endpoint | Purpose | Provided by |
+|----------|---------|-------------|
+| `GET /api/sessions` (CRUD) | Session list/create/rename/delete/fork | Native upstream (#33134); bootstrap only for old builds |
+| `GET /api/sessions/{id}/messages` | Conversation history | Native upstream (#33134); bootstrap only for old builds |
+| `POST /api/sessions/{id}/chat` | Synchronous session chat | Native upstream (#33134) |
+| `POST /api/sessions/{id}/chat/stream` | Session-based SSE chat | Native upstream (#33134); bootstrap does NOT inject |
+| `GET /v1/skills`, `GET /v1/toolsets` | Read-only skill/toolset discovery | Native upstream (#33016) |
+| `GET /api/sessions/search` | Full-text message search | Bootstrap/fork legacy; not in current upstream main |
+| `GET /api/config`, `PATCH /api/config` | Personalities + model config | Bootstrap/fork legacy or dashboard web-server surface; not current API-server upstream |
+| `GET /api/skills`, `/{name}` | Legacy skill discovery/detail | Bootstrap/fork legacy; prefer native `/v1/skills` for lists |
+| `PUT /api/skills/toggle` | Enable/disable installed skill | `hermes_cli/web_server.py` dashboard surface; bootstrap stub returns 501 |
+| `GET/POST/PATCH/DELETE /api/memory` | Memory CRUD | Bootstrap/fork legacy; not current API-server upstream |
+| `GET /api/available-models` | Provider model list | Bootstrap/fork legacy; not current API-server upstream |
+
+The Android client probes per-endpoint capability via `HermesApiClient.probeCapabilities()` (returns `ServerCapabilities`). When `streamingEndpoint = "auto"`, `ConnectionViewModel.resolveStreamingEndpoint()` picks `sessions`, `completions`, or `runs` based on the capability snapshot.
+
+**Dashboard web server (separate surface — standard Manage / Desktop remote gateway):**
+
+hermes-agent ships a second web server at `hermes_cli/web_server.py` that hosts the React admin dashboard at `hermes_cli/web_dist/`. It has its **own** `/api/*` routes that **do not live on `api_server.py`** — notably: `GET/PUT /api/config` (full tree), `GET /api/config/schema`, `GET /api/config/defaults`, `GET/PUT /api/config/raw` (YAML text), `GET/PUT/DELETE /api/env` + `POST /api/env/reveal`, `PUT /api/skills/toggle`, `/api/cron/jobs/*` (different shape from `/api/jobs/*`), `/api/providers/oauth/*`, `/api/dashboard/themes`, `/api/dashboard/plugins`, `/api/model/info` + `/api/model/options` + `POST /api/model/set`, `/api/profiles/*` (CRUD, `POST /api/profiles/active`, per-profile soul/description/model), `/api/mcp/*`, `/api/logs`, `/api/analytics/usage`, and **`POST /api/audio/transcribe` + `POST /api/audio/speak`** (base64 data-url contract, built for hermes-desktop voice). The API server has **no audio routes** — its `/v1/capabilities` advertises `audio_api: false`; PR #8199 (`/v1/audio/*`) is the canonical future surface but is unmerged. Android's **Vanilla Hermes (no-plugin) voice** therefore rides this dashboard surface via `StandardHermesVoiceClient` with the per-connection dashboard cookie session (Manage sign-in unlocks voice); `AutoVoiceAudioClient` prefers Relay when paired and falls back to standard.
+
+Current upstream supports two auth modes on this surface. Loopback dashboards still use the injected `window.__HERMES_SESSION_TOKEN__` path. Remote/non-loopback dashboards use the Desktop-style dashboard auth gate: `/api/status` advertises `auth_required` and providers, `/auth/password-login` handles password providers, `/auth/login?provider=...` handles Nous/OIDC redirects, `/api/auth/me` returns the verified session, and `/api/auth/ws-ticket` mints a short-lived ticket for `/api/ws` / `/api/pty`. This dashboard session is **not** an `API_SERVER_KEY`. Android uses it for Manage, Vanilla Hermes voice, and the gateway chat transport. `/api/ws` is backed by `tui_gateway/server.py` (what hermes-desktop + the Ink TUI speak) and is the only upstream surface with **live** `reasoning.delta`/`thinking.delta` streaming; the api_server SSE paths remain the SSE fallback. Relay-only capabilities remain behind Relay pairing. **Do not proxy dashboard auth or dashboard admin APIs over the relay.**
 
 **Tool call rendering paths:**
-1. **Runs API** (`/v1/runs`) — Best for tool display. Emits `tool.started`/`tool.completed` as real SSE events → rendered as ToolProgressCards in real-time.
-2. **Sessions API** (`/api/sessions/{id}/chat/stream`) — Does NOT emit structured tool events during streaming. Tool calls are stored server-side as `tool_calls` JSON on each message. On stream complete, `ChatViewModel.onCompleteCb` reloads message history via `getMessages()` → `loadMessageHistory()` to get proper message boundaries + tool call cards. This is the "session_end reload" pattern.
-3. **Annotation parser** (`ChatHandler.parseAnnotationLine` + `finalizeAnnotations`) — Fallback for servers that inject inline markdown annotations (`` `💻 terminal` ``). Parses during streaming + reconciliation pass on stream end. If your Hermes version uses a different format, check `adb logcat -s HermesApiClient` for raw SSE events and update the regex.
+1. **Runs API** — Emits `tool.started`/`tool.completed` as real SSE events → `ToolProgressCard` in real-time.
+2. **Sessions API** — Native upstream emits structured SSE (`run.started`, `message.started`, `assistant.delta`, `tool.progress`, `tool.started/completed/failed`, `assistant.completed`, `run.completed`, `done`). `run.completed.messages` can reconcile authoritative per-turn transcript.
+3. **Annotation parser** — Fallback for servers emitting inline markdown annotations (`` `💻 terminal` ``).
 
 ## Key Instructions
-- **Always verify upstream before assuming an endpoint exists.** Check `gateway/platforms/api_server.py` in hermes-agent. If an endpoint isn't there, document it as non-standard and implement a fallback.
-- When building features that interface with hermes-agent, reference the upstream source — not just our spec docs. Our spec may be aspirational or based on a specific server version.
-- If we use a non-standard endpoint, mark it clearly in code comments and ensure `detectChatMode()` handles its absence gracefully.
+- **Vanilla Hermes path = upstream-only.** The default (no-plugin) connection path — gateway/API chat, Manage, and Vanilla Hermes voice via the dashboard surface — must work against **unmodified upstream hermes-agent**: no fork patches, no bespoke server config as a dependency. The app ships on Google Play to users whose servers we don't control. Features that need server-side changes go through upstream PRs (with graceful degradation until merged) or live behind the opt-in relay plugin.
+- **Always verify upstream before assuming an endpoint exists.** Check `gateway/platforms/api_server.py` in hermes-agent. If an endpoint isn't there, document whether bootstrap injects it or it requires the fork.
+- If we use a non-standard endpoint, ensure `probeCapabilities()` covers it and the auto-resolver degrades gracefully.
+- **Bootstrap maintenance:** Retire `plugin/hermes_relay_bootstrap/` per surface. Sessions and read-only skills/toolsets now have native upstream replacements; config, memory, legacy skill detail/toggle, available-models, and slash middleware still need explicit replacement decisions before full removal.
 
 ## Repository Layout
 
 ```
-hermes-android/                  ← Android Studio opens this root
-├── app/                         ← Android app module (Compose)
-│   ├── src/main/kotlin/com/hermesandroid/relay/
-│   │   ├── ui/                  # Screens, components, theme
-│   │   ├── network/             # ConnectionManager, ChannelMultiplexer, handlers
-│   │   ├── auth/                # AuthManager (pairing + tokens)
-│   │   ├── viewmodel/           # ChatViewModel, ConnectionViewModel
-│   │   └── data/                # ChatMessage, ToolCall models
-│   └── build.gradle.kts
-├── build.gradle.kts             ← Root Gradle (AGP, Kotlin plugins)
-├── settings.gradle.kts
-├── gradle/                      ← Wrapper (8.13) + version catalog
-├── scripts/                     ← Dev scripts (build, install, run, test, relay)
-├── relay_server/             ← Python WSS relay server
-│   ├── relay.py                 # Main aiohttp WSS server
-│   ├── auth.py                  # Pairing + session management
-│   ├── channels/                # chat.py, terminal.py (stub), bridge.py (stub)
-│   └── config.py
-├── plugin/                      ← Hermes agent plugin (14 android_* tools)
-│   ├── android_tool.py
-│   ├── android_relay.py
-│   ├── tools/                   # Standalone toolset
-│   ├── skills/                  # Agent skills
-│   └── tests/
-├── skills/                      ← Installable Hermes skills
-│   └── hermes-pairing-qr/      # (DEPRECATED) QR pairing — use `hermes pair` from the plugin instead
-├── docs/                        ← spec, decisions, security
-└── .github/workflows/           ← CI + release
+hermes-android/
+├── app/src/main/kotlin/com/hermesandroid/relay/
+│   ├── ui/                  # Screens, components, theme
+│   ├── network/             # ConnectionManager, ChannelMultiplexer, handlers
+│   ├── auth/                # AuthManager (pairing + tokens)
+│   ├── viewmodel/           # ChatViewModel, ConnectionViewModel
+│   ├── data/                # ChatMessage, ToolCall models, FeatureFlags
+│   ├── audio/               # VoiceRecorder, VoicePlayer, VoiceSfxPlayer
+│   ├── voice/               # VoiceViewModel, VoiceBridgeIntentHandler
+│   ├── accessibility/       # HermesAccessibilityService, ScreenReader, ActionExecutor
+│   ├── bridge/              # BridgeSafetyManager, BridgeForegroundService, BridgeStatusOverlay
+│   └── notifications/       # HermesNotificationCompanion
+├── relay-core/              ← [EXPERIMENTAL] Quest/XR shared core lib (com.axiomlabs.hermesrelay.core) — pairing, transport, terminal, voice, wire
+├── relay-ui/                ← [EXPERIMENTAL] Quest/XR shared Compose UI lib — sphere, terminal WebView, QR scanner
+├── quest/                   ← [EXPERIMENTAL] Meta Spatial SDK Quest/XR app (gradle includeBuild; in development, not shipped)
+├── ui-preview/              ← Desktop Compose Hot Reload harness for PC UI iteration (NOT shipped; shares MorphingSphereCore)
+├── desktop/                 ← Node thin-client CLI (`@hermes-relay/cli`)
+│   ├── bin/hermes-relay.js  # #!/usr/bin/env node shim → dist/cli.js
+│   ├── src/
+│   │   ├── cli.ts           # argv parser + subcommand dispatcher (bare → shell)
+│   │   ├── commands/        # chat, shell, pair, status, tools, devices
+│   │   ├── banner.ts        # contextual connect line (LAN / Tailscale / Plain / Secure)
+│   │   ├── renderer.ts      # GatewayEvent → plain-line stdout formatter (chat only)
+│   │   ├── endpoint.ts      # ADR 24 EndpointCandidate + role helpers
+│   │   ├── pairingQr.ts     # v3 QR decode + priority-raced reachability probe
+│   │   ├── pairing.ts       # readline 6-char prompt + payload validator
+│   │   ├── credentials.ts   # token → pair-qr → code → stored → prompt precedence
+│   │   ├── certPin.ts       # TOFU SPKI sha256 extract / pinKey / compare
+│   │   ├── tools/           # desktop.command router + fs/terminal/search handlers + consent
+│   │   ├── transport/       # RelayTransport (reconnect state machine + TLS probe TOFU)
+│   │   └── lib/             # gracefulExit, rpc, circularBuffer (vendored)
+│   └── scripts/             # install.sh + install.ps1 curl/iwr one-liners
+├── plugin/                  ← Hermes agent plugin
+│   ├── android_tool.py      # 18 android_* tool handlers
+│   ├── pair.py              # QR pairing implementation
+│   ├── relay/               # Canonical WSS relay (server.py, auth.py, channels/, media.py, voice.py)
+│   ├── tools/               # android_navigate.py, android_notifications.py
+│   └── dashboard/           # hermes-agent dashboard plugin — manifest, React UI, FastAPI proxy
+├── relay_server/            ← Thin compat shim → plugin.relay (legacy entrypoint)
+├── hermes_relay_bootstrap/  ← Legacy import shim for older startup hooks
+├── skills/devops/hermes-relay-pair/  ← /hermes-relay-pair slash command
+├── scripts/                 ← dev.bat, bridge-smoke.sh, bump-version.sh
+└── docs/                    ← spec, decisions, security, relay-server, mcp-tooling
 ```
 
 ## Project Conventions
 
 ### File Structure
-- **Root-level:** README.md, CLAUDE.md, AGENTS.md, DEVLOG.md, .gitignore
+- **Root-level:** README.md, CLAUDE.md, AGENTS.md, DEVLOG.md, TODO.md, .gitignore
 - **docs/** — spec, decisions, security, and any other long-form documentation
-- **DEVLOG.md** — update at end of each work session with what was done, what's next, blockers
+- **DEVLOG.md** — update at end of each work session with what was done + verification (the factual record of *what happened*). It churns; do NOT park forward work here.
+- **TODO.md** — the single home for follow-ups / deferred work / known gaps ("what's next"). Record them here — never buried in DEVLOG or scattered through code/doc comments where they get lost.
+- **CLAUDE.md hygiene:** Key Files entries must stay one line — implementation detail belongs in the file or `docs/`. Run `/revise-claude-md` after feature-heavy sessions to trim drift.
+
+### Public-repo writing hygiene
+
+This is a **public, distributed repo** — every committed file (CHANGELOG, DEVLOG, README, docs, release notes) is public-facing. Write accordingly:
+
+- **No personal names** in prose — attribute impersonally ("a user reported", "observed"). Author identity lives in git history + the signing cert, not the changelog.
+- **No private infrastructure** — real server hostnames/IPs, internal deployment names, `~/SYSTEM.md` contents. (Generic example IPs like `192.168.1.100` in setup docs are fine.)
+- **No AI/assistant process self-narration** — no "I should have…", no course-correction confessionals. State the technical conclusion, not the path to it.
+- **No internal jargon / fork-branch plumbing** in user-facing notes — keep *what changed*, drop *where we staged it*.
+- **CHANGELOG** uses Keep-a-Changelog grouping (Added / Changed / Fixed). Detail may accumulate during iteration, but at **release-prep the version block is condensed to crisp public bullets** (1–2 lines each) — deep "how we debugged it" stays in commits/DEVLOG. See [RELEASE.md](RELEASE.md) §2 "Scrub for public distribution".
+- **DEVLOG.md** is a committed, factual engineering log — what changed, why, and verification — depersonalized and third-person, not a diary.
 
 ### Code Style — Android (Kotlin)
 - **Jetpack Compose** — no XML layouts. Material 3 / Material You.
 - **kotlinx.serialization** — not Gson. Type-safe, faster.
 - **OkHttp** for WebSocket + SSE — `okhttp` for WSS relay, `okhttp-sse` for API streaming
 - **Single-activity** — Compose Navigation for all routing
-- **Package:** `com.hermesandroid.relay`
-- **Min SDK 26, Target SDK 35, Compile SDK 36**
-- **Kotlin 2.0+**, JVM toolchain 17
+- **Namespace (Kotlin source tree):** `com.hermesandroid.relay` — stable, drives on-disk layout + class FQCNs
+- **applicationId:** `com.axiomlabs.hermesrelay` (googlePlay), `com.axiomlabs.hermesrelay.sideload` (sideload)
+- **Min SDK 26, Target SDK 35, Compile SDK 36** / **Kotlin 2.0+**, JVM toolchain 17
+
+### Code Style — Desktop CLI (Node/TypeScript)
+- **Node ≥21** — uses built-in global `WebSocket` (no `ws`/`undici` dep). Strict TS, ES modules, `NodeNext` resolution.
+- **Zero runtime deps** — `@types/node` + `tsx`/`rimraf`/`typescript` are devDeps only. Ship compiled `dist/`, not tsx.
+- **One binary, subcommands** — idiomatic for Node CLIs (codex, continue, vite pattern). Bare invocation is `chat`.
+- **Vendor-for-now** — transport/gateway/types are copied verbatim from `hermes-agent-tui-smoke/ui-tui/src/` with a header note. Extract to a shared package when the TUI and CLI stabilize.
+- **Dev loop:** `npx tsx src/cli.ts <args>` (no rebuild). `npm run build` + `npm link` before pushing to verify the bin shim. Never ship tsx in the published tarball — pre-build with `tsc` so Windows `npm install -g` can cmd-shim the JS directly.
 
 ### Code Style — Server (Python)
-- **aiohttp** for the WSS relay — async, matches existing Hermes relay patterns
+- **aiohttp** — async, matches existing Hermes relay patterns
 - **Type hints everywhere** — Python 3.11+ syntax
-- **asyncio** for concurrency — no threading
-- **Structured logging** — use `logging` module, not print()
+- **asyncio** — no threading; **structured logging** — use `logging`, not print()
 
 ### Git
-- **Commit messages:** `type: description` — e.g. `feat: add chat channel UI`, `fix: WSS reconnect race condition`
-- **Branch from main** — feature branches for anything non-trivial
+- **Conventional Commits:** `feat`, `fix`, `docs`, `refactor`, `test`, `chore`
+- **Branching model (as of 2026-04-19):** `main` + `dev`. Feature branches target `dev`, not `main`. `main` receives only release merges (and tags). No straight-to-main exemption — even single-file typos go through `dev`.
+- **Merge style:** `git merge --no-ff` — no squash. Preserves per-commit trail for agent-team branches on every merge in the chain (feature → dev → main).
+- **Merging ≠ releasing.** Feature branches land on `dev` continuously as CI goes green; each PR appends to `[Unreleased]` in `CHANGELOG.md` on `dev`. Releases are a separate act — cut when accumulated state is worth shipping, not per-feature. See `RELEASE.md` "When to cut a release."
+- **Version bumps happen on `dev`, then release-merge to `main`.** Bump only the surface being released: `scripts/bump-android-version.sh` for `android-vX.Y.Z`, `scripts/bump-plugin-version.sh` for `plugin-vX.Y.Z`, and `desktop/package.json` for `cli-vX.Y.Z`. The release commit lives on `dev`, then a release PR merges `dev` → `main` with `--no-ff`, then the surface tag is cut from `main`.
+- **Server tracks `dev` for staging.** The hermes-host deployment pulls `dev` so merged features are exercised before they reach a tag. Released state lives on tags cut from `main`.
+- **Branch protection** on `main` — direct push blocked; only release-merge PRs from `dev` land here. `dev` also requires CI to pass on PRs but accepts feature-branch merges freely.
 
 ### Testing
 - **Android:** JUnit + Compose testing for UI, MockK for mocks
-- **Python:** pytest for relay tests
-- **CI runs on every push** — build must pass before merge
+- **Python:** `python -m unittest plugin.tests.test_<name>` — avoid bare `pytest` (conftest imports `responses` which may not be installed in the venv)
+- **CI is split by path:** `.github/workflows/ci-android.yml` runs on app/Gradle changes; `.github/workflows/ci-plugin.yml` runs on plugin/Python changes. Both trigger on pushes to `main` and `dev` and on PRs targeting either. Build + tests must pass before merge to `dev`; release-merge to `main` requires the same.
 
 ## Key Files
 
@@ -124,51 +189,166 @@ hermes-android/                  ← Android Studio opens this root
 |------|-----|
 | `docs/spec.md` | Full specification — protocol, UI layouts, phases, dependencies |
 | `docs/decisions.md` | Architecture decisions — framework choice, channel design, auth model |
-| `app/src/main/kotlin/.../ui/RelayApp.kt` | Main scaffold — bottom nav, navigation |
-| `app/src/main/kotlin/.../network/HermesApiClient.kt` | Direct HTTP/SSE client — `sendChatStream()` for sessions endpoint, `sendRunStream()` for runs endpoint, `detectChatMode()` for capability probing |
-| `app/src/main/kotlin/.../network/ConnectionManager.kt` | WSS connection with auto-reconnect (relay) |
-| `app/src/main/kotlin/.../network/ChannelMultiplexer.kt` | Envelope routing by channel (relay) |
-| `app/src/main/kotlin/.../network/ConnectivityObserver.kt` | Reactive network connectivity listener |
-| `app/src/main/kotlin/.../network/handlers/ChatHandler.kt` | Chat message state, streaming events, tool annotation parser (inline markdown → ToolCall) |
-| `app/src/main/kotlin/.../network/models/SessionModels.kt` | Session, message, SSE event data models |
-| `app/src/main/kotlin/.../data/FeatureFlags.kt` | Feature gating — compile-time defaults (DEV_MODE) + runtime DataStore overrides |
-| `app/src/main/kotlin/.../data/AppAnalytics.kt` | In-app analytics singleton (TTFT, tokens, health, stream rates) |
-| `app/src/main/kotlin/.../ui/screens/ChatScreen.kt` | Chat UI — streaming messages, slash commands, tool cards |
-| `app/src/main/kotlin/.../ui/screens/SettingsScreen.kt` | Settings — connection, chat, appearance, analytics, about |
-| `app/src/main/kotlin/.../ui/components/StatsForNerds.kt` | Canvas bar charts for analytics display |
-| `app/src/main/kotlin/.../ui/components/CompactToolCall.kt` | Inline compact tool call display |
-| `app/src/main/kotlin/.../ui/components/PersonalityPicker.kt` | Personality picker dropdown (from config.agent.personalities) |
-| `app/src/main/kotlin/.../ui/components/CommandPalette.kt` | Searchable command palette (bottom sheet) + inline autocomplete |
-| `app/src/main/kotlin/.../ui/components/ConnectionStatusBadge.kt` | Animated pulse ring status indicator (connected/connecting/disconnected) |
-| `app/src/main/kotlin/.../ui/components/MorphingSphere.kt` | ASCII morphing sphere — 3D lit character sphere with color pulse, used in empty chat state, ambient mode, and behind-messages background |
-| `app/src/main/kotlin/.../ui/components/MessageBubble.kt` | Message bubbles with markdown, tokens, tool cards |
-| `app/src/main/kotlin/.../ui/components/ToolProgressCard.kt` | Expandable tool execution card (auto-expand/collapse) |
-| `app/src/main/kotlin/.../viewmodel/ChatViewModel.kt` | Chat orchestration — send, stream, cancel, slash commands |
-| `app/src/main/kotlin/.../viewmodel/ConnectionViewModel.kt` | Dual connection model (API + relay) |
-| `app/src/main/res/drawable/splash_icon.xml` | Splash screen icon (0.9x scale) |
-| `app/src/main/res/drawable/splash_icon_animated.xml` | Animated splash (scale + overshoot + fade) |
-| `relay_server/relay.py` | Relay server — main WSS server (bridge/terminal only) |
-| `relay_server/SKILL.md` | Hermes skill reference for relay self-setup |
-| `relay_server/Dockerfile` | Container image for relay server |
-| `relay_server/hermes-relay.service` | Systemd unit file for persistent deployment |
-| `docs/relay-server.md` | Relay server setup, config, Docker, systemd, TLS reference |
-| `app/src/main/kotlin/.../ui/components/QrPairingScanner.kt` | QR code scanner + Hermes pairing payload parser |
-| `plugin/pair.py` | QR pairing logic (pure-Python, uses segno) — replaces deprecated bash script |
-| `plugin/cli.py` | Registers `hermes pair` CLI sub-command via v0.8.0 plugin CLI API |
-| `skills/hermes-pairing-qr/SKILL.md` | (DEPRECATED) QR pairing skill — use `hermes pair` from the plugin instead |
-| `skills/hermes-pairing-qr/hermes-pair` | (DEPRECATED) QR generator script — use `hermes pair` from the plugin instead |
-| `AGENTS.md` | Tool usage patterns for the `android_*` toolset |
-| `docs/mcp-tooling.md` | MCP server setup — android-tools-mcp + mobile-mcp |
+| `AGENTS.md` | Universal agent entry point — points here + the non-negotiables (standard-path, commits, writing hygiene) |
+| `docs/mcp-tooling.md` | MCP server setup — android-tools-mcp + mobile-mcp; `android_*` tool usage patterns |
+| **App — Core** | |
+| `ui/RelayApp.kt` | Main scaffold — bottom nav, Compose navigation |
+| `viewmodel/ChatViewModel.kt` | Chat orchestration — send, stream, cancel, slash commands |
+| `viewmodel/ConnectionViewModel.kt` | Dual connection model (API + relay); `resolveStreamingEndpoint()`; derived `relayUiState` flow + `markPaired` hook stamp the active Connection |
+| `viewmodel/RelayUiState.kt` | Shared sealed state for the relay row — 5 cases + `asBadgeState()` / `statusText()` extensions; 5s grace window before Stale |
+| `network/HermesApiClient.kt` | Direct HTTP/SSE — `sendRunStream()`, `sendChatStream()`, `probeCapabilities()` |
+| `network/GatewayChatClient.kt` | Gateway chat transport — JSON-RPC over dashboard `/api/ws` (tui_gateway); live `reasoning.delta`; fresh ws-ticket per connect; per-turn SSE fallback via `onPreflightFailure`; `prewarm()` (connect+resume off the send path); `setKeepAliveInBackground()` suppresses the 120s idle-close |
+| `network/GatewayKeepAliveService.kt` | Opt-in `specialUse` foreground service (BOTH flavors; declared in main manifest; Play needs a Console FGS declaration) holding the process up so the gateway socket survives background/Doze; driven by ConnectionViewModel from the `KEY_GATEWAY_KEEP_ALIVE` toggle; stops on task-removal |
+| `data/GatewayKeepAlivePrefs.kt` | Shared `KEY_GATEWAY_KEEP_ALIVE` pref key + `Context.setGatewayKeepAlive()` — used by ConnectionViewModel (StateFlow/setter) and the FGS Stop action |
+| `network/GatewayEventMapper.kt` | Pure-JVM gateway event→callback mapping for one turn; unknown event types silently ignored; tui_gateway usage-key translation |
+| `network/GatewayModels.kt` | `GatewayAvailability`, `ActiveTurnHandle`, `GatewayTurnCallbacks` (all members REQUIRED — forces dispatchOn main-thread wrap), `GatewayAsk`, `GatewaySubagentEvent`, `resolveStreamingEndpointPreference()` |
+| `ui/components/ChatInputBar.kt` | Redesigned input bar — pill field, one trailing slot morphing Send/Voice/Stop/Steer/Queue, no slash button (long-press + opens palette) |
+| `ui/components/SubagentLane.kt` | Per-taskIndex subagent progress lane — guide rail, compact tool rows, auto-collapse |
+| `notifications/TurnCompleteNotifier.kt` | Turn-complete local notification when backgrounded — channel `chat_turn_complete`, cancel on resume, settings-gated |
+| `network/ConnectionManager.kt` | WSS to relay with auto-reconnect; rebuilds OkHttpClient with fresh CertPinner on connect |
+| `network/ChannelMultiplexer.kt` | Envelope routing by channel; `sendNotification()` for notification outbound |
+| `network/handlers/ChatHandler.kt` | Chat message state, streaming events, tool annotation parser |
+| `network/models/SessionModels.kt` | Session, message, SSE event data models |
+| `data/FeatureFlags.kt` | Feature gating — DEV_MODE + DataStore overrides; `BuildFlavor` (googlePlay/sideload Tier flags) |
+| **App — Auth** | |
+| `auth/AuthManager.kt` | Wires SessionTokenStore + CertPinStore; parses auth.ok; `applyServerIssuedCodeAndReset()` |
+| `auth/SessionTokenStore.kt` | Keystore (StrongBox) + EncryptedSharedPrefs fallback; lossless migration on upgrade |
+| `auth/CertPinStore.kt` | TOFU cert pinning — SHA-256 SPKI per host:port in DataStore |
+| `auth/PairedSession.kt` | PairedSession state + PairedDeviceInfo wire model |
+| `data/Endpoint.kt` | `EndpointCandidate` / `ApiEndpoint` / `RelayEndpoint` — multi-endpoint pairing (ADR 24); `displayLabel()` for LAN/Tailscale/Public/Custom chips |
+| `network/RelayHttpClient.kt` | OkHttp for /media, /sessions (list/revoke/extend), /health |
+| **App — Bridge** | |
+| `network/handlers/BridgeCommandHandler.kt` | Routes `bridge.command` → ActionExecutor; full path inventory + safety-rail integration |
+| `viewmodel/BridgeViewModel.kt` | BridgeScreen VM — masterToggle, bridgeStatus, permissionStatus, activityLog |
+| `bridge/BridgeSafetyManager.kt` | Blocklist + destructive-verb confirmation + auto-disable timer; fails-closed on /call and /send_sms |
+| `data/BridgeSafetyPreferences.kt` | DataStore for blocklist, destructive verbs, auto-disable minutes, confirmation timeout |
+| `ui/screens/BridgeScreen.kt` | Bridge UI — master → permission checklist → [Advanced] → unattended → safety → activity log (v0.4.1 reorder) |
+| `ui/components/UnattendedAccessRow.kt` | Unattended toggle card (sideload); `enabled=masterEnabled`; inline `KeyguardDetectedAlert` |
+| `ui/components/UnattendedGlobalBanner.kt` | 28dp amber strip at scaffold top when master+unattended on (sideload); tap → Bridge tab |
+| `bridge/BridgeStatusOverlay.kt` | WindowManager overlay; `ConfirmationOverlayHost`; requires `SavedStateRegistryOwner` init order (CREATED→restore→RESUMED) |
+| `accessibility/HermesAccessibilityService.kt` | AccessibilityService subclass; `@Volatile instance` singleton for BridgeCommandHandler |
+| `accessibility/ScreenReader.kt` | UI tree → ScreenContent; `findNodeBoundsByText()`, `findFocusedInput()` |
+| `accessibility/ActionExecutor.kt` | Gesture/text dispatch via GestureDescription + ACTION_SET_TEXT; pressKey maps vocab only |
+| **App — Voice** | |
+| `voice/VoiceViewModel.kt` | Voice turn state machine; TTS queue; `ignoreAssistantId`; `errorEvents: SharedFlow` |
+| `audio/VoiceRecorder.kt` | MediaRecorder wrapper; perceptual amplitude curve; `.m4a` at 16kHz/64kbps |
+| `audio/VoicePlayer.kt` | Media3 ExoPlayer (gapless TTS queue) + Visualizer; amplitude StateFlow; `awaitCompletion()` via coroutine; `audioSessionId` is a thread-safe `@Volatile` cache |
+| `network/RelayVoiceClient.kt` | OkHttp for `/voice/transcribe`, `/synthesize`, `/config` |
+| `voice/VoiceBridgeIntentHandler.kt` | Interface routing voice utterances to bridge; impls per flavor via factory |
+| `voice/VoiceIntentClassifier.kt` | Regex phone-control classifier (sideload only); false-negatives preferred over false-positives |
+| `ui/components/VoiceModeOverlay.kt` | Full-screen voice UI — MorphingSphere + VoiceWaveform + mic button |
+| `ui/components/MorphingSphere.kt` | Compose renderer for the agent sphere — delegates math to `MorphingSphereCore` |
+| `ui/components/MorphingSphereCore.kt` | Platform-agnostic sphere algorithm (`kotlin.math` only) — single source of truth; mirrored byte-for-byte in `preview/web/sphere.js` |
+| `preview/web/` | Zero-dep browser harness — live `index.html` preview + `parity-check.mjs`; paired with `MorphingSphereCoreParityTest` (JVM) for struct/full checksum diffing |
+| `user-docs/.vitepress/theme/components/SphereMark.vue` | Docs-site sphere embed — imports `preview/web/sphere.js` directly; autonomous fbm drift + pointer-proximity gaze/state blend; `<ClientOnly>` + `IntersectionObserver` + `prefers-reduced-motion` aware |
+| **App — Media + Notifications** | |
+| `util/MediaCacheWriter.kt` | `cacheDir/hermes-media/` LRU writer; returns FileProvider URIs |
+| `util/MediaSaver.kt` | Save/share/open for chat media — MediaStore scoped-storage save (Pictures/Download `Hermes-Relay`, no perms on API 29+; pre-Q → share sheet); FileProvider share staging; remote-byte fetch; magic-byte image-MIME sniff for correct extensions |
+| `ui/components/ChatImageViewer.kt` | Full-screen image viewer — pinch-zoom/pan (`detectTransformGestures`), double-tap 1×/2.5×, Share/Save/Close; `ChatImageViewerSource` decouples Coil-model/bitmap display from a suspend `bytesProvider` so Save keeps original bytes |
+| `ui/components/InboundAttachmentCard.kt` | Discord-style attachment card for images/video/audio/pdf/text/generic; image tap → ChatImageViewer, file card long-press → Open/Share/Save menu |
+| `ui/components/ChatImageContent.kt` | Parses `![alt](src)` out of assistant content; remote http(s) → Coil (tap → ChatImageViewer), server-local/failed → inline "can't render" notice with the path |
+| `data/HermesCard.kt` | `CARD:{json}` envelope (ADR 26) — type/accent/fields/actions; kotlinx.serialization |
+| `ui/components/HermesCardBubble.kt` | Rich-card renderer — accent stripe + FlowRow actions + dispatch stamp collapse |
+| `viewmodel/CardDispatchSyncBuilder.kt` | Twin of VoiceIntentSyncBuilder — synthesizes card dispatches as `hermes_card_action` OpenAI pairs for session memory |
+| `notifications/HermesNotificationCompanion.kt` | NotificationListenerService; cold-start buffer (50); forwards via ChannelMultiplexer |
+| `util/RelayErrorClassifier.kt` | `classifyError(Throwable, context) → HumanError`; used by Voice/Chat/Connection |
+| `util/TurnLatencyTracer.kt` | One `TurnLatency` INFO line per chat turn — `warm/cold` + `connect/session/submit/ttfe/ttft/done@…ms`; gateway + 3 SSE paths use it for desktop-comparable latency diagnosis; durations only |
+| **Relay — Server** | |
+| `plugin/relay/server.py` | Canonical relay — WSS + HTTP routes; bridge, media, voice, session, pairing handlers. `handle_pairing_mint` mirrors `pair.py:762` — top-level = API server, `relay.{url,code}` nested |
+| `plugin/relay/auth.py` | PairingManager, SessionManager, RateLimiter; `math.inf` for never-expire |
+| `plugin/relay/channels/bridge.py` | Bridge handler — `handle_command()` mints request_id, awaits response, 30s timeout |
+| `plugin/relay/channels/notifications.py` | Bounded deque (100) of notification metadata; in-memory only |
+| `plugin/relay/media.py` | MediaRegistry — LRU token store; `strict_sandbox` off by default for `/media/by-path` |
+| `plugin/relay/voice.py` | Voice endpoints — transcribe, synthesize, voice_config; lazy tool imports |
+| `plugin/relay/qr_sign.py` | HMAC-SHA256 QR signing; secret at `~/.hermes/hermes-relay-qr-secret`; canonical form preserves `endpoints` array order + role strings verbatim (ADR 24) |
+| `plugin/relay/tailscale.py` | First-class Tailscale helper (ADR 25) — `status()` / `enable(port)` / `disable(port)` / `canonical_upstream_present()`; safe-absent via shell-out to `tailscale` CLI |
+| `plugin/relay/_env_bootstrap.py` | Loads `~/.hermes/.env` before relay imports; called from both entry points |
+| **Plugin — Tools + Installer** | |
+| `plugin/tools/android_tool.py` | 18 `android_*` tool handlers (14 baseline + send_sms, call, search_contacts, return_to_hermes); `android_screenshot` first consumer of `register_media()` |
+| `plugin/tools/android_navigate.py` | Vision-driven navigation loop; up to 20 iterations; `llm_gap` error until vision client wired |
+| `plugin/pair.py` | QR payload builder + CLI; `build_payload(sign=True)`; `--register-code` fallback |
+| `plugin/doctor.py` | `hermes relay doctor`; checks standard upstream API/dashboard reachability, Relay loopback state, plugin layout, and compat hook state |
+| `plugin/compat.py` | `hermes relay compat status/install/remove`; owns the optional `hermes_relay_bootstrap.pth` lifecycle |
+| `plugin/hermes_relay_bootstrap/` | Plugin-owned runtime compatibility patch; skips native routes per method/path; retire only after remaining config/memory/legacy skill/slash gaps are handled |
+| `install.sh` | Canonical installer — 6 steps; idempotent; drops `hermes-relay-update` shim |
+| `uninstall.sh` | Canonical uninstaller; reverses install.sh; never touches `.env` or `state.db` |
+| `hermes_relay_bootstrap/` | Legacy import shim for old `.pth` files and editable installs |
+| **Plugin — Dashboard** | |
+| `plugin/dashboard/manifest.json` | Declares tab, entry bundle, and FastAPI module for hermes-agent discovery |
+| `plugin/dashboard/plugin_api.py` | FastAPI router proxying 5 routes to relay over loopback; `/pairing` body = API-server overrides (host/port/tls/api_key), relay URL auto-derived |
+| `plugin/dashboard/src/index.jsx` | React root registering `hermes-relay` plugin with 4-tab shell |
+| `plugin/dashboard/dist/index.js` | Committed IIFE bundle loaded verbatim by dashboard |
+| **Desktop CLI** | |
+| `desktop/package.json` | `@hermes-relay/cli` package manifest — Node ≥21, one `hermes-relay` bin, pre-built dist |
+| `desktop/bin/hermes-relay.js` | Tiny shim: `import('../dist/cli.js').then(m => m.main())` + error surfacing |
+| `desktop/src/chatAttach.ts` | captureClipboardImage / captureScreenshot / readImageFile; ships base64 to server via `image.attach.bytes` RPC before next prompt.submit |
+| `desktop/src/cli.ts` | argv parser + subcommand dispatcher — bare → `shell` (PTY), positional-only → `chat`; command-scoped `--help` falls through to each command |
+| `desktop/src/lib/theme.ts` | Shared ANSI palette + `colorEnabled()` + `Theme` (semantic helpers, `statusDot`) — single visual language; `--no-color`/`NO_COLOR`/TTY aware |
+| `desktop/src/lib/table.ts` | Zero-dep column-aligned table renderer (ANSI-width aware, last column flexes to terminal width) — used by devices/sessions/audit |
+| `desktop/src/lib/spinner.ts` | Stderr braille spinner for slow ops (pair probe, gateway connect); no-op when piped/quiet/json |
+| `desktop/src/lib/usage.ts` | `UsageSpec` + `renderUsage`/`printUsage`/`unknownSubcommand` — per-subcommand `--help` + self-documenting sub-verb fallback |
+| `desktop/src/lib/hints.ts` | `suggestedFix(err, ctx)` → next-step command (re-pair on auth fail, etc.); `formatError` renders error + hint |
+| `desktop/src/lib/logo.ts` | Slim box-drawing "Hermes Relay" wordmark; shown atop `--help`, first-run welcome, REPL header, and `hermes-relay logo`; theme/no-color aware |
+| `desktop/src/lib/auditLog.ts` | Local desktop-tool audit JSONL (`~/.hermes/desktop-audit.jsonl`); router appends per dispatch; backs `audit` command (relay's ring is loopback-only) |
+| `desktop/src/lib/daemonStatus.ts` | Daemon heartbeat file (`~/.hermes/daemon-status.json`) + `isPidAlive` liveness; backs `daemon --status` |
+| `desktop/src/commands/audit.ts` | `hermes-relay audit` — tails the local audit log into a table (WHEN/TOOL/STATUS/DETAIL); `--limit`, `--json` |
+| `desktop/src/commands/relay.ts` | `hermes-relay relay info/security/context` — relay-server management surface; info/security loopback-only, context works remote with bearer |
+| `desktop/src/commands/chat.ts` | REPL + one-shot + piped-stdin; `runOneTurn` returns `{promise, cancel}` for safe SIGINT; auto-wires `DesktopToolRouter` when consented |
+| `desktop/src/commands/shell.ts` | Pipes the `terminal` relay channel to raw-mode stdin/stdout; post-attach `exec hermes` 350ms after tmux settles; `Ctrl+A .` detach / `Ctrl+A k` kill / `Ctrl+A Ctrl+A` literal |
+| `desktop/src/commands/pair.ts` | Either 6-char code + `--remote`, or full v3 QR via `--pair-qr` — probes + picks endpoint, records role; `--grant-tools` (TTY prompt) / `--auto-grant-tools` (silent) stamp `toolsConsented` so `daemon` works without a `shell` round-trip |
+| `desktop/src/commands/tools.ts` | `tools.list` RPC → enabled/available toolsets; `--verbose` lists individual tools |
+| `desktop/src/commands/status.ts` | Local read of `~/.hermes/remote-sessions.json`; renders `grants:` + `expires:` + `route:`; `--json` redacts tokens, `--reveal-tokens` opts in |
+| `desktop/src/commands/devices.ts` | Server-side session management — `GET/DELETE/PATCH /sessions` via `fetch` over http(s)://host:port; `list` / `revoke <prefix>` / `extend <prefix> --ttl <s>` |
+| `desktop/src/banner.ts` | `buildConnectBanner({url, meta, endpointRole})` → "Connected via LAN (plain) — server 0.6.0"; `humanExpiry()` for TTL formatting |
+| `desktop/src/endpoint.ts` | `EndpointCandidate` / `EndpointRole` types + `displayLabel()` — mirrors Android `data/Endpoint.kt` |
+| `desktop/src/pairingQr.ts` | `decodePairingPayload` (JSON or base64), `payloadToCandidates` (v3 verbatim / v1–v2 synthesized), `probeCandidatesByPriority` (`Promise.any` within tier, `AbortSignal.any`, 4s timeout, 60s cache) |
+| `desktop/src/certPin.ts` | `extractSpkiSha256(der)` via `crypto.X509Certificate` + `publicKey.export({type:'spki'})`; `pinKey(url)`, `comparePins()`, `isSecureUrl()` |
+| `desktop/src/tools/router.ts` | `DesktopToolRouter.attach(relay)` — `onChannel('desktop')` dispatch under 30s `AbortController`; heartbeat enriched with host/platform/version/uptime_ms + sticky `last_error` for `desktop_health` |
+| `desktop/src/tools/handlerSet.ts` | Single source of truth for the desktop tool map — `DESKTOP_HANDLERS` + `DESKTOP_ADVERTISED_TOOLS`; consumed by `chat.ts` / `shell.ts` / `daemon.ts` so adding a tool is a one-file change |
+| `desktop/src/tools/consent.ts` | `ensureToolsConsent(url)` — stored per-URL in `toolsConsented`; TTY prompt; non-TTY fails closed |
+| `desktop/src/tools/handlers/fs.ts` | `readFileHandler` / `writeFileHandler` / `patchHandler` — strict unified-diff applier, no fuzz |
+| `desktop/src/tools/handlers/terminal.ts` | `bash -lc` / `cmd /c`, SIGKILL on timeout or abort, returns `{stdout, stderr, exit_code, duration_ms}` |
+| `desktop/src/tools/handlers/powershell.ts` | Spawns `pwsh`/`powershell` directly with `-Command -`, script piped via stdin — no cmd.exe quote-mangling; auto-picks pwsh > powershell |
+| `desktop/src/tools/handlers/process.ts` | `spawn_detached` (unref'd, returns pid+log_path), `list_processes` (tasklist /FO CSV — no /V to dodge window-title latency), `kill_process`, `find_pid_by_port` (netstat/lsof/ss) |
+| `desktop/src/tools/handlers/jobs.ts` | Job API — `~/.hermes/desktop-jobs/<id>/{stdout.log, stderr.log, meta.json}` is source of truth across daemon restarts; `taskkill /T` on Windows so build trees die fully |
+| `desktop/src/tools/handlers/transfer.ts` | `copy_directory` via `fs.cp`, `zip`/`unzip` via tar > zip > PowerShell probe, `checksum` streamed (sha256/sha1/md5) |
+| `desktop/src/tools/handlers/search.ts` | ripgrep with pure-Node fallback, skips `.git`/`node_modules`/`dist`/`.next`/`.cache` |
+| `desktop/src/renderer.ts` | Streams `message.delta` → stdout, tool events → decorated lines; NO_COLOR / --json / --quiet aware |
+| `desktop/src/pairing.ts` | readline-based 6-char prompt (`A-Z0-9`); headless mirror of TUI's Ink prompt; `validatePairingPayloadString` discriminated-union wrapper |
+| `desktop/src/credentials.ts` | Precedence: `--token` → `--pair-qr` (probe+pair) → `--code` → stored → prompt; returns `Credentials{sessionToken?, pairingCode?, resolvedEndpoint?}` |
+| `desktop/src/transport/RelayTransport.ts` | Fork of ui-tui's transport + reconnect state machine (`idle/connecting/connected/reconnecting`, exp backoff 1→30s, 5min on 429, gate re-check post-sleep) + pre-WS TLS probe for TOFU |
+| `desktop/src/remoteSessions.ts` | Same file path as TUI (`~/.hermes/remote-sessions.json`, 0600); schema widened with `grants`, `ttlExpiresAt`, `endpointRole`, `toolsConsented`; `saveSession` back-compat overload |
+| `desktop/src/commands/daemon.ts` | Headless WSS + tool router for always-on access; JSON-line logs; fails closed on missing consent unless `--allow-tools` with explicit `--token` |
+| `desktop/src/commands/doctor.ts` | Local-only diagnostic report — version / binary path / PATH / sessions / daemon detection; `--json` for support-paste; omits tokens entirely |
+| `desktop/src/relayUrlPrompt.ts` | First-run URL fallback — `resolveFirstRunUrl()` auto-picks single stored session, numbered picker for multiple, welcome banner for zero; throws on non-interactive + ambiguous |
+| `desktop/src/version.ts` | Build-time-generated constant (`npm run gen:version` before every build) — Bun compiled binaries can't read package.json via `__dirname` so version is embedded at build |
+| `desktop/scripts/install.sh` / `install.ps1` | curl/iwr one-liner installers — download prebuilt Bun binary (no Node required), SHA256-verified, API-resolver for `latest` that includes prereleases, version-aware pre/post-install readback |
+| `desktop/scripts/uninstall.sh` / `uninstall.ps1` | 3-tier removal — default (binary + PATH), `--purge` (also wipes `~/.hermes/remote-sessions.json`), `--service` (stub for future service installers); Windows iex-safe env-var fallback |
+| `desktop/README.md` | User-facing install + usage reference |
+| **Desktop CLI — dev iteration** | |
+| `npm run smoke` (in `desktop/`) | Builds Windows binary + runs `--version` / `--help` / `doctor`, fails loud on zero-output. Local pre-flight before cutting any tag. |
+| `npm run gen:version` | Regenerates `src/version.ts` from `package.json`. Runs automatically before every `build` / `build:bin:*`. |
+| `release-cli.yml → Smoke-test Linux binary` step | CI-side equivalent: runs compiled Linux binary through the same 3-command check before uploading assets. Catches silent-exit-0 + segfault classes. |
+| **Server — Desktop tool routing (Phase B)** | |
+| `plugin/relay/channels/desktop.py` | Mirrors `bridge.py` — `desktop.command`/`desktop.response`/`desktop.status`, UUID-correlated futures, 30s timeout, single-client MVP, per-session advertised-tools set |
+| `plugin/tools/desktop_tool.py` | 24 `desktop_*` tools (fs/shell/powershell/process/jobs/transfer/health) — registers with `tools.registry` under `desktop` toolset; per-tool `check_fn` pings `/desktop/_ping?tool=<name>`; `desktop_health` is `_RELAY_ONLY` and pings `/desktop/health` so it works even when the client is wedged |
+| **Gradle modules — experimental Quest/XR (in development)** | |
+| `relay-core/` | [EXPERIMENTAL] Android library (`com.axiomlabs.hermesrelay.core`) — shared pairing/transport/terminal/voice/wire for the Quest port; not yet wired into the shipped `:app` |
+| `relay-ui/` | [EXPERIMENTAL] Android library (`com.axiomlabs.hermesrelay.ui`) — shared Compose UI (sphere, terminal WebView, QR scanner) for the Quest port; carries its own sphere copy |
+| `quest/` | [EXPERIMENTAL] Meta Spatial SDK Quest/XR app — gradle `includeBuild("quest")`; needs further development, not shipped |
+| **Tooling — dev iteration (not shipped)** | |
+| `ui-preview/` | Desktop Compose Hot Reload harness — JVM Compose for Desktop; source-shares `MorphingSphereCore` from `:relay-ui`; `Main.kt` gallery; see `ui-preview/README.md` |
+| `app/src/test/.../screenshots/StoreScreenshotTest.kt` | Roborazzi host-side store/docs screenshot renderer — deterministic, no device, exact 1080×2160; reuses real components+chrome with mock data; `capture(name, themeId){…}` renders any view; see `docs/screenshot-automation.md` §Deterministic rendering (JDK-21 + no-plugin gotchas) |
 
 ## What NOT to Do
 
 - **Don't use XML layouts** — Compose only
 - **Don't use Gson** — kotlinx.serialization
 - **Don't use Ktor for networking** — OkHttp for WebSocket
-- **Don't build terminal or bridge channels yet** — Phase 2 and 3. Stubbed with `TODO`.
 - **Don't use plaintext WebSocket** — `wss://` only, even in development
 - **Don't put documentation in root** — long-form docs go in `docs/`
-- **Don't forget DEVLOG.md** — update it
+- **Don't forget DEVLOG.md** — update it (record *what happened*)
+- **Don't bury follow-ups** — deferred work / known gaps go in `TODO.md`, never in DEVLOG or one-off code/doc comments
 
 ## MCP Tooling
 
@@ -179,8 +359,6 @@ Two MCP servers are configured for AI-assisted development. See `docs/mcp-toolin
 | `android-tools-mcp` | IDE/Build — Compose previews, Gradle, code search, Android docs | Android Studio running with project open |
 | `mobile-mcp` | Device/Runtime — tap, swipe, screenshot, app management | ADB + connected device/emulator |
 
-Together they cover the full loop: code → preview → build → deploy → interact → screenshot.
-
 ## Dev Workflow
 
 ```bash
@@ -193,39 +371,109 @@ scripts/dev.bat version    # Show current version from libs.versions.toml
 scripts/dev.bat relay      # Start relay server (dev mode, no SSL)
 ```
 
-Open repo root in Android Studio for Compose previews and device deployment.
+### Bridge smoke test (run on hermes-host, not local PC)
+
+```bash
+scripts/bridge-smoke.sh                   # full suite, destructive ON
+scripts/bridge-smoke.sh --no-destructive  # read-only paths only
+scripts/bridge-smoke.sh --filter open_app # re-run a single test
+scripts/bridge-smoke.sh --pair ABCDEF     # register pairing code first
+```
+
+Curls every bridge HTTP route via `localhost:8767`. Catches the silent-drop regression class (Python relay registers a route but Kotlin dispatcher's `when (path)` has no matching branch). Run after every relay restart.
+
+### Typical Dev Loop
+
+1. **Edit locally** — Windows checkout. Both plugin (`plugin/`) and app (`app/`) live here.
+2. **Python syntax check** — `python -m py_compile plugin/<file>.py`. Full tests run on the server.
+3. **Kotlin changes** — do NOT run `gradle build`. Bailey builds via Android Studio's ▶ button. Never `adb install` from Claude.
+4. **Before pushing Kotlin changes** — run `./gradlew lint` locally. It's the exact task CI runs and catches errors Android Studio's live inspections miss — e.g. `UnsafeOptInUsageError` with `kotlin.OptIn` vs `androidx.annotation.OptIn`, `FlowOperatorInvokedInComposition` (mapped flows inside Composables), Media3 `@UnstableApi` propagation. Android CI runs lint alongside build/test for faster feedback, but a local lint run still surfaces issues before the workflow spends runner time compiling and packaging.
+5. **Commit + push** — feature branch off `dev`, merged back to `dev` via PR. `main` is reserved for release merges.
+6. **Pull + restart on server** — see Server Deployment below.
+7. **Test on phone** — Bailey builds from Studio, installs to Samsung device, pairs via `/hermes-relay-pair`.
+
+### Server Deployment
+
+Server is a Linux box running hermes-agent with hermes-relay editable-installed (`pip install -e`). Sensitive details (IP, user, secrets) in `~/SYSTEM.md` on the server — not in this repo.
+
+| What | Where |
+|---|---|
+| hermes-agent repo | `~/.hermes/hermes-agent/` |
+| hermes-relay clone | `~/.hermes/hermes-relay/` |
+| Plugin symlink | `~/.hermes/plugins/hermes-relay` → `~/.hermes/hermes-relay/plugin` |
+| Config | `~/.hermes/config.yaml` + `~/.hermes/.env` |
+| Relay log | `journalctl --user -u hermes-relay -f` |
+
+**Update:** `hermes-relay-update` (idempotent, re-fetches install.sh). Or manually: `git pull --ff-only && systemctl --user restart hermes-relay`.
+
+**Compat hook:** `hermes relay compat status/install/remove` manages only the
+optional `hermes_relay_bootstrap.pth` startup hook. New installs load the
+plugin-owned bootstrap from `plugin/hermes_relay_bootstrap/`; the repo-root
+package is only a legacy import shim. Vanilla Hermes chat, Manage, and dashboard voice
+must not depend on this hook.
+
+**Key conventions:**
+- Phone re-pairs after each relay restart (SessionManager is in-memory; wiped on restart)
+- Use `python -m unittest` not `pytest` — conftest imports `responses` which may not be installed
+- `_env_bootstrap.py` loads `~/.hermes/.env` on every relay start — no stale API keys
+
+### Where Python vs. Kotlin changes land
+
+| Change type | Who restarts? | Command |
+|---|---|---|
+| Plugin tool (`android_tool.py` etc.) | `hermes-gateway.service` | `systemctl --user restart hermes-gateway` |
+| Relay code (`plugin/relay/*.py`) | `hermes-relay.service` | `systemctl --user restart hermes-relay` |
+| Pair CLI / skill files | — | No restart — fresh process / scanned on invocation |
+| Android app | Bailey (Studio) | Studio run button |
 
 ### Release Process
 
-See [RELEASE.md](RELEASE.md) for the full release recipe — versioning conventions, keystore setup, Play Console upload (manual + automated via `gradle-play-publisher`), GitHub release workflow, and troubleshooting.
+See [RELEASE.md](RELEASE.md) for the full recipe.
 
-Quick reference:
-- **Version source of truth**: `gradle/libs.versions.toml` (`appVersionName`, `appVersionCode`)
-- **SemVer with optional prereleases**: `v0.1.0`, `v0.1.1`, `v0.2.0-beta.1`, `v1.0.0-rc.1`
-- **`appVersionCode` is monotonic** — always increment, even across prereleases (Play Console rejects collisions)
-- **Build AAB locally**: `scripts/dev.bat bundle` → `app/build/outputs/bundle/release/app-release.aab`
-- **Verify signing**: `keytool -list -printcert -jarfile <aab>` — must NOT show `CN=Android Debug`
-- **Cut a release**: bump version → commit → `git tag vMAJOR.MINOR.PATCH` → `git push origin <tag>` → CI builds APK + AAB and creates GitHub Release
-- **Required GitHub Secrets** for signed CI builds: `HERMES_KEYSTORE_BASE64`, `HERMES_KEYSTORE_PASSWORD`, `HERMES_KEY_ALIAS`, `HERMES_KEY_PASSWORD` (without these the workflow still runs but produces debug-signed artifacts that Play Console will reject)
-- **Optional automated upload**: `gradlew publishReleaseBundle --track=internal` (requires `play-service-account.json` at repo root, gitignored)
+- **Android version source:** `gradle/libs.versions.toml` (`appVersionName`, `appVersionCode`); bump with `scripts/bump-android-version.sh`
+- **Relay plugin version source:** `pyproject.toml`; keep plugin/dashboard metadata synced with `scripts/check-plugin-version-sync.py`; bump with `scripts/bump-plugin-version.sh`
+- **Desktop CLI version source:** `desktop/package.json`; regenerate `desktop/src/version.ts` with `npm run gen:version`
+- **Track audit:** `python scripts/check-version-tracks.py` reports Android, plugin, and CLI versions without forcing them to match
+- **`appVersionCode` is monotonic** — always increment across Android prereleases
+- **Cut a release:** bump the target surface → commit → merge `dev` to `main` → tag with `android-v*`, `plugin-v*`, or `cli-v*` → push tag → CI builds + GitHub Release
+- **Required secrets:** `HERMES_KEYSTORE_BASE64`, `HERMES_KEYSTORE_PASSWORD`, `HERMES_KEY_ALIAS`, `HERMES_KEY_PASSWORD`
 
 ## Integration Points
 
-| Surface | Standard Endpoint | Non-Standard Fallback |
-|---------|-------------------|----------------------|
-| Chat streaming | `POST /v1/runs` → `GET /v1/runs/{id}/events` (structured tool events) | `POST /api/sessions/{id}/chat/stream` (inline tool text) |
-| Chat (OpenAI compat) | `POST /v1/chat/completions` (stream=true) | — |
-| Session CRUD | `X-Hermes-Session-Id` header on `/v1/chat/completions` | `GET/POST/PATCH/DELETE /api/sessions` (non-standard) |
-| Personalities | Read from `~/.hermes/config.yaml` | `GET /api/config` (non-standard) |
-| Server skills | — | `GET /api/skills` (non-standard) |
-| Health check | `GET /health` or `GET /v1/health` | — |
-| Models | `GET /v1/models` | — |
-| Plugin tools | `android_*` via `plugin/` | — |
+| Surface | Endpoint | Notes |
+|---------|----------|-------|
+| Chat (gateway) | Dashboard `POST /api/auth/ws-ticket` -> WS `/api/ws` | Vanilla Hermes dashboard/tui_gateway path; live thinking/reasoning; requires dashboard auth |
+| Chat streaming | `POST /v1/runs` → `GET /v1/runs/{id}/events` | Structured tool events; async run-control path |
+| Chat (sessions) | `POST /api/sessions/{id}/chat/stream` | Native upstream session-persisted SSE; preferred when capability probe finds it |
+| Chat (compat) | `POST /v1/chat/completions` (stream=true) | Inline tool annotations only |
+| Session CRUD | `GET/POST/PATCH/DELETE /api/sessions` | Native upstream (#33134); bootstrap fallback only for old builds |
+| Manage | Dashboard `/api/status`, `/api/auth/me`, `/api/config`, `/api/profiles/*`, `/api/env`, `/api/model/*`, `/api/mcp/*` | Vanilla Hermes dashboard surface; do not proxy through Relay |
+| Vanilla Hermes voice | Dashboard `POST /api/audio/transcribe`, `POST /api/audio/speak` | Vanilla Hermes no-plugin voice; uses dashboard session from Manage |
+| Pairing (QR) | `POST /pairing/register` (loopback only) | Via `/hermes-relay-pair` or `hermes-pair` shim; accepts optional `endpoints` for multi-endpoint QRs |
+| Pairing (multi-endpoint) | QR `endpoints` array (ADR 24) | `hermes: 3` schema; ordered `lan`/`tailscale`/`public`/... candidates; phone re-probes on network change |
+| Pairing auth | WSS `auth.ok` payload | Includes `expires_at`, `grants`, `transport_hint` |
+| Tailscale Serve (ADR 25) | `hermes-relay-tailscale enable\|disable\|status` CLI | Fronts loopback `:8767` with `tailscale serve --bg --https=<port>`; auto-retires on upstream PR #9295 |
+| Inbound media (token) | `GET /media/{token}` | Bearer auth; 24h TTL |
+| Inbound media (path) | `GET /media/by-path?path=<abs>` | Permissive by default; `RELAY_MEDIA_STRICT_SANDBOX=1` to restrict |
+| Session management | `GET /sessions`, `DELETE /sessions/{prefix}`, `PATCH /sessions/{prefix}` | List/revoke/extend; RelayHttpClient |
+| Voice transcribe | `POST /voice/transcribe` | multipart/form-data; bearer auth |
+| Voice synthesize | `POST /voice/synthesize` | JSON → audio/mpeg; max 5000 chars |
+| Voice config | `GET /voice/config` | Returns current tts/stt provider info |
+| Plugin diagnostics | `hermes relay doctor --json` | Reports upstream route reachability, Relay loopback state, plugin layout, and legacy bootstrap state |
+| Compat hook lifecycle | `hermes relay compat status/install/remove` | Optional legacy API compatibility hook; not required for the standard path |
+| Notifications | `GET /notifications/recent?limit=N` | Loopback callers skip bearer |
+| Relay health | `GET /health` on `:8767` | Used by `RelayHttpClient.probeHealth()` |
+| Capabilities | `GET /v1/capabilities` plus targeted `HEAD` probes | Prefer capabilities when present; HEAD probes keep mixed-version fallback working |
+| Desktop CLI (tui channel) | WSS `tui.attach` / `tui.rpc.request` / `tui.rpc.event` | Same channel + envelopes as the Ink TUI — the CLI just renders events as plain lines. Zero server changes. |
+| Desktop CLI (terminal channel) | WSS `terminal.attach` / `terminal.input` / `terminal.output` / `terminal.resize` / `terminal.detached` | Existing channel (shared with Android). CLI `shell` subcommand attaches, injects `clear; exec hermes\n` 350ms after ack, pipes raw bytes. `Ctrl+A .` detaches (tmux preserved), `Ctrl+A k` kills. |
+| Desktop CLI tool visibility | `tools.list` RPC on the shared tui channel | Returns `{toolsets: [{name, description, tool_count, enabled, tools:[]}]}`; surfaced by `hermes-relay tools` |
+| Desktop CLI devices | HTTP `GET/DELETE/PATCH /sessions` on the relay's same port | Wrapped by `hermes-relay devices list | revoke <prefix> | extend <prefix> --ttl <s>`; bearer token from stored session; token prefix only (never full token) |
+| Desktop tool routing (Phase B) | WSS `desktop.command` (s→c) + `desktop.response` (c→s) + `desktop.status` (c→s heartbeat) | New channel. Hermes calls `desktop_read_file(path)` → Python handler POSTs to `/desktop/desktop_read_file` → relay forwards over `desktop.command` → Node client's `DesktopToolRouter` runs the handler locally → response bubbles back. Mirror of Android's `bridge.command` pattern. |
+| Desktop tool check_fn | HTTP `GET /desktop/_ping?tool=<name>` | Returns 200 if a client is connected AND advertises this tool; 503 otherwise. Hermes uses this to fail the tool quickly when no desktop client is live, instead of waiting 30s for the dispatch timeout. |
+| Desktop health | HTTP `GET /desktop/health` | Returns full status snapshot — connected/host/platform/version/pid/uptime/advertised_tools/last_error/recent_commands. Loopback-only. Backs the `desktop_health` agent tool, which intentionally does NOT round-trip through the client so it remains callable when other tools are wedged. |
 
 ## Upstream References
 
-When working on features that interface with hermes-agent, consult these source files directly:
-
 | Topic | Upstream File |
 |-------|--------------|
 | API endpoints | `gateway/platforms/api_server.py` — all registered HTTP routes |

CLI_RELEASE_NOTES.md

@@ -0,0 +1,53 @@
+# Hermes-Relay-CLI v__VERSION__
+
+**Release Date:** 2026-06-21
+**Since the previous CLI release:** a first-class command surface — activity audit, relay inspection, a background daemon, a polished visual layer, and v1.2.0 server parity.
+
+This is a broad CLI uplift: new commands for seeing what the agent did and inspecting the relay, a daemon you can run in the background, and a consistent themed interface with per-command help. Everything is additive — existing commands, flags, and scripts keep working.
+
+**Experimental phase.** Assets are unsigned — Windows SmartScreen and macOS Gatekeeper will warn on first launch. Windows ships a tray installer as the primary desktop surface; CLI binaries remain available for terminal/headless use and for macOS/Linux.
+
+## What's changed
+
+### Added
+- **`hermes-relay audit`** — see what the remote agent has run on this machine through the desktop tools (tool, status, detail), read from a local log. No network, no auth; works whether the relay is local or remote.
+- **`hermes-relay relay`** — inspect the relay server: `relay context` audits the system-prompt context the relay injects into the agent (works from any paired machine), and `relay info` / `relay security` report server state for operators on the relay host.
+- **Background daemon.** `hermes-relay daemon start` runs the headless tool router in the background — no console window, survives closing the terminal — with `daemon stop` and `daemon status` to manage it. Bare `daemon` still runs in the foreground. Logs go to `~/.hermes/daemon.log`.
+- **Per-command help.** Every subcommand answers `--help`, and `devices` / `sessions` / `plugins` / `voice` / `relay` print their own usage (sub-commands, flags, examples) instead of a terse "unknown sub-verb".
+- **Startup banner.** A slim "Hermes Relay" wordmark shows atop `--help`, the first-run welcome, and the chat REPL; `hermes-relay logo` prints it on demand. Suppressed for piped / `--json` / `--no-color` output.
+
+### Changed
+- **Visual + ergonomics refresh.** One consistent color theme across the CLI, aligned tables for `devices` / `sessions`, on/off status dots, and progress spinners for slow operations (the multi-endpoint pairing probe and the gateway connect) so nothing looks hung. Errors now suggest the fix (e.g. re-pair on auth failure).
+- **Smoother pairing.** The multi-endpoint probe shows per-endpoint progress and latency; a near-expiry session warns before it fails and prints the exact re-pair command; and a bare `ws://host` (no port) defaults to `:8767`.
+- **Voice + consent transparency.** `voice` now surfaces enhanced-voice capabilities (Gemini tone tags / persona, xAI speech tags); the desktop-tool consent prompt is clear that it persists per relay and points at `hermes-relay audit`; and computer-use's observe → grant → act flow is documented in `--help`.
+
+## Install
+
+**Windows tray app (PowerShell):**
+```powershell
+irm https://raw.githubusercontent.com/Codename-11/hermes-relay/main/desktop/scripts/install.ps1 | iex
+```
+
+**Windows CLI only:**
+```powershell
+$env:HERMES_RELAY_INSTALL_SURFACE='cli'; irm https://raw.githubusercontent.com/Codename-11/hermes-relay/main/desktop/scripts/install.ps1 | iex
+```
+
+**macOS / Linux CLI:**
+```bash
+curl -fsSL https://raw.githubusercontent.com/Codename-11/hermes-relay/main/desktop/scripts/install.sh | sh
+```
+
+Pin this specific release with `HERMES_RELAY_VERSION=__TAG__`.
+
+## Verify
+
+```text
+hermes-relay --version
+hermes-relay pair --remote ws://<host>:8767
+hermes-relay shell
+```
+
+Open **Hermes Relay Desktop** from the Windows Start menu for tray pairing, devices, task log, settings, pause, and emergency stop.
+
+See [Desktop docs](https://codename-11.github.io/hermes-relay/desktop/) for full usage.

CODE_OF_CONDUCT.md

@@ -0,0 +1,78 @@
+# Code of Conduct
+
+Hermes-Relay adopts the [Contributor Covenant](https://www.contributor-covenant.org/version/2/1/code_of_conduct/),
+version 2.1, as its code of conduct. The canonical, full text lives at that
+link; the summary below states what it means for this project.
+
+## Our Pledge
+
+We as members, contributors, and maintainers pledge to make participation in our
+community a harassment-free experience for everyone, regardless of age, body
+size, visible or invisible disability, ethnicity, sex characteristics, gender
+identity and expression, level of experience, education, socio-economic status,
+nationality, personal appearance, race, religion, or sexual identity and
+orientation.
+
+We pledge to act and interact in ways that contribute to an open, welcoming,
+diverse, inclusive, and healthy community.
+
+## Our Standards
+
+Behavior that helps create a positive environment includes:
+
+- Showing empathy and kindness toward others.
+- Being respectful of differing opinions, viewpoints, and experiences.
+- Giving and gracefully accepting constructive feedback.
+- Taking responsibility, apologizing to those affected by our mistakes, and
+  learning from the experience.
+- Focusing on what is best for the overall community, not just ourselves.
+
+Behavior that is not acceptable includes:
+
+- Harassment, intimidation, or discrimination in any form.
+- Personal or political attacks, insults, or derogatory comments.
+- Unwelcome advances or attention, including of a romantic or sexual nature.
+- Publishing others' private information (such as a physical or email address)
+  without their explicit permission.
+- Other conduct that could reasonably be considered inappropriate in a
+  professional setting.
+
+For the complete, canonical list of standards and examples, see the
+[Contributor Covenant v2.1](https://www.contributor-covenant.org/version/2/1/code_of_conduct/).
+
+## Enforcement Responsibilities
+
+Project maintainers are responsible for clarifying and enforcing these standards
+and will take appropriate and fair corrective action in response to any behavior
+they deem inappropriate, threatening, offensive, or harmful.
+
+Maintainers have the right and responsibility to remove, edit, or reject
+comments, commits, code, issues, and other contributions that are not aligned
+with this Code of Conduct, and will communicate reasons for moderation decisions
+when appropriate.
+
+## Scope
+
+This Code of Conduct applies within all project spaces — the repository, issues,
+pull requests, discussions, and the documentation site — and also applies when
+an individual is officially representing the project in public spaces.
+
+## Reporting & Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported privately to the maintainers at **`conduct@codename-11.dev`**. All
+complaints will be reviewed and investigated promptly and fairly. Maintainers
+are obligated to respect the privacy and security of the reporter of any
+incident.
+
+For the **Enforcement Guidelines** (the tiered Correction → Warning →
+Temporary Ban → Permanent Ban ladder maintainers use to determine consequences),
+see the corresponding section of the
+[Contributor Covenant v2.1](https://www.contributor-covenant.org/version/2/1/code_of_conduct/#enforcement-guidelines).
+
+## Attribution
+
+This Code of Conduct is adapted from the
+[Contributor Covenant](https://www.contributor-covenant.org/), version 2.1.
+Community Impact Guidelines were inspired by
+[Mozilla's code of conduct enforcement ladder](https://github.com/mozilla/diversity).

CONTRIBUTING.md

@@ -0,0 +1,119 @@
+# Contributing to Hermes-Relay
+
+Thanks for your interest in contributing! Hermes-Relay is an indie, open-source project and every contribution — code, bug reports, docs tweaks, feature ideas — genuinely shapes where it goes next.
+
+This guide covers the developer setup. For the release recipe see [RELEASE.md](RELEASE.md); for architecture context see [docs/spec.md](docs/spec.md) and [docs/decisions.md](docs/decisions.md).
+
+## Quick Start (Android)
+
+1. **File > Open** the repo root in Android Studio
+2. Wait for Gradle sync
+3. **Run** (Shift+F10) to deploy to emulator or device
+
+That's it — no extra setup or credentials required for a debug build.
+
+## Dev Scripts
+
+Helper scripts for common development tasks:
+
+```bash
+scripts/dev.bat build      # Build debug APK
+scripts/dev.bat release    # Build signed release APK
+scripts/dev.bat bundle     # Build release AAB for Google Play
+scripts/dev.bat run        # Build + install + launch + logcat
+scripts/dev.bat test       # Run unit tests
+scripts/dev.bat version    # Show current version
+scripts/dev.bat relay      # Start relay server (dev, no TLS)
+```
+
+Linux/macOS equivalent lives at `scripts/dev.sh`.
+
+## Repository Structure
+
+```
+hermes-relay/
+├── app/                       # Android app (Kotlin + Jetpack Compose)
+├── plugin/                    # Hermes agent plugin + relay server (Python + aiohttp)
+│   ├── relay/                 # Canonical relay server (channels, auth, media, voice)
+│   ├── tools/                 # android_* tool implementations
+│   └── pair.py                # QR pairing CLI
+├── skills/                    # Hermes agent skills (pair, self-setup)
+├── user-docs/                 # VitePress documentation site
+├── docs/                      # Spec, architecture decisions, security notes
+├── scripts/                   # Dev helper scripts
+├── .github/workflows/         # CI + release pipelines
+└── gradle/                    # Wrapper + version catalog
+```
+
+The legacy `relay_server/` directory is a thin compatibility shim around `plugin.relay` that keeps the `python -m relay_server` entry point working.
+
+## Tech Stack
+
+| Component | Stack |
+|-----------|-------|
+| **Android App** | Kotlin 2.0, Jetpack Compose, Material 3, OkHttp |
+| **Relay Server** | Python 3.11+, aiohttp |
+| **Serialization** | kotlinx.serialization |
+| **Build** | AGP 9, Gradle 8.13, JVM toolchain 17 |
+| **CI/CD** | GitHub Actions (lint, build, test, signed APK artifacts) |
+| **Min SDK** | 26 (Android 8.0) / Target SDK 35 |
+
+## Running the Relay Locally
+
+Only needed if you're working on the bridge, voice, notifications, or media features. Chat alone doesn't need the relay.
+
+```bash
+# From the hermes-agent venv (if you installed via the one-liner):
+hermes relay start --no-ssl
+
+# Or from a repo checkout:
+python -m plugin.relay --no-ssl
+```
+
+See [docs/relay-server.md](docs/relay-server.md) for TLS, systemd, Docker, and full configuration.
+
+## Plugin Development
+
+End users should install via the one-liner in the README. For local development from a clone:
+
+```bash
+# One-shot copy:
+cp -r plugin ~/.hermes/plugins/hermes-relay
+
+# Or symlink for live edits:
+ln -s "$PWD/plugin" ~/.hermes/plugins/hermes-relay
+```
+
+After the plugin is in place, restart hermes and verify pairing with `hermes-pair` (shell shim) or `/hermes-relay-pair` in any Hermes chat surface. The 18 `android_*` tools register regardless of hermes-agent version.
+
+> **Note:** A top-level `hermes pair` CLI sub-command is not currently exposed — hermes-agent v0.8.0's top-level argparser doesn't yet forward to third-party plugins' `register_cli_command()` dict. Use the slash command or the dashed shim instead.
+
+## Commit Conventions
+
+We follow [Conventional Commits](https://www.conventionalcommits.org/): `feat:`, `fix:`, `docs:`, `refactor:`, `test:`, `chore:`.
+
+**Branching model (as of 2026-04-19): `main` + `dev`.** Feature branches — `feature/<name>`, `fix/<name>`, `docs/<name>`, `chore/<name>` — branch off `dev` and merge back into `dev` via `--no-ff` PRs. `main` is released state only; it receives release merges from `dev` and nothing else. There is no straight-to-main exemption — even single-file typos go through `dev`.
+
+Release-prep commits (version bump, changelog promotion) land on `dev` first, then a surface-specific release PR merges `dev` → `main` with `--no-ff`. Tags are cut from `main` after the merge: `android-vX.Y.Z`, `server-vX.Y.Z`, or `desktop-vX.Y.Z`. See [RELEASE.md](RELEASE.md) for the full release process.
+
+## Changelog & writing conventions
+
+This is a **public repo** — `CHANGELOG.md`, `DEVLOG.md`, the README, and everything under `docs/` ship publicly. Keep them clean:
+
+- **`CHANGELOG.md`** follows [Keep a Changelog](https://keepachangelog.com/) (Added / Changed / Fixed). Append your change to the `## [Unreleased]` block in the PR. Entries can carry detail while they accumulate, but at release-prep the version block is **condensed to crisp public bullets** (1–2 lines each) — the deep "how we debugged it" narrative belongs in commit messages and `DEVLOG.md`, not the public changelog.
+- **`DEVLOG.md`** is a factual engineering log — what changed, why, and how it was verified. Keep it depersonalized and third-person; it's a record, not a diary.
+- **No non-public wording anywhere committed:** no personal names (attribute impersonally — identity lives in git history), no real server hostnames/IPs or internal deployment names, no AI/assistant process self-narration, no fork/branch plumbing in user-facing notes. Generic example IPs in setup docs are fine.
+
+Release notes (`RELEASE_NOTES.md`, `app/src/main/assets/whats_new.txt`, `docs/play-store-listing.md`) are theme-framed and user-facing; see [RELEASE.md](RELEASE.md) §2 "Scrub for public distribution" for the full checklist.
+
+## Testing
+
+- **Android unit tests:** `scripts/dev.bat test` (runs JUnit + MockK + Compose testing)
+- **Python tests:** `python -m unittest plugin.tests.test_<name>` from the repo root with the hermes-agent venv active. `pytest` works too but the pre-existing `conftest.py` imports a module that isn't always installed — `unittest` avoids that entirely.
+
+CI is split into path-filtered workflows: `.github/workflows/ci-android.yml` (lint + build + test on app/Gradle changes), `.github/workflows/ci-server.yml` (syntax check + focused server tests on plugin/Python changes), and `.github/workflows/ci-desktop.yml` (desktop type/build/smoke checks). They run on pushes to `main` and `dev` and on PRs targeting either when their paths are touched.
+
+## Questions?
+
+- **Architecture context?** [docs/spec.md](docs/spec.md) covers protocols, UI layouts, and the channel model. [docs/decisions.md](docs/decisions.md) covers the forks in the road and why we picked what we did.
+- **Something unclear?** [Open an issue](https://github.com/Codename-11/hermes-relay/issues/new) — we read every one, and "this contributing guide is confusing" is a completely fair bug report.

GEMINI.md

@@ -0,0 +1,13 @@
+# GEMINI.md
+
+Agent instructions for **Hermes-Relay**. This file exists so Gemini CLI (which
+does not read `AGENTS.md` natively) picks up the project's guidance.
+
+**Read [AGENTS.md](AGENTS.md) — it is the single source of truth** for every
+coding agent: the entry point, the non-negotiables (standard-path-is-vanilla-
+upstream, verify-endpoints, Conventional Commits + `main`/`dev` branching, the
+per-language stack rules), and the public-repo writing hygiene. It links on to
+`CLAUDE.md` for the deep reference (architecture, upstream Hermes API, repo
+layout, code style, the dev loop, and the Key Files map).
+
+Do not restate rules here — keep them in `AGENTS.md` so they can't drift.

PLUGIN_RELEASE_NOTES.md

@@ -0,0 +1,29 @@
+# Hermes-Relay-Plugin v__VERSION__
+
+**Release Date:** June 22, 2026
+**Since the previous plugin release:** Reliability fixes for the Realtime Agent voice path — brokered Hermes turns no longer drop with `session_not_found`, and long-running Hermes work no longer times out a live voice session.
+
+This is a focused patch for the relay's Realtime Agent. When a spoken turn reached back into Hermes for context or tool work, a session-namespace mismatch could make the API Server reject the turn, and long background tasks could let the voice session lapse mid-run. Both paths are now resilient. Provider-native voice turns and vanilla upstream (no plugin) are unaffected.
+
+## What's changed
+
+### Fixed
+- **Brokered Hermes turns no longer fail with `session_not_found`.** When the Realtime Agent reached back to Hermes for context or tool work, it could hand the API Server a session id from a different session namespace (the gateway/client store), which the API Server rejected. The broker now mints a valid API Server session and retries the turn once when that happens, reuses an existing API Server session when the id is already valid, and reads the API Server's current nested `{"session": {"id": …}}` create-session response (previously only the legacy flat shape) so session creation no longer errors with "created a session without an id."
+- **Realtime voice survives long Hermes runs.** A heartbeat now keeps the realtime voice session alive while a long-running Hermes task is in flight, so the turn no longer times out before the work finishes.
+
+## Install
+
+```bash
+pip install hermes-relay==__VERSION__
+```
+
+## Verify
+
+```bash
+python -m relay_server --help
+```
+
+---
+
+Tag prefixes: Android releases use `android-v*`, CLI releases use `cli-v*`. Historical
+relay/plugin releases used `relay-v*` tags.

README.md

@@ -1,19 +1,23 @@
 <p align="center">
-  <img src="assets/logo.svg" alt="Hermes-Relay" width="120">
+  <img src="assets/play-store-feature-1024x500.png" alt="Hermes-Relay — your Hermes agent, in your pocket" width="800">
 </p>
 
-<h1 align="center">Hermes-Relay</h1>
+<p align="center">
+  <strong>Runs on your machine. Lives on your devices.</strong><br>
+  A native Android companion for your <a href="https://github.com/NousResearch/hermes-agent">Hermes agent</a> — streaming chat, hands-free voice,
+  and full agent management. Plus a single-binary CLI that gives the agent hands on any machine you pair.
+</p>
 
 <p align="center">
-  Native Android client for the Hermes agent platform.<br>
-  Chat, control, and connect — one app for your AI agent.
+  <a href="https://play.google.com/store/apps/details?id=com.axiomlabs.hermesrelay"><img src="https://play.google.com/intl/en_us/badges/static/images/badges/en_badge_web_generic.png" alt="Get it on Google Play" height="56"></a>
 </p>
 
 <p align="center">
   <a href="https://opensource.org/licenses/MIT"><img src="https://img.shields.io/badge/License-MIT-blue.svg" alt="MIT"></a>
-  <a href="https://developer.android.com"><img src="https://img.shields.io/badge/Platform-Android-green.svg" alt="Android"></a>
-  <a href="https://github.com/Codename-11/hermes-relay/actions/workflows/ci.yml"><img src="https://github.com/Codename-11/hermes-relay/actions/workflows/ci.yml/badge.svg" alt="CI"></a>
-  <a href="https://developer.android.com/about/versions/oreo"><img src="https://img.shields.io/badge/Min%20SDK-26-brightgreen.svg" alt="Min SDK 26"></a>
+  <a href="https://developer.android.com/about/versions/oreo"><img src="https://img.shields.io/badge/Android-8.0%2B-3DDC84.svg?logo=android&logoColor=white" alt="Android 8.0+"></a>
+  <a href="https://github.com/Codename-11/hermes-relay/actions/workflows/ci-android.yml"><img src="https://github.com/Codename-11/hermes-relay/actions/workflows/ci-android.yml/badge.svg" alt="Android CI"></a>
+  <a href="https://github.com/Codename-11/hermes-relay/releases"><img src="https://img.shields.io/github/v/release/Codename-11/hermes-relay?filter=android-v*&label=release&color=8B5CF6" alt="Latest release"></a>
+  <a href="https://github.com/Codename-11/hermes-relay/tree/main/desktop"><img src="https://img.shields.io/badge/CLI-alpha-orange.svg" alt="CLI (alpha)"></a>
 </p>
 
 <p align="center">
@@ -23,173 +27,312 @@
   <a href="https://hermes-agent.nousresearch.com">Hermes Agent</a>
 </p>
 
-<p align="center">
-  <video src="https://github.com/Codename-11/hermes-relay/raw/main/assets/chat_demo.mp4" poster="https://github.com/Codename-11/hermes-relay/raw/main/assets/chat_demo_poster.jpg" autoplay loop muted playsinline width="280"></video>
-</p>
-
 ---
 
-## Quick Start
+## What it is
 
-Two steps: install the Android app on your phone, then install the plugin on your Hermes server.
+Hermes-Relay puts your [Hermes agent](https://github.com/NousResearch/hermes-agent) on the devices you actually carry. The brain stays on your own machine — Hermes-Relay is how you reach it.
 
-### 1. Install the Android app
+- **📱 Android app** — streaming chat, hands-free voice, and the full Hermes dashboard (models, keys, skills, profiles), rebuilt native. On sideload builds, the agent can read your screen and act on it.
+- **⌨️ Hermes-Relay CLI** *(alpha)* — a single binary that gives the agent **hands on any machine you pair**: files, terminal, search, screenshots — consent-gated.
 
-<!-- TODO: Uncomment when Play Store listing is live
-<a href="https://play.google.com/store/apps/details?id=com.hermesandroid.relay"><img src="https://play.google.com/intl/en_us/badges/static/images/badges/en_badge_web_generic.png" alt="Get it on Google Play" height="80"></a>
--->
+A vanilla [hermes-agent](https://github.com/NousResearch/hermes-agent) install is enough — chat, management, and voice need **no plugin**. Add the optional relay only when you want terminal, phone control, or the CLI's tools. **Pair once from either surface; both work.**
 
-- **Google Play** — coming soon
-- **APK** — download from [GitHub Releases](https://github.com/Codename-11/hermes-relay/releases)
+<p align="center">
+  <img src="docs/diagrams/architecture-homepage.png" alt="How Hermes-Relay connects — Vanilla Hermes (Chat, Manage, Voice) runs with no plugin; the optional Relay plugin adds Terminal, Bridge, relay voice and desktop tools to the app and CLI; Device Control needs the sideload build." width="900">
+</p>
 
-### 2. Install the server plugin (one-liner)
+## Quick Start (Android)
 
-On the machine running your Hermes agent:
+Install → connect → talk, in about two minutes.
+
+### 1 · Install the app
+
+- **Google Play** *(easiest — auto-updates)* — [**install from Google Play**](https://play.google.com/store/apps/details?id=com.axiomlabs.hermesrelay). Chat, voice, Manage, terminal/TUI, media, notifications, and relay sessions.
+- **APK** *(full phone-control feature set)* — download the file ending in **`-sideload-release.apk`** from the newest `android-v*` release on [GitHub Releases](https://github.com/Codename-11/hermes-relay/releases) and open it (allow your browser to install unknown apps the first time). Integrity verification, signing fingerprint, and per-build details are in the [Sideload guide](https://codename-11.github.io/hermes-relay/guide/getting-started.html#sideload-apk).
+
+Sideload builds check GitHub for updates and show a one-tap banner when you're behind; Play builds update through the Store. See [Release tracks](https://codename-11.github.io/hermes-relay/guide/release-tracks) for the capability matrix.
+
+### 2 · Have Hermes running
+
+The app needs your Hermes **API server enabled and reachable from your phone**, plus an **API key** — the token the app sends to authenticate Chat (pick any value you like). Installing Hermes and choosing a provider is vanilla Hermes setup; the [full walkthrough](https://codename-11.github.io/hermes-relay/guide/getting-started) covers Windows, the dashboard for **Manage**, LAN scan, and QR setup.
+
+```bash
+hermes setup --portal                      # install / log in / pick a provider — skip if already done
+
+mkdir -p ~/.hermes
+API_SERVER_KEY="$(openssl rand -hex 32)"   # strong random key — or substitute your own memorable value
+cat >> ~/.hermes/.env <<EOF
+API_SERVER_ENABLED=true
+API_SERVER_HOST=0.0.0.0
+API_SERVER_PORT=8642
+API_SERVER_KEY=$API_SERVER_KEY
+EOF
+chmod 600 ~/.hermes/.env
+
+echo "Android API URL: http://<this-computer-ip>:8642   key: $API_SERVER_KEY"
+hermes gateway
+```
+
+`API_SERVER_ENABLED` turns the API server on; `API_SERVER_HOST=0.0.0.0` makes it reachable on your LAN (the default is localhost-only); `API_SERVER_KEY` is the bearer token the app sends — **your choice of value**.
+
+> **Heads up on `0.0.0.0`:** that exposes the API to every device on your network — fine on a trusted home LAN, but off it keep the key set and front it with Tailscale or an HTTPS reverse proxy ([Remote access](https://codename-11.github.io/hermes-relay/guide/remote-access)) rather than exposing it directly. You don't have to type the key on your phone — **Scan for Hermes on LAN**, or have your agent make a setup QR (below). For **Manage** (skills, models, keys), also run the Hermes dashboard — see [Getting Started](https://codename-11.github.io/hermes-relay/guide/getting-started).
+
+### 3 · Connect and talk
+
+Open the app and pick how to connect — any of:
+
+- **Vanilla Hermes** → tap **Scan for Hermes on LAN** to auto-find the server, then enter your key.
+- **Vanilla Hermes** → type the address (`http://<host>:8642`) and key by hand.
+- **Scan setup QR** → ask your Hermes agent to generate a QR with your URL + key (e.g. `{"api_url":"http://<host>:8642","api_key":"<key>","dashboard_url":"http://<host>:9119"}`) and scan it. `dashboard_url` is optional when the dashboard uses the conventional same-host `:9119` URL.
+
+The wizard probes everything and finishes with a capability card:
+
+| Line | What it means |
+|------|---------------|
+| **Chat** | API server reachable — you can talk |
+| **Manage** | Dashboard found — models, keys, skills, profiles from the phone |
+| **Voice** | Speech ready via your server (or one Manage sign-in away) |
+| **Remote** | Fallback route configured — keeps working away from home |
+| **Relay** | Optional power tools — fine to leave unpaired |
+
+If your dashboard requires sign-in, do it once under the **Manage** tab — the same session unlocks voice. That's the whole Vanilla Hermes setup.
+
+> **Going places?** Put your server's Tailscale URL in the setup form's *Remote access* field (or add a route any time under **Settings → Connections → Routes**). The app uses LAN at home and switches routes automatically when you leave. See [Remote access](https://codename-11.github.io/hermes-relay/guide/remote-access).
+
+### 4 · Optional: install Relay for power tools
+
+Install the Relay plugin on the server only when you want Terminal, Bridge phone control, relay sessions, media routes, or the realtime voice engine:
+
+```bash
+hermes plugins install Codename-11/hermes-relay/plugin --enable
+hermes relay doctor
+hermes relay start --no-ssl
+hermes pair
+```
+
+Use the legacy installer instead if you also want the systemd user service,
+shell shims, and the full clone/update workflow:
 
 ```bash
 curl -fsSL https://raw.githubusercontent.com/Codename-11/hermes-relay/main/install.sh | bash
 ```
 
-This installs the `hermes-android` plugin — 14 `android_*` device control tools plus the `hermes pair` CLI command. After restarting hermes, generate a pairing QR code:
+The plugin-manager install owns the plugin code, dashboard tab, CLI commands,
+and agent tools. `hermes relay compat status/install/remove` manages only the
+optional legacy API compatibility hook when an older Hermes build needs it. Scan
+the QR from the phone's Connections screen — or use
+`hermes pair --register-code ABCD12` with the manual code from Android
+**Settings → Connections → Advanced**.
 
-```bash
-hermes pair
-```
+- **Plugin-manager uninstall:** `hermes relay compat remove --all` if you installed the optional hook, then `hermes plugins remove hermes-relay`.
+- **Legacy installer update:** `hermes-relay-update` (idempotent) — or re-run the install one-liner.
+- **Legacy installer uninstall:** `bash ~/.hermes/hermes-relay/uninstall.sh` — removes the service, shims, clone, external skill path, editable package, and compat hook. It never touches shared Hermes state. Flags: `--dry-run`, `--keep-clone`, `--remove-secret`.
+- **Dashboard plugin:** installs with the same symlink — restart the gateway and a **Relay** tab (paired devices, bridge activity, media tokens) appears in the web UI.
 
-Scan it from the Android app's onboarding screen and you're connected. The command also prints the server URL and API key as plain text, so you can pair manually if your terminal can't render QR blocks.
+Full server setup, TLS, and systemd details: [docs/relay-server.md](docs/relay-server.md).
 
-**Requirements:** Android 8.0+ (SDK 26), [hermes-agent](https://github.com/NousResearch/hermes-agent) v0.8.0+ (for the `hermes pair` CLI), Python 3.11+.
+**Requirements:** Android 8.0+ (SDK 26) · current upstream [hermes-agent](https://github.com/NousResearch/hermes-agent) with the API server and dashboard enabled · Python 3.11+ on the server.
 
-## What It Does
+## Screenshots
 
-Talk to your Hermes agent from anywhere. Direct API streaming, session history, tool visualization — all native on Android.
+<table>
+  <tr>
+    <td align="center" width="25%"><img src="assets/screenshots/01_startup.png" alt="Cold start" width="100%"><br><sub><b>Cold start</b></sub></td>
+    <td align="center" width="25%"><img src="assets/screenshots/02_chat.png" alt="Streaming chat" width="100%"><br><sub><b>Streaming chat</b></sub></td>
+    <td align="center" width="25%"><img src="assets/screenshots/03_voice.png" alt="Hands-free voice" width="100%"><br><sub><b>Hands-free voice</b></sub></td>
+    <td align="center" width="25%"><img src="assets/screenshots/04_sessions.png" alt="Session history" width="100%"><br><sub><b>Session history</b></sub></td>
+  </tr>
+  <tr>
+    <td align="center" width="25%"><img src="assets/screenshots/05_themes.png" alt="App themes" width="100%"><br><sub><b>App themes</b></sub></td>
+    <td align="center" width="25%"><img src="assets/screenshots/06_manage.png" alt="Manage your agent" width="100%"><br><sub><b>Manage your agent</b></sub></td>
+    <td align="center" width="25%"><img src="assets/screenshots/07_connections.png" alt="Connections and routes" width="100%"><br><sub><b>Connections &amp; routes</b></sub></td>
+    <td align="center" width="25%"><img src="assets/screenshots/08_appearance.png" alt="Agent avatar &amp; skins" width="100%"><br><sub><b>Avatars &amp; skins</b></sub></td>
+  </tr>
+</table>
 
-| Channel | What | Status |
-|---------|------|--------|
-| **Chat** | Stream conversations to Hermes via HTTP/SSE | Available |
-| **Terminal** | Secure remote shell via tmux | Phase 2 |
-| **Bridge** | Agent controls the phone — taps, types, screenshots | Phase 3 |
+<p align="center"><sub>▶ <a href="https://codename-11.github.io/hermes-relay/guide/getting-started.html#see-it-working">Watch the demo</a> on the docs site</sub></p>
 
 ## Features
 
-- **Streaming chat** — Direct SSE to the Hermes API Server with real-time markdown rendering
-- **Smooth auto-scroll** — Live-follow streaming responses with a "scrolled up to read" pause/resume gesture
-- **Session management** — Create, switch, rename, delete chat sessions
-- **Tool visualization** — See agent tool calls as they execute (compact or detailed cards)
-- **Personalities** — Switch between agent personalities with a picker
-- **Slash commands** — 29+ gateway commands, searchable command palette
-- **File attachments** — Send images, documents, any file type
-- **Message queuing** — Send messages while the agent is still streaming
-- **Analytics** — Stats for Nerds with TTFT, token usage, stream health
-- **Security** — Encrypted local storage (AES-256-GCM), HTTPS enforced
-- **QR pairing** — Scan a QR code to auto-configure your server connection
+### Android
 
-## Getting Started
+- **Streaming chat** — rides vanilla Hermes, preferring the dashboard gateway (`/api/ws`, live thinking) when signed in to Manage and falling back to API-server SSE otherwise, with live markdown, tool-call cards, session history, a searchable command palette, file attachments, quote-in-reply, conversation share, and send-while-streaming queuing.
+- **Manage your agent** — the full Hermes dashboard, native: switch models from your provider catalog, manage keys (write-only, masked, rate-limited reveal), create and edit profiles including `SOUL.md`, and browse/install/update skills. One dashboard sign-in covers it all.
+- **Hands-free voice** — talk on a vanilla install: speech rides your server's configured providers, unlocked by the same Manage sign-in. Relay-paired setups add per-profile voice and an opt-in provider-native Realtime Agent with background task handoff.
+- **Works away from home** — add a Tailscale or public URL and the app roams automatically (LAN at home, fallback elsewhere). An unreachable server gets a diagnosis, not just a red dot.
+- **Multi-Connection + profiles** — pair multiple Hermes servers (home + work, dev + prod) and switch in one tap; overlay a profile's model + `SOUL.md` per chat.
+- **Phone control (bridge)** — with Relay paired, the agent reads the screen and acts: tap, type, swipe, scroll, screenshots, clipboard, media keys, batched macros. Guarded by per-app blocklist (banking/2FA blocked by default), destructive-verb confirmation, idle auto-disable, and a full activity log.
+- **Notification companion** — opt-in access so the agent can triage, summarize, and route incoming notifications.
+- **Security & pairing** — QR pairing, Android Keystore session storage (StrongBox-preferred), TOFU cert pinning, per-channel time-bound grants, user-chosen session TTL.
+- **Stats for Nerds** — local-only analytics: TTFT, token usage, stream health, peak-time charts.
 
-1. **Install the app** from the link above
-2. **Enter your Hermes server URL** (e.g. `http://192.168.1.100:8642`) during onboarding
-3. **Start chatting** — the app connects directly to the Hermes API Server
+> Sideload builds add direct SMS, contact search, one-tap dialing, and location awareness — handy for fully hands-free intents like *"text Sam I'll be 10 minutes late."* See [Release tracks](https://codename-11.github.io/hermes-relay/guide/release-tracks).
 
-For detailed setup, server configuration, and feature guides, see the **[full documentation](https://codename-11.github.io/hermes-relay/)**.
+## Hands on any machine — the Hermes-Relay CLI&nbsp;<sub>(alpha)</sub>
+
+> **Alpha · Windows today** (macOS / Linux coming soon). A single self-contained binary — no Node required. Binaries are unsigned during the experimental phase, so SmartScreen / Gatekeeper warnings are expected.
+
+The agent's brain stays on the host; the CLI lets it call tools **on your machine** over the same WSS relay — `read_file`, `write_file`, `terminal`, `search_files`, `screenshot`, `clipboard`, `open_in_editor`, and more — behind a one-time consent gate, interactive diff approval for patches, and a `--no-tools` kill-switch.
+
+```powershell
+irm https://raw.githubusercontent.com/Codename-11/hermes-relay/main/desktop/scripts/install.ps1 | iex
+```
+
+```bash
+hermes-relay pair --remote ws://<host>:8767   # once
+hermes-relay daemon                            # headless tool router — agent reaches you anytime
+hermes-relay update                            # self-update via GitHub Releases
+```
+
+It pairs against the **same relay and credential store** as the Android app — pair once from either, both work. Tagged on a separate `cli-v*` [release track](https://github.com/Codename-11/hermes-relay/releases?q=cli), with old alpha prereleases still visible under `desktop-v*`.
+
+- **Docs:** [CLI guide](https://codename-11.github.io/hermes-relay/desktop/) · [`desktop/README.md`](desktop/README.md)
+- **AI-agent setup recipe:** `/hermes-relay-desktop-setup`
 
 ## How It Works
 
 ```
-Phone (HTTP/SSE) --> Hermes API Server (:8642)   [chat — direct]
-Phone (WSS)      --> Relay Server (:8767)         [terminal, bridge — future]
+Phone        (HTTP/WSS) --> Hermes Dashboard  (:9119)   [chat gateway, manage, vanilla voice]
+Phone        (HTTP/SSE) --> Hermes API Server (:8642)   [chat fallback, sessions, runs]
+Phone        (WSS/HTTP) --> Relay             (:8767)   [terminal, bridge, media, relay voice, sessions]
+CLI          (WSS)      --> Relay             (:8767)   [machine tools, tui, terminal]
 ```
 
-Chat connects directly to the Hermes API Server — same pattern used by Open WebUI and other Hermes frontends. The relay server is a separate lightweight Python service for terminal and bridge channels (coming in Phase 2/3).
+Chat prefers the Hermes dashboard gateway when Manage auth is ready, then falls
+back to the upstream API server SSE path with the API key. Manage and Vanilla Hermes
+voice ride the Hermes dashboard with its own one-time sign-in, so a vanilla
+install needs no plugin for either. The optional relay on `:8767` adds the power
+surfaces: terminal, bridge phone control, media handoff, machine tools, and
+relay-side voice, which is preferred automatically when paired. One QR can
+configure API, dashboard, and relay routes without merging their auth models.
 
 ## Documentation
 
 | | |
 |---|---|
-| **[User Guide](https://codename-11.github.io/hermes-relay/)** | **Getting started, features, configuration — start here** |
-| [Architecture](https://codename-11.github.io/hermes-relay/architecture/) | How the app works under the hood |
-| [API Reference](https://codename-11.github.io/hermes-relay/reference/api.html) | Hermes API endpoints used by the app |
+| **[User Guide](https://codename-11.github.io/hermes-relay/)** | **Quick start, features, configuration — start here** |
+| [Android](https://codename-11.github.io/hermes-relay/guide/) | Android install + setup + features |
+| [Hermes-Relay CLI](https://codename-11.github.io/hermes-relay/desktop/) | Pairing, subcommands, local tool routing |
+| [Architecture](https://codename-11.github.io/hermes-relay/architecture/) | How the system works under the hood |
+| [API Reference](https://codename-11.github.io/hermes-relay/reference/api.html) | Hermes API endpoints used by both surfaces |
 | [Specification](docs/spec.md) | Full spec — protocol, UI, phases, dependencies |
 | [Architecture Decisions](docs/decisions.md) | ADRs — framework, channels, auth, terminal |
-| [Changelog](CHANGELOG.md) | Release history |
+| [Changelog](CHANGELOG.md) | Release history (`android-v*`, `plugin-v*`, `cli-v*`) |
 
----
+<details>
+<summary><b>Install with an AI agent</b> — paste-ready prompt for Claude / GPT</summary>
+
+<br>
+
+If an AI assistant manages your server, paste this block into its chat and it will fetch the canonical setup recipe and walk you through install, pairing, and troubleshooting:
+
+```text
+You are helping me install and maintain Hermes-Relay (https://github.com/Codename-11/hermes-relay) — a native Android client + a CLI + a Python plugin for the Hermes AI agent platform.
+
+Read the canonical setup recipe before acting:
+  https://raw.githubusercontent.com/Codename-11/hermes-relay/main/skills/devops/hermes-relay-self-setup/SKILL.md
+
+Then guide me through:
+- Verifying hermes-agent is already installed (it's a prerequisite — Hermes-Relay is a plugin, not standalone)
+- Running the server-plugin install one-liner: `curl -fsSL https://raw.githubusercontent.com/Codename-11/hermes-relay/main/install.sh | bash`
+- Connecting my phone by Vanilla Hermes API URL/key first, then optionally pairing Relay via `hermes pair` or `/hermes-relay-pair` for power tools; OR pairing my laptop via the Hermes-Relay CLI (`irm https://raw.githubusercontent.com/Codename-11/hermes-relay/main/desktop/scripts/install.ps1 | iex` on Windows, then `hermes-relay pair --remote ws://<host>:8767`)
+- Verifying with `hermes-status` (server) or `hermes-relay doctor` (CLI)
+
+Always confirm before running shell commands. Never restart hermes-gateway without asking. If any step fails, consult the Troubleshooting section in the SKILL.md and ask me for the exact error.
+```
+
+Already installed? The same recipe is auto-loaded as a Hermes skill — invoke `/hermes-relay-self-setup` from any chat for re-setup or "is everything wired correctly?" checks.
+
+</details>
 
 ## Development
 
-### Quick Start
-
-1. **File > Open** the repo root in Android Studio
-2. Wait for Gradle sync
-3. **Run** (Shift+F10) to deploy to emulator or device
-
-### Dev Scripts
-
 ```bash
+# Android: open the repo root in Android Studio, wait for Gradle sync, Run (Shift+F10).
 scripts/dev.bat build      # Build debug APK
 scripts/dev.bat release    # Build signed release APK
 scripts/dev.bat bundle     # Build release AAB for Google Play
 scripts/dev.bat run        # Build + install + launch + logcat
 scripts/dev.bat test       # Run unit tests
 scripts/dev.bat version    # Show current version
-scripts/dev.bat relay      # Start relay server (dev, no TLS)
-```
-
-### Repository Structure
-
-```
-hermes-relay/
-├── app/                       # Android app (Kotlin + Jetpack Compose)
-├── relay_server/              # WSS relay server (Python + aiohttp)
-├── plugin/                    # Hermes agent plugin (14 android_* tools)
-├── skills/                    # Hermes agent skills (QR pairing)
-├── user-docs/                 # VitePress documentation site
-├── docs/                      # Spec, decisions, security
-├── scripts/                   # Dev helper scripts
-├── .github/workflows/         # CI + release pipelines
-└── gradle/                    # Wrapper (8.13) + version catalog
+scripts/dev.bat relay      # Start the relay server (dev, no TLS)
 ```
 
 ### Tech Stack
 
 | Component | Stack |
 |-----------|-------|
-| **Android App** | Kotlin 2.0, Jetpack Compose, Material 3, OkHttp |
-| **Relay Server** | Python 3.11+, aiohttp |
-| **Serialization** | kotlinx.serialization |
-| **Build** | AGP 9, Gradle 8.13, JVM toolchain 17 |
-| **CI/CD** | GitHub Actions (lint, build, test, APK artifact) |
-| **Min SDK** | 26 (Android 8.0) / Target SDK 35 |
+| **Android app** | Kotlin 2.0, Jetpack Compose, Material 3, OkHttp |
+| **Hermes-Relay CLI** | TypeScript, Bun-compiled native binary, Node ≥21 (source/dev), zero runtime deps |
+| **Server / plugin** | Python 3.11+, aiohttp |
+| **Serialization** | kotlinx.serialization (Android) |
+| **Build** | AGP 9, Gradle 8.13, JVM toolchain 17 (Android); `tsc` + `bun build --compile` (CLI) |
+| **CI/CD** | GitHub Actions — lint, build, test, APK artifact, CLI binaries per platform |
+| **Min SDK** | 26 (Android 8.0) · Target SDK 35 |
 
-### Relay Server (optional — terminal/bridge only)
+<details>
+<summary><b>Repository structure</b></summary>
 
-```bash
-pip install aiohttp pyyaml && python -m relay_server --no-ssl
+```
+hermes-relay/
+├── app/                       # Android app (Kotlin + Jetpack Compose)
+├── desktop/                   # Hermes-Relay CLI thin-client (TS + Bun-compiled binary)
+├── relay_server/              # WSS server (Python + aiohttp; thin shim → plugin/relay)
+├── plugin/                    # Hermes agent plugin
+│   ├── relay/                 #   - canonical relay (server.py, channels/, media, voice, machine tools)
+│   ├── tools/                 #   - android_* bridge + desktop_* tool handlers
+│   └── pair.py                #   - QR pairing CLI + multi-endpoint payload builder
+├── skills/devops/             # Hermes agent skills (pairing, self-setup, CLI setup recipes)
+├── user-docs/                 # VitePress documentation site
+├── docs/                      # Spec, decisions, security
+├── scripts/                   # Dev helper scripts
+├── .github/workflows/         # CI + release pipelines (ci-android / ci-plugin / ci-desktop)
+└── gradle/                    # Wrapper (8.13) + version catalog
 ```
 
-Or with Docker:
+</details>
+
+<details>
+<summary><b>Running the server / plugin from a clone</b></summary>
+
+<br>
+
+End users should install via the [one-liner](#4--optional-install-relay-for-power-tools) above. For local development:
 
 ```bash
+hermes relay start --no-ssl          # if you installed the plugin
+python -m plugin.relay --no-ssl      # or from a repo checkout
+
+# Docker:
 docker build -t hermes-relay relay_server/ && docker run -d --network host --name hermes-relay hermes-relay
+
+# Live-edit the plugin against a local Hermes:
+ln -s "$PWD/plugin" ~/.hermes/plugins/hermes-relay
 ```
 
-See [docs/relay-server.md](docs/relay-server.md) for TLS, systemd, and full setup.
+Then restart hermes and run `hermes pair` to verify. The 18 `android_*` and 9 `desktop_*` tools register regardless of hermes-agent version. See [docs/relay-server.md](docs/relay-server.md) for TLS, systemd, and full setup.
 
-### Hermes Plugin (for contributors)
+</details>
 
-End users should install via the [one-liner](#2-install-the-server-plugin-one-liner) at the top. For local development from a clone:
-
-```bash
-cp -r plugin ~/.hermes/plugins/hermes-android
-# Or symlink for live edits:
-ln -s "$PWD/plugin" ~/.hermes/plugins/hermes-android
-```
-
-Then restart hermes and run `hermes pair` to test the CLI command. The 14 `android_*` tools register regardless of hermes-agent version; the `hermes pair` CLI requires v0.8.0+.
-
-## Hermes Agent
+## Built for Hermes Agent
 
 Hermes-Relay is built for [Hermes Agent](https://github.com/NousResearch/hermes-agent) — an open-source AI agent platform by [Nous Research](https://nousresearch.com). See the [Hermes Agent docs](https://hermes-agent.nousresearch.com) for server setup, gateway configuration, and plugin development.
 
+## Found a bug? Let us know
+
+This is an indie project and every report helps shape where it goes next. If something feels off, broken, or just weird — [open an issue](https://github.com/Codename-11/hermes-relay/issues/new). We read every one, and even a one-line *"this didn't work on my Pixel 7"* is genuinely useful.
+
+## Star History
+
+<a href="https://www.star-history.com/?repos=Codename-11%2Fhermes-relay&type=date&legend=top-left">
+ <picture>
+   <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/chart?repos=Codename-11/hermes-relay&type=date&theme=dark&legend=top-left" />
+   <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/chart?repos=Codename-11/hermes-relay&type=date&legend=top-left" />
+   <img alt="Star History Chart" src="https://api.star-history.com/chart?repos=Codename-11/hermes-relay&type=date&legend=top-left" />
+ </picture>
+</a>
+
 ## License
 
 [MIT](LICENSE) — Copyright (c) 2026 [Axiom-Labs](https://codename-11.dev)

RELEASE.md

@@ -3,7 +3,7 @@
 > The full recipe for cutting a new release. Read this end-to-end before
 > tagging your first release.
 
-## Versioning
+## Release Tracks And Versioning
 
 Hermes-Relay follows [SemVer](https://semver.org/): `MAJOR.MINOR.PATCH`,
 with optional prerelease identifiers.
@@ -13,6 +13,26 @@ with optional prerelease identifiers.
 - `PATCH` — bug fixes, backwards compatible
 - Prerelease suffixes: `-alpha`, `-beta`, `-rc.N` (e.g. `0.2.0-beta.1`)
 
+Hermes-Relay now ships three independently versioned surfaces. Public GitHub
+Release titles use product names (`Hermes-Relay-Android`,
+`Hermes-Relay-Plugin`, `Hermes-Relay-CLI`); tag prefixes stay short and stable
+for automation.
+
+| Surface | Tag prefix | Version source | Bump script | Release workflow |
+|---|---|---|---|---|
+| Hermes-Relay-Android | `android-v*` | `gradle/libs.versions.toml` | `scripts/bump-android-version.sh` | `.github/workflows/release-android.yml` |
+| Hermes-Relay-Plugin | `plugin-v*` | `pyproject.toml` plus checked plugin/dashboard metadata | `scripts/bump-plugin-version.sh` | `.github/workflows/release-plugin.yml` |
+| Hermes-Relay-CLI | `cli-v*` | `desktop/package.json` | `npm version` or manual package bump | `.github/workflows/release-cli.yml` |
+
+This split is intentional. The plugin carries relay features for both Android
+and CLI clients, so plugin fixes can ship without forcing an Android app
+`versionCode` bump, and CLI alphas can continue on their own cadence. Historical
+Android releases before this naming split used bare `v*` tags. Historical
+plugin/server releases used `relay-v*` tags, and historical CLI prereleases used
+`desktop-v*` tags. New releases use the explicit tag prefixes above.
+
+### Android app versioning
+
 **Source of truth:** `gradle/libs.versions.toml`
 
 ```toml
@@ -44,6 +64,137 @@ Never decrement `appVersionCode` — Play Console rejects any upload whose
 code is lower than or equal to a previous upload on the same track. Confirm
 current values with `scripts\dev.bat version`.
 
+Always bump Android releases via:
+
+```bash
+bash scripts/bump-android-version.sh 0.6.2
+```
+
+`scripts/bump-version.sh` remains as a backward-compatible alias for the
+Android script.
+
+### Plugin / Python package versioning
+
+Plugin version metadata lives in these plugin-owned files and must stay in
+lockstep:
+
+| File | Line | Purpose |
+|---|---|---|
+| `pyproject.toml` | `version = "..."` | Python package metadata |
+| `plugin/relay/__init__.py` | `__version__ = "..."` | runtime version reported by `/health` and `/relay/info` |
+| `plugin/plugin.yaml` | `version: ...` | Hermes plugin metadata |
+| `plugin/dashboard/manifest.json` | `"version": "..."` | Hermes dashboard plugin metadata |
+| `plugin/dashboard/package.json` | `"version": "..."` | dashboard build/package metadata |
+| `plugin/dashboard/package-lock.json` | `"version": "..."` | locked dashboard package metadata |
+
+Always bump Plugin releases via:
+
+```bash
+bash scripts/bump-plugin-version.sh 0.6.2
+```
+
+Check the current metadata with:
+
+```bash
+python scripts/check-plugin-version-sync.py
+```
+
+Check all release tracks at once with:
+
+```bash
+python scripts/check-version-tracks.py
+```
+
+This aggregate check reports Android, plugin, and CLI versions
+side by side and validates that each track's own source files are internally
+consistent. It deliberately does not require all three tracks to share the same
+SemVer.
+
+The `plugin-v*` release workflow validates the tag against the same metadata,
+runs plugin tests, builds a wheel and sdist, generates checksums, and
+publishes a `Hermes-Relay-Plugin vX.Y.Z` GitHub Release with the package
+artifacts.
+
+## Branching policy
+
+> **Updated 2026-04-19:** moved from `main`-only to `main + dev`. See
+> `docs/decisions.md` §23 for the rationale.
+
+Hermes-Relay uses **`main` + `dev` with feature branches and no-ff
+merges**. `main` is **released state only** — every commit on `main`
+corresponds to a shipped version or a release-merge of `dev`. Day-to-day
+integration happens on `dev`.
+
+**Merging is decoupled from releasing.** Feature branches land on `dev`
+continuously as they go green in CI — there is no "one feature per
+release" rule. The `[Unreleased]` section of `CHANGELOG.md` on `dev` is
+the accumulator: every merged PR appends bullets there. A release is a
+separate act, taken when the accumulated state on `dev` is worth shipping
+(see "When to cut a release" below). Cutting a release means opening a
+surface-specific release PR from `dev` into `main`, merging it `--no-ff`,
+then tagging `main`.
+
+**Server tracks `dev` for staging.** The hermes-host deployment pulls
+`dev` so merged features get exercised against real data before they
+reach a tag. Users (Play Store, sideload, `hermes-relay-update`) only
+see state that lives on `main` and on release tags.
+
+### Branch names
+
+| Prefix | When | Example |
+|---|---|---|
+| `feature/<name>` | New feature (>1-2 commits) | `feature/bridge-scroll-tool` |
+| `fix/<name>` | Focused bug fix | `fix/media-projection-fgs` |
+| `docs/<name>` | Docs-only changes larger than a typo | `docs/sideload-guide` |
+| `chore/<name>` | Cleanup / refactor / tooling | `chore/sync-version-sources` |
+
+All of the above branch off `dev` and merge back to `dev`. There is no
+straight-to-main exemption — even single-file typos go through a feature
+branch and PR into `dev`.
+
+### Merge style: `--no-ff`
+
+Always merge with `git merge --no-ff <branch>` (or the "Create a merge
+commit" option in the GitHub PR UI). This applies at every level —
+feature → `dev`, and `dev` → `main` for release merges. `--no-ff`
+preserves the branch context as a visible merge commit in
+`git log --graph`, which is valuable when:
+
+- An agent team pushed several commits to a branch — the per-commit trail
+  is useful for "which agent did what"
+- `git bisect` needs to treat the whole branch as one unit
+- Someone reviews history in 6 months and wants to know "what was the
+  bundle of changes that introduced feature X"
+
+Squash merges lose that detail and are **not** the house style.
+
+### Version bumps happen at release-prep on `dev`, NOT on feature branches
+
+Feature branches **never** touch `gradle/libs.versions.toml`,
+plugin-owned version metadata, or `desktop/package.json`.
+If two feature branches both bumped a release version, they'd collide on
+version files and, for Android, on `appVersionCode` (which must be
+monotonic).
+
+Version-bump commits live on `dev` as the last commit of release-prep
+work. Android commits use `release(android): android-vX.Y.Z`; plugin commits
+use `release(plugin): plugin-vX.Y.Z`; CLI commits use
+`release(cli): cli-vX.Y.Z`. A release PR then merges `dev` →
+`main` with `--no-ff`, and the matching tag is cut from the resulting
+`main` tip.
+
+### Branch protection
+
+Light branch protection is enabled:
+
+- **`main`** — direct pushes blocked; only release PRs from `dev` merge
+  here. PR must pass CI (Android + Plugin) before merge. Force push and
+  branch deletion blocked.
+- **`dev`** — direct pushes blocked for non-trivial work; feature
+  branches PR in. PR must pass CI. Force push and branch deletion
+  blocked.
+- Signed commits + review approval NOT required (solo-dev overhead).
+
 ## One-time Setup
 
 ### 1. Release signing keystore
@@ -73,10 +224,12 @@ hermes.key.password=YOUR_KEY_PASSWORD
 ```
 
 `local.properties`, `*.keystore`, and `*.jks` are already gitignored.
+Relative `hermes.keystore.path` values resolve from the repo root, so
+`release.keystore` works when the keystore lives beside this file.
 
 > If the keystore at `hermes.keystore.path` is missing, `app/build.gradle.kts`
 > silently falls back to debug signing. The build succeeds but Play Console
-> rejects the AAB — always verify with `keytool -list -printcert` (step 3
+> rejects the AAB — always verify with `keytool -printcert` (step 3
 > below).
 
 #### CI builds
@@ -100,75 +253,209 @@ file afterward.
 
 ### 2. Google Play Console developer account
 
+Hermes-Relay ships under the **Axiom-Labs, LLC** Play Console account
+(D-U-N-S verified organization). The applicationId is
+`com.axiomlabs.hermesrelay` (googlePlay flavor) and
+`com.axiomlabs.hermesrelay.sideload` (sideload flavor — not shipped through
+Play at all). The Kotlin namespace / source tree stays at
+`com.hermesandroid.relay` for historical reasons; see `app/build.gradle.kts`
+for the decoupling rationale.
+
+If you're setting up a fresh account (for a fork or a new downstream):
+
 1. Register at <https://play.google.com/console/signup> ($25 one-time fee).
 2. Complete identity verification (personal accounts need a government ID;
    organization accounts need a D-U-N-S number).
 3. Create the app listing: name, language, free/paid, declarations.
 
-**New personal accounts only**: Google requires an app to run in
-**closed testing** with **at least 12 opted-in testers** for **14
-continuous days** before it can be promoted to production. Internal testing
-does NOT satisfy this requirement — only the closed testing track starts
-the 14-day clock. Organization (D-U-N-S) accounts are exempt. See
-[Google's policy](https://support.google.com/googleplay/android-developer/answer/14151465).
+**The 14-day closed-testing rule does NOT apply to Hermes-Relay.** Google
+requires *new personal* developer accounts to run an app in closed testing
+with ≥12 opted-in testers for 14 continuous days before promotion to
+production. Organization accounts with a verified D-U-N-S number are exempt
+from this policy, and Axiom-Labs is a D-U-N-S-verified org account. See
+[Google's policy](https://support.google.com/googleplay/android-developer/answer/14151465)
+for the full text.
+
+> **Historical note (2026-04-13 migration):** v0.1.x through v0.3.0 shipped
+> on Internal testing under Bailey's personal Play Console account with
+> applicationId `com.hermesandroid.relay`. That listing was retired as part
+> of the org-account migration. Play Store package names are permanently
+> reserved once used — `com.hermesandroid.relay` can never be reclaimed —
+> so all releases from v0.3.1 onwards ship fresh under the new
+> `com.axiomlabs.hermesrelay` listing. The upload keystore identity is
+> unchanged (same `CN=Bailey Dixon, Codename-11` cert, same SHA256
+> fingerprint), so existing GitHub Secrets and the CI signing flow need no
+> changes. Google Play App Signing mints a new server-side app signing key
+> per listing — that's invisible to us since App Signing is enabled.
 
 ### 3. Play Developer API service account (optional)
 
-Required only if you want `gradlew publishReleaseBundle` to upload directly
-to Play Console. Manual UI uploads work without this.
+Required for automated upload (the `android-v*` workflow's Play step, or local
+`gradlew publishGooglePlayReleaseBundle`). Manual UI uploads work without this.
 
-1. Open <https://console.cloud.google.com/> and select the project linked
-   to your Play Console account (Play Console > Setup > API access shows
-   which one).
-2. **IAM & Admin > Service Accounts > Create Service Account** (e.g.
-   `hermes-relay-publisher`). No project roles needed.
-3. On the new service account, **Keys > Add key > Create new key > JSON**
-   and download the file.
-4. In Play Console > **Setup > API access**, find the service account,
-   click **Grant access**, and assign the **Release manager** role.
-5. Save the JSON as `play-service-account.json` in the repo root (already
-   in `.gitignore`).
-6. Verify with `gradlew bootstrapReleasePlayResources` — should succeed
-   without auth errors.
+The service account is **created in Google Cloud Console** and then **authorized
+in Play Console** — two separate consoles. (Play Console's older "Setup > API
+access" page has been reorganized; there is no longer a "Setup" group. Use the
+paths below.)
+
+1. **Create the service account (Google Cloud Console).** Open
+   <https://console.cloud.google.com/iam-admin/serviceaccounts>, pick the project
+   (any project works; if Play Console's **API access** page already names a linked
+   project, use that one). **Create service account** → name it e.g.
+   `hermes-relay-publisher` → **Done**. No project roles needed.
+2. **Create a JSON key.** On the new service account → **Keys** tab → **Add key >
+   Create new key > JSON** → download. This file's *contents* are the secret.
+3. **Authorize it in Play Console.** Open the Play Console account-level left
+   sidebar → **Users and permissions** → **Invite new users** → paste the service
+   account's email (`...@...iam.gserviceaccount.com`). Under **App permissions**
+   (for `com.axiomlabs.hermesrelay`) or **Account permissions**, grant the
+   **Release** permissions — "Release apps to testing tracks" and "Release to
+   production, exclude devices, and use Play App Signing" — plus "View app
+   information". (Granting **Admin (all permissions)** also works but is broader
+   than needed.) **Invite user**.
+4. **Use it.** For CI, paste the JSON contents into the `PLAY_SERVICE_ACCOUNT_JSON`
+   repo secret (step 4 / secrets table). For local publish, save the JSON as
+   `play-service-account.json` in the repo root (already in `.gitignore`).
+5. Verify locally with `gradlew bootstrapGooglePlayReleaseResources` — succeeds
+   without auth errors once permissions propagate (allow a few minutes).
 
 ### 4. GitHub Actions secrets
 
 In the repo: **Settings > Secrets and variables > Actions > New repository
-secret.** Add all four (see the table in "Required GitHub Secrets" below).
+secret.** Add all four (see the table in "Required Android Release Secrets"
+below).
 
 If `HERMES_KEYSTORE_BASE64` is missing, CI release builds fall back to
 debug signing and print a warning in the workflow summary — those
 artifacts will not be accepted by Play Console.
 
+## When to cut a release
+
+Cut a release when **any of the following** is true:
+
+- The `[Unreleased]` section of `CHANGELOG.md` has enough user-facing
+  change that a version number is worth attaching.
+- A user-facing bug is fixed and you want affected users to pick it up
+  via `hermes-relay-update` or a Play Store auto-update.
+- A regulatory / policy deadline applies (new Play Console target SDK,
+  etc).
+- You've been sitting on unreleased work for more than a couple of
+  weeks and the delta-from-last-release is growing faster than it
+  should.
+
+**Don't** cut a release just because a feature landed. If one feature
+isn't enough to justify a version bump, wait — merge the next one, let
+it sit alongside in `[Unreleased]`, and ship them together. A release
+is a statement to users that "this is a thing worth updating to," so
+the threshold is intent-driven, not event-driven.
+
+If you want to dogfood accumulated `main` state without declaring GA,
+tag a **pre-release** (`android-vX.Y.Z-rc.N`). Users can opt in via
+`hermes-relay-update --branch rc/vX.Y.Z-rc.N` without being auto-pushed
+the unstable build.
+
 ## Release Process
 
-### 1. Bump the version
+### 1. Bump the Android app version
 
-Edit `gradle/libs.versions.toml`:
+Use `scripts/bump-android-version.sh`. It rewrites
+`gradle/libs.versions.toml`, increments `appVersionCode` monotonically,
+and runs a sanity check. Don't edit the Android version files by hand.
 
-```toml
-[versions]
-appVersionName = "0.1.1"   # bump per SemVer
-appVersionCode = "2"       # ALWAYS increment, even for prereleases
+```bash
+bash scripts/bump-android-version.sh 0.6.2
 ```
 
-Confirm:
+Confirm the bump:
 
 ```bat
 scripts\dev.bat version
 ```
 
+The script's diff output should show `gradle/libs.versions.toml` carrying
+the new app version and a higher `appVersionCode`.
+
 ### 2. Update release notes and changelog
 
+> Each surface has its own GitHub-Release-body file, all in the same format
+> (Summary + Added/Changed/Fixed + Install/Verify): `RELEASE_NOTES.md` (Android),
+> `PLUGIN_RELEASE_NOTES.md` (plugin), `CLI_RELEASE_NOTES.md` (CLI). This step covers
+> the Android artifacts; the plugin/CLI files are filled in their own release
+> sections below but follow the identical scrub and Keep-a-Changelog grouping.
+
+- `CHANGELOG.md` — promote the accumulated `[Unreleased]` block to a
+  versioned header. The block already exists: every feature PR has
+  been appending to it. All you do here is:
+  1. Change the `## [Unreleased]` header to `## [X.Y.Z] - YYYY-MM-DD`.
+  2. Insert a fresh empty `## [Unreleased]` header above it so the
+     next PR has a landing spot.
+  3. Skim the new versioned block and tighten / reorder if needed —
+     Keep-a-Changelog grouping (`Added` / `Changed` / `Fixed`) should
+     already be in place from the accumulator phase.
+  4. **Per-surface split.** `[Unreleased]` accumulates entries from *all
+     three* surfaces (Android + CLI + plugin), but releases are
+     per-surface. Move only the entries for the surface you're cutting into
+     the new versioned block, and leave the other surfaces' entries under
+     the fresh `[Unreleased]` for their own `cli-v*` / `plugin-v*` cut.
+     (Those tracks' GitHub-Release bodies come from `CLI_RELEASE_NOTES.md` /
+     `PLUGIN_RELEASE_NOTES.md`, so the split here only governs this file's
+     historical record.)
 - `RELEASE_NOTES.md` — body of the GitHub Release for this version
-  (rewritten each release; the workflow uses this as-is).
-- `CHANGELOG.md` — cumulative history; append a new section.
+  (rewritten each release; the workflow uses this as-is). This is the
+  operator-facing summary, not the CHANGELOG mirror. Keep the
+  **Download** section near the top — it should spell out which file
+  to grab by its `-sideload-release.apk` / `-googlePlay-release.aab`
+  suffix (every artifact is version-tagged as
+  `hermes-relay-<version>-<flavor>-<buildType>` via `archivesName`
+  in `app/build.gradle.kts`) and link to the sideload guide.
+  The v0.3.0 body is a good template.
+- `app/src/main/assets/whats_new.txt` — in-app "What's New" content
+  shown in the settings/about screen. Update with the version number
+  and a brief feature summary. Gets stale silently if forgotten
+  (v0.4.0 shipped with 0.1.0 content until caught post-release).
+- `app/src/googlePlay/play/release-notes/en-US/default.txt` — the Play
+  Console **"What's new"** text, which gradle-play-publisher reads at
+  upload to fill the Production-draft release notes. This is **separate**
+  from `RELEASE_NOTES.md` (that one is only the GitHub Release body) — if
+  this file is missing or stale, the Play draft ships with empty/wrong
+  notes (shipped empty in v1.1.0 until caught post-release). Keep it
+  **≤500 chars per language**, user-facing, Android-only.
+- `docs/play-store-listing.md` — Play Store listing copy. Update
+  the version reference and the "Release Notes" section that gets
+  pasted into the Play Console "What's new" field. Keep the Play
+  "What's new" within **500 characters** and framed around the
+  release's themes, not a feature dump.
+
+#### Scrub for public distribution
+
+This is a **public repo** and these four files are user-facing. Before
+promoting the `[Unreleased]` block and writing the notes, scrub the
+versioned CHANGELOG block and all three release-notes artifacts for
+wording that shouldn't ship publicly. The CHANGELOG accumulates in a
+dev-log voice during the iteration phase — release-prep is where it
+becomes public copy. Check for and remove/rewrite:
+
+- **Personal names / quoted asides** — `git grep -niE "bailey|: \"" CHANGELOG.md`
+  on the new block. Attribute fixes impersonally ("a user reported"),
+  not by name. (Author identity already lives in git + the signing cert.)
+- **Private infrastructure** — server hostnames/IPs, `~/SYSTEM.md`,
+  internal deployment names, anything that should stay in the operator's
+  environment and not the repo. `grep -niE "192\.168|10\.0\.|hermes-host|SYSTEM\.md"`.
+  (Example IPs like `192.168.1.100` in install docs are fine.)
+- **Fork / branch plumbing + internal nicknames** — references to private
+  fork branches, rollout channels, or in-team incident nicknames read as
+  internal. Keep the *what changed*, drop the *where we staged it*.
+- **Personal example data** — genericize sample profile/agent names to
+  neutral placeholders so the copy doesn't expose a specific setup.
+
+The goal is that someone who has never seen the repo can read the block
+and the release notes and learn only what the software does.
 
 ### 3. Build and verify locally
 
 ```bat
 scripts\dev.bat bundle
-keytool -list -printcert -jarfile app\build\outputs\bundle\release\app-release.aab
+keytool -printcert -jarfile app\build\outputs\bundle\googlePlayRelease\hermes-relay-*-googlePlay-release.aab
 ```
 
 The `keytool` output must show your release certificate (the CN/OU/O
@@ -176,47 +463,137 @@ values you entered during `keytool -genkey`). If it shows
 `CN=Android Debug, O=Android, C=US`, the keystore wasn't picked up —
 recheck `local.properties` before continuing.
 
-Optional device smoke test: `scripts\dev.bat release` then
-`adb install -r app\build\outputs\apk\release\app-release.apk`.
+Product flavors (`googlePlay`, `sideload`) nest outputs under a flavor
+directory: APKs live in `app/build/outputs/apk/<flavor>/release/` and
+AABs live in `app/build/outputs/bundle/<flavor>Release/`. Every file is
+prefixed `hermes-relay-<version>-` via `archivesName` in
+`app/build.gradle.kts`.
 
-### 4. Commit and tag
+Optional device smoke test: `scripts\dev.bat release` then
+`adb install -r app\build\outputs\apk\sideload\release\hermes-relay-*-sideload-release.apk`.
+
+### 4. Commit on `dev`, merge to `main`, tag from `main`
+
+The release-prep commit lands on `dev` first. Then a release PR merges
+`dev` → `main` with `--no-ff`, and the `android-v<version>` tag is cut from the
+resulting merge commit on `main`:
 
 ```bash
-git add gradle/libs.versions.toml RELEASE_NOTES.md CHANGELOG.md
-git commit -m "release: v0.1.1"
-git push origin main
+# From a clean dev checkout:
+git checkout dev
+git pull --ff-only origin dev
 
-git tag v0.1.1
-git push origin v0.1.1
+git add gradle/libs.versions.toml RELEASE_NOTES.md CHANGELOG.md \
+        app/src/main/assets/whats_new.txt docs/play-store-listing.md
+git commit -m "release(android): android-v0.6.2"
+git push origin dev
+
+# Open the release PR (dev -> main) and merge with --no-ff.
+# After merge, tag from the new main tip:
+git checkout main
+git pull --ff-only origin main
+git tag android-v0.6.2
+git push origin android-v0.6.2
 ```
 
-Pushing a tag matching `v*` triggers `.github/workflows/release.yml`,
+Pushing a tag matching `android-v*` triggers `.github/workflows/release-android.yml`,
 which builds, signs, checksums, and creates a GitHub Release. Watch the
 run under the **Actions** tab.
 
+Plugin/Python version files are intentionally not part of an Android app
+release unless the plugin package itself is also being released.
+
+### Plugin / Python package release
+
+Use this when plugin or relay behavior changes independently of Android app
+delivery, for example CLI channel support, bridge routes, pairing server fixes,
+voice auth, dashboard plugin UI, or packaging changes.
+
+First **rewrite `PLUGIN_RELEASE_NOTES.md`** — it is the GitHub Release body for
+`plugin-v*` tags (the same role `RELEASE_NOTES.md` plays for Android). Fill the
+Summary and the Added/Changed/Fixed groups from the plugin-relevant bullets in the
+promoted `CHANGELOG.md` block, keep the `__VERSION__` token in the Install command
+(the workflow substitutes it), and apply the same public-distribution scrub as §2.
+
+```bash
+git checkout dev
+git pull --ff-only origin dev
+
+bash scripts/bump-plugin-version.sh 0.6.2
+git add pyproject.toml plugin/relay/__init__.py plugin/plugin.yaml plugin/dashboard/manifest.json plugin/dashboard/package.json plugin/dashboard/package-lock.json CHANGELOG.md PLUGIN_RELEASE_NOTES.md
+git commit -m "release(plugin): plugin-v0.6.2"
+git push origin dev
+
+# Open the release PR (dev -> main) and merge with --no-ff.
+# After merge, tag from the new main tip:
+git checkout main
+git pull --ff-only origin main
+git tag plugin-v0.6.2
+git push origin plugin-v0.6.2
+```
+
+Pushing `plugin-v*` triggers `.github/workflows/release-plugin.yml`, which
+validates all plugin-owned version metadata with
+`scripts/check-plugin-version-sync.py`. Run
+`python scripts/check-version-tracks.py` locally before tagging when a change
+touches more than one release surface. The workflow also runs plugin tests,
+builds a wheel and sdist, generates `SHA256SUMS.txt`, and creates a GitHub
+Release named `Hermes-Relay-Plugin v<version>` for the plugin package.
+
 ### 5. Upload to Play Console
 
-**Manual upload (default):**
+> **If `PLAY_SERVICE_ACCOUNT_JSON` is configured as a repo secret, this step is
+> automated for stable tags.** The release workflow runs
+> `publishGooglePlayReleaseBundle --track=production` and the build appears as a
+> Production **draft** — skip to the Play Console, confirm the draft, and click
+> **Start rollout**. The manual path below is the fallback when the secret is
+> unset (or for staging on a non-production track).
+>
+> This automated tag path is intentionally bundle-only. It uploads the
+> `googlePlayRelease` AAB and release-scoped "What's new" notes, but it does
+> not republish static listing assets such as screenshots, title, description,
+> icon, or feature graphic. Use the Play Store Listing workflow when those
+> assets change.
 
-1. Download `app-release.aab` from the GitHub Release assets, or use your
-   local build at `app\build\outputs\bundle\release\app-release.aab`.
-2. In Play Console: **Release > Testing > Internal testing** (or **Closed
-   testing** for the 14-day clock).
+**Pick the track first.** The AAB is track-agnostic — the same
+`-googlePlay-release.aab` goes to whichever track you publish on. Choose by intent,
+not habit:
+
+- **Production** — the default for a stable GA release (`android-vX.Y.Z`). The
+  listing is live, so this is where real releases land. The org account is
+  D-U-N-S-verified, so the 14-day / 12-tester closed-testing gate does **not**
+  apply — you can publish straight to Production.
+- **Open / Closed testing** — only when you actually want a public/private beta
+  channel for this build.
+- **Internal testing** — only for a throwaway pre-release smoke check (e.g. a
+  prerelease tag), not for a GA. Don't default here.
+
+**Manual upload:**
+
+1. Download the file ending in `-googlePlay-release.aab` from the GitHub
+   Release assets (for example, `hermes-relay-1.0.0-googlePlay-release.aab`),
+   or use your local build at
+   `app\build\outputs\bundle\googlePlayRelease\hermes-relay-<version>-googlePlay-release.aab`.
+2. In Play Console, open the track you chose above — for a GA that's
+   **Release > Production**.
 3. **Create new release** > upload the AAB.
-4. Paste `RELEASE_NOTES.md` into the release notes field.
-5. **Review release** > **Start rollout.**
+4. Paste the Play "What's new" from `docs/play-store-listing.md` (≤500 chars) into
+   the release notes field. (`RELEASE_NOTES.md` is the GitHub-Release body, not the
+   Play field — don't paste that; it's over the limit.)
+5. **Review release** > **Start rollout** (set the staged-rollout percentage if you
+   want a gradual production ramp).
 
 **Automated upload (if `play-service-account.json` is configured):**
 
 ```bat
 scripts\dev.bat bundle
-gradlew publishReleaseBundle
+gradlew publishReleaseBundle --track=production
 ```
 
-Defaults to the `internal` track with `DRAFT` status (configured in the
-`play { }` block in `app/build.gradle.kts`). Override per-invocation with
-`--track=alpha` (= Closed testing), `--track=beta` (= Open testing), or
-`--track=production`.
+The `play { }` block in `app/build.gradle.kts` defaults to the `internal` track
+with `DRAFT` status as a safety net for unattended runs, so pass `--track` explicitly
+for a real release: `--track=production` (GA), or `--track=alpha` (Closed) /
+`--track=beta` (Open) for a beta channel.
 
 To promote an existing release between tracks without rebuilding:
 
@@ -224,43 +601,90 @@ To promote an existing release between tracks without rebuilding:
 gradlew promoteReleaseArtifact --from-track=internal --promote-track=alpha
 ```
 
-### 6. Promote through tracks
+### 6. Tracks (a menu, not a mandatory ladder)
 
-Typical path:
+The org account is exempt from the 14-day / 12-tester closed-testing rule, so a
+stable GA publishes **straight to Production** — there is no required promotion
+chain. The other tracks are opt-in tools, not steps you must climb:
 
-1. **Internal testing** — personal smoke test (no tester or time minimum)
-2. **Closed testing (alpha)** — starts the 14-day clock for new personal
-   accounts; needs at least 12 opted-in testers
-3. **Open testing (beta)** — optional public beta
-4. **Production** — live on the Play Store
+- **Production** — live on the Play Store. Where GA releases go.
+- **Open testing (beta)** — opt-in public beta channel.
+- **Closed testing (alpha)** — opt-in private beta (named tester lists).
+- **Internal testing** — throwaway smoke check (e.g. a prerelease tag), no tester
+  or time minimum.
 
-Promote via the Play Console UI or `gradlew promoteReleaseArtifact`.
+If you *do* stage through tracks, promote an existing release without rebuilding via
+the Play Console UI or:
+
+```bat
+gradlew promoteReleaseArtifact --from-track=internal --promote-track=production
+```
 
 ### 7. After release
 
 - Verify the GitHub Release has APK, AAB, and `SHA256SUMS.txt` attached.
+- Confirm the release body includes the **Download** section that tells
+  users which asset to grab. If you kept the structure from
+  `RELEASE_NOTES.md` this will already be baked in. If for some reason
+  it's missing, edit the body with:
+  ```bash
+  gh release view android-vX.Y.Z --repo Codename-11/hermes-relay --json body --jq .body > /tmp/body.md
+  # edit /tmp/body.md to add/fix the Download section
+  gh release edit android-vX.Y.Z --repo Codename-11/hermes-relay --notes-file /tmp/body.md
+  ```
+  (This step was only needed as a retrofit for v0.1.0 — v0.1.1+ inherit
+  the Download section automatically from `RELEASE_NOTES.md`.)
 - Confirm Play Console shows the new versionCode on the target track.
 - Update `DEVLOG.md` with a short entry for the release.
 
 ## CI Behavior
 
-On every push of a tag matching `v*`, `.github/workflows/release.yml`:
+Android, Plugin, dashboard, and desktop now have separate CI/release lanes.
+This keeps a dashboard CSS fix from running the full server suite, and keeps
+plugin changes from forcing an Android app `versionCode` bump.
+
+On every push of a tag matching `android-v*`, `.github/workflows/release-android.yml`:
 
 1. Validates the tag matches `appVersionName` in
    `gradle/libs.versions.toml` (mismatches fail the workflow).
-2. Runs `./gradlew assembleDebug` and `./gradlew test`.
+2. Runs the Android debug build and the stable sideload pairing/connection
+   regression slice with explicit timeouts.
 3. Decodes `HERMES_KEYSTORE_BASE64` into `$RUNNER_TEMP/release.keystore`
    and exports `HERMES_KEYSTORE_PATH` (skipped if the secret is unset).
-4. Builds both artifacts: `./gradlew bundleRelease assembleRelease`.
+4. Builds both Android release artifacts:
+   `./gradlew bundleRelease assembleRelease`.
 5. Generates `SHA256SUMS.txt` covering both.
-6. Creates a GitHub Release named `v<version>` with `RELEASE_NOTES.md` as
+6. Creates a GitHub Release named `Hermes-Relay-Android v<version>` with `RELEASE_NOTES.md` as
    the body. Attaches the APK, AAB, and `SHA256SUMS.txt`. Tags any version
-   containing a dash (e.g. `v0.2.0-beta.1`) as a prerelease automatically.
+   containing a dash (e.g. `android-v0.2.0-beta.1`) as a prerelease automatically.
 7. Prints a `$GITHUB_STEP_SUMMARY` showing whether release signing
    succeeded. If `HERMES_KEYSTORE_BASE64` is missing, the summary warns
    that the artifacts are debug-signed and unsuitable for Play Store.
 
-## Required GitHub Secrets
+On every push of a tag matching `plugin-v*`,
+`.github/workflows/release-plugin.yml`:
+
+1. Validates the tag matches all plugin-owned version metadata checked by
+   `scripts/check-plugin-version-sync.py`.
+2. Runs plugin syntax checks and the focused route/auth/session test slice.
+3. Builds the Python wheel and sdist with `python -m build`.
+4. Generates `dist/SHA256SUMS.txt`.
+5. Creates a GitHub Release named `Hermes-Relay-Plugin v<version>` with the wheel,
+   sdist, and checksum file attached.
+
+On every push of a tag matching `cli-v*`,
+`.github/workflows/release-cli.yml` builds and publishes the CLI binaries and
+Windows tray installer. Its GitHub Release body comes from `CLI_RELEASE_NOTES.md`
+(rewritten per release — the CLI counterpart of `RELEASE_NOTES.md`); the workflow
+substitutes `__VERSION__` (bare, e.g. `0.3.0`) and `__TAG__` (full, e.g.
+`cli-v0.3.0`) so the install/pin commands stay accurate. Fill its Summary and
+Added/Changed/Fixed groups at CLI release-prep and apply the §2 public scrub.
+Dashboard-only changes are covered by
+`.github/workflows/ci-dashboard.yml`, which builds the dashboard plugin,
+runs the dashboard API tests, and verifies the modal CSS markers are present
+in the built bundle.
+
+## Required Android Release Secrets
 
 | Secret                      | Purpose                             | How to populate                                  |
 |-----------------------------|-------------------------------------|--------------------------------------------------|
@@ -268,30 +692,52 @@ On every push of a tag matching `v*`, `.github/workflows/release.yml`:
 | `HERMES_KEYSTORE_PASSWORD`  | Store password                      | Password set during `keytool -genkey`            |
 | `HERMES_KEY_ALIAS`          | Key alias                           | Alias set during `keytool -genkey`               |
 | `HERMES_KEY_PASSWORD`       | Key password                        | Usually the same as the store password          |
+| `PLAY_SERVICE_ACCOUNT_JSON` | **Optional** — Play auto-upload     | Paste the full Play Developer API service-account JSON (step 3) |
+
+If `PLAY_SERVICE_ACCOUNT_JSON` is set, the `android-v*` release workflow uploads
+the `googlePlay` AAB to the **Production track as a DRAFT** automatically (stable
+tags only — prereleases are skipped). CI does the upload; you still click **Start
+rollout** in Play Console. If the secret is unset, the workflow skips the upload
+and you upload manually (§5) — nothing else changes.
 
 ## Hotfix Recipe
 
 When production has a bug and you need to ship a fix without picking up
-unrelated `main` changes:
+unreleased work from `dev`, branch from the affected release tag and only
+bump the version source for the surface you are shipping.
 
-1. `git checkout -b fix/short-name v0.1.0` — branch from the released tag.
+For an Android app hotfix:
+
+1. `git checkout -b fix/short-name android-v0.6.1` — branch from the released
+   Android tag (not from `main` or `dev`).
 2. Apply the fix, add a test, commit.
-3. Bump `appVersionName` and `appVersionCode` in
+3. Run `bash scripts/bump-android-version.sh 0.6.2` to update
    `gradle/libs.versions.toml`.
-4. Update `RELEASE_NOTES.md` and `CHANGELOG.md`.
-5. `git tag v0.1.1 && git push origin v0.1.1` — CI builds and publishes.
-6. Upload to Play Console as normal.
-7. Merge the hotfix branch back into `main` so the fix isn't lost.
+4. Update `RELEASE_NOTES.md`, `CHANGELOG.md`, in-app What's New, and Play
+   listing notes as needed.
+5. Open a PR from `fix/short-name` into `main`, merge with `--no-ff`.
+6. `git tag android-v0.6.2` from the new `main` tip and `git push origin android-v0.6.2`
+   so Android release CI builds and publishes.
+7. Upload to Play Console as normal.
+8. Merge `main` back into `dev` (`git checkout dev && git merge --no-ff main`)
+   so `dev` picks up the hotfix and the versionCode bump. Without this,
+   `dev`'s `appVersionCode` lags behind `main` and the next app release
+   bump collides.
+
+For a Plugin hotfix, branch from the affected `plugin-v*` tag, apply
+the fix, run `bash scripts/bump-plugin-version.sh <next-version>`, merge to
+`main`, and tag `plugin-v<next-version>`. Do not touch
+`gradle/libs.versions.toml` unless an Android app release is also shipping.
 
 ## Troubleshooting
 
 **`Tag version (X) does not match appVersionName (Y)` in CI validate step**
 You pushed a tag before bumping `gradle/libs.versions.toml`, or vice versa.
 Fix: update the file, commit, delete the remote tag
-(`git push --delete origin vX`), re-tag, and push again.
+(`git push --delete origin android-vX`), re-tag, and push again.
 
 **Play Console rejects the AAB as debug-signed**
-Run `keytool -list -printcert -jarfile <aab>` locally — if it shows
+Run `keytool -printcert -jarfile <aab>` locally — if it shows
 `CN=Android Debug`, fix `local.properties` for local builds or
 `HERMES_KEYSTORE_BASE64` for CI. For CI, check the workflow summary; if it
 says "Debug-signed", one of the four `HERMES_*` secrets is missing or the

RELEASE_NOTES.md

@@ -1,41 +1,35 @@
-# Hermes-Relay v0.1.0
+# Hermes-Relay-Android v1.2.3
 
-First release — a native Android client for the Hermes agent platform with direct API chat, session management, and a full Material 3 Compose UI.
+**Release Date:** June 23, 2026
+**Since v1.2.2:** A connection-stability hotfix. Connecting to a server over an **encrypted link** (Tailscale Serve or public HTTPS) could hard-close the app the moment the connection came up; that crash is fixed, so securing your connection no longer force-closes Hermes-Relay.
+
+v1.2.3 is a focused fix for anyone connecting over Tailscale or public TLS. Plain-LAN connections were never affected.
+
+---
+
+## Download
+
+v1.2.3 ships in two Android build flavors. APK and AAB filenames are version-tagged:
+
+| Flavor | File | Who it's for |
+|---|---|---|
+| Google Play | `hermes-relay-1.2.3-googlePlay-release.aab` | Upload this Android App Bundle to Play Console. It has no AccessibilityService, screen reading, screenshots, gestures, SMS/calls, contacts/location, overlays, or unattended phone control. |
+| sideload | `hermes-relay-1.2.3-sideload-release.apk` | Direct-install APK for full Device Control. Installs as `com.axiomlabs.hermesrelay.sideload`. |
+| googlePlay APK | `hermes-relay-1.2.3-googlePlay-release.apk` | Parity/testing artifact. |
+| sideload AAB | `hermes-relay-1.2.3-sideload-release.aab` | Parity/testing artifact. |
+
+Verify integrity with `SHA256SUMS.txt` from the same release. See the [Sideload guide](https://codename-11.github.io/hermes-relay/guide/getting-started.html#sideload-apk) for APK install steps.
+
+---
 
 ## Highlights
 
-- **Direct API chat** — connects to your Hermes API Server via SSE streaming
-- **Session management** — create, switch, rename, delete sessions with full message history
-- **Markdown rendering** — code blocks, bold, italic, links, lists in assistant messages
-- **Reasoning display** — collapsible thinking blocks when the agent uses extended thinking
-- **Token tracking** — per-message input/output token count and estimated cost
-- **Personality picker** — dynamic personalities from server config, agent name on chat bubbles
-- **Command palette** — searchable command browser with 29 gateway commands + server skills
-- **QR code pairing** — scan `hermes-pair` QR to auto-configure connection
-- **Material You theming** — dynamic colors with light/dark/auto support
-- **File attachments** — attach images, documents, and other files to messages
-- **Message queuing** — send follow-up messages while the agent is still responding
-- **Offline detection** — graceful degradation when network connectivity is lost
-- **Feature gating** — Developer Options (tap version 7x) for experimental features
-- **Configurable limits** — adjustable attachment size and message length in Settings
-- **In-app analytics** — Stats for Nerds with response times, token usage, peak times, reset
+### Fixed
+- **No more crash on connect over TLS / Tailscale.** Connecting over an encrypted link (Tailscale Serve or public HTTPS) could force-close the app with a `NetworkOnMainThreadException` as the connection came up — a live SSL socket was being closed on the main thread during client teardown, and a TLS close performs a network write. Socket teardown now always runs off the main thread, so connecting over a secured link is stable. Plain-LAN connections were never affected.
 
-## Install
+---
 
-Download from Google Play or install the APK from the release assets below.
-
-## Requirements
-
-- Android 8.0+ (API 26)
-- A running [Hermes agent](https://github.com/NousResearch/hermes-agent) instance
-
-## What's Next
-
-- Terminal channel via tmux (Phase 2)
-- Bridge channel migration (Phase 3)
-- Push notifications
-- Agent-initiated image rendering (MEDIA: tags)
-
-## Feedback
-
-- Issues: https://github.com/Codename-11/hermes-relay/issues
+## Upgrade notes
+- This is an app-side fix on **both** flavors — no Device Control or server changes needed.
+- If you were crashing on connect over Tailscale or HTTPS, update and reconnect.
+- `appVersionCode` is **17**.

ROADMAP.md

@@ -0,0 +1,159 @@
+# Hermes-Relay Roadmap
+
+> Where Hermes-Relay is headed. Short, high-level, grouped by release milestone. For detailed implementation plans of active work see [`docs/plans/`](docs/plans/); for shipped work see [`CHANGELOG.md`](CHANGELOG.md); for the session-by-session narrative see [`DEVLOG.md`](DEVLOG.md).
+
+## Vision
+
+Native Android companion for the [Hermes agent platform](https://github.com/NousResearch/hermes-agent) — chat, voice, and full phone control in one app. We're building toward a world where your AI agent has safe, graceful hands on your phone for the tasks where that matters most: messaging, navigation, music, day-to-day automation, and anything else that's currently a tap-through chore.
+
+## Shipped
+
+- **v0.3.0** — Bridge channel (sideload), voice mode, notification companion, two build flavors, full safety rails system. [CHANGELOG](CHANGELOG.md#030---2026-04-13)
+- **v0.2.0** — Voice mode foundation, terminal preview, TOFU cert pinning, Paired Devices screen. [CHANGELOG](CHANGELOG.md)
+- **v0.1.0** — Chat, sessions, QR pairing, encrypted storage, Play Store submission.
+
+### Desktop track (parallel lane to Android) — **experimental**
+
+Release tags: `cli-v*` (separate cadence from Android `android-v*` and Plugin `plugin-v*`). Historical alpha prereleases used `desktop-v*`, and the installer/updater keep a migration fallback. Curl-installed prebuilt binaries (no Node required); Windows first, macOS / Linux same release. Workflows: [`ci-desktop.yml`](.github/workflows/ci-desktop.yml) + [`release-cli.yml`](.github/workflows/release-cli.yml).
+
+**Shipped (2026-04-23 — first tagged release `desktop-v0.3.0-alpha.1`):**
+
+- **`@hermes-relay/cli` v0.1** — Node thin-client at [`desktop/`](desktop/). Remote chat + pair + status + tools subcommands over the relay's `tui` WSS channel. Shares `~/.hermes/remote-sessions.json` with the Android client (pair once, both work).
+- **v0.2 — resilience + pairing UX** — multi-endpoint pairing (ADR 24: `--pair-qr` probes LAN/Tailscale/Public, strict-priority within-tier race, 4s timeout, 60s cache), reconnect-on-drop state machine (1s→30s exp backoff, 5min on 429, gate re-check post-sleep), TOFU cert pinning via pre-WS TLS probe (SPKI sha256, `sha256/<base64>` OkHttp-compatible).
+- **v0.2 — UX polish** — bare `hermes-relay` → `shell` (full Hermes CLI over PTY with `clear; exec hermes` after tmux settles); contextual connect banner (`Connected via LAN (plain) — server 0.6.0`); `status` surfaces grants + TTL + endpoint role from `auth.ok`; new `devices` subcommand talking to relay `GET/DELETE/PATCH /sessions` over HTTP.
+- **Phase B — client-side tool routing** — server-side `plugin/relay/channels/desktop.py` + `plugin/tools/desktop_tool.py` register `desktop_read_file` / `_write_file` / `_terminal` / `_search_files` / `_patch` via `tools.registry` (mirror of `android_*` pattern — **zero hermes-agent core change**). Client-side `DesktopToolRouter` attaches to the `desktop` channel, dispatches under a 30s AbortController, heartbeats `desktop.status` every 30s. One-time per-URL consent gate + `--no-tools` kill-switch.
+- **`hermes-relay daemon`** — headless WSS + tool router that keeps desktop tools serving without a visible shell. Fails closed on missing stored consent (`--allow-tools` escape hatch with an explicit `--token`). JSON-line logs by default, auto-human on TTY. Inherits transport's reconnect state machine; `setImmediate(exit)` to flush final log line before process dies.
+- **Pre-release hardening** — `hermes-relay doctor` (local diagnostic report, human + `--json`, no token leakage); `uninstall.{sh,ps1}` (3-tier: default keeps session store, `--purge` wipes it with cross-surface warning, `--service` stub); interactive first-run prompts (`resolveFirstRunUrl` — auto-picks single stored session, numbered picker for multiple, welcome banner for fresh install); version-aware install (`upgrading X → Y` readback pre-install, post-install confirmation).
+- **Self-setup skill** — [`skills/devops/hermes-relay-desktop-setup/SKILL.md`](skills/devops/hermes-relay-desktop-setup/SKILL.md) lets any Hermes agent install, pair, and troubleshoot the CLI with **live local diagnostics** via `desktop_terminal` (can read the user's Node version, PATH, binary location directly — something the Android setup skill can't match).
+
+**Shipped — `desktop-v0.3.0-alpha.6` (seamless-local dev pass, done 2026-04-23):** Plan at [`docs/plans/2026-04-23-desktop-alpha-6-seamless-local.md`](docs/plans/2026-04-23-desktop-alpha-6-seamless-local.md). Nine features across six parallel agent workstreams, all opt-in: workspace-awareness envelope + active-editor signal (#1+#8), `hermes-relay update` self-update subcommand (#2), `desktop_open_in_editor` tool + interactive patch approval with unified-diff rendering (#3+#4), conversation picker on connect (#5), clipboard bridge + screenshot handlers (#9+#12), and a `hermes` alias so muscle-memory works without the `-relay` suffix (#13). Integration day: 2026-04-23.
+
+**Active — `desktop-v0.3.0-alpha.7` (native image paste):** Plan at [`docs/plans/2026-04-23-desktop-alpha-7-native-paste.md`](docs/plans/2026-04-23-desktop-alpha-7-native-paste.md). Two-repo workstream: client slash commands `/paste` (clipboard), `/screenshot` (primary display), `/image <path>` (file) land in `hermes-relay chat`, each echoes a one-line feedback and attaches the image to the next `prompt.submit` so the vision-capable model sees it in the same turn — parity with Claude Desktop's paste UX minus OS-level Ctrl+V (terminals don't pipe image bytes to stdin). Client half is new `desktop/src/chatAttach.ts` + slash-command branches in `desktop/src/commands/chat.ts`. Server half is ONE new `@method("image.attach.bytes")` on the fork's `tui_gateway/server.py` (branch `feat/image-attach-bytes` → merged to `axiom`); the fork's existing `_enrich_with_attached_images` already handles multimodal payload plumbing and session-scoped image state, so this release is almost entirely about bridging client-captured bytes to server-side state that's been there for months. Relay channel unchanged — `tui` is a transparent RPC forwarder. Graceful fallback when hermes-host hasn't been updated yet: client catches `method not found`, prints a pointer at the axiom rollout, REPL stays alive.
+
+**Active — desktop control / computer-use:** Enhanced plan at [`docs/plans/desktop-control-computer-use-enhanced.md`](docs/plans/desktop-control-computer-use-enhanced.md); earlier MVP implementation record at [`docs/plans/desktop-computer-use-mvp.md`](docs/plans/desktop-computer-use-mvp.md). Windows now has the first Tauri tray/overlay app as the primary Easy/Standard install surface: pair, start/pause daemon, Devices/Revoke, Task Log, Settings, overlay status chip, emergency stop, and bundled CLI sidecar. The existing CLI and daemon remain the primary advanced/headless surface. `desktop_computer_*` schemas are registered on the normal desktop tool channel but advertised only behind the explicit experimental computer-use flag. Host input still requires desktop-tool consent plus a visible, task-scoped assist/control grant; there is no unrestricted or silent mouse/keyboard automation.
+
+**Desktop control UX direction:** Tauri v2 (Rust + static web UI) is the native shell for the polished Easy-tier experience: tray icon, always-visible overlay chip, task log, settings, and one-click pause/emergency stop. Easy tier pairs once, shows a connected/observing chip, and exposes Devices / Revoke / Task Log / Settings / Emergency Stop from the tray. Standard tier adds full tray management; Advanced tier remains CLI + daemon + JSON policy (`~/.hermes/desktop-control.json`) for operators. The default policy baseline blocks password managers, credential prompts, banking/payment/crypto surfaces, OS security/admin settings, and private-key/token material until locally overridden.
+
+**Deferred to alpha.8 / alpha.9 / v1.0:**
+
+- **Per-project session stickiness** — blocked on hermes-agent plugin hook that consumes the workspace envelope; premature until the envelope shape stabilizes in use.
+- **Shell-history context hook** — needs rc-file-edit install path, which our install philosophy currently avoids. Design pass required.
+- **Desktop notifications for long-running daemon work** — let daemon bake in real-world use first; latency/idle-detection thresholds best tuned with telemetry.
+- **Environment-variable passthrough** — security-sensitive; needs per-var prompt UX + threat model before shipping.
+- **Global hotkey to summon a prompt** — OS-specific helper installers; out of scope for binary-only release.
+- **Watch mode** (`hermes-relay daemon --watch`) — needs a DSL and clear safety bounds; own feature branch.
+- **Native assist/control grant modal hardening** — the tray-managed daemon now has a local grant bridge and Grant Requests view. Next pass should polish native modal behavior, notification routing, and multi-client grant ownership.
+- **Kitty / iTerm2 inline image protocols for paste feedback** — would show a thumbnail of the attached image directly in the terminal after `/paste` instead of a plain text line. Most terminals don't support them; the slash-command feedback line works anywhere. Revisit if users request it.
+
+**Earlier alpha.2–alpha.5 workstreams (now in-flight / done — see DEVLOG 2026-04-23 entries for specifics):**
+
+- **`hermes-relay update` subcommand + auto-update nudge.** The binary self-update path polls the GitHub Releases API, prefers `cli-v*`, falls back to historical `desktop-v*` prereleases during migration, compares to `readVersion()`, and downloads the binary directly + `rename` over the current one (Windows can rename while running; Linux/macOS atomic replace is fine for long-lived daemons because the running process keeps the old inode open). Add a once-per-day background check in `daemon` mode that emits `update_available` as a log event — opt-in via `--check-updates`, never auto-installs without user action. Signing prerequisite: SmartScreen/Gatekeeper would warn on every auto-downloaded binary until we sign, so this is behind code signing.
+- **Workspace-awareness — desktop client sends cwd/git/hostname on connect.** Biggest lingering "is the agent working against the right tree?" problem. On WSS auth, the client advertises an ephemeral workspace descriptor — `cwd`, `git_root`, `git_branch`, `git_status_summary` (staged/modified counts), `repo_name`, `hostname`, `platform`, `active_shell`. Server-side `DesktopHandler` stashes it as live session metadata (NOT persistent state). New hermes-agent plugin hook injects a one-line ephemeral prompt prefix into the session context — *"Active desktop workspace: machine=Bailey-PC · repo=hermes-relay · branch=dev · staged=3"* — so the LLM reads it every turn without the operator having to explain. Also default `desktop_terminal` / `desktop_read_file` / `desktop_search_files` `cwd` to the repo root when unset. Expose the snapshot in `hermes-relay doctor` + `hermes-relay status` + a new `hermes-relay workspace` subcommand + a relay dashboard tab so both operator and agent have a common view. Pair with a `.hermes/workspace-context.json` file-based fallback for when the socket path can't be reached. Requires: new WSS envelope (`desktop.workspace` on connect), hermes-agent plugin hook for ephemeral context injection, schema coordination with the upstream `ContextVar` multi-client work.
+- **Service installers** — `scripts/install-service-{win,linux,mac}.{ps1,sh}` — Windows Service via `sc.exe create`, `systemd --user` unit with `loginctl enable-linger`, `launchctl load` plist for macOS. Auto-start on login so the daemon is always reachable.
+- **Multi-client routing on the `desktop` channel** — replace single-client MVP with per-token indexing + device-id reconnect handoff. Hermes session state carries `desktop_session_token` via a new `ContextVar` in `gateway/session_context.py` (hermes-agent PR candidate — won't affect Android). Natural pairing with the workspace-awareness envelope — the ContextVar scheme determines which client's workspace the active session sees.
+- **Harden `release-cli.yml` retag semantics.** The `softprops/action-gh-release` step failed during the alpha.1 retag with `tag_name already_exists` after deleting + re-uploading all 5 assets; recovered by `gh api` cleanup (delete orphan draft + PATCH draft→false on the release with the real assets). Follow-up: pin the action version, add `make_latest: false` + explicit `release_id` lookup, or switch to `ncipollo/release-action` which handles retags without the duplicate-draft creation.
+- **Signed binaries** — Windows EV code-signing (~$300/yr, DigiCert or SSL.com) + Apple Developer ID + notarization ($99/yr). Removes SmartScreen/Gatekeeper warnings. Prerequisite for the auto-update path.
+- **npm registry publication** — future v1.0 distribution work. The package name is local workspace metadata today; current install paths are GitHub Release binaries or local clone + `npm link`.
+- **HMAC verification on QR payloads** — defer until a client-accessible secret story exists (same deferral as the Android app). Not blocking GA.
+
+**Docs + references:** user-docs `/desktop/` section (Overview → Installation → Pairing → Subcommands → Local tool routing → Troubleshooting → FAQ) with an `<ExperimentalBadge />` Vue component on every page. README.md landing has a dedicated "Experimental: Desktop CLI" section with the install one-liners.
+
+## Current — Axiom-Labs migration
+
+Moving the Play Store listing from a personal account to the DUNS-verified Axiom-Labs LLC org account. Unblocks straight-to-production rollout (no 14-day closed-testing requirement). New applicationId `com.axiomlabs.hermesrelay`; keystore identity + SHA256 fingerprint preserved. In progress — waiting on Google DUNS verification.
+
+## Next — v0.4: Bridge feature expansion
+
+Detailed plan: [`docs/plans/2026-04-13-bridge-feature-expansion.md`](docs/plans/2026-04-13-bridge-feature-expansion.md).
+
+Expands the bridge channel's tool surface substantially, ports reliability patterns from the broader Hermes-Android ecosystem, and ships a per-app playbook skill so the agent has ready-made procedures for common apps out of the box.
+
+**Core gestures.** Long press, drag, and pinch — foundational interactions currently missing from the toolkit.
+
+**Screen efficiency.** Lightweight screen hashing + diff for cheap change detection in navigation loops; targeted node search (`find_nodes`) to avoid dumping full accessibility trees; detailed node introspection (`describe_node`) for richer LLM context.
+
+**System integration.** Clipboard bridge (read + write), system-wide media playback control (play / pause / next / previous), sequential macro execution for batched workflows.
+
+**Reliability.** Wake-lock wrapping on gesture-dispatching actions, three-tier `tap_text` fallback cascade for apps that wrap clickable content in non-clickable views, multi-window accessibility tree traversal.
+
+**Per-app playbook skill.** `skills/android/SKILL.md` gives the LLM ready-made step-by-step procedures for Uber, WhatsApp, Spotify, Maps, Settings, and Tinder — plus a hard "do not loop" rule for bounded tool-call budgets.
+
+**Sideload-only additions.** Location (`ACCESS_FINE_LOCATION`), contact search (`READ_CONTACTS`), direct SMS (`SEND_SMS`), and direct-dial calling (`CALL_PHONE`). All gated behind the existing sideload flavor to preserve Play Store policy compliance on the `googlePlay` track.
+
+## Next-next — v0.4.1: Bridge fast-follows
+
+Small follow-ons to v0.4 deliberately deferred to keep the v0.4.0 release surface focused.
+
+**Unattended access mode** *(sideload-only).* ~~Opt-in toggle on the Bridge tab that acquires `FULL_WAKE_LOCK + ACQUIRE_CAUSES_WAKEUP`, raises `SCREEN_OFF_TIMEOUT` to max while active, and requests `KeyguardManager.requestDismissKeyguard()` so the agent can drive the device while the user is away.~~ **SHIPPED in v0.4.1** — see [`CHANGELOG.md`](CHANGELOG.md#041---unreleased). Final shape: opt-in toggle on the Bridge tab (sideload-only) that acquires `SCREEN_BRIGHT_WAKE_LOCK | ACQUIRE_CAUSES_WAKEUP | ON_AFTER_RELEASE` per bridge action, calls `KeyguardManager.requestDismissKeyguard()` via the registered MainActivity host, and reports `keyguard_blocked` (HTTP 423) when a credential lock blocks the action. Hard-bounded by the existing bridge auto-disable timer; persistent foreground-service notification + amber "Unattended ON" status-overlay chip stay visible while active; first-enable shows a scary dialog explaining the security model and credential-lock limitation. The original spec mentioned a WiFi-disconnect failsafe — rejected during implementation because Tailscale / VPN invalidates the "leaving WiFi = leaving LAN" assumption; the existing relay-disconnect detection (master toggle drops on disconnect → `UnattendedAccessManager.release()`) plus the auto-disable timer cover that surface.
+
+**Voice intent local dispatch loop.** The v0.4 voice intent handler builds `bridge.command` envelopes and routes them through the `ChannelMultiplexer` → WSS → relay → back-to-phone path, which the relay correctly rejects with `ignoring unexpected bridge.command from phone` (the wire protocol is server→phone only by design). Voice intents are phone-local, so the dispatch should be local: extend `BridgeCommandHandler` with a `handleLocalCommand(envelope)` entry point that runs the existing `when(path)` dispatch + the full Tier 5 safety check pipeline (blocklist → destructive verb modal → action executor) in-process, and have `RealVoiceBridgeIntentHandler.dispatch()` call it instead of `multiplexer.send()`. Single source of truth for "bridge command → action" preserved; safety modals still fire for destructive verbs; no WSS round-trip for an action that's happening on the same device. Caught by Bailey's on-device test 2026-04-14 after the multiplexer-wiring fix unblocked the dispatch path.
+
+**~~Tiered permission checklist with JIT permission errors~~ — shipped on `feature/tiered-permissions` (v0.4.1).** See [CHANGELOG.md](CHANGELOG.md) under `[Unreleased] → v0.4.1 Bridge fast-follows` for the landed surface. Original scope:
+
+- Tiered checklist with sideload-only sections gated on `BuildFlavor.SIDELOAD` (Core bridge / Notification companion / Voice & camera / Sideload features), Optional pills, runtime-permission launchers, ON_RESUME re-probes — done.
+- JIT permission-denied surfacing — bridge tool error envelope carries canonical `code` + `permission` aliases, Python `ResolveResult` types in `plugin/tools/resolve_result.py`, agent-tool wrappers upgrade `permission_denied` responses to structured LLM-readable envelopes, voice-mode JIT chip deep-links to `Settings.ACTION_APPLICATION_DETAILS_SETTINGS` for the running package — done.
+
+**Voice intent → server session sync.** ✅ **Shipped 2026-04-16** — see [CHANGELOG `[Unreleased]`](CHANGELOG.md#unreleased) for the implementation. Picked option (d) (not in the original menu): synthesize OpenAI-format `assistant` (with `tool_calls`) + `tool` (with `tool_call_id`) message pairs from local voice-intent traces and pass them under a new `messages` field on the existing `/v1/runs` and `/api/sessions/{id}/chat/stream` payloads. LLMs are trained on this exact shape so they read it as natural conversation history rather than a system-prompt side note (lower retry risk than option (b)). Zero server changes (option (a) avoided), no double-dispatch (option (c) avoided). Idempotency via a `syncedToServer` flag on each trace.
+
+**Original problem statement (preserved for context):** Voice intents currently dispatch in-process (good for latency) and append a **local-only** trace to chat history (good for visual continuity), but the server-side session never sees them — so the gateway LLM has no memory of prior voice actions when the user follows up via text or voice. Symptom: user says "open Chrome" via voice (works), then says "did that work?" → LLM responds "I have no prior context for what you're asking about". Caught by Bailey's on-device test 2026-04-14: "The chat is resetting on voice or with our tools?" — actually voice intents bypass chat entirely, but the user-visible effect is the same.
+
+**Gateway slash-command preprocessor — bootstrap middleware (Option B scope).** Built-in Hermes slash commands (`/model`, `/new`, `/retry`, the 29 in `hermes_cli/commands.py::GATEWAY_KNOWN_COMMANDS`) are intercepted by in-process platform adapters like Discord, Telegram, Slack, etc. — all of which route inbound `MessageEvent`s through `GatewayRouter._handle_message` at `gateway/run.py:2645–2929`, where a ~300-line dispatch chain mutates router-owned state (`_session_model_overrides`, `_agent_cache`). But `APIServerAdapter` **does not connect to the router** — it's intentionally excluded from the router notification path (see comment at `run.py:3148`), calls `_run_agent` directly, and **creates a fresh agent per request with no persistent session state**. This is the design intent of the OpenAI-compatible endpoint, not an oversight. The practical effect: on `POST /v1/runs` and `POST /v1/chat/completions`, slash commands pass through to the LLM verbatim; the LLM hallucinates a plausible-sounding but wrong reply ("`/model` is a client-side command"); the user is confused. Caught by Bailey on 2026-04-15 during a Hermes chat test from the Android app.
+
+**What the middleware can do (near-term, ships via install.sh).** New aiohttp middleware in `hermes_relay_bootstrap/_command_middleware.py`, installed at the same `_PatchedApplication.__setitem__` hook as the current route injection so it lands before `AppRunner.setup()` freezes the app. Filters by `request.path in ("/v1/runs", "/v1/chat/completions")` — zero-cost fast path for everything else. On chat paths: parses the body, lazy-imports `GATEWAY_KNOWN_COMMANDS` + `resolve_command()` + `gateway_help_lines()` from `hermes_cli.commands`, and splits on command type:
+- **Stateless commands** (`/help`, `/commands`, and any others the upstream Option B PR ends up supporting without router state) — actually dispatch, emit a synthetic SSE stream matching the runs handler's existing event shape so the Android client at `HermesApiClient.kt:655-715` renders it as a normal assistant turn.
+- **Stateful commands** (`/model`, `/new`, `/retry`, `/undo`, `/compress`, `/title`, `/resume`, `/branch`, `/rollback`, `/yolo`, `/reasoning`, `/personality`, etc. — most of the registry) — emit a synthetic SSE stream whose content is a short, helpful notice: *"The `/model` command requires a persistent session and isn't available on the stateless `/v1/runs` endpoint. Use `/api/sessions/{id}/chat/stream` (post-PR-#8556) or a channel with session state. For commands that work here, type `/help`."* This replaces the LLM hallucination with a deterministic, accurate message that points the user at the real fix.
+
+**On no match** (unknown command, cli-only command, or plain text): falls through to `handler(request)` unchanged. Fork-detects the same way the existing injection does — if the upstream preprocessor PR lands first, the middleware no-ops.
+
+**Ceiling.** This middleware can **never** make `/model` actually switch models on `/v1/runs`, because there is no persistent session on that endpoint to switch. That's a Phase 2 follow-up (below), not a flaw in the middleware.
+
+**Files.** New `hermes_relay_bootstrap/_command_middleware.py` (~150 LOC), one-line append in `_patch.py` inside `_maybe_register_routes`, stdlib `unittest` coverage in `plugin/tests/test_bootstrap_command_middleware.py` mirroring the existing `test_bootstrap_patch.py` harness. Mirrors the upstream Option B PR exactly so the two can be reviewed side-by-side.
+
+**Phase 2 — stateful dispatch on the session chat stream endpoint (post PR #8556).** Once PR #8556 merges and `/api/sessions/{id}/chat/stream` ships natively in upstream, a separate middleware (or a follow-up upstream PR) can add a preprocessor **scoped to that endpoint only**, leveraging the `session_id` in the URL as the persistence handle. At that point stateful commands become a dict write against session-scoped state — `session.model_override = new_model` — without needing to refactor `GatewayRouter` or plumb api_server into the router. Much smaller than a full router refactor, and it matches upstream's partition: `/v1/*` stays stateless, statefulness lives on `/api/sessions/*`. Blocked on #8556 landing.
+
+## Future — v0.5+
+
+Shape subject to change. Each theme needs a separate design + plan pass before implementation; file design notes as research matures.
+
+### Desktop thin-client — Phase B (client-side tool routing)
+
+v0.1 ships a remote-chat CLI. Phase B is the bigger win: **per-tool dispatch routing** so file/terminal/browser tools run against the user's machine while state tools (memory, skills, sessions, cron) stay on the server. Design detailed in the vault under `Axiom-Vault/3. System/Projects/Hermes-Relay/Desktop Client.md`. Key insertion point is hermes-agent `model_tools.py::handle_function_call()` (~line 517) — before `registry.dispatch()`, consult a session-scoped routing table populated by a relay handshake extension where the client advertises which tools it can service. Isomorphic to how `android_*` tools already flow through the `bridge.command` channel. Proposed branch: `fork/tool-relay` on the hermes-agent fork; upstream issue to open before merging. Blocked on: (a) the handshake extension in `plugin/relay/auth.py` to carry the advertised-tools list, (b) a new `desktop.command` channel mirroring `bridge.command` semantics, (c) the upstream PR conversation.
+
+### Observability & introspection
+- Real-time accessibility event streaming for reactive workflows (`android_events`, `android_event_stream`)
+- On-device text-to-speech through the phone's system speaker for hands-free responses (distinct from the in-app voice mode)
+- Short MP4 screen recording for visual bug reports and "show me what happens when you tap this" flows
+- Annotated failure screenshots — auto-capture a screenshot with the intended target highlighted when a tap or wait fails, so the LLM can self-correct with visual context
+- Generalized loop guardrails across all bridge tools — extend `android_navigate`'s `max_iterations` cap into a per-session rolling counter covering every bridge tool call
+- Raw Intent / Broadcast escape hatch for power workflows
+
+### Automation & triggers
+- **Scheduled automations** — "every weekday at 7am, open Maps, check my commute, report the time." Wires bridge commands to hermes-agent's existing cron tool
+- **Event-triggered actions** — "when a notification from X arrives, do Y." Reactive rule engine on top of the notification companion + accessibility event stream
+- **User-recorded macros** — watch a workflow once, replay it on demand via `android_macro`
+- **Multi-phone pairing UX** — explicit "add another device" flow, per-device routing for tool calls
+- **Phone → server file transfer** — reverse direction of the existing inbound media pipeline ("fetch my latest photo")
+
+### Voice assistant
+- Always-listening wake-word mode (Porcupine or equivalent), off-by-default with explicit opt-in
+- Phone call handling — agent answers incoming calls, speaks via TTS, transcribes incoming audio, takes messages ("answer my phone, take a message, tell them I'll call back")
+
+### Research horizon
+- **On-device local model execution** — Gemma / Qwen running directly on the phone via MediaPipe or llama.cpp, for offline fallback and hybrid routing (simple tasks local, complex tasks remote)
+- **Cross-app workflow execution** with inter-step state carry-over — "find a restaurant on Maps, share it on WhatsApp, book an Uber there"
+- **Web dashboard** for monitoring bridge activity server-side
+- **iOS support** via Shortcuts + accessibility bridge + App Intents (evaluate feasibility before committing)
+- **Developer-mode embedded HTTP server** on the phone — a Ktor/Netty server on a local port for direct-to-phone testing over USB or LAN without routing through the relay (dev ergonomics, not user-facing)
+
+### Vision
+Dedicated **"Hermes Phone"** — a device (or phone ROM) that boots straight into agent mode, where the OS itself is the agent. Long-term north star, not a concrete deliverable.
+
+---
+
+## How this roadmap evolves
+
+New ideas enter via: direct proposals in GitHub issues, comparison passes against similar projects, community feedback from users and contributors, or internal research that turns into a shipped prototype.
+
+Active work waves (like the v0.4 bridge feature expansion above) get their detailed implementation plans in [`docs/plans/`](docs/plans/). When a plan wave ships, its plan file is archived or removed and the items migrate into [`CHANGELOG.md`](CHANGELOG.md).
+
+Have an idea? [Open an issue](https://github.com/Codename-11/hermes-relay/issues/new) — every one is read.

SECURITY.md

@@ -0,0 +1,91 @@
+# Security Policy
+
+Hermes-Relay can give a remote AI agent real control of a phone and, via the
+CLI, of a paired desktop. We take security reports seriously and welcome
+responsible disclosure.
+
+For the architecture, threat model, and the `googlePlay` vs. `sideload`
+capability boundary, see [`docs/security.md`](docs/security.md). This document
+covers **how to report a problem**.
+
+## Reporting a Vulnerability
+
+**Please do not open a public issue, discussion, or pull request for a security
+vulnerability.** Public reports expose users before a fix is available.
+
+Use one of these private channels instead:
+
+1. **GitHub Private Vulnerability Reporting (preferred).** Go to the
+   repository's **Security** tab → **Report a vulnerability**, or
+   [open a draft advisory directly](https://github.com/Codename-11/hermes-relay/security/advisories/new).
+   This keeps the whole exchange private and threaded with the code.
+2. **Email** — `security@codename-11.dev`. Use this if you can't use GitHub.
+   If you'd like to encrypt the report, say so in a first contact message and
+   we'll arrange a key.
+
+### What to include
+
+A good report lets us reproduce and assess impact quickly:
+
+- The affected surface — **Android app** (and which flavor, `googlePlay` or
+  `sideload`), **relay plugin / server**, **desktop CLI**, or the **docs site**.
+- Affected version(s) — app version/code, plugin version, or CLI version.
+- A clear description of the issue and its security impact.
+- Step-by-step reproduction, a proof of concept, or a minimal example.
+- Any suggested remediation, if you have one.
+
+> ⚠️ **Scrub secrets before sending.** Remove API keys, relay session tokens,
+> pairing codes, real hostnames/IPs, and personal data from logs, traces, and
+> screenshots.
+
+## What to Expect
+
+This is an indie, open-source project, so timelines are best-effort rather than
+contractual:
+
+- **Acknowledgement** of your report — typically within **5 business days**.
+- An initial **assessment and severity triage** after we can reproduce it.
+- **Coordinated disclosure:** we'll work with you on a fix and a disclosure
+  timeline, and credit you in the advisory and release notes if you'd like
+  (or keep you anonymous if you prefer).
+- A public GitHub Security Advisory and a `CHANGELOG.md` entry once a fix ships.
+
+## Scope
+
+**In scope** — vulnerabilities in code this project ships:
+
+- The Android app (`app/`) on either flavor.
+- The relay plugin and server (`plugin/`).
+- The desktop CLI (`desktop/`).
+- The pairing, auth, transport, media, and tool-routing surfaces.
+
+**Out of scope** — please report these to the right place instead:
+
+- **Your own Hermes server configuration** (missing TLS, an exposed dashboard,
+  weak provider keys). The relay connects only to endpoints you configure; how
+  you deploy and secure your Hermes host is outside this app. See
+  [`docs/security.md`](docs/security.md) and the relay-server docs for hardening
+  guidance.
+- **Upstream [hermes-agent](https://github.com/NousResearch/hermes-agent)**
+  issues — report those to the upstream project (a heads-up to us is welcome if
+  it affects how Hermes-Relay should behave).
+- **Third-party dependencies** — report upstream; if a dependency issue affects
+  Hermes-Relay users, tell us so we can pin or patch.
+- Findings that require a **rooted device, a physical-access attacker, or a
+  malicious app already granted Accessibility/overlay permissions** — these are
+  outside the model documented in `docs/security.md`, though we'll still read
+  the report.
+
+## Safe Harbor
+
+We consider security research conducted in good faith under this policy to be
+authorized. We will not pursue or support legal action against researchers who:
+
+- Make a good-faith effort to avoid privacy violations, data destruction, and
+  service disruption.
+- Test only against **their own devices, installs, and Hermes servers** — never
+  another person's data or infrastructure.
+- Report promptly and give us a reasonable chance to remediate before any
+  public disclosure.
+
+Thank you for helping keep Hermes-Relay and its users safe.

TODO.md

@@ -0,0 +1,245 @@
+# Hermes-Relay — TODO
+
+Open items that don't fit a formal Phase plan but shouldn't be lost. Items move from here into a Plan in `docs/spec.md` or an Obsidian Phase plan once they're ready to schedule.
+
+For shipped work, see `DEVLOG.md`. For architectural decisions, see `docs/decisions.md`.
+
+---
+
+## User-Added:
+
+- [x] **Clean-chat: taller scrollable text viewport** *(impl 2026-06-22, orchestration batch — unbuilt; verify in Studio.)* Replaced the fragile `screenHeightDp*0.34f` cap with a weight split (sphere `weight(1f)` / flow `weight(1.1f)` ≈ 52% of the vertical slack); kept the internal scroll + top-fade + `min=96.dp` floor. `AgentTextFlow.kt` (`1dca285`).
+- [ ] Verify profile selection retains voice config selections in all voice modes/configuration combinations - enhance UI/configurability/management for this.
+- [x] **Session delete on a non-default profile now persists** *(impl 2026-06-22, orchestration batch — unbuilt; verify in Studio.)* Root cause: a non-default profile's sessions live in that profile's own `state.db`, but the delete went through the unscoped api_server `DELETE /api/sessions/{id}` (shared DB) so the row survived and the next profile-scoped list resurrected it. Fix routes gateway deletes through the dashboard profile-scoped surface (write twin of the list path) + `refreshSessions()` after success. `DashboardApiClient`/`ConnectionViewModel`/`ChatViewModel`/`RelayApp` (`6552566`).
+- [x] **Voice-settings profile override in 'auto' mode** *(impl 2026-06-21, orchestration batch — unbuilt; verify in Studio. See DEVLOG + "Orchestration batch (2026-06-21)" below.)* Root cause: `VoiceViewModel.shouldPreferRealtimeVoice()` gated on `.route` (configured) not `.effectiveRoute` (resolved), so 'auto'+relay never engaged the override-capable relay path and fell back to host-global Standard `/api/audio/speak` (no override slot). Fixed + wired `connectionId` for per-profile voice-prefs namespacing. Original note: *Look into the voice-settings profile specific capabilities - in 'auto' mode the user-override voice wasn't applied (system default used) despite being displayed; only 'Relay' applied it.*
+
+- [x] **Analytics + Diagnostics overhaul** *(impl 2026-06-22, orchestration batch — unbuilt; verify in Studio.)* Diagnostics is now a full-screen `DiagnosticsScreen` (new `Screen.Diagnostics` route, replacing the modal sheet) led by a vertical status-check timeline — Network, API server, capabilities, chat transport, pairing/auth, relay, voice — each a green/amber/red/gray dot on a connecting rail with an inline failure reason; checks backed by a logged error are tappable into `DiagnosticDetailDialog`. Derived read-only from existing `ConnectionViewModel` flows + recent `DiagnosticsLog` via a pure `buildStatusChecks()`; recent-activity log kept below. Analytics hierarchy tidied. `c3098a9`. See follow-ups below.
+- [x] **Realtime voice stall + over-chatty status** *(client half impl 2026-06-21, orchestration batch — unbuilt; server half deferred, see below.)* Client now relaxes the 90s idle watchdog on promoted/long runs (5-min backstop kept) and throttles spoken status (≥22s gap, ≤3/turn); realtime waveform now gates on real playback-start. Original note: *Realtime voice mode stalls/times-out when calling a background Hermes task and repeatedly reports status vocally when not necessary.*
+- [x] **Connections reframe: "Vanilla/Standard Hermes" → "Hermes"** *(impl 2026-06-22, orchestration batch — unbuilt; verify in Studio.)* 28 user-facing display strings across 10 connection/voice/permissions files; "Hermes-Relay plugin" → "Relay plugin" where it reads naturally. Display text only — no enum names, sealed types, when-branches, or stored route values touched. `c9fa8f7`.
+- [x] **Lock app to a specific profile** *(impl 2026-06-21, orchestration batch — unbuilt; verify in Studio.)* Per-connection lock: new `ProfileLockStore`, `ProfileController` lock flows + enforcement, `ConnectionInfoSheet` collapses the picker to a static "Locked to <name>" row, `SettingsScreen` adds the lock card + dialog (the one surface still listing all profiles). Original note: *Allow locking app to a specific profile, hiding all other profiles except from this setting - cleanly hide profile specific UI elements based on this gate.*
+- [x] **Profile icon in the floating voice overlay** *(impl 2026-06-21, orchestration batch — unbuilt.)* `VoiceModeOverlay` header pill now shows the per-profile icon (`LocalAgentIconPath`); sphere/pet stays the fallback.
+- [x] **Voice dropdown state mixes + label overflow** *(impl 2026-06-21, orchestration batch — unbuilt.)* Invalid engine/route combos made unreachable (RealtimeAgent disabled without relay, unavailable routes disabled, `coerceAudioRoute` auto-corrects); long dropdown/provider labels get `maxLines=1`+ellipsis. Original note: *Fix the voice dropdown mode toggles to not allow weird state mixes - labels need overflow control to prevent 2 lines or crunching.*
+
+- [x] **Per-profile agent icon + static-image avatar (shipped 2026-06-20 —** `d827e46`**, see DEVLOG).** Per-profile icon: client-side `ProfileIconStore` (per `(connection, profile)`, never sent to Hermes; stores a copied-file path) → small Coil image beside the agent name in `MessageBubble` via `LocalAgentIconPath`; picker is `AgentIconRow` under the local-name row in `ConnectionInfoSheet`. Static image: "Add a pet" accepts a single image (magic-byte detect → one-frame static pet). Scope shipped: small name-adjacent icon only; big avatar stays global. Follow-ups: on-device smoke (import an image as a pet; set a profile icon, confirm it shows by the name + persists across restart); optionally also show the icon in the profile picker.
+
+## Orchestration batch (2026-06-22) — deferred follow-ups
+
+Four User-Added items resolved via a 4-worker orchestration pass (disjoint file ownership, coordinator-serialized commits): clean-chat viewport (`1dca285`), connections reframe (`c9fa8f7`), diagnostics/analytics (`c3098a9`), session-delete fix (`6552566`). Plus a follow-on profile-isolation fix raised mid-session: cold-start session-drawer hydration (`889273a`). **Committed to `dev`, NOT built/linted/verified.** Remaining:
+
+- **Build + lint + on-device verify all five (Studio).** Run `./gradlew lint` and a Studio build before pushing `dev` (workers couldn't run gradle). Then confirm on device: clean-chat shows a noticeably taller text area that scrolls; deleting a session on a *non-default* profile sticks (no resurrection after the drawer re-fetches); the Diagnostics screen renders honest per-check status + failure reasons and opens detail on a failing tappable row; connections/voice/permissions copy reads "Hermes"/"Relay"; **and on a cold start while a non-default profile is selected, the session drawer loads that profile's sessions directly with no flash of the server-default list.**
+- **Profile isolation — broader sweep (cold-start race).** The session drawer + restored session context are now gated on `ProfileController.selectionSettled` (`889273a`), so they no longer load the server-default profile before the persisted profile resolves. Other profile-scoped surfaces read the *live* `selectedProfile.value` and self-correct when it resolves but aren't gated: voice prefs (`VoiceViewModel.onProfileChanged` at the `RelayApp` voice effect), `profileDisplayAlias`, `profileIcon`. They re-seed on resolution (no visible content-flash like the drawer), but if any shows a wrong-profile beat on cold start, gate its first use on `profileSelectionSettled` the same way. Also: `selectionSettled`'s decision logic is unit-testable (pure over connId/selected/pending/profiles) — add a `ProfileControllerSettledTest` when convenient.
+- **Diagnostics: no live re-probe trigger.** The status checks reflect the *last* probe state (read-only snapshot). A "Re-run checks" button would need `ConnectionViewModel` to expose probe methods — deferred so the diagnostics work didn't have to edit a concurrently-owned VM.
+- **Diagnostics: Pass checks lack a last-checked timestamp/duration.** `StatusCheck` carries `timestampMs`/`durationMs`, but the VM doesn't expose probe timing, so passing rows show no "checked Ns ago". Wire when/if the VM surfaces probe timestamps.
+- **Connections reframe — out-of-scope occurrences left intentionally.** `ConnectionViewModel.kt`, `VoiceAudioClient.kt`, `VoiceViewModel.kt`, `BridgeCoreScreen.kt`, and `RelayApp.kt` still contain "Standard"/"Vanilla" in code identifiers/log strings; only user-facing display copy was reframed. Revisit if any of those surface to users.
+
+## Orchestration batch (2026-06-21) — deferred follow-ups
+
+Client-side profile-lock + voice fixes (the items marked above) landed via a planning→implementation orchestration pass, **built + deployed to device as 1.2.1 (versionCode 15)**; new unit suite green (36 Kotlin + 11 Python). On-device behaviour verification still pending. Remaining from that batch:
+
+- **Realtime voice: server-side half (Python) — DONE + DEPLOYED 2026-06-21.** `plugin/relay/realtime_agent/broker.py`: `_send_hermes_run_progress` now heartbeats while `session.hermes_task` is unfinished (helper `_should_continue_heartbeat`), closing the 90s stall at the source; spoken-status repeat raised 30s→90s and gated on a *coarse* status change (`_coarse_spoken_status_key` / `_should_repeat_spoken_status`) so tool-message churn no longer re-narrates. `plugin/tests/test_realtime_heartbeat.py` 11/11; `test_realtime_promotion` regression 5/5. Deployed: committed `d1820fb` → pushed to `origin/dev` → server `~/.hermes/hermes-relay` fast-forwarded + `hermes-relay` restarted (active, clean startup) — both client + server halves now live end-to-end (re-pair the phone after the relay restart). Optional follow-up: flip `promotion_enabled` default to True so long runs detach.
+- **Voice override on the streaming path (open question).** The `.route`→`.effectiveRoute` fix makes 'auto'+relay engage the override-capable path, but the streaming `/voice/output` renderer reads the relay's server-saved `voice_output:` config, not the UI `enhancedVoice` override. Decide whether the override card should also push to `updateVoiceOutputConfig`, or whether an override should force the basic `/voice/synthesize` path.
+- **Per-profile voice on Standard (upstream).** `/api/audio/*` is host-global/text-only; the Standard surface still can't carry a per-request voice. Needs the upstream profile-voice / `/v1/audio/*` PR. Until then the client prefers the relay path; consider surfacing an honest "override needs Relay" state when Standard is the effective surface.
+- **Profile lock: ChatScreen glyph + export.** The optional lock glyph on the chat-header avatar was skipped (`ChatScreen.kt` is owned by a concurrent session). Decide whether the per-connection lock belongs in settings export/import (it rides the `profile_selections` DataStore).
+- **Unit tests — DONE 2026-06-21 (36/36 pass via `:app:testSideloadDebugUnitTest`).** `ProfileLockStoreTest` (9 — uses an in-memory `DataStore` harness; the file-backed factory hits a Windows write-rename/instance race), `ProfileControllerLockTest` (8, Robolectric), `CoerceAudioRouteTest` (7), `VoiceStatusGatesTest` (12).
+- **CHANGELOG.** Add `[Unreleased]` entries (Profile lock → Added; voice override + realtime → Fixed) at build-verify/PR time.
+- **On-device verification.** Override applies in 'auto'+relay; realtime survives a &gt;90s background task without stalling and stops over-narrating; Speaking waveform unfolds at first audible frame; profile lock hides pickers + holds on a missing profile; overlay shows the profile icon.
+
+## Hands-free agentic voice backlog
+
+Goal: make Hermes usable for hands-free work without leaving the operator blind
+
+to tool state, safety prompts, or the current task.
+
+- **Waveform output-start sync** — current input waveform timing feels good, but
+
+the agent-output waveform can unfold and begin movement before audible speech
+
+starts. Split "preparing audio" from "speaking audio" in the visual layer, or
+
+gate the unfolded Speaking waveform on the first real playback frame/audio
+
+amplitude. Processing can stay as the folded circular spinner until output is
+
+actually audible.
+
+- **Voice command layer** — reserve local commands that bypass normal agent
+
+routing: "pause", "resume", "stop talking", "cancel", "repeat that", "open
+
+overlay", "return to Hermes", and "new chat". These should work while the
+
+agent is thinking, speaking, or using tools.
+
+- **Spoken tool progress** — when Hermes uses tools, voice mode should speak
+
+short status updates such as "I'm checking the relay logs" or "I found an
+
+error" without waiting for final assistant text. Long tool calls should emit
+
+periodic, low-noise progress updates.
+
+- **Realtime tool timeline parity** — the voice overlay should render the same
+
+live thinking blocks, streaming assistant text, and tool call progress as the
+
+normal chat surface without requiring exit/reload.
+
+- **Hands-free confirmation flow** — risky actions need first-class spoken and
+
+visual confirmation: "yes", "no", "cancel", "confirm", plus a visible and
+
+audible countdown for destructive actions.
+
+- **Voice session memory/status** — add a compact "where are we?" summary for
+
+the current voice task: active objective, last tool result, pending next step,
+
+and whether the agent is waiting on the user.
+
+- **Mode presets** — add presets such as Hands-free, Low latency, Careful tool
+
+mode, and Quiet/visual-only. Hands-free should favor Continuous listening,
+
+spoken tool progress, confirmations, and overlay availability.
+
+- **Barge-in hardening** — keep barge-in experimental until echo/self-recording
+
+is solved. The target path is proper AEC, playback-ducking, and a rule that
+
+output audio can never become a user turn.
+
+- **Audio quality guardrails** — normalize output volume across realtime and
+
+fallback TTS providers, keep pronunciation hints/profile voice tuning, and
+
+measure provider-specific delay, chunk gaps, and tail clipping.
+
+- **Pluggable Realtime Agent media transports** — add an OpenAI-first WebRTC
+
+transport option for Realtime Agent so mobile audio can use provider-native
+
+jitter buffering, interruption, and media handling instead of only relay
+
+WebSocket PCM. Design this as a provider transport interface
+
+(`websocket`, `webrtc`, future `livekit`/SIP-style bridges) so other
+
+realtime providers can opt in without forking the Hermes broker/tool
+
+contract. Hermes must still own tools, memory, confirmations, current data,
+
+and durable transcript state.
+
+- **Voice engine selector** — implemented as an opt-in experimental Realtime
+
+Agent engine in `docs/plans/2026-05-19-realtime-hermes-voice-agent.md`.
+
+Follow-up work is provider-native turn-taking, richer confirmation handling,
+
+and quality/latency evaluation before promotion beyond Experimental.
+
+- **Realtime-native Hermes bridge prototype** — first relay-brokered slice
+
+implemented in `docs/plans/2026-05-19-realtime-hermes-voice-agent.md`.
+
+Remaining work: let OpenAI/xAI realtime sessions own more of the live speech
+
+turn while still proxying every tool, confirmation, memory, and Android bridge
+
+action through Hermes/relay safety.
+
+---
+
+## Research / open questions
+
+### Proper Hermes plugin / skill / tool distribution
+
+**Status:** open question, no plan yet.
+
+We currently distribute Hermes-Relay via a one-shot `install.sh` that clones the repo, `pip install -e`s the package into the user's hermes-agent venv, and registers `skills/` via the `external_dirs` config knob. This works but it's a custom protocol — every project that wants to ship a Hermes plugin reinvents it.
+
+Things to look into:
+
+- **Does upstream hermes-agent have or plan a canonical plugin registry / package format?** If yes, we should migrate to it. If no, we may want to propose one upstream so third-party plugins (ours and others) get a standard install path.
+- **Skill distribution as separate from plugin distribution** — right now skills ride along with the plugin install via `external_dirs`. Should skills be installable independently (e.g. `hermes skill install <git-url>`)? Would that fragment maintenance or improve reuse?
+- **Tool registration discoverability** — `android_*` tools register at gateway import time. There's no canonical "list installed plugin tools" API. Would adding one to upstream make sense, or is `gateway tool list` already enough?
+- **Versioning + compatibility ranges** — `pip install -e` doesn't enforce version pins between hermes-agent and our plugin. A breaking change in upstream's plugin loader could silently break us. Do we need a `hermes_compat: ">=0.8.0,<1.0.0"` field somewhere?
+- `**hermes-relay-self-setup` SKILL.md as a precedent** — we just shipped a self-installing skill that an LLM can fetch from a raw GitHub URL and execute. Does this pattern generalize? Could it become a recommended way for any third-party Hermes project to ship setup automation?
+- **Bootstrap injection** — `hermes_relay_bootstrap/` monkey-patches `aiohttp.web.Application` to inject endpoints into vanilla upstream. This is intentional but feels like a hack. Upstream PR #8556 (`feat/session-api`) will eventually let us delete it — verified 2026-04-15 that its scope covers the full bootstrap surface (sessions, memory, skills, config, available-models). Track that PR's status periodically.
+- **Gateway slash-command preprocessor — upstream Stage 1 PR.** Sibling follow-up to #8556. Intercepts known gateway commands on `/v1/runs` + `/v1/chat/completions`, dispatches the stateless ones (`/help`, `/commands`) via `gateway_help_lines()`, returns a deterministic "use a channel with session state" notice for the stateful majority. Currently being prepared in `C:/Users/Bailey/Desktop/Open-Projects/hermes-agent-pr-prep/` on branch `feat/api-server-gateway-commands`; awaiting subagent's code + draft PR body before pushing. See `docs/upstream-contributions.md` §5.
+- **Gateway slash-command preprocessor — bootstrap middleware (Stage 1 equivalent).** Sibling shim in `hermes_relay_bootstrap/_command_middleware.py` that mirrors the upstream Stage 1 PR as an aiohttp middleware injected at bootstrap time. Ships the hallucination fix to vanilla-upstream installs before the upstream PR lands. Planned for v0.4.1, after the current bridge feature branch wraps. See `ROADMAP.md` v0.4.1 entry.
+- **Stage 2 — stateful slash-command dispatch on `/api/sessions/{id}/chat/stream`.** Blocked on PR #8556 merging. Once session primitives ship upstream, add a preprocessor scoped to the session chat stream endpoint only, using `session_id` as the persistence handle. Separate upstream PR + matching bootstrap middleware. See `docs/upstream-contributions.md` §5 ("Stage 2").
+
+When the answer becomes clearer, this section becomes either an ADR in `docs/decisions.md` or a Plan under `Plans/`.
+
+---
+
+## Smaller deferred items
+
+- **MediaProjection consent flow** — wired in MainActivity (2026-04-12), needs end-to-end test on a real device
+- **WorkManager upgrade for auto-disable timer** — currently a coroutine `Job + delay()` in `AutoDisableWorker.kt`; documented at top of file. Upgrade when androidx.work joins the classpath
+- **Wave 3 voice-bridge multi-turn confirmation** — currently a 5s TTS countdown with cancel; conversational confirmation is the follow-up
+- **LLM client wiring for `android_navigate`** — `_default_vision_model` is stubbed; production swap to a real Anthropic/OpenAI vision client
+- **Real screenshots of each flavor's a11y permission dialog** — for `user-docs/guide/release-tracks.md`
+- `**llms.txt` standard** — explicitly skipped in favor of the `hermes-relay-self-setup` SKILL.md path; revisit if the standard gains traction in the agent ecosystem
+- `**markdown-renderer`/`lifecycle` compileSdk ceiling — RESOLVED via compileSdk 37 (2026-06-22).** `MarkdownContent.kt` is on the 0.4x API, and `markdown-renderer 0.42.0` / `lifecycle 2.11.0` (the Dependabot bumps) require `compileSdk 37`. The project moved to **compileSdk 37** (`206d182`, across app/quest/relay-core/relay-ui; `targetSdk` stays 35), which satisfies them — so the temporary 1.2.2-prep pins (0.41.0 / 2.10.0 on compileSdk 36) were dropped when integrating `origin/dev`. **CLAUDE.md still says "Compile SDK 36" — update it to 37 to match the build.** A Dependabot ignore rule is still worth adding so a future bump that raises the compileSdk floor again fails loudly rather than silently (see next item).
+- **Dependabot auto-merge guardrails** — Dependabot merged breaking bumps despite CI failing. Investigate why `.github/workflows/dependabot-auto-merge.yml` isn't gating on CI status, and consider adding an ignore rule for packages we know need manual attention on major bumps (`markdown-renderer`, compose BOM, activity-compose).
+
+---
+
+## Crash reporting + foldable hardening (shipped 2026-06-20)
+
+Triggered by a Play Store review: app "keeps crashing" during setup on a Samsung Galaxy Z Fold7 (Android 16 / SDK 36, version code 13). Shipped: in-app crash capture (`util/CrashReporter.kt` — uncaught handler that persists a report then re-raises so Play vitals still collects; `ui/components/CrashReportDialog.kt` — show-once dialog with Copy + pre-filled GitHub-issue "Report"); QR camera-init hardening (`QrPairingScanner.kt` — try/catch around `ProcessCameraProvider.get()` and `InputImage.fromMediaImage()`, graceful `CameraUnavailableCard` → manual pairing instead of force-close).
+
+Follow-ups:
+
+- **Confirm the actual crash from Play vitals.** Pull the top crash cluster for Galaxy Z Fold7 / version code 13 (Quality → Android vitals → Crashes &amp; ANRs) to verify the camera path is the real cause vs. another setup-path throw. The hardening is correct regardless, but the trace closes the loop.
+- **Portrait lock is moot on large screens under SDK 36.** `android:screenOrientation="portrait"` is largely ignored by Android 16's mandatory large-screen orientation override on foldables/tablets. Decide whether to keep the lock (it still applies on phones) or make it conditional; either way it does not *cause* the crash.
+- **Foldable camera lifecycle races (from the 2026-06-20 audit, not yet fixed).** `QrPairingScanner` can still hit bind/unbind races on rapid fold/unfold recomposition (the `DisposableEffect` `unbindAll()` vs. an in-flight `addListener` bind), and `mapBoxToViewport` runs on possibly-stale `viewportSizePx` during a fold transition. Not crash-fatal after the try/catch hardening (logged + skipped), but worth a fold-aware guard if foldable adoption grows.
+- **Optional: surface crash history in Settings.** The reporter keeps only the most recent crash (`files/crash/last-crash.json`, consumed on view). If repeat-crash diagnosis becomes common, keep a small ring of recent reports + a Settings entry to view/copy them.
+
+---
+
+## Relay enhancement layer + agent-context injection (shipped 2026-06-20 — `docs/plans/2026-06-20-relay-enhancement-layer.md`)
+
+Shipped: `plugin/enhancements/` (registry + fail-open `context_injection` wrap of `AIAgent._build_system_prompt`), the `media-sensitivity` block, `GET /context/injected` audit route, dashboard toggles, client sensitivity re-thread + "Relay context (server-side)" audit section, and the transport-path UI (`ChatTransportStatusBadge` / `RelayStatusStrip` + tier ladder). OFF by default, removable, vanilla-safe.
+
+Follow-ups:
+
+- **Confirm the `AIAgent` seam on the live host before relying on it.** `context_injection._resolve_ai_agent_class()` tries `agent.system_prompt` / `run_agent`. When you flip `RELAY_AGENT_CONTEXT_ENABLED=1`, verify `GET /context/injected` shows the block AND that it actually lands in the prompt (the wrap is fail-open, so a wrong module = inert, not broken). If the class lives elsewhere, widen the module list.
+- **Retire the monkey-patch when upstream adds a plugin context hook.** Drop `context_injection` (and migrate to the native hook) the moment hermes-agent ships a first-class system-prompt contributor — same as we retire bootstrap routes for native upstream routes.
+- **Incremental bootstrap migration.** Fold the existing `hermes_relay_bootstrap` route-patches into `plugin/enhancements/` per-surface (startup phase) so patching is one surface; don't big-bang the working compat.
+- **Structured media channel** — `docs/plans/2026-06-20-structured-media-channel.md` (design only). Replace fragile `MEDIA:`/markdown text markers with a structured channel carrying `sensitive` natively; lead with a relay `relay_send_media(path, sensitive, …)` tool.
+- **Gateway voice-ephemeral via the same slot.** The enhancement layer's server-side injection can carry per-turn voice instructions on the gateway (which has no ephemeral `system_message`), letting voice stay on the gateway instead of being forced to SSE. Wire when the voice path is revisited.
+
+---
+
+## Attachments (shipped 2026-06-18 — `docs/plans/2026-06-18-attachment-experience.md`)
+
+- **B3 — download progress + cancel.** Inbound fetch is un-cancelable; the previews work scaffolded an indeterminate bar + nullable `onCancel`. Live wiring needs the fetch-path owner (`ChatViewModel`/`Attachment`) to expose determinate progress (Content-Length) + a cancel hook.
+- **A6 — multi-image gallery.** N images in one message → grid + swipe-across viewer (Telegram media-group parity).
+- **C5 — agent-side sensitivity config gate.** `RELAY_MEDIA_SENSITIVITY_HINTS` (env or per-profile) instructing the agent to annotate sensitive media via the prompt-builder. Transport (relay `X-Media-Sensitive` header + client blur) already ships; the agent isn't asked to set the bit yet.
+- **Relay thumbnails (D6).** Server-side thumbnail generation to avoid full-size download for cards/galleries. Needs an image lib (Pillow not currently a dep) — evaluate before adding.
+- **D5 — outbound upload progress.** No per-attachment progress during the 60s gateway PDF-render window.
+
+## Voice overhaul (shipped 2026-06-18 — `docs/plans/2026-06-18-voice-overhaul.md`)
+
+- **Per-profile voice on Standard (upstream PR).** Upstream `/api/profiles/*` has no voice field and `/api/audio/*` is host-global. Long-term: PR a voice section to the profile config + make `/api/audio/*` honor the active/`?profile=` profile. The relay path already carries per-profile voice; ship that first.
+- **Wire connectionId for per-profile voice namespacing.** `VoicePreferencesRepository` is scope-aware (`base_connId_profile`), but `RelayApp` passes only the profile *name* to `onProfileChanged`, so `connectionId` is null and keys namespace by profile-only. Wire `setVoicePrefsConnection` to `ConnectionViewModel.activeConnectionId` (in `RelayApp`) so two connections with same-named profiles don't share voice settings.
+- **Realtime-PCM waveform output gating.** The basic-TTS output waveform is now Visualizer-accurate (gated on real playback amplitude), but the realtime path gates `outputAudioActive` on `audioSeen` (first decoded PCM bytes) in `VoiceViewModel.handleRealtimeVoiceEvent`, which can still lead audible output by the `RealtimePcmPlayer` start prebuffer. Gate realtime on actual playback-start (head moved) to match the basic-TTS path.
+
+## Chat clean-mode + pets (shipped 2026-06-18 — `docs/plans/2026-06-18-chat-clean-mode-and-pets.md`)
+
+- **Part-A chat polish (optional bundle).** Per-code-block copy + horizontal scroll, visible copy affordance, mid-stream stall feedback, profile/skill-aware empty-state chips, the ~40-flow recomposition hotspot at the top of `ChatScreen`. (Sphere `contentDescription`/reduced-motion was handled by the clean-mode a11y work.)
+- **Pet hot-load + in-app add/remove (shipped 2026-06-20).** Pets now live-refresh: an `avatarsRefreshTick` keys the avatar `produceState` in `RelayApp`, and Appearance re-scans `pets/` on open and after in-app import/delete — no app restart. Appearance gained "Add a pet" (SAF `.zip` import via `PetImporter`, zip-slip/zip-bomb guarded + validated through `toAvatar`) and an "Installed pets" list with per-pet remove (`PetLoader.deletePet`, confirm dialog, Sphere fallback). Remaining:
+  - **Sphere-skin parity.** Skins are still process-scoped + `adb push` only — the live tick and the importer cover pets, not skins. Extend the tick to `loadUserSkins` and add a `.json` skin import if hot-loading/adding skins in-app is wanted.
+  - `**adb push` into `Android/data` hangs on Samsung scoped storage.** Confirmed: pushing a pet pack to `/sdcard/Android/data/<pkg>/files/pets/` stalls (no bytes written) although `adb shell ls` of the dir works. In-app `.zip` import is the supported path; `/sdcard/Download` pushes fine. Consider softening `docs/pet-spec.md` + user-docs to lead with in-app import over adb.
+  - **On-device import/delete smoke.** Import `/sdcard/Download/lucy.zip` via Add a pet → confirm Lucy appears, selects, and animates all states; then remove it and confirm the avatar falls back to the Sphere.
+- **Pet state-change re-decode can flash one blank frame.** When the agent state switches clips, the first frame of the new clip may briefly be blank during decode; prewarm/hold-last-frame to smooth it. Root cause is the same as the next item: `PetAvatar.Render` re-decodes from disk on every clip change.
+- **Pet frame-sequence memory: no cap or downsample (audit 2026-06-19).** `decodeClip` decodes every frame of the selected clip into `List<ImageBitmap>` at full resolution with no `inSampleSize` downscale to the display size and no frame-count/dimension ceiling — a long sequence of large PNGs can use a lot of RAM and a single very large image can OOM `BitmapFactory`. Add `inSampleSize` downsampling to the avatar's draw size and/or a documented hard cap. Spec now warns authors (prefer sprite sheets), but the renderer doesn't enforce it.
+- **Pet decoded-clip cache (audit 2026-06-19).** `PetAvatar.Render` keys `produceState` on `clip`, so idle→thinking→speaking→idle within one turn re-runs `BitmapFactory.decodeFile` from disk each transition (repeated I/O + GC churn, and the blank-frame flash above). Add a small per-avatar `Map<SphereState, PetFrames>` decode cache.
+- **Pet behavior model — richer state association (spec'd 2026-06-19, `docs/pet-spec.md` "Agent states &amp; pet behavior").** Shipped: the honesty clamp (declared reactivity ∩ `PET_RENDERER_CAPABILITIES`), the friendly `writing` alias, the `**working`/tool-use overlay** (pet-local sub-state from `toolCallBurst`; opt-in `working` clip drives both the swap and the Tools badge), the **one-shot reaction layer** (`greet`/`wake` on appear, `done`/`celebrate` on turn-finish — opt-in, play-once-then-revert, transition-derived; `ONE_SHOT_MAX_MS` backstop), and `**intensity` modulation** (opt-in `reactive.intensity` → live playback speedup ≤1.6× via `rememberUpdatedState`; un-clamps the Activity badge). Voice · Tools · Activity reactivity is now complete. Remaining:
+  - `**attention` one-shot (only deferred behavior).** A reaction on notification arrival — needs a host event the avatar doesn't yet receive (unlike `greet`/`done`, which ride state transitions). Would plumb a notification edge into `AvatarRenderState` (or a side channel) + a `PetOneShot.Attention`. Low priority: the avatar is rarely on-screen when notifications land (backgrounded) — see the value analysis; revisit only if the avatar becomes an always-on surface (persistent overlay / Quest port).
+  - **On-device verification (working + one-shots + intensity).** Best seen in clean mode (`AgentTextFlow` feeds `toolCallBurst` + `streamingIntensity` + state transitions). Confirm: a `working` clip swaps in during a tool run and releases ~600ms after (`WORKING_BURST_THRESHOLD` 0.5); a `done` clip plays once on reply completion then returns to idle; a `greet` clip plays once when the avatar appears; with `intensity:true`, a writing/working loop visibly quickens while streaming. Watch for the known clip re-decode flash on each swap (separate TODO — decoded-clip cache).
+- **Undecodable-but-present image appears valid (audit 2026-06-19).** A file that exists but isn't a decodable image passes the loader's `isFile` check, so the pet shows in the picker but renders blank. Documented as a caveat; consider a cheap header sniff at load time if false-valid pets become a support issue.
+

app/build.gradle.kts

@@ -7,12 +7,35 @@ plugins {
     alias(libs.plugins.play.publisher)
 }
 
+// Rename output artifacts to include the app version. AGP respects
+// `archivesName` for both APK (assemble*) and AAB (bundle*) outputs, so
+// this single line produces `hermes-relay-<version>-<flavor>-<buildType>`
+// filenames across debug, release, and per-flavor variants. The version
+// is pulled from libs.versions.toml so bumping via scripts/bump-version.sh
+// keeps artifact names in sync with no second source of truth.
+base {
+    archivesName.set("hermes-relay-${libs.versions.appVersionName.get()}")
+}
+
 android {
+    // Kotlin package / on-disk source layout / R class namespace. Decoupled
+    // from `applicationId` below as of the Axiom-Labs org-account migration:
+    // the repo's source tree stays under `com.hermesandroid.relay` (so all
+    // 130+ Kotlin files and their package declarations keep working) while
+    // the Play Store / Android-system identity lives under `com.axiomlabs.*`.
+    // This is an AGP-supported pattern — `namespace` is a build-time concept
+    // and `applicationId` is the runtime install identity; they don't have
+    // to match.
     namespace = "com.hermesandroid.relay"
-    compileSdk = 36
+    compileSdk = 37
 
     defaultConfig {
-        applicationId = "com.hermesandroid.relay"
+        // Axiom-Labs, LLC Play Console listing. Changed from the original
+        // `com.hermesandroid.relay` on 2026-04-13 during the org-account
+        // migration. The old Internal-testing listing under Bailey's personal
+        // account is being deleted; the DUNS-verified Axiom-Labs account is
+        // exempt from Play's 14-day closed-testing rule. See RELEASE.md.
+        applicationId = "com.axiomlabs.hermesrelay"
         minSdk = 26
         targetSdk = 35
         versionCode = libs.versions.appVersionCode.get().toInt()
@@ -31,11 +54,10 @@ android {
                 Properties().apply { localProps.inputStream().use { stream -> load(stream) } }
             } else null
 
-            storeFile = file(
-                System.getenv("HERMES_KEYSTORE_PATH")
-                    ?: props?.getProperty("hermes.keystore.path")
-                    ?: "/nonexistent"
-            )
+            val keystorePath = System.getenv("HERMES_KEYSTORE_PATH")
+                ?: props?.getProperty("hermes.keystore.path")
+                ?: "/nonexistent"
+            storeFile = rootProject.file(keystorePath)
             storePassword = System.getenv("HERMES_KEYSTORE_PASSWORD")
                 ?: props?.getProperty("hermes.keystore.password") ?: ""
             keyAlias = System.getenv("HERMES_KEY_ALIAS")
@@ -45,12 +67,67 @@ android {
         }
     }
 
+    // ─── Bridge release tracks ─────────────────────────────────────────────────
+    // Google Play ships Bridge Core only: pairing, chat, voice, terminal/TUI,
+    // media, notification companion, relay sessions, and status. It does not
+    // declare AccessibilityService, overlay, MediaProjection, wake-lock device
+    // control, SMS/call/contact/location, or unattended-control permissions.
+    //
+    //   googlePlay  — canonical Play Store install. Bridge Core only.
+    //
+    //   sideload    — Device Control for users who install directly (GitHub
+    //                 Releases, F-Droid, ADB). AccessibilityService, gestures,
+    //                 screenshots, overlay/status chip, and phone utilities are
+    //                 declared in the sideload manifest.
+    //
+    // applicationIdSuffix decision: sideload gets `.sideload` so both tracks can
+    // coexist on the same device. The Play build keeps the base
+    // `com.axiomlabs.hermesrelay` applicationId as the canonical Play Store
+    // install; sideload becomes `com.axiomlabs.hermesrelay.sideload`. Cost:
+    // anyone with both installed sees two launcher icons — we differentiate
+    // via the flavored strings.xml label suffix.
+    //
+    // Note: the previous `com.hermesandroid.relay` applicationId (Internal
+    // testing under Bailey's personal Play account) is being retired as part
+    // of the Axiom-Labs org-account migration. Play Store package names are
+    // permanently reserved once used, so the old ID can never be reclaimed —
+    // existing Internal-testing installs won't auto-upgrade to the new listing
+    // and will need a manual reinstall (limited blast radius, single tester).
+    flavorDimensions += "track"
+    productFlavors {
+        create("googlePlay") {
+            dimension = "track"
+            // No applicationIdSuffix — this IS the canonical Play Store install.
+        }
+        create("sideload") {
+            dimension = "track"
+            applicationIdSuffix = ".sideload"
+            versionNameSuffix = "-sideload"
+        }
+    }
+
+    // Structural guard: the sideload flavor is distributed via GitHub Releases /
+    // F-Droid / ADB and must NEVER be uploaded to Play Console (it declares the
+    // unattended Device Control surface Play forbids). gradle-play-publisher
+    // generates a publish task per variant, so the aggregate `publishReleaseBundle`
+    // would otherwise try BOTH flavors. Disabling sideload here means only
+    // `publishGooglePlayReleaseBundle` can ever reach Play — see the `play { }`
+    // block below and .github/workflows/release-android.yml.
+    playConfigs {
+        register("sideload") {
+            enabled.set(false)
+        }
+    }
+
     buildTypes {
         debug {
             buildConfigField("boolean", "DEV_MODE", "true")
         }
         release {
             isMinifyEnabled = true
+            ndk {
+                debugSymbolLevel = "SYMBOL_TABLE"
+            }
             proguardFiles(
                 getDefaultProguardFile("proguard-android-optimize.txt"),
                 "proguard-rules.pro"
@@ -86,6 +163,27 @@ android {
             kotlin.srcDirs("src/androidTest/kotlin")
         }
     }
+
+    // JVM unit tests run against the stubbed Android SDK jar, where every
+    // platform API method throws RuntimeException("... not mocked") by
+    // default. With returnDefaultValues = true, those stubs instead
+    // return the Java defaults (0 / null / false / empty). This unblocks
+    // tests that exercise production code calling android.util.Log (which
+    // UnattendedAccessManager does defensively in catch blocks) without
+    // needing every test to mockkStatic(Log::class). Regression discovered
+    // when v0.5.0 CI release caught UnattendedAccessManagerTest's
+    // acquireForAction_uninitialized + refreshKeyguardState_threwException
+    // both failing with RuntimeException from unmocked Log.w calls.
+    testOptions {
+        unitTests.isReturnDefaultValues = true
+        // Robolectric (VoicePlayerTest) needs merged Android resources +
+        // manifest on the unit-test classpath to bootstrap its sandbox.
+        unitTests.isIncludeAndroidResources = true
+        // [POC] Roborazzi runs without its Gradle plugin (the plugin needs AGP's
+        // removed TestedExtension). Force record mode via the test-JVM system
+        // property the plugin would otherwise inject, so captureRoboImage writes.
+        unitTests.all { it.systemProperty("roborazzi.test.record", "true") }
+    }
 }
 
 // Google Play Publisher — optional automated upload to Play Console.
@@ -104,6 +202,17 @@ kotlin {
     jvmToolchain(17)
 }
 
+// [screenshots] Host-side screenshot tests render MessageBubble -> MarkdownContent,
+// whose code-highlighter (dev.snipme.highlights) ships Java-21 bytecode. The build
+// toolchain pins test execution to JDK 17, which can't load class-file v65, so run
+// unit tests on a 21 JVM. Compile target stays 17; on-device (dexed) is unaffected.
+// foojay (settings.gradle.kts) auto-provisions the 21 JDK if absent.
+tasks.withType<Test>().configureEach {
+    javaLauncher.set(
+        javaToolchains.launcherFor { languageVersion.set(JavaLanguageVersion.of(21)) }
+    )
+}
+
 dependencies {
     // Compose BOM
     val composeBom = platform(libs.compose.bom)
@@ -126,6 +235,7 @@ dependencies {
     implementation(libs.lifecycle.runtime.ktx)
     implementation(libs.lifecycle.runtime.compose)
     implementation(libs.lifecycle.viewmodel.compose)
+    implementation(libs.lifecycle.process)
 
     // Activity
     implementation(libs.activity.compose)
@@ -137,10 +247,30 @@ dependencies {
     implementation(libs.okhttp)
     implementation(libs.okhttp.sse)
 
+    // Media3 ExoPlayer — gapless TTS queue playback (replaces MediaPlayer in VoicePlayer)
+    implementation(libs.media3.exoplayer)
+
+    // android-vad Silero — on-device VAD for barge-in (B2)
+    // Bundled ONNX Silero model (~2.2 MB); pulled from JitPack.
+    implementation(libs.android.vad.silero)
+
+    // Google Play In-App Update — googlePlay flavor ONLY (FLEXIBLE flow).
+    // Scoped via the `googlePlayImplementation` configuration so it never
+    // ships in the sideload APK, which updates via the GitHub-releases
+    // UpdateChecker instead. The `app/src/googlePlay/.../update/` impl
+    // references AppUpdateManager; the `app/src/sideload/.../update/` impl
+    // never touches this library.
+    "googlePlayImplementation"(libs.play.app.update)
+    "googlePlayImplementation"(libs.play.app.update.ktx)
+
     // Markdown rendering
     implementation(libs.markdown.renderer.m3)
     implementation(libs.markdown.renderer.code)
 
+    // Coil 3 — async image loading for generated images in chat
+    implementation(libs.coil.compose)
+    implementation(libs.coil.network.okhttp)
+
     // QR Code scanning (ML Kit + CameraX)
     implementation(libs.mlkit.barcode)
     implementation(libs.camera.core)
@@ -170,9 +300,26 @@ dependencies {
     // Testing
     testImplementation(libs.junit)
     testImplementation(libs.mockk)
+    testImplementation(libs.robolectric)
     testImplementation(libs.kotlinx.coroutines.test)
     testImplementation(libs.kotlinx.serialization.json)
+    // MockWebServer for ADR 24 EndpointResolver tests — probes HEAD /health
+    // across priority groups against real local sockets so the behavior we
+    // validate matches on-device.
+    testImplementation(libs.okhttp.mockwebserver)
+    // Konsist — enforces the ADR 34 upstream/relay/shared package fence as a JUnit test
+    testImplementation(libs.konsist)
     androidTestImplementation(libs.compose.ui.test.junit4)
     debugImplementation(libs.compose.ui.tooling)
     debugImplementation(libs.compose.ui.test.manifest)
+
+    // [POC] Roborazzi host-side screenshot rendering (src/test, Robolectric).
+    // Renders real composables on the JVM at an exact canvas — no device, no
+    // status bar, no clipping. See StoreScreenshotTest.
+    testImplementation("io.github.takahirom.roborazzi:roborazzi:1.43.1")
+    testImplementation("io.github.takahirom.roborazzi:roborazzi-compose:1.43.1")
+    testImplementation(libs.compose.ui.test.junit4)
+    testImplementation(libs.compose.ui.test.manifest)
+    testImplementation("androidx.test.ext:junit:1.3.0")
 }
+

app/src/androidTest/kotlin/com/hermesandroid/relay/ui/components/BridgeMasterToggleTest.kt

@@ -0,0 +1,155 @@
+package com.hermesandroid.relay.ui.components
+
+import androidx.compose.material3.MaterialTheme
+import androidx.compose.ui.test.assertIsOff
+import androidx.compose.ui.test.isToggleable
+import androidx.compose.ui.test.junit4.createComposeRule
+import androidx.compose.ui.test.performClick
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertTrue
+import org.junit.Rule
+import org.junit.Test
+
+/**
+ * Instrumented tests for the v0.4.1 [BridgeMasterToggle] polish: tapping
+ * the Switch to ON while accessibility hasn't been granted must route
+ * through the new [BridgeMasterToggle.onAccessibilityNeeded] callback
+ * instead of silently flipping the toggle on.
+ *
+ * The Switch is intentionally *not* `enabled = false` when accessibility
+ * is missing — a disabled Switch swallows taps silently on Android, which
+ * reads as a broken control to users. Instead the onCheckedChange handler
+ * short-circuits through onAccessibilityNeeded so BridgeScreen can surface
+ * an "Open Settings" snackbar.
+ */
+class BridgeMasterToggleTest {
+
+    @get:Rule
+    val composeTestRule = createComposeRule()
+
+    @Test
+    fun switch_whenAccessibilityMissing_togglingOn_callsOnAccessibilityNeeded() {
+        var toggleCalls = 0
+        var toggleLastValue: Boolean? = null
+        var needsCalls = 0
+
+        composeTestRule.setContent {
+            MaterialTheme {
+                BridgeMasterToggle(
+                    enabled = false,
+                    status = null,
+                    accessibilityGranted = false,
+                    onToggle = { wantsOn ->
+                        toggleCalls++
+                        toggleLastValue = wantsOn
+                    },
+                    onAccessibilityNeeded = { needsCalls++ },
+                )
+            }
+        }
+
+        // The Switch is the only toggleable node in this composable — find it
+        // without relying on an accessibility label (the design spec doesn't
+        // currently give the Switch one) to avoid flakiness if the label
+        // changes.
+        composeTestRule.onNode(isToggleable()).assertIsOff()
+        composeTestRule.onNode(isToggleable()).performClick()
+        composeTestRule.waitForIdle()
+
+        assertEquals(
+            "onAccessibilityNeeded should fire exactly once when user taps " +
+                "to enable without accessibility permission",
+            1,
+            needsCalls,
+        )
+        assertEquals(
+            "onToggle must NOT fire on the blocked-enable path — otherwise " +
+                "callers would see a phantom enable event even though a11y " +
+                "isn't granted",
+            0,
+            toggleCalls,
+        )
+        assertEquals(
+            "sanity: onToggle lastValue should remain untouched",
+            null,
+            toggleLastValue,
+        )
+    }
+
+    @Test
+    fun switch_whenAccessibilityGrantedAndOn_togglingOff_callsOnToggleFalse() {
+        // Complementary path: when accessibility IS granted and the Switch
+        // is currently checked, flipping it off must go through onToggle
+        // (not onAccessibilityNeeded). Locks in that the new conditional
+        // didn't accidentally hijack the normal toggle-off path.
+        var toggleCalls = 0
+        var toggleLastValue: Boolean? = null
+        var needsCalls = 0
+
+        composeTestRule.setContent {
+            MaterialTheme {
+                BridgeMasterToggle(
+                    enabled = true,
+                    status = null,
+                    accessibilityGranted = true,
+                    onToggle = { wantsOn ->
+                        toggleCalls++
+                        toggleLastValue = wantsOn
+                    },
+                    onAccessibilityNeeded = { needsCalls++ },
+                )
+            }
+        }
+
+        composeTestRule.onNode(isToggleable()).performClick()
+        composeTestRule.waitForIdle()
+
+        assertEquals("onToggle must fire exactly once", 1, toggleCalls)
+        assertFalse(
+            "toggling a checked switch should pass wantsOn=false",
+            toggleLastValue!!,
+        )
+        assertEquals(
+            "onAccessibilityNeeded must NOT fire on the normal toggle-off path",
+            0,
+            needsCalls,
+        )
+    }
+
+    @Test
+    fun switch_whenAccessibilityGrantedAndOff_togglingOn_callsOnToggleTrue() {
+        var toggleCalls = 0
+        var toggleLastValue: Boolean? = null
+        var needsCalls = 0
+
+        composeTestRule.setContent {
+            MaterialTheme {
+                BridgeMasterToggle(
+                    enabled = false,
+                    status = null,
+                    accessibilityGranted = true,
+                    onToggle = { wantsOn ->
+                        toggleCalls++
+                        toggleLastValue = wantsOn
+                    },
+                    onAccessibilityNeeded = { needsCalls++ },
+                )
+            }
+        }
+
+        composeTestRule.onNode(isToggleable()).performClick()
+        composeTestRule.waitForIdle()
+
+        assertEquals("onToggle must fire exactly once", 1, toggleCalls)
+        assertTrue(
+            "toggling an unchecked switch with a11y granted should pass wantsOn=true",
+            toggleLastValue!!,
+        )
+        assertEquals(
+            "onAccessibilityNeeded must NOT fire when a11y is already granted",
+            0,
+            needsCalls,
+        )
+    }
+}

app/src/androidTest/kotlin/com/hermesandroid/relay/ui/components/PowerFeatureGateUiTest.kt

@@ -0,0 +1,66 @@
+package com.hermesandroid.relay.ui.components
+
+import androidx.compose.material3.MaterialTheme
+import androidx.compose.ui.test.assertIsDisplayed
+import androidx.compose.ui.test.junit4.createComposeRule
+import androidx.compose.ui.test.onNodeWithText
+import org.junit.Rule
+import org.junit.Test
+
+class PowerFeatureGateUiTest {
+
+    @get:Rule
+    val composeTestRule = createComposeRule()
+
+    @Test
+    fun requiresPairingCard_showsPairToUnlock() {
+        composeTestRule.setContent {
+            MaterialTheme {
+                PowerFeatureGateCard(
+                    title = "Terminal",
+                    summary = "Open a server shell through your paired relay session.",
+                    status = PowerFeatureGateStatus.RequiresPairing,
+                    onPrimaryAction = {},
+                )
+            }
+        }
+
+        composeTestRule.onNodeWithText("Requires pairing").assertIsDisplayed()
+        composeTestRule.onNodeWithText("Pair to unlock").assertIsDisplayed()
+        composeTestRule.onNodeWithText("This feature uses relay grants", substring = true).assertIsDisplayed()
+    }
+
+    @Test
+    fun expiredPairingCard_showsPairAgain() {
+        composeTestRule.setContent {
+            MaterialTheme {
+                PowerFeatureGateCard(
+                    title = "Bridge",
+                    summary = "Let Hermes send approved bridge commands to this phone.",
+                    status = PowerFeatureGateStatus.PairingExpired,
+                    onPrimaryAction = {},
+                )
+            }
+        }
+
+        composeTestRule.onNodeWithText("Pairing expired").assertIsDisplayed()
+        composeTestRule.onNodeWithText("Pair again").assertIsDisplayed()
+    }
+
+    @Test
+    fun dashboardSignInCard_usesDashboardLanguage() {
+        composeTestRule.setContent {
+            MaterialTheme {
+                PowerFeatureGateCard(
+                    title = "Manage",
+                    summary = "Open dashboard-backed management features.",
+                    status = PowerFeatureGateStatus.DashboardSignInRequired,
+                    onPrimaryAction = {},
+                )
+            }
+        }
+
+        composeTestRule.onNodeWithText("Dashboard sign-in required").assertIsDisplayed()
+        composeTestRule.onNodeWithText("Open sign-in").assertIsDisplayed()
+    }
+}

app/src/androidTest/kotlin/com/hermesandroid/relay/ui/components/UnattendedAccessRowTest.kt

@@ -0,0 +1,107 @@
+package com.hermesandroid.relay.ui.components
+
+import androidx.compose.material3.MaterialTheme
+import androidx.compose.ui.test.assertIsDisplayed
+import androidx.compose.ui.test.assertIsNotEnabled
+import androidx.compose.ui.test.assertIsEnabled
+import androidx.compose.ui.test.isToggleable
+import androidx.compose.ui.test.junit4.createComposeRule
+import androidx.compose.ui.test.onNodeWithText
+import org.junit.Rule
+import org.junit.Test
+
+/**
+ * Instrumented tests for the v0.4.1 [UnattendedAccessRow] `masterEnabled`
+ * gate. When the master Agent Control switch is off, the unattended-access
+ * Switch must be disabled and the subtitle must advise the user to enable
+ * the master switch first — otherwise they'd flip unattended on and see
+ * nothing happen (the wake-lock acquire path short-circuits on master-off
+ * regardless of this flag).
+ */
+class UnattendedAccessRowTest {
+
+    @get:Rule
+    val composeTestRule = createComposeRule()
+
+    @Test
+    fun masterDisabled_switchIsDisabled() {
+        composeTestRule.setContent {
+            MaterialTheme {
+                UnattendedAccessRow(
+                    enabled = false,
+                    warningSeen = true,
+                    credentialLockDetected = false,
+                    onToggle = {},
+                    onWarningSeen = {},
+                    masterEnabled = false,
+                )
+            }
+        }
+
+        composeTestRule.onNode(isToggleable()).assertIsNotEnabled()
+    }
+
+    @Test
+    fun masterDisabled_subtitleExplainsWhy() {
+        composeTestRule.setContent {
+            MaterialTheme {
+                UnattendedAccessRow(
+                    enabled = false,
+                    warningSeen = true,
+                    credentialLockDetected = false,
+                    onToggle = {},
+                    onWarningSeen = {},
+                    masterEnabled = false,
+                )
+            }
+        }
+
+        composeTestRule
+            .onNodeWithText("Requires Agent Control", substring = true)
+            .assertIsDisplayed()
+        composeTestRule
+            .onNodeWithText("enable the master switch above first", substring = true)
+            .assertIsDisplayed()
+    }
+
+    @Test
+    fun masterEnabled_switchIsInteractive() {
+        // Regression: don't accidentally disable the Switch in the common path.
+        composeTestRule.setContent {
+            MaterialTheme {
+                UnattendedAccessRow(
+                    enabled = false,
+                    warningSeen = true,
+                    credentialLockDetected = false,
+                    onToggle = {},
+                    onWarningSeen = {},
+                    masterEnabled = true,
+                )
+            }
+        }
+
+        composeTestRule.onNode(isToggleable()).assertIsEnabled()
+    }
+
+    @Test
+    fun masterEnabled_offSubtitle_doesNotMentionMasterRequirement() {
+        composeTestRule.setContent {
+            MaterialTheme {
+                UnattendedAccessRow(
+                    enabled = false,
+                    warningSeen = true,
+                    credentialLockDetected = false,
+                    onToggle = {},
+                    onWarningSeen = {},
+                    masterEnabled = true,
+                )
+            }
+        }
+
+        // The off-but-master-on subtitle is the "actions only land when the
+        // screen is already on" copy, NOT the master-gated one.
+        composeTestRule
+            .onNodeWithText("bridge actions only land", substring = true)
+            .assertIsDisplayed()
+    }
+}

app/src/androidTest/kotlin/com/hermesandroid/relay/ui/components/VoiceModeOverlayTranscriptTest.kt

@@ -0,0 +1,104 @@
+package com.hermesandroid.relay.ui.components
+
+import androidx.compose.material3.MaterialTheme
+import androidx.compose.ui.test.junit4.createComposeRule
+import androidx.compose.ui.test.onAllNodesWithText
+import com.hermesandroid.relay.data.ChatMessage
+import com.hermesandroid.relay.data.MessageRole
+import com.hermesandroid.relay.viewmodel.InteractionMode
+import com.hermesandroid.relay.viewmodel.VoiceState
+import com.hermesandroid.relay.viewmodel.VoiceUiState
+import org.junit.Assert.assertEquals
+import org.junit.Rule
+import org.junit.Test
+
+/**
+ * Verifies the voice overlay renders exactly one transcript row per turn
+ * even when [VoiceUiState.transcribedText] and [VoiceUiState.responseText]
+ * are populated alongside the same content in [ChatMessage]s.
+ *
+ * Pre-fix bug: the overlay rendered from THREE sources — `transcribedText`
+ * (a top "YOU" row), `responseText` (a `StreamingResponseRow`), and
+ * `transcriptMessages` (the scrolling chat-history list). During a voice
+ * turn ChatViewModel committed the user's send and streamed the assistant
+ * reply into its own message flow, so the same content ended up in both
+ * `transcribedText`/`responseText` AND in `transcriptMessages` — every
+ * turn appeared twice on screen.
+ *
+ * Fix: the overlay consumes only `transcriptMessages` now. This test asserts
+ * that even when the other two fields are set, the on-screen count of each
+ * turn's text is exactly one.
+ */
+class VoiceModeOverlayTranscriptTest {
+
+    @get:Rule
+    val composeTestRule = createComposeRule()
+
+    @Test
+    fun userAndAgentTurns_renderExactlyOnce_evenWithLegacyFieldsSet() {
+        val userText = "Hello agent"
+        val agentText = "Hi there"
+
+        val messages = listOf(
+            ChatMessage(
+                id = "u-1",
+                role = MessageRole.USER,
+                content = userText,
+                timestamp = 1L,
+                isStreaming = false,
+            ),
+            ChatMessage(
+                id = "a-1",
+                role = MessageRole.ASSISTANT,
+                content = agentText,
+                timestamp = 2L,
+                isStreaming = true,
+            ),
+        )
+
+        composeTestRule.setContent {
+            MaterialTheme {
+                VoiceModeOverlay(
+                    uiState = VoiceUiState(
+                        voiceMode = true,
+                        state = VoiceState.Speaking,
+                        // Legacy fields — if the overlay still read these,
+                        // each turn's text would appear twice.
+                        transcribedText = userText,
+                        responseText = agentText,
+                        interactionMode = InteractionMode.TapToTalk,
+                    ),
+                    onMicTap = {},
+                    onMicRelease = {},
+                    onInterrupt = {},
+                    onDismiss = {},
+                    onModeChange = {},
+                    onClearError = {},
+                    transcriptMessages = messages,
+                )
+            }
+        }
+
+        composeTestRule.waitForIdle()
+
+        val userOccurrences = composeTestRule
+            .onAllNodesWithText(userText, substring = false)
+            .fetchSemanticsNodes()
+            .size
+        val agentOccurrences = composeTestRule
+            .onAllNodesWithText(agentText, substring = false)
+            .fetchSemanticsNodes()
+            .size
+
+        assertEquals(
+            "user turn must render exactly once (no double-entry from transcribedText)",
+            1,
+            userOccurrences,
+        )
+        assertEquals(
+            "agent turn must render exactly once (no double-entry from responseText)",
+            1,
+            agentOccurrences,
+        )
+    }
+}

app/src/androidTest/kotlin/com/hermesandroid/relay/ui/onboarding/OnboardingFlowTest.kt

@@ -1,22 +1,19 @@
 package com.hermesandroid.relay.ui.onboarding
 
+import android.app.Application
 import androidx.compose.ui.test.assertIsDisplayed
 import androidx.compose.ui.test.assertIsEnabled
-import androidx.compose.ui.test.assertIsNotDisplayed
-import androidx.compose.ui.test.hasText
 import androidx.compose.ui.test.junit4.createComposeRule
 import androidx.compose.ui.test.onNodeWithText
 import androidx.compose.ui.test.performClick
-import androidx.compose.ui.test.performScrollTo
+import androidx.test.core.app.ApplicationProvider
 import com.hermesandroid.relay.ui.theme.HermesRelayTheme
+import com.hermesandroid.relay.viewmodel.ConnectionViewModel
 import org.junit.Rule
 import org.junit.Test
 
 /**
- * Instrumented tests for the onboarding pager flow.
- *
- * These tests require an Android device or emulator because they use
- * Compose UI testing APIs and interact with real Compose components.
+ * Instrumented tests for the Standard-first onboarding pager.
  */
 class OnboardingFlowTest {
 
@@ -24,270 +21,186 @@ class OnboardingFlowTest {
     val composeTestRule = createComposeRule()
 
     private fun setOnboardingContent() {
+        val app = ApplicationProvider.getApplicationContext<Application>()
+        val connectionViewModel = ConnectionViewModel(app)
         composeTestRule.setContent {
             HermesRelayTheme {
                 OnboardingScreen(
-                    onComplete = { _, _, _ -> }
+                    connectionViewModel = connectionViewModel,
+                    onComplete = {},
                 )
             }
         }
     }
 
-    // --- Page 1: Welcome ---
-
     @Test
-    fun firstPage_showsHermesRelayTitle() {
+    fun firstPage_showsHermesForAndroidTitle() {
         setOnboardingContent()
 
         composeTestRule
-            .onNodeWithText("Hermes-Relay")
+            .onNodeWithText("Hermes-Relay for Android")
             .assertIsDisplayed()
     }
 
     @Test
-    fun firstPage_showsWelcomeDescription() {
+    fun firstPage_showsStandardFirstDescription() {
         setOnboardingContent()
 
         composeTestRule
-            .onNodeWithText("Your AI agent, in your pocket. Chat, control, and connect — all from your phone.")
+            .onNodeWithText("Chat with Hermes and manage your dashboard from your phone.")
             .assertIsDisplayed()
-    }
-
-    // --- Skip button ---
-
-    @Test
-    fun skipButton_isAlwaysVisible_onFirstPage() {
-        setOnboardingContent()
-
         composeTestRule
-            .onNodeWithText("Skip")
+            .onNodeWithText("Standard")
             .assertIsDisplayed()
-    }
-
-    // --- Navigation: Next button ---
-
-    @Test
-    fun nextButton_isDisplayed_onFirstPage() {
-        setOnboardingContent()
-
         composeTestRule
-            .onNodeWithText("Next")
+            .onNodeWithText("Advanced")
+            .assertIsDisplayed()
+        composeTestRule
+            .onNodeWithText("Setup Guide")
+            .assertIsDisplayed()
+        composeTestRule
+            .onNodeWithText("Hermes Docs")
             .assertIsDisplayed()
     }
 
     @Test
-    fun nextButton_navigatesForward_toPage2() {
+    fun nextButton_navigatesForward_toChatPage() {
         setOnboardingContent()
 
-        // Page 1 -> Page 2
         composeTestRule.onNodeWithText("Next").performClick()
         composeTestRule.waitForIdle()
 
-        // Page 2 is "Talk to Your Agent"
         composeTestRule
-            .onNodeWithText("Talk to Your Agent")
+            .onNodeWithText("Chat")
             .assertIsDisplayed()
     }
 
     @Test
-    fun canNavigateForward_throughAllPages() {
+    fun canNavigateForward_throughStandardAndPowerPages() {
         setOnboardingContent()
 
-        // Page 1: Hermes-Relay (Welcome)
-        composeTestRule.onNodeWithText("Hermes-Relay").assertIsDisplayed()
+        composeTestRule.onNodeWithText("Hermes-Relay for Android").assertIsDisplayed()
         composeTestRule.onNodeWithText("Next").performClick()
         composeTestRule.waitForIdle()
 
-        // Page 2: Talk to Your Agent (Chat)
-        composeTestRule.onNodeWithText("Talk to Your Agent").assertIsDisplayed()
+        composeTestRule.onNodeWithText("Chat").assertIsDisplayed()
         composeTestRule.onNodeWithText("Next").performClick()
         composeTestRule.waitForIdle()
 
-        // Page 3: Remote Terminal
-        composeTestRule.onNodeWithText("Remote Terminal").assertIsDisplayed()
+        composeTestRule.onNodeWithText("Manage").assertIsDisplayed()
         composeTestRule.onNodeWithText("Next").performClick()
         composeTestRule.waitForIdle()
 
-        // Page 4: Device Bridge
-        composeTestRule.onNodeWithText("Device Bridge").assertIsDisplayed()
-        composeTestRule.onNodeWithText("Next").performClick()
+        composeTestRule.onNodeWithText("Power tools").assertIsDisplayed()
+        composeTestRule.onNodeWithText("Connect").performClick()
         composeTestRule.waitForIdle()
 
-        // Page 5: Connect to Hermes
         composeTestRule.onNodeWithText("Connect to Hermes").assertIsDisplayed()
-        composeTestRule.onNodeWithText("Next").performClick()
-        composeTestRule.waitForIdle()
-
-        // Page 6: Relay Server (last page)
-        composeTestRule.onNodeWithText("Relay Server").assertIsDisplayed()
     }
 
-    // --- Back button ---
-
     @Test
     fun backButton_hiddenOnFirstPage() {
         setOnboardingContent()
 
-        // On page 1, Back should not exist
         composeTestRule
             .onNodeWithText("Back")
             .assertDoesNotExist()
     }
 
-    @Test
-    fun backButton_visibleOnPage2() {
-        setOnboardingContent()
-
-        composeTestRule.onNodeWithText("Next").performClick()
-        composeTestRule.waitForIdle()
-
-        composeTestRule
-            .onNodeWithText("Back")
-            .assertIsDisplayed()
-    }
-
     @Test
     fun backButton_navigatesBackward() {
         setOnboardingContent()
 
-        // Go to page 2
         composeTestRule.onNodeWithText("Next").performClick()
         composeTestRule.waitForIdle()
-        composeTestRule.onNodeWithText("Talk to Your Agent").assertIsDisplayed()
+        composeTestRule.onNodeWithText("Chat").assertIsDisplayed()
 
-        // Go back to page 1
         composeTestRule.onNodeWithText("Back").performClick()
         composeTestRule.waitForIdle()
-        composeTestRule.onNodeWithText("Hermes-Relay").assertIsDisplayed()
-    }
-
-    // --- Page 5: Connect page ---
-
-    @Test
-    fun connectPage_hasApiServerUrlField() {
-        setOnboardingContent()
-        navigateToPage(4) // 0-indexed, page 5 is index 4
-
-        composeTestRule
-            .onNodeWithText("API Server URL")
-            .assertIsDisplayed()
+        composeTestRule.onNodeWithText("Hermes-Relay for Android").assertIsDisplayed()
     }
 
     @Test
-    fun connectPage_hasApiKeyField() {
+    fun connectPage_showsStandardChoiceFirst() {
         setOnboardingContent()
         navigateToPage(4)
 
         composeTestRule
-            .onNodeWithText("API Key (optional)", substring = true)
+            .onNodeWithText("Vanilla Hermes")
             .assertIsDisplayed()
     }
 
     @Test
-    fun connectPage_whereDoIFindThis_showsHelpDialog() {
+    fun standardSetup_showsApiFields() {
         setOnboardingContent()
         navigateToPage(4)
 
-        // Tap "Where do I find this?"
-        composeTestRule
-            .onNodeWithText("Where do I find this?")
-            .performClick()
+        composeTestRule.onNodeWithText("Vanilla Hermes").performClick()
         composeTestRule.waitForIdle()
 
-        // Dialog should show
         composeTestRule
-            .onNodeWithText("Do I need an API key?")
+            .onNodeWithText("API server URL")
+            .assertIsDisplayed()
+        composeTestRule
+            .onNodeWithText("API key")
             .assertIsDisplayed()
     }
 
     @Test
-    fun connectPage_helpDialog_canBeDismissed() {
+    fun standardSetup_connectButton_isEnabled_withDefaultUrl() {
         setOnboardingContent()
         navigateToPage(4)
 
-        composeTestRule.onNodeWithText("Where do I find this?").performClick()
+        composeTestRule.onNodeWithText("Vanilla Hermes").performClick()
         composeTestRule.waitForIdle()
 
-        // Dialog is showing
-        composeTestRule.onNodeWithText("Do I need an API key?").assertIsDisplayed()
-
-        // Dismiss it
-        composeTestRule.onNodeWithText("Got it").performClick()
-        composeTestRule.waitForIdle()
-
-        // Dialog should be gone
         composeTestRule
-            .onNodeWithText("Do I need an API key?")
-            .assertDoesNotExist()
-    }
-
-    // --- Page 6: Relay page ---
-
-    @Test
-    fun relayPage_showsOptionalMessaging() {
-        setOnboardingContent()
-        navigateToPage(5) // Last page
-
-        composeTestRule
-            .onNodeWithText("This is optional", substring = true)
-            .assertIsDisplayed()
-    }
-
-    @Test
-    fun relayPage_showsRelayUrlField() {
-        setOnboardingContent()
-        navigateToPage(5)
-
-        composeTestRule
-            .onNodeWithText("Relay URL (optional)")
-            .assertIsDisplayed()
-    }
-
-    // --- Get Started button ---
-
-    @Test
-    fun lastPage_showsGetStartedButton() {
-        setOnboardingContent()
-        navigateToPage(5)
-
-        composeTestRule
-            .onNodeWithText("Get Started")
-            .assertIsDisplayed()
-    }
-
-    @Test
-    fun lastPage_getStartedButton_isEnabled_withDefaultUrl() {
-        setOnboardingContent()
-        navigateToPage(5)
-
-        // Default URL is "http://localhost:8642" which is non-blank
-        composeTestRule
-            .onNodeWithText("Get Started")
+            .onNodeWithText("Connect")
             .assertIsEnabled()
     }
 
-    // --- Skip button visibility across pages ---
-
     @Test
-    fun skipButton_visibleOnAllPages() {
+    fun connectPage_keepsPairingOptional() {
         setOnboardingContent()
+        navigateToPage(4)
 
-        // Check skip on first page
-        composeTestRule.onNodeWithText("Skip").assertIsDisplayed()
-
-        // Navigate through all pages and check skip
-        for (i in 0 until 5) {
-            composeTestRule.onNodeWithText("Next").performClick()
-            composeTestRule.waitForIdle()
-            composeTestRule.onNodeWithText("Skip").assertIsDisplayed()
-        }
+        composeTestRule
+            .onNodeWithText("Pair Relay by code")
+            .assertIsDisplayed()
+        composeTestRule
+            .onNodeWithText("Power-user path for Terminal, Bridge, Relay sessions, and grants")
+            .assertIsDisplayed()
     }
 
-    // --- Helper ---
+    @Test
+    fun powerPage_linksToPermissionReview() {
+        setOnboardingContent()
+        navigateToPage(3)
+
+        composeTestRule
+            .onNodeWithText("Review permissions")
+            .assertIsDisplayed()
+            .assertIsEnabled()
+    }
+
+    @Test
+    fun skipButton_visibleOnIntroPages_andWizardSkipOnConnectPage() {
+        setOnboardingContent()
+
+        repeat(4) {
+            composeTestRule.onNodeWithText("Skip").assertIsDisplayed()
+            composeTestRule.onNodeWithText(if (it == 3) "Connect" else "Next").performClick()
+            composeTestRule.waitForIdle()
+        }
+
+        composeTestRule
+            .onNodeWithText("Skip for now — set up later in Settings")
+            .assertIsDisplayed()
+    }
 
     private fun navigateToPage(pageIndex: Int) {
         repeat(pageIndex) {
-            composeTestRule.onNodeWithText("Next").performClick()
+            composeTestRule.onNodeWithText(if (it == 3) "Connect" else "Next").performClick()
             composeTestRule.waitForIdle()
         }
     }

app/src/androidTest/kotlin/com/hermesandroid/relay/ui/screens/EmptyStateTest.kt

@@ -1,157 +1,52 @@
 package com.hermesandroid.relay.ui.screens
 
+import android.app.Application
+import androidx.compose.material3.MaterialTheme
 import androidx.compose.ui.test.assertIsDisplayed
 import androidx.compose.ui.test.junit4.createComposeRule
+import androidx.compose.ui.test.onNodeWithContentDescription
 import androidx.compose.ui.test.onNodeWithText
-import androidx.compose.material3.MaterialTheme
+import androidx.test.core.app.ApplicationProvider
+import com.hermesandroid.relay.viewmodel.ConnectionViewModel
+import com.hermesandroid.relay.viewmodel.TerminalViewModel
 import org.junit.Rule
 import org.junit.Test
 
 /**
- * Instrumented tests for Terminal and Bridge empty state screens.
+ * Instrumented smoke tests for the current Terminal and Bridge surfaces.
  */
 class EmptyStateTest {
 
     @get:Rule
     val composeTestRule = createComposeRule()
 
-    // --- Terminal Screen ---
-
     @Test
-    fun terminalScreen_showsTitle() {
+    fun terminalScreen_showsCurrentTopBar() {
+        val app = ApplicationProvider.getApplicationContext<Application>()
+        val terminalViewModel = TerminalViewModel(app)
+        val connectionViewModel = ConnectionViewModel(app)
+
         composeTestRule.setContent {
             MaterialTheme {
-                TerminalScreen()
+                TerminalScreen(
+                    terminalViewModel = terminalViewModel,
+                    connectionViewModel = connectionViewModel,
+                )
             }
         }
 
-        composeTestRule
-            .onNodeWithText("Remote Terminal")
-            .assertIsDisplayed()
+        composeTestRule.onNodeWithText("Terminal").assertIsDisplayed()
+        composeTestRule.onNodeWithContentDescription("Search scrollback").assertIsDisplayed()
     }
 
     @Test
-    fun terminalScreen_showsPhase2Chip() {
-        composeTestRule.setContent {
-            MaterialTheme {
-                TerminalScreen()
-            }
-        }
-
-        composeTestRule
-            .onNodeWithText("Coming in Phase 2")
-            .assertIsDisplayed()
-    }
-
-    @Test
-    fun terminalScreen_showsDescription() {
-        composeTestRule.setContent {
-            MaterialTheme {
-                TerminalScreen()
-            }
-        }
-
-        composeTestRule
-            .onNodeWithText("Secure shell access", substring = true)
-            .assertIsDisplayed()
-    }
-
-    @Test
-    fun terminalScreen_showsTopBarTitle() {
-        composeTestRule.setContent {
-            MaterialTheme {
-                TerminalScreen()
-            }
-        }
-
-        composeTestRule
-            .onNodeWithText("Terminal")
-            .assertIsDisplayed()
-    }
-
-    @Test
-    fun terminalScreen_showsPlannedFeatures() {
-        composeTestRule.setContent {
-            MaterialTheme {
-                TerminalScreen()
-            }
-        }
-
-        composeTestRule
-            .onNodeWithText("Full ANSI terminal emulator", substring = true)
-            .assertIsDisplayed()
-        composeTestRule
-            .onNodeWithText("tmux session management", substring = true)
-            .assertIsDisplayed()
-    }
-
-    // --- Bridge Screen ---
-
-    @Test
-    fun bridgeScreen_showsTitle() {
+    fun bridgeScreen_showsCurrentTopBar() {
         composeTestRule.setContent {
             MaterialTheme {
                 BridgeScreen()
             }
         }
 
-        composeTestRule
-            .onNodeWithText("Device Bridge")
-            .assertIsDisplayed()
-    }
-
-    @Test
-    fun bridgeScreen_showsPhase3Chip() {
-        composeTestRule.setContent {
-            MaterialTheme {
-                BridgeScreen()
-            }
-        }
-
-        composeTestRule
-            .onNodeWithText("Coming in Phase 3")
-            .assertIsDisplayed()
-    }
-
-    @Test
-    fun bridgeScreen_showsDescription() {
-        composeTestRule.setContent {
-            MaterialTheme {
-                BridgeScreen()
-            }
-        }
-
-        composeTestRule
-            .onNodeWithText("Let your Hermes agent interact with your phone", substring = true)
-            .assertIsDisplayed()
-    }
-
-    @Test
-    fun bridgeScreen_showsTopBarTitle() {
-        composeTestRule.setContent {
-            MaterialTheme {
-                BridgeScreen()
-            }
-        }
-
-        composeTestRule
-            .onNodeWithText("Bridge")
-            .assertIsDisplayed()
-    }
-
-    @Test
-    fun bridgeScreen_showsPlannedFeatures() {
-        composeTestRule.setContent {
-            MaterialTheme {
-                BridgeScreen()
-            }
-        }
-
-        composeTestRule
-            .onNodeWithText("Agent-controlled device interaction", substring = true)
-            .assertIsDisplayed()
-        composeTestRule
-            .onNodeWithText("Permission management", substring = true)
-            .assertIsDisplayed()
+        composeTestRule.onNodeWithText("Bridge").assertIsDisplayed()
     }
 }

app/src/androidTest/kotlin/com/hermesandroid/relay/ui/screens/PermissionsStatusScreenTest.kt

@@ -0,0 +1,45 @@
+package com.hermesandroid.relay.ui.screens
+
+import androidx.compose.ui.test.assertIsDisplayed
+import androidx.compose.ui.test.junit4.createComposeRule
+import androidx.compose.ui.test.onNodeWithText
+import androidx.compose.ui.test.performScrollTo
+import com.hermesandroid.relay.ui.theme.HermesRelayTheme
+import org.junit.Rule
+import org.junit.Test
+
+class PermissionsStatusScreenTest {
+
+    @get:Rule
+    val composeTestRule = createComposeRule()
+
+    @Test
+    fun permissionsScreen_showsStandardAndOnDemandRows() {
+        composeTestRule.setContent {
+            HermesRelayTheme {
+                PermissionsStatusScreen(
+                    onBack = {},
+                    onOpenBridge = {},
+                )
+            }
+        }
+
+        composeTestRule
+            .onNodeWithText("Permissions and capabilities")
+            .assertIsDisplayed()
+        composeTestRule
+            .onNodeWithText("Chat and Manage")
+            .assertIsDisplayed()
+        composeTestRule
+            .onNodeWithText("No Android runtime permission needed. API/dashboard auth is configured separately.")
+            .assertIsDisplayed()
+        composeTestRule
+            .onNodeWithText("Camera")
+            .performScrollTo()
+            .assertIsDisplayed()
+        composeTestRule
+            .onNodeWithText("Microphone")
+            .performScrollTo()
+            .assertIsDisplayed()
+    }
+}

app/src/googlePlay/AndroidManifest.xml

@@ -0,0 +1,27 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+    Google Play flavor manifest overlay.
+
+    Merged on top of `app/src/main/AndroidManifest.xml` by AGP when the
+    `googlePlayDebug` / `googlePlayRelease` variants are built.
+
+    Google Play ships Hermes Bridge Core only. It intentionally does not merge
+    any Device Control services or permissions.
+
+    This file is intentionally kept as an empty overlay so future flavor-specific
+    permissions / activities have an obvious home. Mirror structural additions
+    in `app/src/sideload/AndroidManifest.xml` unless the change is intentionally
+    track-specific.
+-->
+<manifest xmlns:android="http://schemas.android.com/apk/res/android"
+    xmlns:tools="http://schemas.android.com/tools">
+
+    <!-- Media3 ExoPlayer contributes a power-management permission from its
+         library manifest. Strip it from the merged Play artifact. -->
+    <uses-permission
+        android:name="android.permission.WAKE_LOCK"
+        tools:node="remove" />
+
+    <application />
+
+</manifest>

app/src/googlePlay/kotlin/com/hermesandroid/relay/update/UpdateAvailabilityFactory.kt

@@ -0,0 +1,199 @@
+package com.hermesandroid.relay.update
+
+import android.app.Activity
+import android.content.Context
+import android.util.Log
+import com.google.android.play.core.appupdate.AppUpdateInfo
+import com.google.android.play.core.appupdate.AppUpdateManager
+import com.google.android.play.core.appupdate.AppUpdateManagerFactory
+import com.google.android.play.core.appupdate.AppUpdateOptions
+import com.google.android.play.core.install.InstallState
+import com.google.android.play.core.install.InstallStateUpdatedListener
+import com.google.android.play.core.install.model.AppUpdateType
+import com.google.android.play.core.install.model.InstallStatus
+import com.google.android.play.core.install.model.UpdateAvailability
+import kotlinx.coroutines.suspendCancellableCoroutine
+import kotlin.coroutines.resume
+
+/**
+ * === update (googlePlay flavor): factory ===
+ *
+ * Backs [UpdateAvailabilitySource] onto Google Play's In-App Update API,
+ * FLEXIBLE flow. Mirrors `voice/VoiceBridgeIntentFactory`'s flavor-split
+ * factory pattern: both flavors export this exact function signature +
+ * package, so the UI layer has one static call site and no reflection / no
+ * `#if` gating.
+ */
+fun createUpdateAvailabilitySource(context: Context): UpdateAvailabilitySource =
+    PlayUpdateAvailabilitySource(context.applicationContext)
+
+private const val TAG = "PlayUpdate"
+
+/**
+ * Google Play FLEXIBLE in-app update source.
+ *
+ * - [check] queries `AppUpdateManager.appUpdateInfo`. If Play reports
+ *   `UPDATE_AVAILABLE` and FLEXIBLE is allowed, returns [UpdateStatus.Available]
+ *   (or [UpdateStatus.Downloaded] / [UpdateStatus.Downloading] if a previously
+ *   started flexible update is already mid-flight). Anything else →
+ *   [UpdateStatus.UpToDate].
+ * - [startUpdate] launches Play's FLEXIBLE consent + background download and
+ *   registers an [InstallStateUpdatedListener] so DOWNLOADED is reported back
+ *   asynchronously via [onStatusChanged].
+ * - [completeUpdate] calls `AppUpdateManager.completeUpdate()` which restarts
+ *   the app to install the staged APK.
+ *
+ * Robustness: every Play interaction is wrapped in try/catch. On any failure
+ * (no Play services, sideloaded "googlePlay" build on an AOSP device, RESULT
+ * errors) it degrades to [UpdateStatus.UpToDate] / [UpdateStatus.Unsupported]
+ * — the banner just never shows. Play is never a crash surface.
+ */
+private class PlayUpdateAvailabilitySource(
+    private val appContext: Context,
+) : UpdateAvailabilitySource {
+
+    override var onStatusChanged: ((UpdateStatus) -> Unit)? = null
+
+    private val manager: AppUpdateManager? = runCatching {
+        AppUpdateManagerFactory.create(appContext)
+    }.getOrNull()
+
+    /** Cached label/code from the last [check] so async listener events can label themselves. */
+    @Volatile private var lastVersionCode: Long? = null
+
+    private val installListener = InstallStateUpdatedListener { state: InstallState ->
+        when (state.installStatus()) {
+            InstallStatus.DOWNLOADING ->
+                onStatusChanged?.invoke(
+                    UpdateStatus.Downloading(
+                        versionLabel = labelFor(lastVersionCode),
+                        versionCode = lastVersionCode,
+                        // bytesDownloaded()/totalBytesToDownload() are base
+                        // app-update InstallState methods (Long); no ktx import.
+                        bytesDownloaded = state.bytesDownloaded(),
+                        totalBytes = state.totalBytesToDownload(),
+                    )
+                )
+            InstallStatus.DOWNLOADED ->
+                onStatusChanged?.invoke(
+                    UpdateStatus.Downloaded(
+                        versionLabel = labelFor(lastVersionCode),
+                        versionCode = lastVersionCode,
+                    )
+                )
+            else -> Unit // INSTALLING / INSTALLED / FAILED / CANCELED → no banner change
+        }
+    }
+
+    @Volatile private var listenerRegistered = false
+
+    override suspend fun check(): UpdateStatus {
+        val mgr = manager ?: return UpdateStatus.Unsupported
+        return try {
+            val info = mgr.awaitAppUpdateInfo()
+            lastVersionCode = info.availableVersionCode().toLong()
+            when {
+                // A previously started FLEXIBLE update already finished downloading.
+                info.installStatus() == InstallStatus.DOWNLOADED -> {
+                    ensureListener(mgr)
+                    UpdateStatus.Downloaded(
+                        versionLabel = labelFor(lastVersionCode),
+                        versionCode = lastVersionCode,
+                    )
+                }
+                info.updateAvailability() == UpdateAvailability.DEVELOPER_TRIGGERED_UPDATE_IN_PROGRESS ||
+                    info.installStatus() == InstallStatus.DOWNLOADING -> {
+                    ensureListener(mgr)
+                    UpdateStatus.Downloading(
+                        versionLabel = labelFor(lastVersionCode),
+                        versionCode = lastVersionCode,
+                    )
+                }
+                info.updateAvailability() == UpdateAvailability.UPDATE_AVAILABLE &&
+                    info.isUpdateTypeAllowed(AppUpdateType.FLEXIBLE) ->
+                    UpdateStatus.Available(
+                        versionLabel = labelFor(lastVersionCode),
+                        versionCode = lastVersionCode,
+                        openUrl = null,
+                    )
+                else -> UpdateStatus.UpToDate
+            }
+        } catch (t: Throwable) {
+            Log.w(TAG, "appUpdateInfo check failed; treating as up-to-date", t)
+            UpdateStatus.UpToDate
+        }
+    }
+
+    override fun startUpdate(activity: Activity?): Boolean {
+        val mgr = manager ?: return false
+        if (activity == null) return false
+        return try {
+            ensureListener(mgr)
+            mgr.appUpdateInfo
+                .addOnSuccessListener { info: AppUpdateInfo ->
+                    val canStart = info.updateAvailability() == UpdateAvailability.UPDATE_AVAILABLE &&
+                        info.isUpdateTypeAllowed(AppUpdateType.FLEXIBLE)
+                    val resuming = info.updateAvailability() ==
+                        UpdateAvailability.DEVELOPER_TRIGGERED_UPDATE_IN_PROGRESS
+                    if (canStart || resuming) {
+                        runCatching {
+                            mgr.startUpdateFlow(
+                                info,
+                                activity,
+                                AppUpdateOptions.newBuilder(AppUpdateType.FLEXIBLE).build(),
+                            )
+                        }.onFailure { Log.w(TAG, "startUpdateFlow failed", it) }
+                    }
+                }
+                .addOnFailureListener { Log.w(TAG, "startUpdate appUpdateInfo failed", it) }
+            true
+        } catch (t: Throwable) {
+            Log.w(TAG, "startUpdate failed", t)
+            false
+        }
+    }
+
+    override fun completeUpdate() {
+        val mgr = manager ?: return
+        runCatching { mgr.completeUpdate() }
+            .onFailure { Log.w(TAG, "completeUpdate failed", it) }
+    }
+
+    override fun dispose() {
+        val mgr = manager ?: return
+        if (listenerRegistered) {
+            runCatching { mgr.unregisterListener(installListener) }
+            listenerRegistered = false
+        }
+        onStatusChanged = null
+    }
+
+    private fun ensureListener(mgr: AppUpdateManager) {
+        if (!listenerRegistered) {
+            runCatching { mgr.registerListener(installListener) }
+                .onSuccess { listenerRegistered = true }
+                .onFailure { Log.w(TAG, "registerListener failed", it) }
+        }
+    }
+
+    // Play exposes only the numeric versionCode, not a marketing version
+    // string, so the banner copy stays generic ("A new version"). The code is
+    // still carried on the status for per-version dismissal keying.
+    private fun labelFor(@Suppress("UNUSED_PARAMETER") code: Long?): String = "A new version"
+}
+
+// === END update (googlePlay) ===
+
+/**
+ * `await()` for Play's [AppUpdateInfo] task without pulling in
+ * `kotlinx-coroutines-play-services`. Named `await…` (not the ktx
+ * `requestAppUpdateInfo`) to avoid any overload ambiguity with the
+ * `app-update-ktx` suspend extension. Resumable + cancels cleanly if the
+ * coroutine is torn down.
+ */
+private suspend fun AppUpdateManager.awaitAppUpdateInfo(): AppUpdateInfo =
+    suspendCancellableCoroutine { cont ->
+        appUpdateInfo
+            .addOnSuccessListener { info -> if (cont.isActive) cont.resume(info) }
+            .addOnFailureListener { e -> if (cont.isActive) cont.cancel(e) }
+    }

app/src/googlePlay/kotlin/com/hermesandroid/relay/voice/VoiceBridgeIntentFactory.kt

@@ -0,0 +1,53 @@
+package com.hermesandroid.relay.voice
+
+import com.hermesandroid.relay.network.relay.ChannelMultiplexer
+import com.hermesandroid.relay.network.shared.LocalDispatchResult
+import com.hermesandroid.relay.network.relay.models.Envelope
+
+/**
+ * Local in-process bridge dispatcher type. The Play flavor never invokes
+ * this — phone-control actions are sideload-only — but the typealias has
+ * to exist in the googlePlay source set so the shared `VoiceViewModel`
+ * call site compiles regardless of active flavor.
+ *
+ * Return type mirrors the sideload flavor's updated shape so the shared
+ * typealias binding site in VoiceViewModel compiles against either source
+ * set without #if gating.
+ */
+typealias LocalBridgeDispatcher = suspend (Envelope) -> LocalDispatchResult
+
+/** @see com.hermesandroid.relay.voice.VoiceIntentResultCallback in the sideload flavor. */
+typealias VoiceIntentResultCallback = (
+    intentLabel: String,
+    result: LocalDispatchResult,
+    androidToolName: String?,
+    androidToolArgsJson: String,
+) -> Unit
+
+/** @see com.hermesandroid.relay.voice.VoiceIntentCountdownCallback in the sideload flavor. */
+typealias VoiceIntentCountdownCallback = (intentLabel: String, durationMs: Long) -> Unit
+
+/**
+ * === PHASE3-voice-intents (googlePlay flavor): factory ===
+ *
+ * Flavor-specific factory function that [com.hermesandroid.relay.viewmodel.VoiceViewModel]
+ * calls exactly once during `initialize()`. The Play build always returns
+ * the no-op handler.
+ *
+ * Both the `googlePlay` and `sideload` flavors export a function with this
+ * exact signature + package so `VoiceViewModel` has a single static call
+ * site and no reflection.
+ *
+ * All parameters accepted for signature parity with sideload and silently
+ * ignored — the Play APK deliberately never references any bridge or
+ * accessibility class so the conservative Play feature description stays
+ * honest.
+ */
+fun createVoiceBridgeIntentHandler(
+    multiplexer: ChannelMultiplexer?,
+    localBridgeDispatcher: LocalBridgeDispatcher? = null,
+    onDispatchResult: VoiceIntentResultCallback? = null,
+    onCountdownStart: VoiceIntentCountdownCallback? = null,
+): VoiceBridgeIntentHandler = NoopVoiceBridgeIntentHandler()
+
+// === END PHASE3-voice-intents (googlePlay) ===

app/src/googlePlay/kotlin/com/hermesandroid/relay/voice/VoiceBridgeIntentHandlerImpl.kt

@@ -0,0 +1,31 @@
+package com.hermesandroid.relay.voice
+
+/**
+ * === PHASE3-voice-intents (googlePlay flavor): no-op voice→bridge handler ===
+ *
+ * On the Google Play track we ship the conservative feature description:
+ * no accessibility-service usage, no device-control voice routing.
+ *
+ * This implementation never references any bridge / accessibility class and
+ * always returns [IntentResult.NotApplicable] so [VoiceViewModel] falls
+ * through to normal chat for every utterance.
+ *
+ * Sibling: `app/src/sideload/kotlin/.../VoiceBridgeIntentHandlerImpl.kt`
+ * ships the real classifier.
+ */
+internal class NoopVoiceBridgeIntentHandler : VoiceBridgeIntentHandler {
+
+    override suspend fun tryHandle(transcribedText: String): IntentResult {
+        // Play APK path: every utterance is chat. No classification runs,
+        // no bridge envelopes are sent. Nothing to cancel either.
+        return IntentResult.NotApplicable
+    }
+
+    override fun cancelPending() {
+        // no-op — nothing to cancel on Play.
+    }
+
+    override fun hasPendingDestructive(): Boolean = false
+}
+
+// === END PHASE3-voice-intents (googlePlay) ===

app/src/googlePlay/play/default-language.txt

@@ -0,0 +1 @@
+en-US

app/src/googlePlay/play/listings/en-US/full-description.txt

@@ -0,0 +1,62 @@
+Hermes-Relay is the native Android client for the Hermes agent platform. Point it at your own Hermes instance and chat with your agent, talk to it hands-free, and manage models, keys, skills, and profiles from anywhere.
+
+It is not a hosted AI service. It is a companion app for the Hermes agent you run, and it talks only to the instances you configure.
+
+QUICK START
+
+1. Run hermes-agent with its API server and dashboard enabled on your computer or home server.
+2. Install Hermes-Relay and enter your server address, for example http://192.168.1.100:8642.
+3. The setup wizard checks what your server supports and shows a readiness card, then you are ready to chat.
+
+A plain Hermes install is enough. Chat, management, and voice work with no plugin or extra service.
+
+HOW IT WORKS
+
+Chat streams directly from your Hermes API Server or dashboard gateway in real time. Manage and voice use your Hermes dashboard with one sign-in. Run the optional relay service and the app can pair by QR code to add power tools: remote terminal, notification companion, media handoff, relay-session management, and additional voice engines.
+
+GOOGLE PLAY BUILD
+
+The Google Play build ships Hermes Bridge Core only. It has no AccessibilityService Device Control: it cannot read your screen, tap, type, swipe, screenshot, send SMS, place calls, or access contacts or location. Device Control is reserved for sideload builds distributed outside Google Play.
+
+FEATURES
+
+- Streaming Chat: real-time responses with reasoning, markdown, tool-call visibility, attachments, mid-turn steering, edit-and-resend, and a searchable command palette.
+
+- Manage Your Agent: use your Hermes dashboard from your phone to switch models, manage provider keys, edit profiles, and browse, install, and update skills.
+
+- Voice Mode: talk hands-free using your server's speech providers. Relay-paired setups add per-profile voices and an experimental realtime engine.
+
+- Works Away From Home: add LAN, Tailscale, or public routes and the app chooses the best available path on connect.
+
+- Sessions: create, switch, rename, and delete chats. Message history loads on demand.
+
+- Multiple Servers and Profiles: connect to more than one server and switch in a tap; overlay an agent profile or personality per conversation.
+
+- Relay Power Tools: optional QR pairing for remote terminal, relay-session management, media handoff, and per-feature grants.
+
+- Notification Companion: optionally forward notification metadata to your paired relay so your assistant can summarize it. Toggle it anytime in system settings.
+
+- Stats for Nerds: local-only counters for response timing, token usage, cost, and stream health.
+
+- Material You: Material 3 dynamic color, light/dark/system themes, and haptics.
+
+SECURITY AND PRIVACY
+
+- API keys and relay tokens are stored in encrypted Android storage.
+- HTTPS is enforced for remote connections; cleartext is limited to localhost or LAN setups.
+- No telemetry, ads, tracking, or third-party analytics SDKs.
+- Notification access and the microphone are optional and user-controlled.
+- All app traffic goes only to servers you configure.
+
+REQUIREMENTS
+
+- Android 8.0 or later.
+- A running Hermes agent for chat, management, and voice.
+- Optional Hermes relay service for power tools such as terminal, notifications, and media.
+- Network access to your server by local network, VPN, or internet.
+
+OPEN SOURCE
+
+Hermes-Relay is MIT licensed. Source, docs, and issue tracking are on GitHub.
+
+This app is a community project and is not affiliated with or endorsed by NousResearch.

app/src/googlePlay/play/listings/en-US/short-description.txt

@@ -0,0 +1 @@
+Your Hermes AI agent, in your pocket - chat, voice, and control.

app/src/googlePlay/play/listings/en-US/title.txt

@@ -0,0 +1 @@
+Hermes-Relay

app/src/googlePlay/play/release-notes/en-US/default.txt

@@ -0,0 +1,3 @@
+v1.2.3 — Connection crash fix.
+
+• Fixed a crash that could close the app right after connecting over an encrypted link (Tailscale or HTTPS). Connecting over a secured connection is now stable. Plain local-network connections were never affected.

app/src/main/AndroidManifest.xml

@@ -1,9 +1,25 @@
 <?xml version="1.0" encoding="utf-8"?>
-<manifest xmlns:android="http://schemas.android.com/apk/res/android">
+<manifest xmlns:android="http://schemas.android.com/apk/res/android"
+    xmlns:tools="http://schemas.android.com/tools">
 
     <uses-permission android:name="android.permission.INTERNET" />
     <uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" />
     <uses-permission android:name="android.permission.CAMERA" />
+    <uses-permission android:name="android.permission.RECORD_AUDIO" />
+    <uses-permission android:name="android.permission.MODIFY_AUDIO_SETTINGS" />
+    <!-- Turn-complete chat notification (TurnCompleteNotifier) — runtime-requested
+         on API 33+ from the Chat Settings toggle. Lives in main (not just the
+         sideload overlay) so the googlePlay flavor can notify too. -->
+    <uses-permission android:name="android.permission.POST_NOTIFICATIONS" />
+
+    <!-- Opt-in "Keep connected in background" (GatewayKeepAliveService). In main
+         (not the sideload overlay) so the googlePlay flavor ships it too — the
+         Home-Assistant-class persistent-connection use case Play permits. The
+         specialUse type requires a one-time Play Console foreground-service
+         declaration at submission. (Also already present in the sideload overlay
+         for the device-control bridge service; the merger dedups.) -->
+    <uses-permission android:name="android.permission.FOREGROUND_SERVICE" />
+    <uses-permission android:name="android.permission.FOREGROUND_SERVICE_SPECIAL_USE" />
 
     <uses-feature android:name="android.hardware.camera" android:required="false" />
 
@@ -20,6 +36,11 @@
         <activity
             android:name=".MainActivity"
             android:exported="true"
+            android:launchMode="singleTask"
+            android:screenOrientation="portrait"
+            tools:ignore="LockedOrientationActivity"
+            android:configChanges="uiMode|fontScale|locale|density|orientation|screenSize|screenLayout|keyboardHidden"
+            android:windowSoftInputMode="adjustResize"
             android:theme="@style/Theme.HermesRelay.Splash">
             <intent-filter>
                 <action android:name="android.intent.action.MAIN" />
@@ -27,6 +48,42 @@
             </intent-filter>
         </activity>
 
+        <provider
+            android:name="androidx.core.content.FileProvider"
+            android:authorities="${applicationId}.fileprovider"
+            android:exported="false"
+            android:grantUriPermissions="true">
+            <meta-data
+                android:name="android.support.FILE_PROVIDER_PATHS"
+                android:resource="@xml/file_provider_paths" />
+        </provider>
+
+        <!-- === PHASE3-notif-listener: notification companion service === -->
+        <service
+            android:name=".notifications.HermesNotificationCompanion"
+            android:label="@string/notification_companion_label"
+            android:permission="android.permission.BIND_NOTIFICATION_LISTENER_SERVICE"
+            android:exported="true">
+            <intent-filter>
+                <action android:name="android.service.notification.NotificationListenerService" />
+            </intent-filter>
+        </service>
+        <!-- === END PHASE3-notif-listener === -->
+
+        <!-- Opt-in "Keep connected in background" — holds the gateway chat
+             socket open while backgrounded. In main so BOTH flavors ship it
+             (Home-Assistant-class persistent connection). Off by default; only
+             runs while the user has explicitly enabled the toggle. specialUse
+             needs a Play Console foreground-service declaration at submission. -->
+        <service
+            android:name=".network.upstream.GatewayKeepAliveService"
+            android:exported="false"
+            android:foregroundServiceType="specialUse">
+            <property
+                android:name="android.app.PROPERTY_SPECIAL_USE_FGS_SUBTYPE"
+                android:value="Keeps the user's chat connection to their Hermes agent open while the app is backgrounded, only when the user has explicitly enabled 'Keep connected in background'." />
+        </service>
+
     </application>
 
 </manifest>

app/src/main/assets/changelog.json

@@ -0,0 +1,181 @@
+{
+  "versions": [
+    {
+      "version": "1.2.3",
+      "title": "Connection crash fix",
+      "date": "2026-06-23",
+      "sections": [
+        {
+          "header": "Stability",
+          "bullets": [
+            "Fixed a crash that could close the app right after connecting over an encrypted link (Tailscale or HTTPS) — a live secure connection was being torn down on the main thread as it came up. Securing your connection no longer force-closes the app; plain-LAN connections were never affected."
+          ]
+        }
+      ]
+    },
+    {
+      "version": "1.2.2",
+      "title": "Multi-profile polish",
+      "date": "2026-06-22",
+      "sections": [
+        {
+          "header": "Profiles that behave",
+          "bullets": [
+            "Deleting a session while a non-default agent profile is active now sticks — it no longer reappears after the list refreshes.",
+            "On a cold start with a non-default profile selected, the session drawer opens on that profile's chats directly instead of briefly showing the default profile's."
+          ]
+        },
+        {
+          "header": "Clearer diagnostics",
+          "bullets": [
+            "Diagnostics is now a full screen led by a top-to-bottom list of subsystem health checks — network, API server, chat transport, pairing, relay, and voice — each with a pass / warning / fail state and the reason when something's wrong; tap a failing check for full detail. The recent-activity log stays below."
+          ]
+        },
+        {
+          "header": "Small touches",
+          "bullets": [
+            "The default connection is now simply \"Hermes\" (and the optional power features are labelled \"Relay\"), across setup, the switcher, voice, and permissions.",
+            "Distraction-free chat mode gives its text a taller, scrollable area."
+          ]
+        }
+      ]
+    },
+    {
+      "version": "1.2.1",
+      "title": "Polish & control",
+      "date": "2026-06-21",
+      "sections": [
+        {
+          "header": "Yours to control",
+          "bullets": [
+            "Lock the app to a single agent profile (Settings → Profile lock) and hide the rest from the pickers."
+          ]
+        },
+        {
+          "header": "Find your way back",
+          "bullets": [
+            "A new \"What's New\" entry in Settings shows current and past release notes any time — not just after an update."
+          ]
+        },
+        {
+          "header": "When something breaks",
+          "bullets": [
+            "Diagnostics show clean error titles — tap any entry for a detail view with Copy, Share, and a one-tap GitHub issue.",
+            "A tasteful in-app banner tells you when a newer version is live (Play or sideload) — dismissable, and it never nags."
+          ]
+        },
+        {
+          "header": "Voice fixes",
+          "bullets": [
+            "Stop now halts realtime speech instantly, hold-to-talk is steadier, the voice overlay is easier to read, and a chosen voice applies in Auto mode.",
+            "Realtime turns that reach back to Hermes no longer drop with a session error."
+          ]
+        }
+      ]
+    },
+    {
+      "version": "1.2.0",
+      "title": "Make it yours",
+      "date": "2026-06-20",
+      "sections": [
+        {
+          "header": "Personalize",
+          "bullets": [
+            "Eight app themes in Settings → Appearance — the Hermes Relay brand plus ports of the Nous Hermes looks (Teal, Nous Blue, Midnight, Ember, Mono, Cyberpunk, Rosé), with light/dark.",
+            "Swap the agent orb for an animated pet that reacts to what the agent is doing — add, preview, and tune pets right in the app, or generate one from sprite art with the AI authoring kit.",
+            "Reskin the sphere, and give each agent profile its own icon."
+          ]
+        },
+        {
+          "header": "See what's happening",
+          "bullets": [
+            "The chat status strip names the actual streaming path (Gateway, Sessions, Completions, Runs), with a basic→best tier ladder in Chat Settings.",
+            "Tap the context meter for a \"What the agent sees\" sheet — the exact extra context prepended to your next turn.",
+            "Voice and Realtime turns are badged in the scrollback."
+          ]
+        },
+        {
+          "header": "Privacy",
+          "bullets": [
+            "When paired to the relay, the agent can mark private media and the phone blurs it per your setting — sensitivity stays model-emitted."
+          ]
+        },
+        {
+          "header": "Faster & more reliable",
+          "bullets": [
+            "Cold start is about 3× faster, and model/personality/approvals load honestly instead of showing a maybe-wrong value.",
+            "In-app crash reporting offers a one-tap, pre-filled bug report.",
+            "QR pairing no longer force-closes on unusual cameras (foldables); fixed crashes opening server images and PDFs; in-chat model picks now apply."
+          ]
+        },
+        {
+          "header": "Voice & terminal",
+          "bullets": [
+            "Enhanced voice control for Gemini and xAI providers.",
+            "Leaner terminal with TUI-correct input and an isolated, tuned tmux."
+          ]
+        }
+      ]
+    },
+    {
+      "version": "1.1.0",
+      "title": "Release plumbing & polish",
+      "date": "2026-06-16",
+      "sections": [
+        {
+          "header": "New",
+          "bullets": [
+            "Automated Play Console upload when a release tag ships (a human still starts the rollout).",
+            "/relay slash commands — status, devices, and pair from any platform — plus a relay-status badge in the dashboard header.",
+            "The relay plugin prompts for its optional voice-provider keys on install, and a tools-only native install path."
+          ]
+        },
+        {
+          "header": "Improved",
+          "bullets": [
+            "Settings overhaul: status pills are now exception-only, Power tools shows a single Plugin active/required/offline badge, and Connections moved to the top.",
+            "Release names and notes are now split per surface (Android, plugin, CLI)."
+          ]
+        },
+        {
+          "header": "Fixed",
+          "bullets": [
+            "No more force-close on connect when the stored credential keyset was corrupt — it now heals in place.",
+            "The installer works on uv-managed Hermes hosts, and the dashboard relay panel buttons are readable again."
+          ]
+        }
+      ]
+    },
+    {
+      "version": "1.0.0",
+      "title": "Stable launch",
+      "date": "2026-06-14",
+      "sections": [
+        {
+          "header": "Gateway chat with live thinking",
+          "bullets": [
+            "Chat can ride the upstream dashboard gateway — the only vanilla-upstream path that streams reasoning live, so the Thinking block and sphere light up during generation. \"Auto\" prefers it and falls back to the SSE endpoints per turn.",
+            "Desktop parity: native image/PDF/file attachments, mid-turn steering, edit & resend, approval/clarify/sudo/secret cards, live subagent lanes, a context-window meter, server slash commands, and turn-complete notifications.",
+            "Warm-start and an opt-in Keep connected in background toggle so long-backgrounded conversations resume instantly."
+          ]
+        },
+        {
+          "header": "Agents, Manage & media",
+          "bullets": [
+            "Switch agent profiles per conversation — model, SOUL, personality, and skills — with the selection bound to the session, never changing the server default for other clients.",
+            "Manage parity with the desktop dashboard: change models, manage provider keys, edit profiles and SOUL.md, and browse/install skills.",
+            "Open and save chat images and attachments — full-screen viewer with pinch-zoom, plus an Open/Share/Save menu."
+          ]
+        },
+        {
+          "header": "Standard path is first-class",
+          "bullets": [
+            "Chat, Manage, and voice all work against an unmodified upstream Hermes agent; the relay plugin is now purely additive.",
+            "Seamless connection UX — LAN↔Tailscale handoffs and reconnects no longer reload the chat, and status shows as in-theme slide-down toasts.",
+            "Persistent Realtime Agent voice that keeps one session across turns, with long runs promoted to tracked background tasks."
+          ]
+        }
+      ]
+    }
+  ]
+}

app/src/main/assets/terminal/addon-fit.js

@@ -0,0 +1,2 @@
+!function(e,t){"object"==typeof exports&&"object"==typeof module?module.exports=t():"function"==typeof define&&define.amd?define([],t):"object"==typeof exports?exports.FitAddon=t():e.FitAddon=t()}(self,(()=>(()=>{"use strict";var e={};return(()=>{var t=e;Object.defineProperty(t,"__esModule",{value:!0}),t.FitAddon=void 0,t.FitAddon=class{activate(e){this._terminal=e}dispose(){}fit(){const e=this.proposeDimensions();if(!e||!this._terminal||isNaN(e.cols)||isNaN(e.rows))return;const t=this._terminal._core;this._terminal.rows===e.rows&&this._terminal.cols===e.cols||(t._renderService.clear(),this._terminal.resize(e.cols,e.rows))}proposeDimensions(){if(!this._terminal)return;if(!this._terminal.element||!this._terminal.element.parentElement)return;const e=this._terminal._core,t=e._renderService.dimensions;if(0===t.css.cell.width||0===t.css.cell.height)return;const r=0===this._terminal.options.scrollback?0:e.viewport.scrollBarWidth,i=window.getComputedStyle(this._terminal.element.parentElement),o=parseInt(i.getPropertyValue("height")),s=Math.max(0,parseInt(i.getPropertyValue("width"))),n=window.getComputedStyle(this._terminal.element),l=o-(parseInt(n.getPropertyValue("padding-top"))+parseInt(n.getPropertyValue("padding-bottom"))),a=s-(parseInt(n.getPropertyValue("padding-right"))+parseInt(n.getPropertyValue("padding-left")))-r;return{cols:Math.max(2,Math.floor(a/t.css.cell.width)),rows:Math.max(1,Math.floor(l/t.css.cell.height))}}}})(),e})()));
+//# sourceMappingURL=addon-fit.js.map

app/src/main/assets/terminal/addon-web-links.js

@@ -0,0 +1,2 @@
+!function(e,t){"object"==typeof exports&&"object"==typeof module?module.exports=t():"function"==typeof define&&define.amd?define([],t):"object"==typeof exports?exports.WebLinksAddon=t():e.WebLinksAddon=t()}(self,(()=>(()=>{"use strict";var e={6:(e,t)=>{function n(e){try{const t=new URL(e),n=t.password&&t.username?`${t.protocol}//${t.username}:${t.password}@${t.host}`:t.username?`${t.protocol}//${t.username}@${t.host}`:`${t.protocol}//${t.host}`;return e.toLocaleLowerCase().startsWith(n.toLocaleLowerCase())}catch(e){return!1}}Object.defineProperty(t,"__esModule",{value:!0}),t.LinkComputer=t.WebLinkProvider=void 0,t.WebLinkProvider=class{constructor(e,t,n,o={}){this._terminal=e,this._regex=t,this._handler=n,this._options=o}provideLinks(e,t){const n=o.computeLink(e,this._regex,this._terminal,this._handler);t(this._addCallbacks(n))}_addCallbacks(e){return e.map((e=>(e.leave=this._options.leave,e.hover=(t,n)=>{if(this._options.hover){const{range:o}=e;this._options.hover(t,n,o)}},e)))}};class o{static computeLink(e,t,r,i){const s=new RegExp(t.source,(t.flags||"")+"g"),[a,c]=o._getWindowedLineStrings(e-1,r),l=a.join("");let d;const p=[];for(;d=s.exec(l);){const e=d[0];if(!n(e))continue;const[t,s]=o._mapStrIdx(r,c,0,d.index),[a,l]=o._mapStrIdx(r,t,s,e.length);if(-1===t||-1===s||-1===a||-1===l)continue;const h={start:{x:s+1,y:t+1},end:{x:l,y:a+1}};p.push({range:h,text:e,activate:i})}return p}static _getWindowedLineStrings(e,t){let n,o=e,r=e,i=0,s="";const a=[];if(n=t.buffer.active.getLine(e)){const e=n.translateToString(!0);if(n.isWrapped&&" "!==e[0]){for(i=0;(n=t.buffer.active.getLine(--o))&&i<2048&&(s=n.translateToString(!0),i+=s.length,a.push(s),n.isWrapped&&-1===s.indexOf(" ")););a.reverse()}for(a.push(e),i=0;(n=t.buffer.active.getLine(++r))&&n.isWrapped&&i<2048&&(s=n.translateToString(!0),i+=s.length,a.push(s),-1===s.indexOf(" ")););}return[a,o]}static _mapStrIdx(e,t,n,o){const r=e.buffer.active,i=r.getNullCell();let s=n;for(;o;){const e=r.getLine(t);if(!e)return[-1,-1];for(let n=s;n<e.length;++n){e.getCell(n,i);const s=i.getChars();if(i.getWidth()&&(o-=s.length||1,n===e.length-1&&""===s)){const e=r.getLine(t+1);e&&e.isWrapped&&(e.getCell(0,i),2===i.getWidth()&&(o+=1))}if(o<0)return[t,n]}t++,s=0}return[t,s]}}t.LinkComputer=o}},t={};function n(o){var r=t[o];if(void 0!==r)return r.exports;var i=t[o]={exports:{}};return e[o](i,i.exports,n),i.exports}var o={};return(()=>{var e=o;Object.defineProperty(e,"__esModule",{value:!0}),e.WebLinksAddon=void 0;const t=n(6),r=/(https?|HTTPS?):[/]{2}[^\s"'!*(){}|\\\^<>`]*[^\s"':,.!?{}|\\\^~\[\]`()<>]/;function i(e,t){const n=window.open();if(n){try{n.opener=null}catch{}n.location.href=t}else console.warn("Opening link blocked as opener could not be cleared")}e.WebLinksAddon=class{constructor(e=i,t={}){this._handler=e,this._options=t}activate(e){this._terminal=e;const n=this._options,o=n.urlRegex||r;this._linkProvider=this._terminal.registerLinkProvider(new t.WebLinkProvider(this._terminal,o,this._handler,n))}dispose(){this._linkProvider?.dispose()}}})(),o})()));
+//# sourceMappingURL=addon-web-links.js.map

app/src/main/assets/terminal/index.html

@@ -0,0 +1,519 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=no, viewport-fit=cover">
+    <meta name="format-detection" content="telephone=no">
+    <title>Hermes-Relay Terminal</title>
+    <link rel="stylesheet" href="xterm.css">
+    <style>
+        html, body {
+            margin: 0;
+            padding: 0;
+            width: 100%;
+            height: 100%;
+            background: #1A1A2E;
+            overflow: hidden;
+            font-family: 'JetBrains Mono', 'Fira Code', 'Cascadia Mono', 'Roboto Mono', monospace;
+            -webkit-user-select: none;
+            user-select: none;
+            -webkit-touch-callout: none;
+            -webkit-tap-highlight-color: transparent;
+        }
+        #terminal {
+            position: absolute;
+            top: 0;
+            left: 0;
+            right: 0;
+            bottom: 0;
+            /* Bottom gap so xterm's last row clears the extra-keys footer
+               instead of butting flush against it (read as an overlap). */
+            padding: 8px 6px 8px 8px;
+            box-sizing: border-box;
+        }
+        .xterm .xterm-viewport {
+            background-color: #1A1A2E !important;
+        }
+        /* Let text inside the terminal be selectable so copy/paste works. */
+        .xterm-rows, .xterm-selection-layer {
+            -webkit-user-select: text;
+            user-select: text;
+        }
+    </style>
+</head>
+<body>
+    <div id="terminal"></div>
+
+    <script src="xterm.js"></script>
+    <script src="addon-fit.js"></script>
+    <script src="addon-web-links.js"></script>
+    <script src="addon-search.js"></script>
+    <script>
+    (function () {
+        // ── Hermes-Relay theme (matches app primary palette) ──────────────
+        const hermesTheme = {
+            background: '#1A1A2E',
+            foreground: '#E8E8F0',
+            cursor: '#B794F4',
+            cursorAccent: '#1A1A2E',
+            selectionBackground: '#4A3A7A',
+            black: '#1A1A2E',
+            red: '#FF6B9D',
+            green: '#7EE787',
+            yellow: '#FFD166',
+            blue: '#79C0FF',
+            magenta: '#B794F4',
+            cyan: '#56D4DD',
+            white: '#E8E8F0',
+            brightBlack: '#4A4A6A',
+            brightRed: '#FF8FAE',
+            brightGreen: '#A8F0B0',
+            brightYellow: '#FFE29A',
+            brightBlue: '#A5D4FF',
+            brightMagenta: '#D0B3FF',
+            brightCyan: '#7FE5EE',
+            brightWhite: '#FFFFFF',
+        };
+
+        const term = new Terminal({
+            cursorBlink: true,
+            cursorStyle: 'block',
+            fontFamily: "'JetBrains Mono', 'Fira Code', 'Cascadia Mono', 'Roboto Mono', monospace",
+            fontSize: 13,
+            lineHeight: 1.15,
+            letterSpacing: 0,
+            scrollback: 10000,
+            theme: hermesTheme,
+            allowProposedApi: true,
+            allowTransparency: false,
+            convertEol: false,
+            macOptionIsMeta: true,
+            rightClickSelectsWord: false,
+        });
+
+        const fitAddon = new FitAddon.FitAddon();
+        const webLinksAddon = new WebLinksAddon.WebLinksAddon(function (event, uri) {
+            // Delegate to Android so taps open the system browser.
+            if (window.AndroidBridge && window.AndroidBridge.onLink) {
+                window.AndroidBridge.onLink(uri);
+            }
+        });
+
+        // Search addon — vendored from @xterm/addon-search@0.15.0. Loaded
+        // here so the Compose-side TerminalSearchBar can call findNext /
+        // findPrevious through the window.search* shims defined below.
+        // Wrapped in a try because if vendoring ever fails or the global
+        // shape changes, we want the rest of the terminal to keep working
+        // rather than turning the whole tab into a JS error.
+        let searchAddon = null;
+        try {
+            if (window.SearchAddon && window.SearchAddon.SearchAddon) {
+                searchAddon = new SearchAddon.SearchAddon();
+            }
+        } catch (err) {
+            console.warn('SearchAddon init failed: ' + err);
+        }
+
+        term.loadAddon(fitAddon);
+        term.loadAddon(webLinksAddon);
+        if (searchAddon) {
+            try { term.loadAddon(searchAddon); } catch (err) {
+                console.warn('SearchAddon loadAddon failed: ' + err);
+                searchAddon = null;
+            }
+        }
+
+        term.open(document.getElementById('terminal'));
+        try { fitAddon.fit(); } catch (_) { /* container not measured yet */ }
+
+        // ── Outbound: terminal → Android ──────────────────────────────────
+        term.onData(function (data) {
+            if (window.AndroidBridge && window.AndroidBridge.onInput) {
+                window.AndroidBridge.onInput(data);
+            }
+        });
+
+        term.onBinary(function (data) {
+            // Binary input (very rare — only used for mouse tracking byte paths).
+            if (window.AndroidBridge && window.AndroidBridge.onInput) {
+                window.AndroidBridge.onInput(data);
+            }
+        });
+
+        let lastCols = 0;
+        let lastRows = 0;
+        term.onResize(function (size) {
+            if (size.cols === lastCols && size.rows === lastRows) return;
+            lastCols = size.cols;
+            lastRows = size.rows;
+            if (window.AndroidBridge && window.AndroidBridge.onResize) {
+                window.AndroidBridge.onResize(size.cols, size.rows);
+            }
+        });
+
+        // Report scroll position so the host can show a "jump to latest" pill
+        // while the user is scrolled up into scrollback. atBottom is true when
+        // the viewport is pinned to the live tail.
+        const reportScroll = function () {
+            if (!(window.AndroidBridge && window.AndroidBridge.onScrollPosition)) return;
+            try {
+                const buf = term.buffer.active;
+                window.AndroidBridge.onScrollPosition(buf.viewportY >= buf.baseY);
+            } catch (_) {}
+        };
+        term.onScroll(function () { reportScroll(); });
+
+        // ── Inbound: Android → terminal ───────────────────────────────────
+        // Base64-encoded payloads avoid JS string-escaping headaches when the
+        // stream contains control characters, raw escape sequences, or bytes
+        // that would need careful quoting in evaluateJavascript.
+        let writeCount = 0;
+        window.writeTerminal = function (b64) {
+            if (!b64) return;
+            try {
+                const binary = atob(b64);
+                const bytes = new Uint8Array(binary.length);
+                for (let i = 0; i < binary.length; i++) {
+                    bytes[i] = binary.charCodeAt(i);
+                }
+                term.write(bytes);
+                writeCount++;
+                // Diagnostic: dump xterm geometry + container metrics every few
+                // writes so we can see from logcat whether xterm has a sane
+                // viewport and rows. Routed through onConsoleMessage → the
+                // TerminalWebView tag.
+                if (writeCount <= 2 || writeCount % 5 === 0) {
+                    const el = document.getElementById('terminal');
+                    console.log('xterm state: cols=' + term.cols +
+                        ' rows=' + term.rows +
+                        ' container=' + el.clientWidth + 'x' + el.clientHeight +
+                        ' bytesIn=' + bytes.length);
+                }
+            } catch (err) {
+                console.error('writeTerminal decode error: ' + err);
+            }
+        };
+
+        // Called by Kotlin's addOnLayoutChangeListener with the WebView's
+        // actual dimensions in CSS pixels. We force body + #terminal to those
+        // sizes explicitly because Chromium WebView's internal viewport does
+        // NOT reliably track native view resizes on Android — `height: 100%`
+        // resolves against a stale 0-height viewport on the first composition
+        // pass and never recovers without this manual override. With the
+        // explicit style set, xterm's fit() reads the correct clientHeight
+        // and computes a sane cols/rows.
+        window.refit = function (widthCss, heightCss) {
+            try {
+                if (typeof widthCss === 'number' && typeof heightCss === 'number' &&
+                    widthCss > 0 && heightCss > 0) {
+                    document.documentElement.style.width = widthCss + 'px';
+                    document.documentElement.style.height = heightCss + 'px';
+                    document.body.style.width = widthCss + 'px';
+                    document.body.style.height = heightCss + 'px';
+                    const el = document.getElementById('terminal');
+                    if (el) {
+                        el.style.width = widthCss + 'px';
+                        el.style.height = heightCss + 'px';
+                    }
+                }
+                fitAddon.fit();
+                const el2 = document.getElementById('terminal');
+                console.log('refit: cols=' + term.cols + ' rows=' + term.rows +
+                    ' container=' + (el2 ? el2.clientWidth + 'x' + el2.clientHeight : '?') +
+                    ' requested=' + widthCss + 'x' + heightCss);
+            } catch (err) {
+                console.error('fit error: ' + err);
+            }
+        };
+
+        window.setFontSize = function (size) {
+            try {
+                term.options.fontSize = size;
+                fitAddon.fit();
+            } catch (_) {}
+        };
+
+        window.focusTerminal = function () {
+            try { term.focus(); } catch (_) {}
+        };
+
+        // Current xterm selection as plain text ('' when nothing selected).
+        // Read back via WebView.evaluateJavascript for the toolbar Copy key,
+        // since long-press copy is unreliable inside an Android WebView.
+        window.getSelectionText = function () {
+            try { return term.getSelection() || ''; } catch (_) { return ''; }
+        };
+
+        window.clearTerminal = function () {
+            try { term.clear(); } catch (_) {}
+        };
+
+        window.pasteToTerminal = function (text) {
+            if (!text) return;
+            try {
+                term.paste(text);
+            } catch (_) {
+                // Fallback — send as plain input
+                if (window.AndroidBridge && window.AndroidBridge.onInput) {
+                    window.AndroidBridge.onInput(text);
+                }
+            }
+        };
+
+        // Mode-aware encoder for the on-screen toolbar's special keys
+        // (arrows / Home / End / Page). Arrows must follow xterm's current
+        // DECCKM (application cursor keys) mode: when an app like vim, less,
+        // or readline has requested it, an arrow is SS3-encoded (\eOA) rather
+        // than CSI (\e[A). The old path always sent CSI from Kotlin, which the
+        // running TUI could misread. We read term.modes here (where the mode
+        // actually lives) and route bytes back through onInput so sticky
+        // modifiers still apply. Page keys are mode-independent.
+        window.termSendKey = function (name) {
+            var appCursor = false;
+            try {
+                appCursor = !!(term.modes && term.modes.applicationCursorKeysMode);
+            } catch (_) {}
+            var p = appCursor ? 'O' : '[';
+            var map = {
+                ArrowUp: p + 'A',
+                ArrowDown: p + 'B',
+                ArrowRight: p + 'C',
+                ArrowLeft: p + 'D',
+                Home: p + 'H',
+                End: p + 'F',
+                PageUp: '[5~',
+                PageDown: '[6~',
+            };
+            var seq = map[name];
+            if (seq && window.AndroidBridge && window.AndroidBridge.onInput) {
+                window.AndroidBridge.onInput(seq);
+            }
+        };
+
+        // ── Scroll shims + gesture ────────────────────────────────────────
+        // xterm.js ships a scrollback buffer (scrollback: 10000 above) but
+        // has no built-in mobile touch-to-scroll — its input handlers are
+        // designed around mouse/wheel events, and it sets touch-action on
+        // its root to swallow gestures for selection. That leaves the
+        // scrollback unreachable on phones unless we add a translator.
+        //
+        // Strategy: one finger, mostly-vertical drag → convert delta to
+        // line-scroll via term.scrollLines(). The threshold keeps short
+        // taps (and their tiny jitter) from triggering scroll; the axis
+        // dominance check lets users still long-press for selection or
+        // horizontal-swipe for future features without false positives.
+        // Every scroll intent on this terminal — gesture, toolbar button,
+        // whatever — gets funneled through a synthetic WheelEvent dispatched
+        // on xterm's render root. This is deliberately NOT a direct call to
+        // term.scrollLines(), because that skips xterm's own buffer + mouse-
+        // mode routing. Letting xterm handle the wheel gives us all three
+        // correct behaviors for free:
+        //
+        //   1. Main buffer (at the shell prompt): xterm scrolls its own
+        //      10k-line scrollback locally — same as our first version.
+        //   2. Alternate buffer + TUI has enabled mouse tracking
+        //      (claude-code, hermes TUI, tmux with `mouse on`, less, vim
+        //      with `set mouse=a` — basically any modern TUI; it's what
+        //      makes hover-to-scroll work on desktop): xterm encodes the
+        //      wheel as an SGR mouse-wheel escape (\e[<64;col;rowM for
+        //      up / <65 for down) and forwards it to the PTY, so the TUI
+        //      scrolls its own content natively.
+        //   3. Alternate buffer + TUI has NOT enabled mouse tracking
+        //      (rare on modern TUIs; mostly old curses apps): xterm
+        //      ignores the wheel — safe no-op, no garbage injected.
+        const wheelTarget = function () {
+            return document.querySelector('.xterm-screen') ||
+                   document.querySelector('.xterm') ||
+                   document.getElementById('terminal');
+        };
+        const dispatchWheel = function (deltaY) {
+            const target = wheelTarget();
+            if (!target) {
+                console.warn('scrollTerminal: no wheel target element found');
+                return;
+            }
+            const rect = target.getBoundingClientRect();
+            // Mouse position matters for SGR wheel encoding — use the
+            // viewport center so TUIs that care (tmux split-pane) hit the
+            // right pane instead of always the top-left cell.
+            const clientX = rect.left + rect.width / 2;
+            const clientY = rect.top + rect.height / 2;
+            const evt = new WheelEvent('wheel', {
+                deltaY: deltaY,
+                deltaMode: 0, // DOM_DELTA_PIXEL
+                bubbles: true,
+                cancelable: true,
+                clientX: clientX,
+                clientY: clientY,
+            });
+            const altBuffer = (function () {
+                try { return term.buffer.active.type === 'alternate'; }
+                catch (_) { return false; }
+            })();
+            // Visible in logcat via TerminalWebView's onConsoleMessage —
+            // confirms the wheel fired and on which buffer. If scroll is
+            // not working in a TUI, this is the first thing to check:
+            // no line here = gesture path broken; line present but no
+            // TUI response = TUI hasn't enabled mouse tracking.
+            console.log('dispatchWheel: deltaY=' + deltaY +
+                ' altBuffer=' + altBuffer +
+                ' target=' + (target.className || target.id));
+            target.dispatchEvent(evt);
+        };
+
+        const lineHeightPx = function () {
+            const size = term.options.fontSize || 13;
+            const lh = term.options.lineHeight || 1.15;
+            return Math.max(10, size * lh);
+        };
+
+        window.scrollTerminalLines = function (lines) {
+            const n = Math.round(lines);
+            if (n === 0) return;
+            dispatchWheel(n * lineHeightPx());
+        };
+        window.scrollTerminalPages = function (pages) {
+            const n = Math.round(pages);
+            if (n === 0) return;
+            dispatchWheel(n * lineHeightPx() * Math.max(1, term.rows - 2));
+        };
+        // Jump-to-bottom only makes sense in the main buffer (alt buffer is
+        // always "at the bottom" — the TUI owns every visible row). In alt
+        // buffer we simply no-op rather than guess what "bottom" means for
+        // whichever app is running.
+        window.scrollTerminalToBottom = function () {
+            try {
+                if (term.buffer.active.type === 'alternate') return;
+                term.scrollToBottom();
+            } catch (_) {}
+        };
+        window.scrollTerminalToTop = function () {
+            try {
+                if (term.buffer.active.type === 'alternate') return;
+                term.scrollToTop();
+            } catch (_) {}
+        };
+
+        (function installTouchScroll() {
+            const root = document.getElementById('terminal');
+            if (!root) return;
+            let touchId = null;
+            let startY = 0;
+            let accumulated = 0;
+            // lineHeightPx() is defined at module scope above — it already
+            // tracks setFontSize() via term.options and returns a fresh
+            // value per call, so we just use it directly here.
+            const onStart = function (ev) {
+                if (ev.touches.length !== 1) { touchId = null; return; }
+                touchId = ev.touches[0].identifier;
+                startY = ev.touches[0].clientY;
+                accumulated = 0;
+            };
+            const onMove = function (ev) {
+                if (touchId === null) return;
+                let t = null;
+                for (let i = 0; i < ev.touches.length; i++) {
+                    if (ev.touches[i].identifier === touchId) { t = ev.touches[i]; break; }
+                }
+                if (!t) return;
+                const dy = t.clientY - startY;
+                // Only fire once past a small deadzone so long-press+select
+                // isn't stolen from xterm.
+                if (Math.abs(dy) < 12) return;
+                const lh = lineHeightPx();
+                const lines = Math.trunc((dy - accumulated) / lh);
+                if (lines !== 0) {
+                    // Route through the shared shim so alt-buffer detection
+                    // kicks in — TUIs (claude-code, hermes, vim, less) live
+                    // in the alt buffer and need real input events, while
+                    // the shell's main buffer uses local scrollback.
+                    // Finger down = older content, so we flip the sign.
+                    window.scrollTerminalLines(-lines);
+                    accumulated += lines * lh;
+                    ev.preventDefault();
+                }
+            };
+            const onEnd = function (ev) {
+                for (let i = 0; i < ev.changedTouches.length; i++) {
+                    if (ev.changedTouches[i].identifier === touchId) {
+                        touchId = null;
+                        return;
+                    }
+                }
+            };
+            // passive:false is required because we preventDefault above to
+            // stop the browser from also hijacking the gesture for refresh
+            // or selection.
+            root.addEventListener('touchstart', onStart, { passive: true });
+            root.addEventListener('touchmove', onMove, { passive: false });
+            root.addEventListener('touchend', onEnd, { passive: true });
+            root.addEventListener('touchcancel', onEnd, { passive: true });
+        })();
+
+        // Refit on any container size change. ResizeObserver is more reliable
+        // than `window.resize` on Android WebView — the window doesn't always
+        // fire `resize` when Compose resizes the parent View, so the initial
+        // fit can latch at rows=1 (before Compose has measured) and never
+        // recompute. ResizeObserver watches the element's content box directly
+        // and fires whenever Compose grows/shrinks the WebView. Without this,
+        // `ls` output scrolls straight off a 1-row viewport and users see
+        // "typed a command, everything cleared, no output".
+        let resizeTimeout = null;
+        const terminalEl = document.getElementById('terminal');
+        const scheduleFit = function () {
+            if (resizeTimeout) clearTimeout(resizeTimeout);
+            resizeTimeout = setTimeout(function () {
+                try { fitAddon.fit(); } catch (_) {}
+            }, 80);
+        };
+        if (typeof ResizeObserver !== 'undefined') {
+            const resizeObserver = new ResizeObserver(scheduleFit);
+            resizeObserver.observe(terminalEl);
+        }
+        // Keep the window.resize listener too — it still fires on orientation
+        // change and covers edge cases where ResizeObserver isn't available.
+        window.addEventListener('resize', scheduleFit);
+
+        // Signal readiness to Android after two rAFs so the initial layout
+        // has a chance to settle. ResizeObserver above will keep re-fitting
+        // if the container grows after this first onReady call, and the
+        // `resize(cols, rows)` bridge call syncs the server side.
+        requestAnimationFrame(function () {
+            try { fitAddon.fit(); } catch (_) {}
+            requestAnimationFrame(function () {
+                if (window.AndroidBridge && window.AndroidBridge.onReady) {
+                    window.AndroidBridge.onReady(term.cols, term.rows);
+                }
+            });
+        });
+
+        // Diagnostic hook — Kotlin can read back the current grid size.
+        window.getTerminalGeometry = function () {
+            return JSON.stringify({ cols: term.cols, rows: term.rows });
+        };
+
+        // ── Search shims — driven by TerminalSearchBar.kt ────────────────
+        // Each function returns a boolean so the Kotlin side can check
+        // whether the search actually matched (for "no results" UX).
+        // The try/catch is defensive: if the addon is missing or its API
+        // changes, the terminal stays usable instead of throwing.
+        window.searchNext = function (text) {
+            if (!text || !searchAddon) return false;
+            try { return !!searchAddon.findNext(text); } catch (_) { return false; }
+        };
+        window.searchPrev = function (text) {
+            if (!text || !searchAddon) return false;
+            try { return !!searchAddon.findPrevious(text); } catch (_) { return false; }
+        };
+        window.clearSearch = function () {
+            if (!searchAddon) return;
+            try {
+                if (typeof searchAddon.clearDecorations === 'function') {
+                    searchAddon.clearDecorations();
+                }
+            } catch (_) { /* old addon-search builds */ }
+        };
+    })();
+    </script>
+</body>
+</html>

app/src/main/assets/terminal/xterm.css

@@ -0,0 +1,218 @@
+/**
+ * Copyright (c) 2014 The xterm.js authors. All rights reserved.
+ * Copyright (c) 2012-2013, Christopher Jeffrey (MIT License)
+ * https://github.com/chjj/term.js
+ * @license MIT
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ *
+ * Originally forked from (with the author's permission):
+ *   Fabrice Bellard's javascript vt100 for jslinux:
+ *   http://bellard.org/jslinux/
+ *   Copyright (c) 2011 Fabrice Bellard
+ *   The original design remains. The terminal itself
+ *   has been extended to include xterm CSI codes, among
+ *   other features.
+ */
+
+/**
+ *  Default styles for xterm.js
+ */
+
+.xterm {
+    cursor: text;
+    position: relative;
+    user-select: none;
+    -ms-user-select: none;
+    -webkit-user-select: none;
+}
+
+.xterm.focus,
+.xterm:focus {
+    outline: none;
+}
+
+.xterm .xterm-helpers {
+    position: absolute;
+    top: 0;
+    /**
+     * The z-index of the helpers must be higher than the canvases in order for
+     * IMEs to appear on top.
+     */
+    z-index: 5;
+}
+
+.xterm .xterm-helper-textarea {
+    padding: 0;
+    border: 0;
+    margin: 0;
+    /* Move textarea out of the screen to the far left, so that the cursor is not visible */
+    position: absolute;
+    opacity: 0;
+    left: -9999em;
+    top: 0;
+    width: 0;
+    height: 0;
+    z-index: -5;
+    /** Prevent wrapping so the IME appears against the textarea at the correct position */
+    white-space: nowrap;
+    overflow: hidden;
+    resize: none;
+}
+
+.xterm .composition-view {
+    /* TODO: Composition position got messed up somewhere */
+    background: #000;
+    color: #FFF;
+    display: none;
+    position: absolute;
+    white-space: nowrap;
+    z-index: 1;
+}
+
+.xterm .composition-view.active {
+    display: block;
+}
+
+.xterm .xterm-viewport {
+    /* On OS X this is required in order for the scroll bar to appear fully opaque */
+    background-color: #000;
+    overflow-y: scroll;
+    cursor: default;
+    position: absolute;
+    right: 0;
+    left: 0;
+    top: 0;
+    bottom: 0;
+}
+
+.xterm .xterm-screen {
+    position: relative;
+}
+
+.xterm .xterm-screen canvas {
+    position: absolute;
+    left: 0;
+    top: 0;
+}
+
+.xterm .xterm-scroll-area {
+    visibility: hidden;
+}
+
+.xterm-char-measure-element {
+    display: inline-block;
+    visibility: hidden;
+    position: absolute;
+    top: 0;
+    left: -9999em;
+    line-height: normal;
+}
+
+.xterm.enable-mouse-events {
+    /* When mouse events are enabled (eg. tmux), revert to the standard pointer cursor */
+    cursor: default;
+}
+
+.xterm.xterm-cursor-pointer,
+.xterm .xterm-cursor-pointer {
+    cursor: pointer;
+}
+
+.xterm.column-select.focus {
+    /* Column selection mode */
+    cursor: crosshair;
+}
+
+.xterm .xterm-accessibility:not(.debug),
+.xterm .xterm-message {
+    position: absolute;
+    left: 0;
+    top: 0;
+    bottom: 0;
+    right: 0;
+    z-index: 10;
+    color: transparent;
+    pointer-events: none;
+}
+
+.xterm .xterm-accessibility-tree:not(.debug) *::selection {
+  color: transparent;
+}
+
+.xterm .xterm-accessibility-tree {
+  user-select: text;
+  white-space: pre;
+}
+
+.xterm .live-region {
+    position: absolute;
+    left: -9999px;
+    width: 1px;
+    height: 1px;
+    overflow: hidden;
+}
+
+.xterm-dim {
+    /* Dim should not apply to background, so the opacity of the foreground color is applied
+     * explicitly in the generated class and reset to 1 here */
+    opacity: 1 !important;
+}
+
+.xterm-underline-1 { text-decoration: underline; }
+.xterm-underline-2 { text-decoration: double underline; }
+.xterm-underline-3 { text-decoration: wavy underline; }
+.xterm-underline-4 { text-decoration: dotted underline; }
+.xterm-underline-5 { text-decoration: dashed underline; }
+
+.xterm-overline {
+    text-decoration: overline;
+}
+
+.xterm-overline.xterm-underline-1 { text-decoration: overline underline; }
+.xterm-overline.xterm-underline-2 { text-decoration: overline double underline; }
+.xterm-overline.xterm-underline-3 { text-decoration: overline wavy underline; }
+.xterm-overline.xterm-underline-4 { text-decoration: overline dotted underline; }
+.xterm-overline.xterm-underline-5 { text-decoration: overline dashed underline; }
+
+.xterm-strikethrough {
+    text-decoration: line-through;
+}
+
+.xterm-screen .xterm-decoration-container .xterm-decoration {
+	z-index: 6;
+	position: absolute;
+}
+
+.xterm-screen .xterm-decoration-container .xterm-decoration.xterm-decoration-top-layer {
+	z-index: 7;
+}
+
+.xterm-decoration-overview-ruler {
+    z-index: 8;
+    position: absolute;
+    top: 0;
+    right: 0;
+    pointer-events: none;
+}
+
+.xterm-decoration-top {
+    z-index: 2;
+    position: relative;
+}

app/src/main/assets/whats_new.txt

@@ -1,32 +1,6 @@
-v0.1.0 — First Release
+v1.2.3 - Connection crash fix
 
-Chat
-• Direct API chat via SSE streaming
-• Markdown rendering — code blocks, bold, italic, links
-• Session management — create, switch, rename, delete
-• Message history with auto-titles
-• Reasoning display (collapsible thinking blocks)
-• Personality picker with dynamic server personalities
-• Command palette — 29+ commands + server skills
-• Token & cost tracking per message
-• File attachments — images, documents, any file type
-• Message queuing — send while agent is streaming
-
-Animation
-• ASCII morphing sphere on empty chat screen
-• Ambient mode — fullscreen sphere (toggle in header)
-• Subtle sphere behind messages at 15% opacity
-• Animation controls in Settings > Appearance
-
-App
-• Material You theming (light/dark/auto)
-• QR code pairing for quick setup
-• Stats for Nerds — response times, health metrics
-• Offline detection with reconnect
-• Developer Options — tap version 7x to unlock experimental features
-• Configurable limits — attachment size, message length
-
-Security
-• API keys in EncryptedSharedPreferences
-• Network security config for localhost
-• Feature gating for unfinished features
+Stability
+* Fixed a crash that could close the app right after connecting over an
+  encrypted link (Tailscale or HTTPS). Securing your connection no longer
+  force-closes the app. Plain-LAN connections were never affected.

app/src/main/kotlin/com/hermesandroid/relay/HermesRelayApp.kt

@@ -1,14 +1,54 @@
 package com.hermesandroid.relay
 
 import android.app.Application
+import coil3.ImageLoader
+import coil3.PlatformContext
+import coil3.SingletonImageLoader
+import coil3.network.okhttp.OkHttpNetworkFetcherFactory
+import coil3.request.crossfade
+import com.hermesandroid.relay.bridge.UnattendedAccessManager
 import com.hermesandroid.relay.data.AppAnalytics
+import com.hermesandroid.relay.power.WakeLockManager
+import com.hermesandroid.relay.util.AppForegroundTracker
+import com.hermesandroid.relay.util.CrashReporter
 
-class HermesRelayApp : Application() {
+class HermesRelayApp : Application(), SingletonImageLoader.Factory {
+
+    /**
+     * Coil's singleton image loader for the whole app. Registering the OkHttp
+     * network fetcher EXPLICITLY guarantees `http(s)` image URLs (e.g. a
+     * generated-image link in a chat reply) load, rather than relying on
+     * artifact auto-registration. Crossfade for a clean fade-in.
+     */
+    override fun newImageLoader(context: PlatformContext): ImageLoader =
+        ImageLoader.Builder(context)
+            .components { add(OkHttpNetworkFetcherFactory()) }
+            .crossfade(true)
+            .build()
 
     override fun onCreate() {
         super.onCreate()
         instance = this
+        // Install the crash handler FIRST so any failure in the rest of app
+        // init (or anywhere later) is captured and surfaced on next launch.
+        CrashReporter.install(this)
         AppAnalytics.initialize(this)
+        // A8 — wire the bridge-gesture wake-lock wrapper so
+        // ActionExecutor.tap/tapText/typeText/swipe/scroll can hold
+        // a partial wake lock while dispatching.
+        WakeLockManager.initialize(this)
+        // v0.4.1 — sideload-only "unattended access" mode wiring.
+        // Initialization is flavor-agnostic (the manager defaults to
+        // disabled and only activates when the user opts in via the
+        // sideload-gated Bridge tab toggle), so the call here is safe
+        // to run on both flavors. The googlePlay flavor never reaches
+        // an enable path so the wake-lock is never built or acquired.
+        UnattendedAccessManager.initialize(this)
+        // v0.4.1 polish — process-wide foreground/background signal
+        // used by BridgeViewModel to suppress the WindowManager chip
+        // while the user is inside Hermes-Relay (the in-app
+        // UnattendedGlobalBanner covers that case). Idempotent.
+        AppForegroundTracker.initialize()
     }
 
     companion object {

app/src/main/kotlin/com/hermesandroid/relay/MainActivity.kt

@@ -1,22 +1,69 @@
 package com.hermesandroid.relay
 
 import android.animation.ObjectAnimator
+import android.content.Context
+import android.content.Intent
+import android.media.projection.MediaProjectionManager
 import android.os.Bundle
+import android.util.Log
 import android.view.View
 import android.view.animation.DecelerateInterpolator
 import androidx.activity.ComponentActivity
 import androidx.activity.compose.setContent
 import androidx.activity.enableEdgeToEdge
+import androidx.activity.result.contract.ActivityResultContracts
 import androidx.activity.viewModels
 import androidx.core.animation.doOnEnd
 import androidx.core.splashscreen.SplashScreen.Companion.installSplashScreen
+import com.hermesandroid.relay.accessibility.ScreenCaptureRequester
+import com.hermesandroid.relay.bridge.BridgeForegroundService
+import com.hermesandroid.relay.bridge.UnattendedAccessManager
+import com.hermesandroid.relay.data.BuildFlavor
+import com.hermesandroid.relay.notifications.TurnCompleteNotifier
 import com.hermesandroid.relay.ui.RelayApp
+import com.hermesandroid.relay.util.NavRouteRequest
 import com.hermesandroid.relay.viewmodel.ConnectionViewModel
 
 class MainActivity : ComponentActivity() {
 
     private val connectionViewModel: ConnectionViewModel by viewModels()
 
+    // === PHASE3-bridge-ui-followup: MediaProjection consent flow ===
+    // ActivityResultLauncher for the system screen-capture consent dialog.
+    // Must be registered BEFORE the activity reaches STARTED state, hence
+    // declared as a property (registerForActivityResult is safe to call
+    // from a property initializer on ComponentActivity).
+    //
+    // We do NOT call MediaProjectionHolder directly from here. On Android
+    // 14+, getMediaProjection() must run from inside a foreground service
+    // that has already called startForeground(type=mediaProjection), and
+    // that startForeground call must happen AFT consent. So we hand the
+    // result off to BridgeForegroundService, which:
+    //   1. Upgrades its FGS type to SPECIAL_USE | MEDIA_PROJECTION
+    //   2. Calls MediaProjectionHolder.acceptGrantInsideForegroundService
+    //   3. Stores the projection in the holder's StateFlow
+    // BridgeViewModel observes that flow and refreshes the UI immediately.
+    //
+    // ScreenCaptureRequester is a process-singleton rendezvous so the
+    // BridgeViewModel (which has no Activity reference) can ask us to
+    // launch the dialog without leaking this Activity through the VM.
+    private val mediaProjectionLauncher = registerForActivityResult(
+        ActivityResultContracts.StartActivityForResult()
+    ) { result ->
+        val data = result.data
+        if (!BuildFlavor.isSideload) {
+            Log.w(TAG, "Ignoring MediaProjection result on Google Play Bridge Core build")
+            return@registerForActivityResult
+        }
+        if (result.resultCode == RESULT_OK && data != null) {
+            Log.i(TAG, "MediaProjection consent granted — handing off to FGS")
+            BridgeForegroundService.grantMediaProjection(this, result.resultCode, data)
+        } else {
+            Log.i(TAG, "MediaProjection consent rejected (resultCode=${result.resultCode})")
+        }
+    }
+    // === END PHASE3-bridge-ui-followup ===
+
     override fun onCreate(savedInstanceState: Bundle?) {
         val splashScreen = installSplashScreen()
 
@@ -41,8 +88,104 @@ class MainActivity : ComponentActivity() {
 
         super.onCreate(savedInstanceState)
         enableEdgeToEdge()
+
+        // === PHASE3-bridge-ui-followup: install MediaProjection requester ===
+        // Hand the launcher to the process-singleton rendezvous so
+        // BridgeViewModel.requestScreenCapture() can fire the consent
+        // dialog without holding an Activity reference.
+        if (BuildFlavor.isSideload) {
+            ScreenCaptureRequester.install {
+                val mgr = getSystemService(Context.MEDIA_PROJECTION_SERVICE)
+                    as MediaProjectionManager
+                try {
+                    mediaProjectionLauncher.launch(mgr.createScreenCaptureIntent())
+                } catch (t: Throwable) {
+                    Log.w(TAG, "failed to launch MediaProjection consent: ${t.message}")
+                }
+            }
+        }
+        // === END PHASE3-bridge-ui-followup ===
+
+        // === PHASE3-safety-rails-followup: deep-link nav route from external intents ===
+        // Foreground services, broadcast receivers, and shortcut intents can
+        // attach EXTRA_NAV_ROUTE to request that RelayApp navigate to a
+        // specific Compose route on launch. The actual navigation happens
+        // in RelayApp's NavRouteRequest collector — we just pump the request
+        // into the SharedFlow here.
+        consumeNavRouteIntent(intent)
+        // === END PHASE3-safety-rails-followup ===
         setContent {
             RelayApp()
         }
     }
+
+    override fun onNewIntent(intent: Intent) {
+        super.onNewIntent(intent)
+        // === PHASE3-safety-rails-followup: deep-link nav route on re-launch ===
+        // Same as onCreate but for the singleTask / FLAG_ACTIVITY_CLEAR_TOP
+        // path: when the app is already running and the foreground service's
+        // PendingIntent re-launches us, the new intent comes through here
+        // instead of onCreate. RelayApp's collector handles both cases.
+        setIntent(intent)
+        consumeNavRouteIntent(intent)
+        // === END PHASE3-safety-rails-followup ===
+    }
+
+    private fun consumeNavRouteIntent(intent: Intent?) {
+        val route = intent?.getStringExtra(EXTRA_NAV_ROUTE) ?: return
+        if (route.isBlank()) return
+        NavRouteRequest.tryRequest(route)
+    }
+
+    override fun onResume() {
+        super.onResume()
+        // Returning to the app clears the one-slot "Hermes finished
+        // responding" notification — the chat surface is the answer.
+        TurnCompleteNotifier.cancel(this)
+        // v0.4.1 — register this activity as the host for
+        // KeyguardManager.requestDismissKeyguard. Cleared in onPause so
+        // we don't leak the Activity past its lifecycle. The unattended-
+        // access manager only attempts dismiss when an activity is
+        // registered AND the user has opted in.
+        if (BuildFlavor.isSideload) {
+            UnattendedAccessManager.setHostActivity(this)
+        }
+        // Re-probe the credential-lock state on resume so the Bridge
+        // tab badge updates immediately if the user just changed their
+        // lock screen in system Settings between app sessions.
+        if (BuildFlavor.isSideload) {
+            UnattendedAccessManager.refreshKeyguardState()
+        }
+    }
+
+    override fun onPause() {
+        if (BuildFlavor.isSideload) {
+            UnattendedAccessManager.setHostActivity(null)
+        }
+        super.onPause()
+    }
+
+    override fun onDestroy() {
+        // === PHASE3-bridge-ui-followup: clear MediaProjection requester ===
+        // Drop the launcher closure so we don't hold a stale Activity ref
+        // after destroy. ScreenCaptureRequester.request() will return false
+        // until the next MainActivity instance reinstalls itself.
+        if (BuildFlavor.isSideload) {
+            ScreenCaptureRequester.uninstall()
+        }
+        // === END PHASE3-bridge-ui-followup ===
+        super.onDestroy()
+    }
+
+    companion object {
+        private const val TAG = "MainActivity"
+
+        /**
+         * Intent extra carrying a Compose nav route. Set by foreground services
+         * (and any other external launcher) on the `Intent(this, MainActivity::class.java)`
+         * they fire to request RelayApp navigate to a specific destination on
+         * launch / re-launch.
+         */
+        const val EXTRA_NAV_ROUTE = "com.hermesandroid.relay.EXTRA_NAV_ROUTE"
+    }
 }

app/src/main/kotlin/com/hermesandroid/relay/accessibility/BridgeStatusReporter.kt

@@ -0,0 +1,343 @@
+package com.hermesandroid.relay.accessibility
+
+import android.content.BroadcastReceiver
+import android.content.Context
+import android.content.Intent
+import android.content.IntentFilter
+import android.os.BatteryManager
+import android.os.Build
+import android.os.PowerManager
+import android.provider.Settings
+import android.util.Log
+import com.hermesandroid.relay.bridge.BridgeSafetyManager
+import com.hermesandroid.relay.bridge.UnattendedAccessManager
+import com.hermesandroid.relay.data.BuildFlavor
+import com.hermesandroid.relay.network.relay.ChannelMultiplexer
+import com.hermesandroid.relay.network.relay.models.Envelope
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.Job
+import kotlinx.coroutines.delay
+import kotlinx.coroutines.isActive
+import kotlinx.coroutines.launch
+import kotlinx.serialization.json.JsonNull
+import kotlinx.serialization.json.buildJsonObject
+import kotlinx.serialization.json.put
+
+/**
+ * Phase 3 — accessibility `accessibility-runtime`
+ *
+ * Coroutine-driven status reporter. Emits a `bridge.status` envelope every
+ * [TICK_MS] (default 30 seconds) describing the phone's current state.
+ *
+ * ## Wire format (Phase 3 `phase3-status` expansion)
+ *
+ * The envelope payload is the full structured status contract that the
+ * relay-side [plugin.relay.channels.bridge.BridgeHandler] caches and
+ * serves via `GET /bridge/status`. It MUST match the JSON contract used
+ * by `android_phone_status()`:
+ *
+ * ```json
+ * {
+ *   "device": {
+ *     "name": "SM-S921U",
+ *     "battery_percent": 78,
+ *     "screen_on": true,
+ *     "current_app": "com.android.chrome"
+ *   },
+ *   "bridge": {
+ *     "master_enabled": true,
+ *     "accessibility_granted": true,
+ *     "screen_capture_granted": true,
+ *     "overlay_granted": true,
+ *     "notification_listener_granted": true
+ *   },
+ *   "safety": {
+ *     "blocklist_count": 30,
+ *     "destructive_verbs_count": 12,
+ *     "auto_disable_minutes": 30,
+ *     "auto_disable_at_ms": null
+ *   },
+ *   "unattended": {
+ *     "supported": true,
+ *     "enabled": false,
+ *     "credential_lock_detected": true
+ *   }
+ * }
+ * ```
+ *
+ * `bridge.device_control_supported` and `unattended.supported` are false on
+ * the googlePlay flavor — the Play APK ships Bridge Core without
+ * AccessibilityService, wake locks, overlays, screenshots, or unattended
+ * control — which lets the agent avoid attempting sideload-only tools.
+ *
+ * The legacy top-level keys (`screen_on`, `battery`, `current_app`,
+ * `accessibility_enabled`, `ts`) are ALSO emitted for backwards
+ * compatibility with any consumer that hasn't been updated to read the
+ * nested `device` / `bridge` / `safety` groups yet. The fields are
+ * cheap and additive, and the relay caches the whole payload verbatim.
+ *
+ * ## Lifecycle
+ *
+ * The reporter is a no-op until [start] is called, and [stop] is
+ * idempotent. [com.hermesandroid.relay.viewmodel.ConnectionViewModel]
+ * owns it and ties the lifecycle to the WSS connection — reporting
+ * while disconnected is a waste of battery and the multiplexer would
+ * drop the envelopes silently anyway.
+ *
+ * ## Out-of-band pushes
+ *
+ * Callers may invoke [pushNow] to force an immediate emission outside
+ * the 30 s tick — used by `ConnectionViewModel` when the master toggle
+ * flips, so the relay-side cache updates immediately instead of waiting
+ * up to 30 s for the next periodic tick.
+ */
+class BridgeStatusReporter(
+    private val context: Context,
+    private val multiplexer: ChannelMultiplexer,
+    private val scope: CoroutineScope,
+) {
+
+    companion object {
+        private const val TAG = "BridgeStatusReporter"
+        private const val TICK_MS = 30_000L
+    }
+
+    private var job: Job? = null
+
+    /**
+     * Start the reporter. Safe to call multiple times — if a job is
+     * already running we log and return.
+     */
+    fun start() {
+        if (job?.isActive == true) {
+            Log.v(TAG, "already running")
+            return
+        }
+        job = scope.launch {
+            // Send an immediate first tick so the agent sees fresh status
+            // as soon as the WSS connection comes up, rather than waiting
+            // up to 30s for the first periodic tick.
+            while (isActive) {
+                try {
+                    emitTick()
+                } catch (t: Throwable) {
+                    Log.w(TAG, "status emit failed: ${t.message}")
+                }
+                delay(TICK_MS)
+            }
+        }
+    }
+
+    fun stop() {
+        job?.cancel()
+        job = null
+    }
+
+    /**
+     * Force an immediate status emission outside the [TICK_MS] cadence.
+     * Useful when state changes that matter to the agent (master toggle
+     * flip, accessibility service connected, etc.) — rather than waiting
+     * up to 30 s for the relay cache to refresh.
+     *
+     * No-op if [start] hasn't been called yet — in that case the next
+     * start() will fire a tick anyway.
+     */
+    fun pushNow() {
+        if (job?.isActive != true) {
+            Log.v(TAG, "pushNow() called while stopped — no-op")
+            return
+        }
+        scope.launch {
+            try {
+                emitTick()
+            } catch (t: Throwable) {
+                Log.w(TAG, "pushNow emit failed: ${t.message}")
+            }
+        }
+    }
+
+    /**
+     * Build one status envelope from live phone state and push it through
+     * the multiplexer. Exposed as internal-ish so unit tests can drive
+     * a single tick without spinning the coroutine.
+     */
+    internal fun emitTick() {
+        val screenOn = try {
+            val pm = context.getSystemService(Context.POWER_SERVICE) as PowerManager
+            pm.isInteractive
+        } catch (t: Throwable) {
+            Log.v(TAG, "screenOn probe failed: ${t.message}")
+            false
+        }
+
+        val battery = try {
+            // Prefer the BatteryManager property API — it's the only
+            // always-accurate source on modern Android. The legacy sticky
+            // intent path is fine too but we'd have to parse two fields.
+            val bm = context.getSystemService(Context.BATTERY_SERVICE) as BatteryManager
+            bm.getIntProperty(BatteryManager.BATTERY_PROPERTY_CAPACITY)
+        } catch (t: Throwable) {
+            Log.v(TAG, "battery probe failed: ${t.message}")
+            -1
+        }
+
+        // If the property API returns 0 (some OEM firmwares do) fall back
+        // to the sticky intent read.
+        val batteryFinal = if (battery <= 0) readBatteryViaIntent() else battery
+
+        val currentApp = HermesAccessibilityService.instance?.currentApp
+        val accessibilityGranted = HermesAccessibilityService.instance != null
+        val masterEnabled = HermesAccessibilityService.instance?.isMasterEnabled() ?: false
+        val deviceControlSupported = BuildFlavor.isSideload
+
+        // Screen-capture grant — the process-singleton holder is non-null
+        // iff the user granted MediaProjection consent this session.
+        val screenCaptureGranted = try {
+            MediaProjectionHolder.projection != null
+        } catch (t: Throwable) {
+            Log.v(TAG, "screen_capture probe failed: ${t.message}")
+            false
+        }
+
+        val overlayGranted = try {
+            Settings.canDrawOverlays(context)
+        } catch (t: Throwable) {
+            Log.v(TAG, "overlay probe failed: ${t.message}")
+            false
+        }
+
+        val notificationListenerGranted = try {
+            val enabled = Settings.Secure.getString(
+                context.contentResolver,
+                "enabled_notification_listeners"
+            )
+            enabled?.contains(context.packageName) ?: false
+        } catch (t: Throwable) {
+            Log.v(TAG, "notification_listener probe failed: ${t.message}")
+            false
+        }
+
+        // Safety snapshot — read lazily through the process-singleton
+        // so we don't take a DI dep here. Falls back to zeros if the
+        // safety manager hasn't been built yet (cold start).
+        val safetyManager = BridgeSafetyManager.peek()
+        val safetySnapshot = safetyManager?.settings?.value
+        val blocklistCount = safetySnapshot?.blocklist?.size ?: 0
+        val destructiveVerbsCount = safetySnapshot?.destructiveVerbs?.size ?: 0
+        val autoDisableMinutes = safetySnapshot?.autoDisableMinutes ?: 0
+        val autoDisableAtMs = safetyManager?.autoDisableAtMs?.value
+
+        val deviceName = Build.MODEL ?: "unknown"
+
+        val envelope = Envelope(
+            channel = "bridge",
+            type = "bridge.status",
+            payload = buildJsonObject {
+                // Nested structured groups matching the relay HTTP contract.
+                put("device", buildJsonObject {
+                    put("name", deviceName)
+                    put("battery_percent", batteryFinal)
+                    put("screen_on", screenOn)
+                    put("current_app", currentApp ?: "unknown")
+                    // Flavor context so the LLM knows upfront which build
+                    // is connected and can avoid attempting sideload-only
+                    // tools on a googlePlay phone. Without this the agent
+                    // is flavor-blind until it tries android_send_sms and
+                    // gets a 403 sideload_only — by which point it's
+                    // already wasted a tool call and has to recover.
+                    put("flavor", com.hermesandroid.relay.data.BuildFlavor.current)
+                    put("application_id", com.hermesandroid.relay.data.BuildFlavor.run {
+                        // BuildConfig.APPLICATION_ID is the resolved
+                        // applicationId from the active flavor variant.
+                        try {
+                            @Suppress("KotlinConstantConditions")
+                            com.hermesandroid.relay.BuildConfig.APPLICATION_ID
+                        } catch (_: Throwable) {
+                            "unknown"
+                        }
+                    })
+                })
+                put("bridge", buildJsonObject {
+                    put("device_control_supported", deviceControlSupported)
+                    put("master_enabled", if (deviceControlSupported) masterEnabled else false)
+                    put(
+                        "accessibility_granted",
+                        if (deviceControlSupported) accessibilityGranted else false,
+                    )
+                    put(
+                        "screen_capture_granted",
+                        if (deviceControlSupported) screenCaptureGranted else false,
+                    )
+                    put("overlay_granted", if (deviceControlSupported) overlayGranted else false)
+                    put("notification_listener_granted", notificationListenerGranted)
+                })
+                put("safety", buildJsonObject {
+                    put("blocklist_count", blocklistCount)
+                    put("destructive_verbs_count", destructiveVerbsCount)
+                    put("auto_disable_minutes", autoDisableMinutes)
+                    if (autoDisableAtMs == null) {
+                        put("auto_disable_at_ms", JsonNull)
+                    } else {
+                        put("auto_disable_at_ms", autoDisableAtMs)
+                    }
+                })
+
+                // v0.4.1: unattended-access state so the agent can decide
+                // upfront whether commands will reach apps with the screen
+                // off (instead of finding out reactively via the
+                // keyguard_blocked error_code after a failed command).
+                // `supported` is false on googlePlay — that flavor has no
+                // wake-lock path and the user can't opt in even if they
+                // wanted to. `credential_lock_detected` reflects whether
+                // a PIN/pattern/biometric lock is currently configured;
+                // when both `enabled=true` and this is true, commands
+                // will wake the screen but stop at the lock screen.
+                put("unattended", buildJsonObject {
+                    put("supported", deviceControlSupported)
+                    put(
+                        "enabled",
+                        if (deviceControlSupported) UnattendedAccessManager.enabled.value else false,
+                    )
+                    put(
+                        "credential_lock_detected",
+                        if (deviceControlSupported) {
+                            UnattendedAccessManager.credentialLockDetected.value
+                        } else {
+                            false
+                        },
+                    )
+                })
+
+                // ── Legacy top-level fields (backwards compat) ────────
+                // Kept so pre-phase3-status consumers still see the
+                // same fields they're already parsing. New consumers
+                // should read from the nested `device` / `bridge`
+                // groups above.
+                put("screen_on", screenOn)
+                put("battery", batteryFinal)
+                put("current_app", if (deviceControlSupported) currentApp ?: "unknown" else "unknown")
+                put("accessibility_enabled", if (deviceControlSupported) accessibilityGranted else false)
+                put("ts", System.currentTimeMillis())
+            }
+        )
+        multiplexer.send(envelope)
+    }
+
+    /**
+     * Legacy fallback for BatteryManager.getIntProperty returning 0 —
+     * reads the sticky `ACTION_BATTERY_CHANGED` intent and computes
+     * percentage manually.
+     */
+    private fun readBatteryViaIntent(): Int = try {
+        val filter = IntentFilter(Intent.ACTION_BATTERY_CHANGED)
+        @Suppress("UNUSED_VARIABLE")
+        val placeholder: BroadcastReceiver? = null
+        val battery = context.registerReceiver(null, filter)
+        val level = battery?.getIntExtra(BatteryManager.EXTRA_LEVEL, -1) ?: -1
+        val scale = battery?.getIntExtra(BatteryManager.EXTRA_SCALE, -1) ?: -1
+        if (level >= 0 && scale > 0) (level * 100 / scale) else -1
+    } catch (t: Throwable) {
+        Log.v(TAG, "battery intent fallback failed: ${t.message}")
+        -1
+    }
+}

app/src/main/kotlin/com/hermesandroid/relay/accessibility/HermesAccessibilityService.kt

@@ -0,0 +1,322 @@
+package com.hermesandroid.relay.accessibility
+
+import android.accessibilityservice.AccessibilityService
+import android.content.Context
+import android.content.Intent
+import android.os.Build
+import android.util.Log
+import android.view.accessibility.AccessibilityEvent
+import android.view.accessibility.AccessibilityNodeInfo
+import androidx.datastore.preferences.core.booleanPreferencesKey
+import androidx.datastore.preferences.core.edit
+import com.hermesandroid.relay.data.relayDataStore
+import com.hermesandroid.relay.event.EventStore
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.SupervisorJob
+import kotlinx.coroutines.cancel
+import kotlinx.coroutines.flow.Flow
+import kotlinx.coroutines.flow.map
+import kotlinx.coroutines.launch
+
+/**
+ * Phase 3 — accessibility `accessibility-runtime`
+ *
+ * Hermes's master `AccessibilityService` subclass. Provides the phone-side
+ * execution layer for the bridge channel: the agent reads the screen,
+ * taps/types/swipes, and captures screenshots through this service.
+ *
+ * # Lifecycle & singleton pattern
+ *
+ * Android instantiates `AccessibilityService` subclasses itself (through the
+ * manifest declaration + user opt-in in Settings → Accessibility), so we
+ * can't pass collaborators in via a constructor. The canonical workaround
+ * is a weak-referenced singleton: on [onServiceConnected] the instance
+ * registers itself with [Companion.instance], and on [onUnbind]/destroy it
+ * clears itself. Any other code that needs to dispatch gestures (the
+ * `BridgeCommandHandler`) asks for [instance] and bails out if it's null
+ * (service not running / user hasn't granted permission).
+ *
+ * # Master enable / disable
+ *
+ * The Android system toggle in `Settings → Accessibility → Hermes-Relay` is
+ * the hard switch — if it's off we never receive events. On top of that the
+ * user can flip a soft master in Settings (`bridge_master_enabled`); when
+ * that's false we still run (Android requires it to stay connected) but we
+ * refuse to execute commands. [isMasterEnabled] is a StateFlow the UI
+ * observes and the command handler checks before dispatching actions.
+ *
+ * # Event handling
+ *
+ * We subscribe to a minimal event set — `TYPE_WINDOW_STATE_CHANGED` to
+ * track the foreground package (for [currentApp] status), and nothing else.
+ * The XML resource (flavor-provided by Agent flavor-split) controls the exact flag
+ * bitset. We deliberately do NOT process text / content-change events —
+ * those fire thousands of times a minute and are pointless for our use
+ * case (we read the UI tree on demand via `rootInActiveWindow`).
+ */
+class HermesAccessibilityService : AccessibilityService() {
+
+    companion object {
+        private const val TAG = "HermesA11yService"
+
+        /** Master-enable DataStore key — read + toggled from Settings UI. */
+        val KEY_BRIDGE_MASTER_ENABLED = booleanPreferencesKey("bridge_master_enabled")
+
+        /**
+         * Static reference to the live service instance, or null if the
+         * service is not running. Written on [onServiceConnected],
+         * cleared on [onUnbind] / [onDestroy].
+         *
+         * Read by [com.hermesandroid.relay.network.relay.BridgeCommandHandler]
+         * and by the Bridge UI screen (bridge-ui) to check live status.
+         */
+        @Volatile
+        var instance: HermesAccessibilityService? = null
+            private set
+
+        /**
+         * Observe the DataStore-backed master enable flag for the bridge.
+         * UI can collect this to drive the master-toggle switch; the service
+         * itself also polls it via [isMasterEnabled] before executing commands.
+         */
+        fun masterEnabledFlow(context: Context): Flow<Boolean> =
+            context.applicationContext.relayDataStore.data
+                .map { prefs -> prefs[KEY_BRIDGE_MASTER_ENABLED] ?: false }
+
+        /**
+         * Persist a new master-enable value. Called from Settings UI when the
+         * user flips the switch, and from [BridgeStatusReporter] / safety
+         * rails when auto-disable timers fire.
+         */
+        suspend fun setMasterEnabled(context: Context, enabled: Boolean) {
+            context.applicationContext.relayDataStore.edit { prefs ->
+                prefs[KEY_BRIDGE_MASTER_ENABLED] = enabled
+            }
+        }
+    }
+
+    private val screenReader = ScreenReader()
+    private val screenHasher = ScreenHasher()
+    private var _actionExecutor: ActionExecutor? = null
+
+    /**
+     * Service-scoped coroutine context. Started fresh in
+     * [onServiceConnected], cancelled in [onUnbind] / [onDestroy]. Used to
+     * observe the DataStore-backed master toggle and pump it into
+     * [cachedMasterEnabled] so [BridgeCommandHandler] can do a non-suspend
+     * gate check on every inbound command.
+     *
+     * Without this collector the cache stays at its `false` default and
+     * the gate refuses every command — that was the original Phase 3
+     * "bridge always disabled" bug.
+     *
+     * Re-created on each connect because cancelled `SupervisorJob`s can't
+     * be reused, and Android may rebind the same service instance after
+     * an unbind on rare config changes.
+     */
+    @Volatile
+    private var serviceScope: CoroutineScope? = null
+
+    /**
+     * Cached package name of the currently-foregrounded app. Updated on
+     * every `TYPE_WINDOW_STATE_CHANGED` event. Read by the status reporter
+     * for the `current_app` field in `bridge.status`.
+     */
+    @Volatile
+    var currentApp: String? = null
+        private set
+
+    /**
+     * Public accessor for the lazily-constructed [ActionExecutor]. The
+     * executor needs a back-reference to the service (for `dispatchGesture`),
+     * so we can only build it after Android has fully constructed us.
+     */
+    val actionExecutor: ActionExecutor
+        get() = _actionExecutor ?: ActionExecutor(this).also { _actionExecutor = it }
+
+    /** Convenience wrapper — the service uses its own [ScreenReader] instance. */
+    val reader: ScreenReader get() = screenReader
+
+    /**
+     * Convenience wrapper for the service's [ScreenHasher] instance.
+     * Used by `BridgeCommandHandler` for `/screen_hash` + `/diff_screen`.
+     */
+    val hasher: ScreenHasher get() = screenHasher
+
+    override fun onServiceConnected() {
+        super.onServiceConnected()
+        instance = this
+        Log.i(TAG, "HermesAccessibilityService connected")
+        // Feed the master-toggle cache for the lifetime of this service
+        // binding. Re-created on each connect — see [serviceScope] KDoc.
+        val scope = CoroutineScope(Dispatchers.Default + SupervisorJob())
+        serviceScope = scope
+        scope.launch {
+            masterEnabledFlow(this@HermesAccessibilityService).collect { enabled ->
+                cachedMasterEnabled = enabled
+                Log.d(TAG, "master toggle cached: $enabled")
+            }
+        }
+    }
+
+    override fun onAccessibilityEvent(event: AccessibilityEvent?) {
+        if (event == null) return
+
+        when (event.eventType) {
+            AccessibilityEvent.TYPE_WINDOW_STATE_CHANGED -> {
+                val pkg = event.packageName?.toString()
+                if (!pkg.isNullOrBlank()) {
+                    currentApp = pkg
+                }
+            }
+            else -> {
+                // Other event types are declared in the config XML for
+                // future safety rails (blocklist enforcement via
+                // content-change events) but we deliberately no-op here
+                // today. Filtering happens inside the config flag bitset
+                // so we never even receive most events.
+            }
+        }
+
+        // === PHASE3-event-stream: B1 android_events / android_event_stream ===
+        // Feed signal-rich events into the bounded ring buffer when the
+        // agent has explicitly opted in via android_event_stream(true).
+        // EventStore does its own type-filter + throttle + thread-safety
+        // — we just hand it the raw event.
+        if (EventStore.isStreaming) {
+            EventStore.append(event)
+        }
+        // === END PHASE3-event-stream ===
+    }
+
+    override fun onInterrupt() {
+        // Called by the system when it wants us to drop any in-flight work.
+        // We don't queue long-running operations — every bridge command is
+        // fire-and-forget with its own callback — so there's nothing to
+        // cancel here.
+        Log.i(TAG, "onInterrupt — accessibility service asked to stop work")
+    }
+
+    override fun onUnbind(intent: Intent?): Boolean {
+        Log.i(TAG, "HermesAccessibilityService unbinding")
+        if (instance === this) instance = null
+        serviceScope?.cancel()
+        serviceScope = null
+        cachedMasterEnabled = false
+        return super.onUnbind(intent)
+    }
+
+    override fun onDestroy() {
+        if (instance === this) instance = null
+        serviceScope?.cancel()
+        serviceScope = null
+        cachedMasterEnabled = false
+        super.onDestroy()
+    }
+
+    /**
+     * Soft master-toggle cache. Fed by the [serviceScope] collector started
+     * in [onServiceConnected] — DO NOT write directly. Read by
+     * [BridgeCommandHandler] on every inbound command via [isMasterEnabled].
+     *
+     * Volatile because the writer runs on Dispatchers.Default and the
+     * reader runs on whichever multiplexer thread the bridge envelope
+     * arrives on.
+     */
+    @Volatile
+    private var cachedMasterEnabled: Boolean = false
+
+    fun isMasterEnabled(): Boolean = cachedMasterEnabled
+
+    /**
+     * Snapshot the current root node of the active window. Returns null if
+     * no window is focused or the system refuses access (e.g. IME window).
+     *
+     * Callers must `recycle()` the returned node when done.
+     *
+     * On API 34+, [AccessibilityNodeInfo.recycle] is deprecated but still
+     * safe to call — the system just no-ops. We support min SDK 26 so we
+     * keep calling it for the older branch.
+     *
+     * Prefer [snapshotAllWindows] for /screen + tap_text / type_text — it
+     * catches system overlays, popup menus, and the notification shade.
+     * This single-root form is retained for callers that genuinely only
+     * care about the foregrounded app window (e.g. [ActionExecutor.scroll],
+     * which uses the active window's bounds as the scroll gesture's frame).
+     */
+    fun snapshotRoot(): AccessibilityNodeInfo? = try {
+        rootInActiveWindow
+    } catch (t: Throwable) {
+        Log.w(TAG, "rootInActiveWindow threw: ${t.message}")
+        null
+    }
+
+    /**
+     * P1 — Snapshot the root nodes of **all** live accessibility windows,
+     * top-of-stack first. Catches system overlays, popup menus, the
+     * notification shade when pulled down, permission dialogs, and
+     * multi-window split-screen state — all of which [snapshotRoot] misses.
+     *
+     * Every [android.view.accessibility.AccessibilityWindowInfo.getRoot]
+     * returns a fresh [AccessibilityNodeInfo] that the caller MUST
+     * `recycle()` when done. Recycling is the single biggest landmine in
+     * this area — leaking window roots makes subsequent gesture dispatches
+     * fail silently because the system runs out of node handles.
+     *
+     * # Fallback semantics
+     *
+     * `service.windows` returns an empty list unless the accessibility
+     * config XML requests `flagRetrieveInteractiveWindows`. The service is
+     * declared only by the `sideload` manifest, and that sideload config sets
+     * the flag. When `windows` is empty (or throws, or every window's root is
+     * null) we fall back to a single-element list wrapping
+     * [rootInActiveWindow], preserving pre-P1 behaviour for tests and
+     * defensive runtime fallback.
+     *
+     * Returns an empty list only if the service cannot read any window
+     * root at all (e.g. lock screen, master-off state). Callers should
+     * treat an empty return the same as `snapshotRoot() == null`.
+     */
+    fun snapshotAllWindows(): List<AccessibilityNodeInfo> {
+        // Try the full multi-window path first. `service.windows` is
+        // available on API 21+ and we target min SDK 26, so no version
+        // guard needed.
+        val windowList: List<android.view.accessibility.AccessibilityWindowInfo> = try {
+            this.windows ?: emptyList()
+        } catch (t: Throwable) {
+            Log.w(TAG, "service.windows threw: ${t.message}")
+            emptyList()
+        }
+
+        if (windowList.isNotEmpty()) {
+            val roots = ArrayList<AccessibilityNodeInfo>(windowList.size)
+            for (wi in windowList) {
+                val root: AccessibilityNodeInfo? = try {
+                    wi.root
+                } catch (t: Throwable) {
+                    Log.w(TAG, "AccessibilityWindowInfo.getRoot threw: ${t.message}")
+                    null
+                }
+                if (root != null) roots.add(root)
+            }
+            if (roots.isNotEmpty()) return roots
+            // Else fall through — all window roots were null, try the
+            // single-window fallback in case it can still see the active
+            // window.
+        }
+
+        // googlePlay fallback (or empty-windows edge case): mimic the
+        // pre-P1 single-root behaviour.
+        val active = snapshotRoot() ?: return emptyList()
+        return listOf(active)
+    }
+
+    /**
+     * Best-effort indicator — `true` when the runtime is >= API 26 (always
+     * true on this app, we target 26+). Exposed for completeness so the
+     * Bridge UI can render a compile-time capabilities badge without
+     * reading BuildConfig directly.
+     */
+    val supportsGestures: Boolean get() = Build.VERSION.SDK_INT >= Build.VERSION_CODES.O
+}

app/src/main/kotlin/com/hermesandroid/relay/accessibility/ScreenCapture.kt

@@ -0,0 +1,631 @@
+package com.hermesandroid.relay.accessibility
+
+import android.content.Context
+import android.content.Intent
+import android.graphics.Bitmap
+import android.graphics.PixelFormat
+import android.hardware.display.DisplayManager
+import android.hardware.display.VirtualDisplay
+import android.media.Image
+import android.media.ImageReader
+import android.media.projection.MediaProjection
+import android.media.projection.MediaProjectionManager
+import android.os.Handler
+import android.os.HandlerThread
+import android.util.DisplayMetrics
+import android.util.Log
+import android.view.WindowManager
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.sync.withLock
+import kotlinx.coroutines.withContext
+import okhttp3.MediaType.Companion.toMediaType
+import okhttp3.MultipartBody
+import okhttp3.OkHttpClient
+import okhttp3.Request
+import okhttp3.RequestBody.Companion.toRequestBody
+import java.io.ByteArrayOutputStream
+import java.io.File
+import java.io.IOException
+import java.util.concurrent.TimeUnit
+
+/**
+ * Phase 3 — accessibility `accessibility-runtime`
+ *
+ * Captures the phone's screen via the Android [MediaProjection] API, encodes
+ * it as PNG, and publishes it to the relay so the agent can fetch it.
+ *
+ * ## Permission flow (blocker for Agent bridge-ui / UI to wire)
+ *
+ * `MediaProjection` cannot be granted by the app itself — it needs an
+ * explicit user consent dialog per session, launched via
+ * [MediaProjectionManager.createScreenCaptureIntent] from an `Activity`.
+ * The resulting `Intent` is then passed to [MediaProjectionManager.getMediaProjection]
+ * to build an actual projection.
+ *
+ * Because the grant lives on an `Activity` result, this class can only
+ * provide the capture loop — **the consent flow must be wired by the
+ * Bridge UI screen (Agent bridge-ui)**. Suggested contract:
+ *
+ *  1. `BridgeScreen` holds an `ActivityResultLauncher<Intent>` registered
+ *     with `ActivityResultContracts.StartActivityForResult()`.
+ *  2. On "Enable screenshots" tap, bridge-ui calls
+ *     `MediaProjectionManager.createScreenCaptureIntent()` and launches it.
+ *  3. On result, bridge-ui passes `(resultCode, data)` into a central holder
+ *     (e.g. a ViewModel singleton or [MediaProjectionHolder]).
+ *  4. [ScreenCapture] reads from that holder on each capture call and
+ *     rebuilds a `MediaProjection` when needed. The projection will need
+ *     to be backed by a foreground service on Android 10+ — Agent safety-rails
+ *     owns the persistent-notification service declaration.
+ *
+ * Until that wiring lands, this class will fail gracefully with
+ * `Result.failure(IllegalStateException("MediaProjection not granted"))`
+ * and the agent will see the error text in the `bridge.response` body.
+ *
+ * ## Upload path — current limitation
+ *
+ * The relay's existing `/media/register` endpoint is **loopback-only and
+ * path-based** (`plugin/relay/media.py`) — it registers a file path that
+ * already exists on the relay host, with an optional content type and
+ * filename. The phone is by definition not on the relay host, so it has no
+ * usable path to register.
+ *
+ * Two options exist for bridging this gap:
+ *
+ * 1. **New relay endpoint** (preferred) — `POST /media/upload` accepts
+ *    `multipart/form-data` with the PNG bytes, writes to a sandboxed tmp
+ *    dir (`tempfile.gettempdir()`), then calls `MediaRegistry.register()`
+ *    on the resulting path. Wire shape mirrors `/voice/transcribe`. This
+ *    is a clean server-side change that Agent bridge-server could land in parallel.
+ *
+ * 2. **Local-only screenshots** (fallback) — the phone writes the PNG to
+ *    its own cache dir, emits `MEDIA:file://<cache_path>` in the response,
+ *    and the agent fetches it via an on-device tool (N/A — the agent runs
+ *    on the host, not the phone). So option 2 doesn't actually work.
+ *
+ * This class implements option 1 via [uploadViaMultipart]. If the endpoint
+ * returns 404 (not yet deployed), we surface the error to the agent with a
+ * clear message. **Agent bridge-server owns the `POST /media/upload` endpoint** — it's
+ * the only remaining server-side work to complete Tier 1 screenshots.
+ *
+ * ## Thread model
+ *
+ * `ImageReader` delivers frames on a background `HandlerThread` we own.
+ * The PNG encode runs on [Dispatchers.IO] via [withContext]. The HTTP
+ * upload is also IO-dispatched. All three can be cancelled by the caller.
+ */
+class ScreenCapture(
+    private val context: Context,
+    private val httpClient: OkHttpClient,
+    private val relayUrlProvider: () -> String?,
+    private val sessionTokenProvider: suspend () -> String?,
+    private val mediaProjectionProvider: () -> MediaProjection?,
+) {
+
+    companion object {
+        private const val TAG = "ScreenCapture"
+
+        /** PNG quality is a no-op for PNG, but Bitmap.compress expects the arg. */
+        private const val PNG_QUALITY = 100
+
+        /**
+         * ImageReader buffer count — we only need the latest frame, but the
+         * reader requires at least 2 slots so the producer (VirtualDisplay)
+         * can keep writing while we acquire the previous one.
+         */
+        private const val MAX_IMAGES = 2
+
+        /** Capture timeout — if no frame arrives in this window, fail loudly. */
+        private const val CAPTURE_TIMEOUT_MS = 2_500L
+    }
+
+    // === PHASE3-bridge-ui-followup: MediaProjection reuse fix ===
+    //
+    // Starting in Android 14 (API 34), each MediaProjection instance supports
+    // exactly ONE createVirtualDisplay() call per session. Calling it a
+    // second time throws with the error:
+    //     "Don't re-use the resultData... Don't take multiple captures by
+    //      invoking MediaProjection#createVirtualDisplay multiple times on
+    //      the same instance."
+    //
+    // The old implementation built a fresh VirtualDisplay + ImageReader on
+    // EVERY screenshot call and released it after, which worked on Android
+    // 13 and below but breaks the second /screenshot request on 14+.
+    //
+    // Fix: keep the VirtualDisplay + ImageReader + HandlerThread alive
+    // across captures, keyed by the MediaProjection instance. Rebuild only
+    // when the projection reference changes (fresh consent grant) or the
+    // dimensions change (orientation flip). The ImageReader's
+    // setOnImageAvailableListener drains the buffer continuously; each
+    // captureAndUpload() installs a one-shot [pendingCapture] callback
+    // that fires on the next frame.
+    //
+    // Thread model:
+    //  - `captureMutex` serializes concurrent captureAndUpload() calls
+    //  - `cacheLock` protects the cached-state fields against the listener
+    //     thread (which runs on `captureThread.looper`) racing with rebuild
+    //  - The listener always acquires the latest frame; the pendingCapture
+    //    deferred is completed with the encoded PNG bytes inside the
+    //    listener callback on the capture thread.
+    private val captureMutex = kotlinx.coroutines.sync.Mutex()
+    private val cacheLock = Any()
+    private var cachedProjection: MediaProjection? = null
+    private var cachedReader: ImageReader? = null
+    private var cachedDisplay: VirtualDisplay? = null
+    private var cachedThread: HandlerThread? = null
+    private var cachedHandler: Handler? = null
+    private var cachedWidth: Int = 0
+    private var cachedHeight: Int = 0
+    private var cachedDensity: Int = 0
+
+    /**
+     * Pending capture request, populated on [captureAndUpload] entry and
+     * completed by the persistent ImageReader listener on the next frame.
+     * `@Volatile` so the listener thread sees assignments made from the
+     * capture coroutine. AtomicReference-style swap semantics via
+     * [pendingCaptureRef] avoid a stale completion racing a new request.
+     */
+    private val pendingCaptureRef = java.util.concurrent.atomic.AtomicReference<
+        kotlinx.coroutines.CompletableDeferred<ByteArray>?
+    >(null)
+    // === END PHASE3-bridge-ui-followup ===
+
+    /**
+     * Build the consent intent that `BridgeScreen` launches via an
+     * `ActivityResultLauncher`. Callers should launch the intent with
+     * `StartActivityForResult` and on success route the result to
+     * `BridgeForegroundService.grantMediaProjection(...)`, which handles
+     * the Android 14+ FGS-type-upgrade dance and stores the projection
+     * inside the holder. Calling
+     * [MediaProjectionHolder.acceptGrantInsideForegroundService] from
+     * outside a foreground service is a known footgun — see that method's
+     * docstring for the full explanation.
+     */
+    fun createConsentIntent(): Intent =
+        (context.getSystemService(Context.MEDIA_PROJECTION_SERVICE) as MediaProjectionManager)
+            .createScreenCaptureIntent()
+
+    /**
+     * Capture one frame and upload it to the relay. Returns the inbound
+     * media marker (`MEDIA:hermes-relay://<token>`) on success so the
+     * bridge command handler can embed it directly in the `bridge.response`
+     * result.
+     *
+     * Fails fast and with clear messaging on every expected error path:
+     *
+     *  - `MediaProjection not granted` → bridge-ui needs to run the consent flow
+     *  - `relay URL not configured` / `session token missing` → pair first
+     *  - `relay upload endpoint not found` → bridge-server needs to ship `/media/upload`
+     *  - `capture timeout` → the virtual display never emitted a frame
+     */
+    suspend fun captureAndUpload(): Result<String> = withContext(Dispatchers.IO) {
+        val projection = mediaProjectionProvider()
+            ?: return@withContext Result.failure(
+                IllegalStateException(
+                    "MediaProjection not granted — enable Bridge screenshots in the app"
+                )
+            )
+
+        // Serialize concurrent capture requests so only one pendingCapture
+        // is in flight at a time. The bridge command handler is the usual
+        // caller and it's single-threaded per /screenshot request, but the
+        // mutex keeps us honest if anything ever parallelizes.
+        val pngBytes = try {
+            captureMutex.withLock {
+                captureFrame(projection)
+            }
+        } catch (e: Exception) {
+            Log.w(TAG, "captureFrame failed: ${e.message}")
+            return@withContext Result.failure(e)
+        }
+
+        uploadViaMultipart(pngBytes)
+    }
+
+    /**
+     * Release any cached VirtualDisplay / ImageReader / HandlerThread. Call
+     * this when the MediaProjection is revoked (the holder's `onStop`
+     * callback, or an explicit revoke) so a subsequent grant starts with
+     * a clean slate. Safe to call multiple times.
+     *
+     * NOTE: this does NOT stop the MediaProjection itself — that's the
+     * holder's responsibility. We only own the capture pipeline built on
+     * top of the projection.
+     */
+    fun releaseCache() {
+        synchronized(cacheLock) {
+            runCatching { cachedDisplay?.release() }
+            runCatching { cachedReader?.close() }
+            runCatching { cachedThread?.quitSafely() }
+            cachedDisplay = null
+            cachedReader = null
+            cachedThread = null
+            cachedHandler = null
+            cachedProjection = null
+            cachedWidth = 0
+            cachedHeight = 0
+            cachedDensity = 0
+        }
+        // Fail any pending capture with a descriptive error so the caller
+        // doesn't hang for the timeout.
+        pendingCaptureRef.getAndSet(null)?.takeIf { it.isActive }?.completeExceptionally(
+            IOException("capture pipeline released before frame arrived")
+        )
+    }
+
+    /**
+     * Capture one frame from the cached VirtualDisplay + ImageReader,
+     * rebuilding them if the projection reference changed or dimensions
+     * drifted (orientation flip). Returns the PNG-encoded bytes.
+     *
+     * The ImageReader's persistent listener is set up once inside
+     * [ensureCacheFor]. Each call here installs a fresh
+     * [pendingCaptureRef] deferred that the listener completes on the
+     * next frame; the listener drains non-waiting frames so the buffer
+     * doesn't back up while nothing is asking for screenshots.
+     */
+    private suspend fun captureFrame(projection: MediaProjection): ByteArray {
+        val metrics = DisplayMetrics()
+        @Suppress("DEPRECATION")
+        (context.getSystemService(Context.WINDOW_SERVICE) as WindowManager)
+            .defaultDisplay.getRealMetrics(metrics)
+        val width = metrics.widthPixels
+        val height = metrics.heightPixels
+        val densityDpi = metrics.densityDpi
+
+        ensureCacheFor(projection, width, height, densityDpi)
+
+        val deferred = kotlinx.coroutines.CompletableDeferred<ByteArray>()
+        // Replace any stale pending capture (shouldn't exist because of
+        // the mutex, but defensive). If there's a previous one, fail it
+        // so nobody ends up stuck.
+        val previous = pendingCaptureRef.getAndSet(deferred)
+        if (previous != null && previous.isActive) {
+            previous.completeExceptionally(
+                IOException("capture superseded by a newer request")
+            )
+        }
+
+        return try {
+            kotlinx.coroutines.withTimeout(CAPTURE_TIMEOUT_MS) { deferred.await() }
+        } catch (e: kotlinx.coroutines.TimeoutCancellationException) {
+            pendingCaptureRef.compareAndSet(deferred, null)
+            throw IOException("screen capture timed out")
+        } catch (t: Throwable) {
+            pendingCaptureRef.compareAndSet(deferred, null)
+            throw t
+        }
+    }
+
+    /**
+     * Build (or reuse) the cached VirtualDisplay + ImageReader + HandlerThread
+     * for this projection. Rebuilds when:
+     *
+     *  - The projection reference has changed (new consent grant landed)
+     *  - The captured dimensions don't match the current display (orientation
+     *    flipped, foldable opened/closed, display switched)
+     *
+     * Must be called while [captureMutex] is held so the cached fields
+     * aren't racing another capture.
+     */
+    private fun ensureCacheFor(
+        projection: MediaProjection,
+        width: Int,
+        height: Int,
+        densityDpi: Int,
+    ) {
+        synchronized(cacheLock) {
+            val projectionChanged = cachedProjection !== projection
+            val dimensionsChanged = width != cachedWidth || height != cachedHeight
+            if (!projectionChanged && !dimensionsChanged && cachedDisplay != null && cachedReader != null) {
+                return
+            }
+
+            // Tear down any stale cache before building fresh.
+            runCatching { cachedDisplay?.release() }
+            runCatching { cachedReader?.close() }
+            runCatching { cachedThread?.quitSafely() }
+
+            val thread = HandlerThread("HermesScreenCapture").apply { start() }
+            val handler = Handler(thread.looper)
+            val reader = ImageReader.newInstance(
+                width, height, PixelFormat.RGBA_8888, MAX_IMAGES
+            )
+
+            // Persistent listener — fires on every frame the VirtualDisplay
+            // produces. If there's a pending capture request, we encode
+            // the frame and complete it; otherwise we just drain the image
+            // so the ImageReader buffer stays clear.
+            reader.setOnImageAvailableListener({ r ->
+                val waiter = pendingCaptureRef.get()
+                if (waiter == null || !waiter.isActive) {
+                    // Drain-and-drop — nobody's asking for a screenshot
+                    // right now but frames are still arriving.
+                    runCatching { r.acquireLatestImage() }.getOrNull()?.close()
+                    return@setOnImageAvailableListener
+                }
+                var image: Image? = null
+                try {
+                    image = r.acquireLatestImage()
+                        ?: return@setOnImageAvailableListener
+                    val png = imageToPngBytes(image, width, height)
+                    // Only complete the EXACT deferred we latched onto,
+                    // so a stale listener firing after supersession doesn't
+                    // resolve a new request.
+                    if (pendingCaptureRef.compareAndSet(waiter, null)) {
+                        waiter.complete(png)
+                    }
+                } catch (t: Throwable) {
+                    if (pendingCaptureRef.compareAndSet(waiter, null)) {
+                        waiter.completeExceptionally(t)
+                    }
+                } finally {
+                    runCatching { image?.close() }
+                }
+            }, handler)
+
+            val display = try {
+                projection.createVirtualDisplay(
+                    "hermes-bridge-capture",
+                    width,
+                    height,
+                    densityDpi,
+                    DisplayManager.VIRTUAL_DISPLAY_FLAG_AUTO_MIRROR,
+                    reader.surface,
+                    null,
+                    handler,
+                )
+            } catch (t: Throwable) {
+                // Build failed — roll back so the next attempt tries fresh.
+                runCatching { reader.close() }
+                runCatching { thread.quitSafely() }
+                throw t
+            }
+
+            // Register the MediaProjection.Callback so if the system stops
+            // this projection out from under us, we release our cache
+            // instead of holding dead handles. The holder's own callback
+            // is separate — it clears projectionFlow; ours clears the
+            // capture pipeline. Both are safe and complementary.
+            try {
+                projection.registerCallback(object : MediaProjection.Callback() {
+                    override fun onStop() {
+                        releaseCache()
+                    }
+                }, handler)
+            } catch (_: Throwable) {
+                // Some OEMs log but don't throw if the callback is already
+                // registered by another party (e.g. the holder). Ignore.
+            }
+
+            cachedProjection = projection
+            cachedReader = reader
+            cachedDisplay = display
+            cachedThread = thread
+            cachedHandler = handler
+            cachedWidth = width
+            cachedHeight = height
+            cachedDensity = densityDpi
+            Log.i(TAG, "screen capture pipeline built ${width}x$height dpi=$densityDpi")
+        }
+    }
+
+    /**
+     * Convert an [Image] from `ImageReader` into a PNG byte array. The
+     * plane's `rowStride` may be wider than `width * 4` — we must crop
+     * the stride padding before [Bitmap.copyPixelsFromBuffer].
+     */
+    private fun imageToPngBytes(image: Image, width: Int, height: Int): ByteArray {
+        val plane = image.planes[0]
+        val buffer = plane.buffer
+        val pixelStride = plane.pixelStride
+        val rowStride = plane.rowStride
+        val rowPadding = rowStride - pixelStride * width
+
+        val bitmapWidth = width + rowPadding / pixelStride
+        val bitmap = Bitmap.createBitmap(bitmapWidth, height, Bitmap.Config.ARGB_8888)
+        bitmap.copyPixelsFromBuffer(buffer)
+
+        // Crop to the exact screen width if rowStride padding widened us.
+        val cropped = if (bitmapWidth != width) {
+            Bitmap.createBitmap(bitmap, 0, 0, width, height).also {
+                bitmap.recycle()
+            }
+        } else bitmap
+
+        val out = ByteArrayOutputStream(256 * 1024)
+        cropped.compress(Bitmap.CompressFormat.PNG, PNG_QUALITY, out)
+        cropped.recycle()
+        return out.toByteArray()
+    }
+
+    /**
+     * Upload PNG bytes to the relay via `POST /media/upload` (multipart).
+     *
+     * **Blocker:** this endpoint does not exist server-side yet (see class
+     * docstring). When it ships, it should accept a single `file` part and
+     * return `{"ok": true, "token": "..."}` — the same JSON shape as
+     * `/media/register`, minus the loopback restriction and with the
+     * server sandboxing the temp-file write internally.
+     */
+    private suspend fun uploadViaMultipart(pngBytes: ByteArray): Result<String> {
+        val relayUrl = relayUrlProvider()?.trim().orEmpty()
+        if (relayUrl.isEmpty()) {
+            return Result.failure(IllegalStateException("Relay URL not configured"))
+        }
+        val sessionToken = sessionTokenProvider()
+        if (sessionToken.isNullOrBlank()) {
+            return Result.failure(
+                IllegalStateException("Relay not paired — session token missing")
+            )
+        }
+
+        val httpBase = relayUrl
+            .replace(Regex("^wss://", RegexOption.IGNORE_CASE), "https://")
+            .replace(Regex("^ws://", RegexOption.IGNORE_CASE), "http://")
+            .trimEnd('/')
+
+        val url = "$httpBase/media/upload"
+        val body = MultipartBody.Builder()
+            .setType(MultipartBody.FORM)
+            .addFormDataPart(
+                "file",
+                "hermes-screenshot-${System.currentTimeMillis()}.png",
+                pngBytes.toRequestBody("image/png".toMediaType())
+            )
+            .build()
+
+        val fastClient = httpClient.newBuilder()
+            .callTimeout(15, TimeUnit.SECONDS)
+            .build()
+
+        val request = Request.Builder()
+            .url(url)
+            .post(body)
+            .header("Authorization", "Bearer $sessionToken")
+            .header("Accept", "application/json")
+            .build()
+
+        return try {
+            fastClient.newCall(request).execute().use { response ->
+                when (response.code) {
+                    200 -> {
+                        val raw = response.body?.string().orEmpty()
+                        val token = extractToken(raw)
+                        if (token.isNullOrBlank()) {
+                            Result.failure(
+                                IOException("relay returned success but no token")
+                            )
+                        } else {
+                            Result.success("MEDIA:hermes-relay://$token")
+                        }
+                    }
+                    404 -> Result.failure(
+                        IOException(
+                            "relay /media/upload endpoint not found — server needs " +
+                                "Phase 3 bridge-server migration"
+                        )
+                    )
+                    401, 403 -> Result.failure(
+                        IOException("unauthorized — re-pair with the relay")
+                    )
+                    413 -> Result.failure(
+                        IOException("screenshot too large for relay media cap")
+                    )
+                    in 500..599 -> Result.failure(
+                        IOException("relay error (HTTP ${response.code})")
+                    )
+                    else -> Result.failure(
+                        IOException("HTTP ${response.code}: ${response.message}")
+                    )
+                }
+            }
+        } catch (e: IOException) {
+            Log.w(TAG, "uploadViaMultipart failed: ${e.message}")
+            Result.failure(e)
+        }
+    }
+
+    /**
+     * Minimal JSON token extractor — the response body is small and has a
+     * single interesting key. We avoid pulling in a full `Json` parse here
+     * because `ScreenCapture` is already a heavy dependency graph (Android
+     * media + OkHttp) and we don't want to add kotlinx.serialization
+     * wiring for a 40-byte response.
+     */
+    private fun extractToken(body: String): String? {
+        val match = Regex("""\"token\"\s*:\s*\"([^\"]+)\"""").find(body)
+        return match?.groupValues?.get(1)
+    }
+}
+
+/**
+ * Holds the per-session [MediaProjection] grant.
+ *
+ * # Android 14+ rule
+ *
+ * `MediaProjectionManager.getMediaProjection()` MUST be called only after a
+ * foreground service has called `startForeground()` with type
+ * `FOREGROUND_SERVICE_TYPE_MEDIA_PROJECTION`, and that call must happen
+ * AFTER the user has granted the consent dialog. Calling it before — even
+ * if you're inside the launcher result callback — gives you a projection
+ * that the system auto-revokes within a frame, with no error visible to
+ * the app. Symptom: consent dialog appears, user allows, dialog closes,
+ * grant evaporates. Sample-tested on Samsung S24 / Android 14, 2026-04-12.
+ *
+ * Because of that rule, this holder no longer constructs the projection
+ * itself — it can only be populated from inside a foreground service that
+ * has already called `startForeground(type=mediaProjection)`. The phone-side
+ * entry point is `BridgeForegroundService.handleGrantedIntent`, which is
+ * dispatched from `MainActivity.mediaProjectionLauncher`.
+ *
+ * The projection state is exposed as a [StateFlow] so the UI can react to
+ * grants/revocations without polling. [BridgeViewModel] observes this and
+ * calls `refreshPermissionStatus()` on every emission, so the green check
+ * lights up immediately rather than waiting for the next lifecycle resume.
+ *
+ * Cleared on [revoke] (user disabled screenshots) or when the projection's
+ * own `onStop` callback fires (system revoked it).
+ */
+object MediaProjectionHolder {
+    private val _projectionFlow = kotlinx.coroutines.flow.MutableStateFlow<MediaProjection?>(null)
+
+    /**
+     * Reactive view of the current projection. Emits a fresh value every
+     * time the holder is populated or cleared; null means "no active grant."
+     */
+    val projectionFlow: kotlinx.coroutines.flow.StateFlow<MediaProjection?> = _projectionFlow
+
+    /**
+     * Synchronous read used by [ScreenCapture] on each capture call. Always
+     * matches the latest [projectionFlow] value.
+     */
+    val projection: MediaProjection? get() = _projectionFlow.value
+
+    /**
+     * Build a [MediaProjection] from a consent intent result and store it.
+     * **Caller must already be inside a foreground service that has called
+     * `startForeground(type=mediaProjection)`** — otherwise Android 14+ will
+     * silently auto-revoke the projection. The canonical caller is
+     * [com.hermesandroid.relay.bridge.BridgeForegroundService.handleGrantedIntent].
+     *
+     * Returns true on success, false on user-rejected consent or any
+     * downstream API error.
+     */
+    fun acceptGrantInsideForegroundService(
+        context: Context,
+        resultCode: Int,
+        data: Intent?,
+    ): Boolean {
+        if (resultCode != android.app.Activity.RESULT_OK || data == null) {
+            Log.i("MediaProjectionHolder", "consent rejected (resultCode=$resultCode)")
+            return false
+        }
+        val manager = context.getSystemService(Context.MEDIA_PROJECTION_SERVICE)
+            as MediaProjectionManager
+        val newProjection = try {
+            manager.getMediaProjection(resultCode, data)
+        } catch (t: Throwable) {
+            Log.w(
+                "MediaProjectionHolder",
+                "getMediaProjection threw: ${t.message} — is this called inside a " +
+                    "foreground service that already did startForeground(mediaProjection)?"
+            )
+            null
+        } ?: return false
+
+        newProjection.registerCallback(object : MediaProjection.Callback() {
+            override fun onStop() {
+                _projectionFlow.value = null
+            }
+        }, Handler(android.os.Looper.getMainLooper()))
+
+        _projectionFlow.value = newProjection
+        Log.i("MediaProjectionHolder", "MediaProjection grant accepted and stored")
+        return true
+    }
+
+    fun revoke() {
+        try { _projectionFlow.value?.stop() } catch (_: Throwable) {}
+        _projectionFlow.value = null
+    }
+}

app/src/main/kotlin/com/hermesandroid/relay/accessibility/ScreenCaptureRequester.kt

@@ -0,0 +1,76 @@
+package com.hermesandroid.relay.accessibility
+
+/**
+ * Phase 3 — bridge-ui follow-up
+ *
+ * Process-singleton bridge between non-Activity code (BridgeViewModel,
+ * settings screens) and the Activity-scoped `ActivityResultLauncher` that
+ * fires the system MediaProjection consent dialog.
+ *
+ * # Why a singleton
+ *
+ * `MediaProjectionManager.createScreenCaptureIntent()` must be launched via
+ * an `ActivityResultLauncher` registered against a `ComponentActivity` —
+ * there is no way to invoke it from a ViewModel directly. We can't pass
+ * the launcher into the ViewModel either, because the ViewModel outlives
+ * the Activity across configuration changes and we'd leak the old Activity.
+ *
+ * The singleton pattern: `MainActivity` registers a launcher in `onCreate`,
+ * stores a closure that calls `launcher.launch(...)` here, and clears the
+ * closure in `onDestroy`. Anything that wants to ask the user for the
+ * MediaProjection grant calls [request] — if the Activity is alive, the
+ * system dialog appears; if not, the call returns false and the caller
+ * should surface "open the app first".
+ *
+ * # Why not just inject the launcher into the ViewModel
+ *
+ * `ActivityResultLauncher` is bound to the ViewModel store of the host
+ * Activity, not the ViewModel. Crossing that boundary either leaks the
+ * Activity (bad) or works only until the first rotation (worse). The
+ * lifecycle-respecting way is to keep the launcher Activity-scoped and
+ * route requests to it through a process-wide rendezvous like this.
+ */
+object ScreenCaptureRequester {
+
+    @Volatile
+    private var launchAction: (() -> Unit)? = null
+
+    /**
+     * Called by `MainActivity.onCreate` (or any ComponentActivity that
+     * wants to host the consent flow) with a closure that launches its
+     * pre-registered `ActivityResultLauncher` for the
+     * `ACTION_MEDIA_PROJECTION` intent.
+     */
+    fun install(launch: () -> Unit) {
+        launchAction = launch
+    }
+
+    /** Called by `MainActivity.onDestroy` so we don't hold a stale Activity ref. */
+    fun uninstall() {
+        launchAction = null
+    }
+
+    /**
+     * Trigger the consent dialog. Returns `true` if a host Activity is
+     * currently installed and the request was dispatched, `false` if no
+     * Activity is alive (caller should fall back to "open the app first").
+     *
+     * The actual grant arrives asynchronously via the launcher's result
+     * callback — see `MainActivity.mediaProjectionLauncher`, which hands
+     * the result to `BridgeForegroundService.grantMediaProjection` so the
+     * grant lands inside a foreground service that's already running with
+     * `startForeground(type=mediaProjection)` (Android 14+ requirement).
+     */
+    fun request(): Boolean {
+        val action = launchAction ?: return false
+        return try {
+            action.invoke()
+            true
+        } catch (t: Throwable) {
+            false
+        }
+    }
+
+    /** Quick poll for UI — true when a host Activity is currently installed. */
+    val isAvailable: Boolean get() = launchAction != null
+}

app/src/main/kotlin/com/hermesandroid/relay/accessibility/ScreenHasher.kt

@@ -0,0 +1,258 @@
+package com.hermesandroid.relay.accessibility
+
+import android.graphics.Rect
+import android.view.accessibility.AccessibilityNodeInfo
+import com.hermesandroid.relay.accessibility.ScreenReader.Companion.MAX_NODES
+import java.security.MessageDigest
+import kotlinx.serialization.Serializable
+
+/**
+ * Phase 3 — bridge feature expansion, work unit A5.
+ *
+ * Cheap change detection for agent navigation loops. Computes a SHA-256
+ * hash over the full multi-window accessibility tree so the agent can
+ * ask "did anything change since last iteration?" with ~100x less data
+ * than a full [ScreenReader.readScreen] round-trip.
+ *
+ * # Fingerprint field set (hash stability is load-bearing)
+ *
+ * Each interesting node contributes:
+ *
+ *   className | text | contentDescription | bounds | viewIdResourceName
+ *
+ * Joined per-node with `|`, and joined between nodes with `\u001e`
+ * (ASCII record separator) so a literal `|` in text can't collide with
+ * field separators. The concatenated string is hashed with SHA-256 and
+ * returned as lowercase hex.
+ *
+ * ## Why these fields
+ *  * **className** — structural identity of the widget
+ *  * **text** — what the user sees; primary content change signal
+ *  * **contentDescription** — screen-reader label, relevant for icon
+ *    buttons whose visible text is empty
+ *  * **bounds** — layout geometry; catches appearance of new dialogs,
+ *    bottom sheets, and popups
+ *  * **viewIdResourceName** — stable across recompositions, lets us
+ *    distinguish nodes that happen to share text (e.g. two "OK" buttons)
+ *
+ * ## Why NOT these
+ *  * **isFocused / accessibility focus** — keyboard navigation toggles
+ *    focus without any visible content change; would cause the hash to
+ *    churn on arrow-key presses
+ *  * **isSelected** — same reasoning as focus; Material chips etc.
+ *    flip selected state during the ripple animation
+ *  * **isEnabled / isClickable** — these almost always co-vary with
+ *    text/bounds and dragging them in adds noise without signal
+ *  * **timestamps** — no timestamps in the fingerprint, obviously
+ *  * **window index (w<N>:<M> nodeId)** — the window index is stable
+ *    across reads within a snapshot, but including it in the fingerprint
+ *    is redundant with bounds (windows are geographically disjoint) and
+ *    would make the hash brittle to window-list reorderings the agent
+ *    doesn't care about
+ *
+ * ## Known limitation
+ * Apps that put a live counter in a text field (e.g. "Downloading…
+ * 3s", scrolling tickers, animated progress %) will churn the hash
+ * every frame. The agent's calling tool documents this and recommends
+ * `android_read_screen` for those edge cases.
+ *
+ * # Traversal
+ *
+ * Walks each provided root with the same child-recycling contract as
+ * [ScreenReader.walk] — children are `.recycle()`'d in `try/finally`,
+ * the input roots are NOT recycled (the caller owns their lifetime,
+ * matching [ScreenReader.readScreen]'s convention).
+ *
+ * Node count is capped at [MAX_NODES] total across all windows so a
+ * pathological grid can't OOM the hasher; if the cap is hit we still
+ * return a hash of what we collected and set [ScreenHashResult.truncated]
+ * = true.
+ *
+ * # Usage pattern
+ *
+ * ```kotlin
+ * // A5 — when P1 multi-window lands, this will be
+ * //   service.snapshotAllWindows() -> List<AccessibilityNodeInfo>
+ * // Until then callers pass a singleton list of the active root.
+ * val roots: List<AccessibilityNodeInfo> = listOfNotNull(service.snapshotRoot())
+ * val hash = ScreenHasher().screenHash(roots)
+ * ```
+ */
+class ScreenHasher {
+
+    companion object {
+        /** ASCII record separator (0x1E) — unlikely to appear in UI text. */
+        private const val RECORD_SEPARATOR = '\u001E'
+
+        /** Intra-node field separator. */
+        private const val FIELD_SEPARATOR = '|'
+
+        /** SHA-256 digest length in hex chars (64). Used by tests. */
+        const val HASH_HEX_LENGTH = 64
+    }
+
+    @Serializable
+    data class ScreenHashResult(
+        val hash: String,
+        val nodeCount: Int,
+        val truncated: Boolean = false,
+    )
+
+    @Serializable
+    data class DiffScreenResult(
+        val changed: Boolean,
+        val hash: String,
+        val nodeCount: Int,
+        val truncated: Boolean = false,
+    )
+
+    /**
+     * Walk the multi-window tree under [roots] and return a stable
+     * SHA-256 fingerprint.
+     *
+     * Does NOT recycle [roots] — caller owns them, same contract as
+     * [ScreenReader.readScreen].
+     */
+    fun screenHash(roots: List<AccessibilityNodeInfo>): ScreenHashResult {
+        val buf = StringBuilder(2048)
+        var count = 0
+        var truncated = false
+
+        for (root in roots) {
+            if (count >= MAX_NODES) {
+                truncated = true
+                break
+            }
+            val hit = walk(root, buf, count)
+            count = hit.count
+            if (hit.truncated) {
+                truncated = true
+                break
+            }
+        }
+
+        val digest = MessageDigest.getInstance("SHA-256")
+            .digest(buf.toString().toByteArray(Charsets.UTF_8))
+        return ScreenHashResult(
+            hash = digest.toHex(),
+            nodeCount = count,
+            truncated = truncated,
+        )
+    }
+
+    /**
+     * Compute the current hash and compare against [previousHash].
+     * Always returns both the new hash and the node count so the agent
+     * can update its reference without a second round-trip.
+     */
+    fun diffScreen(
+        roots: List<AccessibilityNodeInfo>,
+        previousHash: String,
+    ): DiffScreenResult {
+        val current = screenHash(roots)
+        return DiffScreenResult(
+            changed = current.hash != previousHash,
+            hash = current.hash,
+            nodeCount = current.nodeCount,
+            truncated = current.truncated,
+        )
+    }
+
+    // ── Internals ──────────────────────────────────────────────────────
+
+    /** Result of a walk — the running node count and a truncation flag. */
+    private data class WalkResult(val count: Int, val truncated: Boolean)
+
+    /**
+     * Append fingerprints for [node] and all descendants into [out].
+     * Mirrors [ScreenReader.walk]'s recycle contract exactly.
+     */
+    private fun walk(
+        node: AccessibilityNodeInfo?,
+        out: StringBuilder,
+        startCount: Int,
+    ): WalkResult {
+        if (node == null) return WalkResult(startCount, false)
+        if (startCount >= MAX_NODES) return WalkResult(startCount, true)
+
+        var count = startCount
+        val rect = Rect()
+        node.getBoundsInScreen(rect)
+
+        val text = node.text?.toString()?.takeIf { it.isNotBlank() }
+        val contentDesc = node.contentDescription?.toString()?.takeIf { it.isNotBlank() }
+        val clickable = node.isClickable
+        val longClickable = node.isLongClickable
+        val scrollable = node.isScrollable
+
+        // Same "interesting" predicate as ScreenReader so the hash
+        // covers exactly the nodes the agent can actually see/interact
+        // with. Otherwise a layout container reshuffle would churn the
+        // hash without any visible change.
+        val interesting = (
+            text != null || contentDesc != null ||
+            clickable || longClickable || scrollable || node.isEditable
+        ) && rect.width() > 0 && rect.height() > 0
+
+        if (interesting) {
+            appendFingerprint(
+                out = out,
+                className = node.className?.toString(),
+                text = text,
+                contentDescription = contentDesc,
+                rect = rect,
+                viewId = node.viewIdResourceName,
+            )
+            count += 1
+        }
+
+        val childCount = node.childCount
+        for (i in 0 until childCount) {
+            if (count >= MAX_NODES) return WalkResult(count, true)
+            val child = node.getChild(i) ?: continue
+            try {
+                val hit = walk(child, out, count)
+                count = hit.count
+                if (hit.truncated) return WalkResult(count, true)
+            } finally {
+                @Suppress("DEPRECATION")
+                try { child.recycle() } catch (_: Throwable) { }
+            }
+        }
+
+        return WalkResult(count, false)
+    }
+
+    private fun appendFingerprint(
+        out: StringBuilder,
+        className: String?,
+        text: String?,
+        contentDescription: String?,
+        rect: Rect,
+        viewId: String?,
+    ) {
+        if (out.isNotEmpty()) out.append(RECORD_SEPARATOR)
+        out.append(className.orEmpty()).append(FIELD_SEPARATOR)
+        out.append(text.orEmpty()).append(FIELD_SEPARATOR)
+        out.append(contentDescription.orEmpty()).append(FIELD_SEPARATOR)
+        // Compact bounds form — matches what the agent would see in
+        // ScreenNode.bounds.toString() but cheaper to build.
+        out.append(rect.left).append(',')
+            .append(rect.top).append(',')
+            .append(rect.right).append(',')
+            .append(rect.bottom).append(FIELD_SEPARATOR)
+        out.append(viewId.orEmpty())
+    }
+
+    private fun ByteArray.toHex(): String {
+        val sb = StringBuilder(this.size * 2)
+        for (b in this) {
+            val v = b.toInt() and 0xff
+            sb.append(HEX[v ushr 4])
+            sb.append(HEX[v and 0x0f])
+        }
+        return sb.toString()
+    }
+}
+
+private val HEX = "0123456789abcdef".toCharArray()

app/src/main/kotlin/com/hermesandroid/relay/accessibility/ScreenReader.kt

@@ -0,0 +1,807 @@
+package com.hermesandroid.relay.accessibility
+
+import android.graphics.Rect
+import android.os.Build
+import android.view.accessibility.AccessibilityNodeInfo
+import kotlinx.serialization.Serializable
+import kotlinx.serialization.json.JsonElement
+import kotlinx.serialization.json.JsonNull
+import kotlinx.serialization.json.JsonObject
+import kotlinx.serialization.json.JsonPrimitive
+import kotlinx.serialization.json.buildJsonObject
+import kotlinx.serialization.json.put
+
+/**
+ * Phase 3 — accessibility `accessibility-runtime`
+ *
+ * Walks the `AccessibilityNodeInfo` trees of every active accessibility
+ * window and produces a single structured, serializable snapshot the agent
+ * can reason about.
+ *
+ * The output shape is deliberately flat: the agent overwhelmingly cares
+ * about *"what text can I see, and where is it?"* — not the exact widget
+ * hierarchy. We emit one [ScreenNode] per interesting node (anything with
+ * non-blank text, content description, or a click / long-click action) and
+ * include its screen bounds so [ActionExecutor.tapText] can hand them to
+ * `dispatchGesture` without re-walking the tree.
+ *
+ * # Multi-window walk (P1)
+ *
+ * As of P1 (`feature/P1-all-windows`) the reader walks *every* live
+ * accessibility window, not just `rootInActiveWindow`. This catches system
+ * overlays, popup menus, the notification shade when pulled down,
+ * permission dialogs, and multi-window split-screen state — all of which
+ * were previously invisible to the agent.
+ *
+ * ## Tree-merging strategy
+ *
+ * We flatten all windows into **one** `ScreenContent` rather than returning
+ * per-window trees. This is deliberate: the existing public contract
+ * (consumed by `BridgeCommandHandler` and the Python-side LLM prompt) is
+ * "one JSON object with a `nodes[]` array". Preserving that contract means
+ * no wire-format change and no consumer refactor.
+ *
+ * To disambiguate nodes that belong to different windows we prefix every
+ * `nodeId` with `w<windowIndex>:<sequentialIndex>`. `windowIndex` is the
+ * position in `service.windows` (top-of-stack first, per Android docs),
+ * `sequentialIndex` is the 0-based collection order within the combined
+ * walk. The root bounds emitted on `ScreenContent.rootBounds` are the
+ * **union** of every window's root bounds, so geometric callers still see
+ * a single enclosing rectangle.
+ *
+ * ## MAX_NODES cap
+ *
+ * The 512-node cap applies to the *combined* tree, not per-window. If the
+ * first window alone exceeds the cap we short-circuit the whole walk and
+ * set `truncated = true` without descending into later windows — the agent
+ * already has more than it can reasonably use.
+ *
+ * ## Node recycling landmine
+ *
+ * Every `AccessibilityWindowInfo.getRoot()` returns a **fresh**
+ * `AccessibilityNodeInfo` that must be recycled by the caller. Every
+ * `info.getChild(i)` also returns a fresh ref. The public methods here
+ * do NOT recycle their input roots — the caller
+ * ([HermesAccessibilityService.snapshotAllWindows] in practice) owns the
+ * lifetime of the roots it produced. Child nodes fetched during the walk
+ * are recycled per-iteration in `try/finally`.
+ *
+ * The tree is bounded by [MAX_NODES] to prevent pathological apps (grids
+ * with thousands of cells) from producing multi-megabyte screen dumps.
+ * When the cap is hit we short-circuit traversal and set
+ * [ScreenContent.truncated] = true so the agent knows to scroll if it
+ * needs more.
+ */
+class ScreenReader {
+
+    companion object {
+        /**
+         * Hard cap on node count. 512 is comfortable for a typical app
+         * screen (most have 30–150 interesting nodes) while keeping the
+         * wire payload under ~40 KB in the worst case. With P1 the cap
+         * now spans the *combined* tree across all live windows.
+         */
+        const val MAX_NODES = 512
+
+        /** Hard cap on individual text-field length before truncation. */
+        const val MAX_TEXT_LEN = 2000
+    }
+
+    /**
+     * Structured representation of a screen, ready for JSON serialization.
+     * The [rootBounds] are in absolute screen pixels (what `dispatchGesture`
+     * uses). When P1 merges multiple windows, [rootBounds] is the union of
+     * every window's root bounds.
+     */
+    @Serializable
+    data class ScreenContent(
+        val packageName: String?,
+        val rootBounds: Bounds,
+        val nodes: List<ScreenNode>,
+        val truncated: Boolean = false,
+        val nodeCount: Int = nodes.size,
+    )
+
+    @Serializable
+    data class ScreenNode(
+        /**
+         * Stable, walk-scoped identifier for this node. Format:
+         * `w<windowIndex>:<sequentialIndex>` — e.g. `w0:42` for the 43rd
+         * emitted node from the top-of-stack window, `w1:7` for the 8th
+         * emitted node of the next window down. Always present when the
+         * node was produced by [readAllWindows]; may be null for callers
+         * that bypass the multi-window entry point (legacy tests).
+         *
+         * Also re-used by A3 `searchNodes` so filtered results feed back
+         * into `tap nodeId` and other node-ID-addressable commands.
+         *
+         * The Python `android_tool` layer has long advertised a `nodeId`
+         * field in its doc-comments; P1 is the first version that actually
+         * emits it on the wire.
+         */
+        val nodeId: String? = null,
+        val text: String? = null,
+        val contentDescription: String? = null,
+        val className: String? = null,
+        val viewId: String? = null,
+        val bounds: Bounds,
+        val clickable: Boolean = false,
+        val longClickable: Boolean = false,
+        val scrollable: Boolean = false,
+        val editable: Boolean = false,
+        val focused: Boolean = false,
+        val selected: Boolean = false,
+        val enabled: Boolean = true,
+    )
+
+    @Serializable
+    data class Bounds(
+        val left: Int,
+        val top: Int,
+        val right: Int,
+        val bottom: Int,
+    ) {
+        val centerX: Int get() = (left + right) / 2
+        val centerY: Int get() = (top + bottom) / 2
+        val width: Int get() = right - left
+        val height: Int get() = bottom - top
+        val isEmpty: Boolean get() = width <= 0 || height <= 0
+    }
+
+    /**
+     * Back-compat single-root entry point. Delegates to [readAllWindows]
+     * with a single-element list so the walk semantics (cap, recycling,
+     * node-id prefix) stay identical regardless of which public method
+     * the caller picked.
+     *
+     * This method does NOT recycle [rootNode] — the caller owns it.
+     *
+     * @param includeBounds when false, we still collect bounds for
+     *        traversal decisions but zero them in the output to shrink the
+     *        payload. The agent almost always wants bounds so this defaults
+     *        true.
+     */
+    fun readScreen(
+        rootNode: AccessibilityNodeInfo,
+        includeBounds: Boolean = true,
+    ): ScreenContent = readAllWindows(listOf(rootNode), includeBounds)
+
+    /**
+     * P1 multi-window entry point. Walks every root in [windowRoots] in
+     * order (top-of-stack first) and emits a single flat [ScreenContent]
+     * with node IDs prefixed by window index.
+     *
+     * The [windowRoots] list is NOT recycled by this method — callers
+     * ([HermesAccessibilityService.snapshotAllWindows] + finally blocks
+     * in `BridgeCommandHandler`) own the roots they produced. Child nodes
+     * fetched during traversal ARE recycled per-iteration.
+     *
+     * @param includeBounds see [readScreen].
+     */
+    fun readAllWindows(
+        windowRoots: List<AccessibilityNodeInfo>,
+        includeBounds: Boolean = true,
+    ): ScreenContent {
+        val collected = ArrayList<ScreenNode>(128)
+        var truncated = false
+
+        // Union of every window's root bounds. Starts empty and absorbs
+        // each window's root rect via Rect.union(), so one-window callers
+        // see identical output to the pre-P1 code path.
+        val unionRect = Rect()
+        var unionInitialized = false
+        var packageName: String? = null
+
+        for ((windowIndex, rootNode) in windowRoots.withIndex()) {
+            if (collected.size >= MAX_NODES) {
+                // Cap already exhausted by an earlier window — do not
+                // descend. This is intentional: the agent has more than
+                // it can reason about and we'd rather be honest about it
+                // than silently clip the later-window content.
+                truncated = true
+                break
+            }
+
+            // Latch the first window's package name as the "primary" one.
+            // Multi-window state with different packages (e.g. a popup from
+            // a different process) is rare, and the agent can still see
+            // the full package-name string on each node via className if
+            // it needs finer-grained attribution.
+            if (packageName == null) {
+                packageName = rootNode.packageName?.toString()
+            }
+
+            val rootRect = Rect()
+            rootNode.getBoundsInScreen(rootRect)
+            if (!unionInitialized) {
+                unionRect.set(rootRect)
+                unionInitialized = true
+            } else {
+                unionRect.union(rootRect)
+            }
+
+            val hit = walk(
+                node = rootNode,
+                windowIndex = windowIndex,
+                out = collected,
+                includeBounds = includeBounds,
+            )
+            if (hit) {
+                truncated = true
+                break
+            }
+        }
+
+        val rootBounds = if (unionInitialized) unionRect.toBoundsOrZero() else ZERO_BOUNDS
+
+        return ScreenContent(
+            packageName = packageName,
+            rootBounds = rootBounds,
+            nodes = collected,
+            truncated = truncated,
+        )
+    }
+
+    /**
+     * Recursive walker. Returns `true` if the cap was hit (signaling
+     * caller to mark output as truncated).
+     *
+     * [windowIndex] is the position in the parent walk's `windowRoots`
+     * list and becomes the `w<n>:` prefix on every emitted node ID.
+     */
+    private fun walk(
+        node: AccessibilityNodeInfo?,
+        windowIndex: Int,
+        out: MutableList<ScreenNode>,
+        includeBounds: Boolean,
+    ): Boolean {
+        if (node == null) return false
+        if (out.size >= MAX_NODES) return true
+
+        // Skip invisible nodes early — no visual, no interaction target.
+        if (!node.isVisibleToUser) {
+            // still walk children, some containers aren't marked visible
+            // but host visible descendants
+        }
+
+        val rect = Rect()
+        node.getBoundsInScreen(rect)
+        val bounds = if (includeBounds) rect.toBoundsOrZero() else ZERO_BOUNDS
+
+        val text = node.text?.toString()?.takeIf { it.isNotBlank() }?.take(MAX_TEXT_LEN)
+        val contentDesc = node.contentDescription?.toString()
+            ?.takeIf { it.isNotBlank() }
+            ?.take(MAX_TEXT_LEN)
+        val clickable = node.isClickable
+        val longClickable = node.isLongClickable
+        val scrollable = node.isScrollable
+
+        val interesting = (text != null || contentDesc != null ||
+            clickable || longClickable || scrollable || node.isEditable) &&
+            !bounds.isEmpty
+
+        if (interesting) {
+            // Node ID is `w<windowIndex>:<sequentialIndex>`. Using the
+            // sequential emission index (not a hash of the node) keeps
+            // IDs stable within a single snapshot and compact on the
+            // wire, at the cost of being snapshot-scoped (not durable
+            // across successive /screen calls). That's the right tradeoff
+            // — the agent re-reads the screen before each action anyway.
+            val nodeId = "w$windowIndex:${out.size}"
+            out.add(
+                ScreenNode(
+                    nodeId = nodeId,
+                    text = text,
+                    contentDescription = contentDesc,
+                    className = node.className?.toString(),
+                    viewId = node.viewIdResourceName,
+                    bounds = bounds,
+                    clickable = clickable,
+                    longClickable = longClickable,
+                    scrollable = scrollable,
+                    editable = node.isEditable,
+                    focused = node.isFocused,
+                    selected = node.isSelected,
+                    enabled = node.isEnabled,
+                )
+            )
+        }
+
+        val childCount = node.childCount
+        for (i in 0 until childCount) {
+            if (out.size >= MAX_NODES) return true
+            val child = node.getChild(i) ?: continue
+            try {
+                val hit = walk(child, windowIndex, out, includeBounds)
+                if (hit) return true
+            } finally {
+                @Suppress("DEPRECATION")
+                try { child.recycle() } catch (_: Throwable) { }
+            }
+        }
+
+        return false
+    }
+
+    /**
+     * Filtered search across all provided window roots. Used by
+     * `android_find_nodes` — returns up to [limit] matches without
+     * dumping the whole accessibility tree.
+     *
+     * Filter semantics (all optional, all ANDed):
+     *  - [text]: case-insensitive substring match against each node's
+     *    `text` OR `contentDescription`.
+     *  - [className]: exact match against `node.className.toString()`.
+     *  - [clickable]: when non-null, filters on `node.isClickable`.
+     *
+     * The underlying traversal honors [MAX_NODES] as a safety rail even
+     * when [limit] is higher — we stop walking after visiting 512 nodes
+     * regardless of how many matched. Node recycling follows the same
+     * per-child `try/finally` pattern as [walk], so this function is
+     * leak-free w.r.t. the accessibility node pool.
+     *
+     * Returns a list of [ScreenNode] in the same shape that
+     * [readAllWindows] / [readScreen] emits, including the P1 `nodeId`
+     * field (`"w<windowIndex>:<sequentialIndex>"`) so callers can feed
+     * results back into `tap nodeId`.
+     */
+    fun searchNodes(
+        roots: List<AccessibilityNodeInfo>,
+        text: String? = null,
+        className: String? = null,
+        clickable: Boolean? = null,
+        limit: Int = 20,
+    ): List<ScreenNode> {
+        if (limit <= 0) return emptyList()
+        val loweredText = text?.takeIf { it.isNotBlank() }?.lowercase()
+        val effectiveLimit = limit.coerceAtLeast(0)
+
+        val out = ArrayList<ScreenNode>(effectiveLimit.coerceAtMost(64))
+        // Shared visit counter across all windows — the MAX_NODES cap is
+        // global, matching how `readAllWindows` (P1) bounds traversal.
+        val visited = intArrayOf(0)
+        // H2 fix: hoist the emission-id counter OUTSIDE the per-window loop
+        // so it mirrors `walk`/`findNodeById`'s GLOBAL "interesting" counter
+        // exactly. Previously this was scoped to each window, producing IDs
+        // like `w1:0` when the canonical scheme is `w1:N` (N = global). Round
+        // trips through `find_nodes → tap nodeId` then resolved to the wrong
+        // node on any screen with >1 window.
+        val nextIndex = intArrayOf(0)
+
+        for ((windowIndex, root) in roots.withIndex()) {
+            if (out.size >= effectiveLimit) break
+            if (visited[0] >= MAX_NODES) break
+            searchWalk(
+                node = root,
+                windowIndex = windowIndex,
+                nextIndex = nextIndex,
+                visited = visited,
+                loweredText = loweredText,
+                className = className,
+                clickable = clickable,
+                limit = effectiveLimit,
+                out = out,
+            )
+        }
+        return out
+    }
+
+    /**
+     * Recursive walker for [searchNodes]. Returns nothing; accumulates
+     * matches into [out] and respects both [MAX_NODES] (via [visited])
+     * and [limit] (via `out.size`).
+     *
+     * [nextIndex] is the per-window sequential counter used to build the
+     * `w<windowIndex>:<N>` node ID — mirrors the scheme P1 introduced in
+     * [readAllWindows] so the two surfaces produce stable, comparable IDs.
+     */
+    private fun searchWalk(
+        node: AccessibilityNodeInfo?,
+        windowIndex: Int,
+        nextIndex: IntArray,
+        visited: IntArray,
+        loweredText: String?,
+        className: String?,
+        clickable: Boolean?,
+        limit: Int,
+        out: MutableList<ScreenNode>,
+    ) {
+        if (node == null) return
+        if (out.size >= limit) return
+        if (visited[0] >= MAX_NODES) return
+
+        visited[0] += 1
+
+        val nodeText = node.text?.toString()?.takeIf { it.isNotBlank() }?.take(MAX_TEXT_LEN)
+        val contentDesc = node.contentDescription?.toString()
+            ?.takeIf { it.isNotBlank() }
+            ?.take(MAX_TEXT_LEN)
+        val nodeClassName = node.className?.toString()
+        val nodeClickable = node.isClickable
+        val nodeLongClickable = node.isLongClickable
+        val nodeScrollable = node.isScrollable
+        val nodeEditable = node.isEditable
+
+        // H2 fix: nextIndex must mirror `walk`/`findNodeById`'s emission
+        // counter exactly — increment ONLY for nodes that pass the canonical
+        // "interesting" predicate (text || contentDesc || clickable ||
+        // longClickable || scrollable || editable, with non-empty bounds),
+        // not for every visited node. Otherwise the IDs handed back from
+        // find_nodes drift relative to readAllWindows + findNodeById and
+        // round-trip lookups silently resolve to the wrong node.
+        val rect = Rect()
+        node.getBoundsInScreen(rect)
+        val bounds = rect.toBoundsOrZero()
+        val canonicalInteresting = (nodeText != null || contentDesc != null ||
+            nodeClickable || nodeLongClickable || nodeScrollable || nodeEditable) &&
+            !bounds.isEmpty
+
+        val thisNodeIndex: Int
+        if (canonicalInteresting) {
+            thisNodeIndex = nextIndex[0]
+            nextIndex[0] += 1
+        } else {
+            thisNodeIndex = -1
+        }
+
+        val matchesText = loweredText == null ||
+            (nodeText?.lowercase()?.contains(loweredText) == true) ||
+            (contentDesc?.lowercase()?.contains(loweredText) == true)
+        val matchesClass = className == null || nodeClassName == className
+        val matchesClickable = clickable == null || nodeClickable == clickable
+
+        // Only emit nodes that BOTH match the search filter AND are
+        // canonically-interesting (i.e. would also be emitted by `walk`).
+        // Restricting emission to canonical nodes is what makes the round
+        // trip find_nodes → tap nodeId reliable.
+        if (canonicalInteresting && matchesText && matchesClass && matchesClickable) {
+            if (!bounds.isEmpty || loweredText != null || className != null) {
+                out.add(
+                    ScreenNode(
+                        nodeId = "w$windowIndex:$thisNodeIndex",
+                        text = nodeText,
+                        contentDescription = contentDesc,
+                        className = nodeClassName,
+                        viewId = node.viewIdResourceName,
+                        bounds = bounds,
+                        clickable = nodeClickable,
+                        longClickable = node.isLongClickable,
+                        scrollable = node.isScrollable,
+                        editable = node.isEditable,
+                        focused = node.isFocused,
+                        selected = node.isSelected,
+                        enabled = node.isEnabled,
+                    )
+                )
+                if (out.size >= limit) return
+            }
+        }
+
+        val childCount = node.childCount
+        for (i in 0 until childCount) {
+            if (out.size >= limit) return
+            if (visited[0] >= MAX_NODES) return
+            val child = node.getChild(i) ?: continue
+            try {
+                searchWalk(
+                    node = child,
+                    windowIndex = windowIndex,
+                    nextIndex = nextIndex,
+                    visited = visited,
+                    loweredText = loweredText,
+                    className = className,
+                    clickable = clickable,
+                    limit = limit,
+                    out = out,
+                )
+            } finally {
+                @Suppress("DEPRECATION")
+                try { child.recycle() } catch (_: Throwable) { }
+            }
+        }
+    }
+
+    /**
+     * Find the first node across [windowRoots] whose text or
+     * content-description contains [needle] (case-insensitive). Used by
+     * [ActionExecutor.tapText]. Returns the node's bounds, or null if no
+     * match anywhere.
+     *
+     * We walk fresh (not against a cached [ScreenContent]) so the result
+     * is always current — tapping into stale bounds is the single most
+     * common "bridge tapped the wrong thing" bug.
+     */
+    fun findNodeBoundsByText(
+        windowRoots: List<AccessibilityNodeInfo>,
+        needle: String,
+    ): Bounds? {
+        if (needle.isBlank()) return null
+        val lowered = needle.lowercase()
+        for (root in windowRoots) {
+            val hit = findFirst(root) { node ->
+                val text = node.text?.toString()?.lowercase()
+                val desc = node.contentDescription?.toString()?.lowercase()
+                (text?.contains(lowered) == true) || (desc?.contains(lowered) == true)
+            }
+            if (hit != null) {
+                val r = Rect()
+                hit.getBoundsInScreen(r)
+                return r.toBoundsOrZero()
+            }
+        }
+        return null
+    }
+
+    /**
+     * Back-compat single-root overload. Delegates to the multi-window
+     * form so tests and any legacy call site still compile unchanged.
+     */
+    fun findNodeBoundsByText(rootNode: AccessibilityNodeInfo, needle: String): Bounds? =
+        findNodeBoundsByText(listOf(rootNode), needle)
+
+    /**
+     * Find the currently-focused input node across [windowRoots] (for
+     * [ActionExecutor.typeText]). Prefers `FOCUS_INPUT` focus on each
+     * window in order, falls back to the first editable node found in any
+     * window.
+     *
+     * Returned node is caller-owned — must be `recycle()`d on API < 33.
+     */
+    fun findFocusedInput(windowRoots: List<AccessibilityNodeInfo>): AccessibilityNodeInfo? {
+        for (root in windowRoots) {
+            root.findFocus(AccessibilityNodeInfo.FOCUS_INPUT)?.let { return it }
+        }
+        for (root in windowRoots) {
+            findFirst(root) { it.isEditable }?.let { return it }
+        }
+        return null
+    }
+
+    /**
+     * Back-compat single-root overload. Delegates to the multi-window
+     * form.
+     */
+    fun findFocusedInput(rootNode: AccessibilityNodeInfo): AccessibilityNodeInfo? =
+        findFocusedInput(listOf(rootNode))
+
+    private fun findFirst(
+        node: AccessibilityNodeInfo?,
+        predicate: (AccessibilityNodeInfo) -> Boolean,
+    ): AccessibilityNodeInfo? {
+        if (node == null) return null
+        if (predicate(node)) return node
+        val childCount = node.childCount
+        for (i in 0 until childCount) {
+            val child = node.getChild(i) ?: continue
+            val hit = findFirst(child, predicate)
+            if (hit != null) return hit
+            @Suppress("DEPRECATION")
+            try { child.recycle() } catch (_: Throwable) { }
+        }
+        return null
+    }
+
+    // ─── A4: describe_node + stable nodeId lookup ────────────────────────────
+    //
+    // `findNodeById` re-walks the window tree every call. We deliberately do
+    // NOT cache IDs between calls — the UI changes, nodes come and go, and a
+    // cached lookup table would be stale the moment the user scrolled. The
+    // walker assigns the same `w<windowIndex>:<sequentialIndex>` IDs that the
+    // P1 multi-window [walk] emits, so a nodeId from `read_screen` round-trips
+    // cleanly into `describe_node`, `/tap`, and `/scroll` during the same
+    // screen dwell.
+    //
+    // IMPORTANT: the counter MUST mirror P1 semantics exactly:
+    //   1. Only "interesting" nodes (text/contentDesc/clickable/longClickable/
+    //      scrollable/editable AND non-empty bounds) get an ID.
+    //   2. The sequential index is a GLOBAL pre-order emission counter
+    //      shared across all windows (not per-window). Window 0 emits a
+    //      handful of nodes at 0..N-1, then window 1's first emission is
+    //      N, not 0. This matches how readAllWindows feeds a single
+    //      `collected` list into multiple `walk()` calls.
+    //
+    // IMPORTANT: the caller takes ownership of the returned node and is
+    // responsible for `node.recycle()`. We stop recycling at the match frontier
+    // and let it bubble up. `describeNode` below handles this contract.
+
+    /**
+     * Walk every window root in [roots] and return the first node whose
+     * assigned stable ID matches [nodeId]. Returns `null` if no match.
+     *
+     * ID format is `w<windowIndex>:<sequentialIndex>` — the same scheme the
+     * P1 multi-window [walk] emits on [ScreenNode.nodeId]. The sequential
+     * index is a 0-based GLOBAL emission counter (shared across windows)
+     * that increments only for "interesting" nodes — matching the P1 filter
+     * in [walk] (`interesting = has text/desc/clickable/longClickable/
+     * scrollable/editable AND non-empty bounds`).
+     *
+     * The caller takes ownership of the returned [AccessibilityNodeInfo] and
+     * MUST recycle it (on API <= 33) when done. We stop recycling at the
+     * match frontier so the node survives the return trip.
+     */
+    fun findNodeById(
+        roots: List<AccessibilityNodeInfo>,
+        nodeId: String,
+    ): AccessibilityNodeInfo? {
+        if (nodeId.isBlank()) return null
+        // Parse `w<windowIdx>:<seqIdx>`. Reject malformed IDs up front so we
+        // don't spend O(tree) walking when the input can't possibly match.
+        val colonIdx = nodeId.indexOf(':')
+        if (colonIdx <= 1 || nodeId[0] != 'w') return null
+        val wantedWindow = nodeId.substring(1, colonIdx).toIntOrNull() ?: return null
+        val wantedSeq = nodeId.substring(colonIdx + 1).toIntOrNull() ?: return null
+        if (wantedWindow < 0 || wantedWindow >= roots.size || wantedSeq < 0) return null
+
+        // GLOBAL counter, shared across every window's walk to match
+        // readAllWindows' shared `collected` list ordering.
+        val counter = IntArray(1)
+        for ((windowIndex, root) in roots.withIndex()) {
+            // Cheap pre-filter: the wantedSeq is global, so we still have to
+            // walk earlier windows to drain their interesting-node emission
+            // counts, BUT once we're at or past the wanted window we can
+            // look for the match. We only RETURN a match when we're on the
+            // correct windowIndex AND the global counter reaches wantedSeq.
+            val hit = walkForId(root, wantedSeq, counter, windowIndex, wantedWindow)
+            if (hit != null) return hit
+            if (counter[0] > wantedSeq) return null
+        }
+        return null
+    }
+
+    /**
+     * Recursive node-id walker. Increments [counter] only for "interesting"
+     * nodes (matching P1's [walk] semantics). Returns a non-null match
+     * (caller-owned and responsible for recycling) OR null if this subtree
+     * doesn't contain it.
+     *
+     * [currentWindow] is the index of the window currently being walked;
+     * [wantedWindow] is the window portion of the parsed nodeId. We only
+     * return a hit when they match — earlier and later windows still
+     * contribute to the global counter but can't claim the match.
+     *
+     * Recycling rules:
+     *  - Children that don't contain the match are recycled in-place.
+     *  - The matched node bubbles up un-recycled — the outermost caller owns it.
+     *  - The root node itself is never recycled here; the caller of
+     *    `findNodeById` owns window roots (same contract as `snapshotAllWindows`).
+     */
+    private fun walkForId(
+        node: AccessibilityNodeInfo?,
+        wantedSeq: Int,
+        counter: IntArray,
+        currentWindow: Int,
+        wantedWindow: Int,
+    ): AccessibilityNodeInfo? {
+        if (node == null) return null
+        if (counter[0] > wantedSeq) return null
+
+        // Determine whether this node would be emitted by P1's [walk].
+        // Must mirror the `interesting` predicate there exactly or the
+        // counter drifts and the round-trip breaks.
+        val rect = Rect()
+        node.getBoundsInScreen(rect)
+        val bounds = rect.toBoundsOrZero()
+        val nodeText = node.text?.toString()?.takeIf { it.isNotBlank() }
+        val contentDesc = node.contentDescription?.toString()?.takeIf { it.isNotBlank() }
+        val clickable = node.isClickable
+        val longClickable = node.isLongClickable
+        val scrollable = node.isScrollable
+        val interesting = (nodeText != null || contentDesc != null ||
+            clickable || longClickable || scrollable || node.isEditable) &&
+            !bounds.isEmpty
+
+        if (interesting) {
+            val mySeq = counter[0]
+            counter[0] = mySeq + 1
+            if (currentWindow == wantedWindow && mySeq == wantedSeq) {
+                // Match. Bubble up without recycling.
+                return node
+            }
+        }
+
+        val childCount = node.childCount
+        for (i in 0 until childCount) {
+            if (counter[0] > wantedSeq) return null
+            val child = node.getChild(i) ?: continue
+            val hit = walkForId(child, wantedSeq, counter, currentWindow, wantedWindow)
+            if (hit != null) {
+                // Match in this subtree — don't recycle the hit.
+                return hit
+            }
+            @Suppress("DEPRECATION")
+            try { child.recycle() } catch (_: Throwable) { }
+        }
+        return null
+    }
+
+    /**
+     * A4: result of a `describe_node` lookup. Serialized directly into the
+     * `bridge.response` result payload by [BridgeCommandHandler].
+     *
+     * When [found] is false, [properties] is null and [error] explains why.
+     */
+    data class DescribeNodeResult(
+        val found: Boolean,
+        val properties: JsonObject? = null,
+        val error: String? = null,
+    )
+
+    /**
+     * A4: return the full property bag for [nodeId] on the current window
+     * set. Props: `nodeId`, `bounds`, `className`, `text`, `contentDescription`,
+     * `hintText` (API 26+), `viewIdResourceName`, `childCount`, plus a dozen
+     * state flags. `checked` is null when the node isn't checkable so callers
+     * can distinguish "not a toggle" from "unchecked toggle".
+     *
+     * Walks the tree via [findNodeById], builds the JSON, and recycles the
+     * resolved node before returning.
+     */
+    fun describeNode(
+        roots: List<AccessibilityNodeInfo>,
+        nodeId: String,
+    ): DescribeNodeResult {
+        val node = findNodeById(roots, nodeId)
+            ?: return DescribeNodeResult(found = false, error = "node not found: $nodeId")
+
+        try {
+            val rect = Rect().also { node.getBoundsInScreen(it) }
+            val bounds = rect.toBoundsOrZero()
+
+            // hintText is API 26+. minSdk on this project is 26, so in practice
+            // it's always available — but we guard anyway to keep the property
+            // out of the payload on devices where the API call would throw.
+            val hintText: String? = if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.O) {
+                node.hintText?.toString()
+            } else null
+
+            // Local helper to collapse blank/null strings to JsonNull. A
+            // local lambda rather than an extension `put` overload so we
+            // don't shadow `JsonObjectBuilder.put(String, String?)`.
+            fun strOrNull(raw: String?): JsonElement =
+                if (raw.isNullOrBlank()) JsonNull else JsonPrimitive(raw)
+
+            val props: JsonObject = buildJsonObject {
+                put("nodeId", nodeId)
+                put("bounds", buildJsonObject {
+                    put("left", bounds.left)
+                    put("top", bounds.top)
+                    put("right", bounds.right)
+                    put("bottom", bounds.bottom)
+                    put("centerX", bounds.centerX)
+                    put("centerY", bounds.centerY)
+                    put("width", bounds.width)
+                    put("height", bounds.height)
+                })
+                put("className", strOrNull(node.className?.toString()))
+                put("text", strOrNull(node.text?.toString()))
+                put("contentDescription", strOrNull(node.contentDescription?.toString()))
+                put("hintText", strOrNull(hintText))
+                put("viewIdResourceName", strOrNull(node.viewIdResourceName))
+                put("childCount", node.childCount)
+                put("clickable", node.isClickable)
+                put("longClickable", node.isLongClickable)
+                put("focusable", node.isFocusable)
+                put("focused", node.isFocused)
+                put("editable", node.isEditable)
+                put("scrollable", node.isScrollable)
+                put("checkable", node.isCheckable)
+                // Null vs false is load-bearing: null = "not a toggle",
+                // false = "unchecked toggle".
+                put("checked", if (node.isCheckable) JsonPrimitive(node.isChecked) else JsonNull)
+                put("enabled", node.isEnabled)
+                put("selected", node.isSelected)
+                put("password", node.isPassword)
+            }
+
+            return DescribeNodeResult(found = true, properties = props)
+        } finally {
+            @Suppress("DEPRECATION")
+            try { node.recycle() } catch (_: Throwable) { }
+        }
+    }
+
+    private fun Rect.toBoundsOrZero(): Bounds =
+        Bounds(left = left, top = top, right = right, bottom = bottom)
+
+    private val ZERO_BOUNDS = Bounds(0, 0, 0, 0)
+}

app/src/main/kotlin/com/hermesandroid/relay/audio/BargeInListener.kt

@@ -0,0 +1,436 @@
+package com.hermesandroid.relay.audio
+
+import android.annotation.SuppressLint
+import android.content.Context
+import android.media.AudioFormat
+import android.media.AudioRecord
+import android.media.MediaRecorder
+import android.media.audiofx.AcousticEchoCanceler
+import android.media.audiofx.NoiseSuppressor
+import android.util.Log
+import kotlinx.coroutines.CancellationException
+import kotlinx.coroutines.CoroutineDispatcher
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.Job
+import kotlinx.coroutines.delay
+import kotlinx.coroutines.flow.MutableSharedFlow
+import kotlinx.coroutines.flow.MutableStateFlow
+import kotlinx.coroutines.flow.SharedFlow
+import kotlinx.coroutines.flow.StateFlow
+import kotlinx.coroutines.flow.asSharedFlow
+import kotlinx.coroutines.flow.asStateFlow
+import kotlinx.coroutines.isActive
+import kotlinx.coroutines.launch
+import kotlinx.coroutines.yield
+import kotlin.math.max
+
+/**
+ * Duplex audio capture for voice barge-in (plan unit B3).
+ *
+ * While TTS is playing, this listener continuously pulls 32 ms / 512-sample
+ * PCM frames off the microphone and feeds them to [VadEngine]. It emits two
+ * SharedFlows that B4 will wire into the voice state machine:
+ *
+ *  - [maybeSpeech] fires on the **first** positive raw-VAD frame — before the
+ *    second-layer debouncer latches. B4 uses this to softly [VoicePlayer.duck]
+ *    the TTS so the user's voice has acoustic headroom while we decide whether
+ *    to cut off.
+ *
+ *  - [bargeInDetected] fires when [VadEngine] confirms speech post-hysteresis.
+ *    B4 uses this to call `interruptSpeaking()` and flip state to Listening.
+ *
+ * ### Acoustic echo cancellation
+ *
+ * We configure [AudioRecord] with [MediaRecorder.AudioSource.VOICE_COMMUNICATION]
+ * so the platform's voice-call AEC pipeline is in play, and additionally try
+ * to attach [AcousticEchoCanceler] + [NoiseSuppressor] keyed to the ExoPlayer
+ * audio session id so TTS audio is cancelled from the mic stream specifically.
+ * Without AEC, the device's own speaker output would trip the VAD the moment
+ * TTS started and we'd interrupt ourselves.
+ *
+ * The ExoPlayer audio session id is not stable at the moment we want to start
+ * listening — Media3 allocates the underlying AudioTrack lazily on first
+ * playback, and callers may hit [start] before that's happened (e.g. the very
+ * first sentence of a turn). We poll [audioSessionIdProvider] for up to 1 s
+ * before giving up on AEC and proceeding with the mic-hardware AEC alone.
+ * See the `AEC_SESSION_POLL_*` constants below.
+ *
+ * ### Graceful degradation
+ *
+ * - `AudioRecord.getState() != STATE_INITIALIZED` → log WARN, emit nothing,
+ *   [stop] remains safe to call. Typical cause: RECORD_AUDIO denied at runtime
+ *   or another app holding the mic.
+ * - `AcousticEchoCanceler.isAvailable() == false` → log INFO, proceed without.
+ *   Many mid-range and older devices lack the effect; the VAD still works with
+ *   the mic-hardware AEC from VOICE_COMMUNICATION alone (at the cost of some
+ *   false positives during loud TTS).
+ *
+ * ### Testability seam
+ *
+ * The hot path is abstracted behind [AudioFrameSource]. Production code uses
+ * [AudioRecordSource]; unit tests inject a deterministic fake. This keeps the
+ * test on the JVM unit test path with no Robolectric or `android.jar` shim,
+ * matching the [VadEngine] test pattern.
+ *
+ * ### Thread model
+ *
+ * [start] launches a single reader coroutine on [Dispatchers.IO]. The reader
+ * blocks on [AudioFrameSource.read], then synchronously invokes
+ * [VadEngine.analyze] on the same dispatcher — VadEngine is synchronous,
+ * allocation-free, and callers promise single-threaded access. Flow emissions
+ * use [MutableSharedFlow] with `extraBufferCapacity = 1` so slow subscribers
+ * drop events instead of backpressuring the audio loop.
+ */
+class BargeInListener internal constructor(
+    private val audioSource: AudioFrameSource,
+    private val vadEngine: VadEngine,
+    private val audioSessionIdProvider: () -> Int,
+    private val readerDispatcher: CoroutineDispatcher = Dispatchers.IO,
+) {
+
+    companion object {
+        private const val TAG = "BargeInListener"
+
+        /** Bytes per PCM sample at [AudioFormat.ENCODING_PCM_16BIT]. */
+        private const val BYTES_PER_SAMPLE = 2
+
+        /** Frames of buffering on the [AudioRecord] side. 4× keeps read() from
+         *  ever racing the DMA when the reader coroutine is scheduled with a
+         *  brief delay (GC pause, dispatcher contention). */
+        private const val AUDIO_BUFFER_FRAMES = 4
+
+        /** ExoPlayer may return `0` for its audio session id until its
+         *  AudioTrack is first allocated (on playback start). Poll the
+         *  provider briefly before giving up on AEC and proceeding without. */
+        private const val AEC_SESSION_POLL_INTERVAL_MS = 50L
+        private const val AEC_SESSION_POLL_TIMEOUT_MS = 1_000L
+
+        /**
+         * Factory for the production path. Builds an [AudioRecordSource] from
+         * a `Context` and wires it to the listener. The returned listener has
+         * no allocated `AudioRecord` yet — that happens inside [start].
+         */
+        fun create(
+            context: Context,
+            vadEngine: VadEngine,
+            audioSessionIdProvider: () -> Int,
+        ): BargeInListener = BargeInListener(
+            audioSource = AudioRecordSource(context.applicationContext),
+            vadEngine = vadEngine,
+            audioSessionIdProvider = audioSessionIdProvider,
+        )
+    }
+
+    private val _bargeInDetected = MutableSharedFlow<Unit>(extraBufferCapacity = 1)
+    /** Fires post-hysteresis when [VadEngine] confirms the user is speaking. */
+    val bargeInDetected: SharedFlow<Unit> = _bargeInDetected.asSharedFlow()
+
+    private val _maybeSpeech = MutableSharedFlow<Unit>(extraBufferCapacity = 1)
+    /** Fires on the first positive raw VAD frame, before hysteresis latches. */
+    val maybeSpeech: SharedFlow<Unit> = _maybeSpeech.asSharedFlow()
+
+    private val _aecAttached = MutableStateFlow(false)
+    /** True once [AcousticEchoCanceler] has been attached for the current
+     *  listen session. Exposed for observability and B5's compatibility hint. */
+    val aecAttached: StateFlow<Boolean> = _aecAttached.asStateFlow()
+
+    // Reused across every read() call so the hot loop never allocates a
+    // fresh buffer. Length matches the VAD engine's contract (512 samples).
+    private val frameBuffer: ShortArray = ShortArray(VadEngine.FRAME_SIZE_SAMPLES)
+
+    @Volatile private var readerJob: Job? = null
+    @Volatile private var aec: AcousticEchoCanceler? = null
+    @Volatile private var noiseSuppressor: NoiseSuppressor? = null
+
+    /**
+     * Allocate the audio pipeline and begin reading frames into [vadEngine].
+     *
+     * Launches on the supplied [scope] so the reader coroutine dies with its
+     * owner (the ViewModel scope in B4). [start] is not suspend in the usual
+     * "blocks until ready" sense — it returns as soon as the reader job is
+     * launched; the AEC attach happens lazily inside the coroutine so a
+     * caller waiting on the first [maybeSpeech] / [bargeInDetected] emission
+     * is not gated on an AudioTrack that hasn't been allocated yet.
+     *
+     * Idempotent: calling [start] again while a previous session is still
+     * active is a no-op with a WARN log — B4 is expected to bracket each
+     * listen session with a matching [stop].
+     */
+    fun start(scope: CoroutineScope) {
+        if (readerJob?.isActive == true) {
+            Log.w(TAG, "start() called while a reader is already active — ignoring")
+            return
+        }
+
+        if (!audioSource.initialize()) {
+            Log.w(
+                TAG,
+                "AudioFrameSource failed to initialize " +
+                    "(missing RECORD_AUDIO permission or mic busy) — listener inactive",
+            )
+            _aecAttached.value = false
+            return
+        }
+
+        _aecAttached.value = false
+        readerJob = scope.launch(readerDispatcher) {
+            try {
+                try {
+                    audioSource.start()
+                } catch (t: CancellationException) {
+                    throw t
+                } catch (t: Throwable) {
+                    Log.w(TAG, "AudioFrameSource.start failed: ${t.message}")
+                    return@launch
+                }
+                Log.i(TAG, "Barge-in AudioRecord reader started")
+                maybeAttachEffects()
+
+                while (isActive) {
+                    val read = try {
+                        audioSource.read(frameBuffer, VadEngine.FRAME_SIZE_SAMPLES)
+                    } catch (t: CancellationException) {
+                        throw t
+                    } catch (t: Throwable) {
+                        Log.w(TAG, "AudioFrameSource.read failed; stopping reader: ${t.message}")
+                        break
+                    }
+                    if (read <= 0) {
+                        // Negative values are AudioRecord error codes; 0 means
+                        // no data yet. Either way, yield briefly and retry
+                        // rather than spinning — but don't swallow the
+                        // cancellation check for too long.
+                        delay(5)
+                        continue
+                    }
+                    if (read < VadEngine.FRAME_SIZE_SAMPLES) {
+                        // Short read — skip this frame rather than feeding
+                        // the VAD a partially-populated buffer. This is rare;
+                        // AudioRecord.read(…, SIZE_IN_SHORTS) normally fills
+                        // the requested length when state is correct.
+                        continue
+                    }
+
+                    if (!isActive) break
+
+                    val result = try {
+                        vadEngine.analyze(frameBuffer)
+                    } catch (t: CancellationException) {
+                        throw t
+                    } catch (t: Throwable) {
+                        Log.w(TAG, "VadEngine.analyze failed; stopping reader: ${t.message}")
+                        break
+                    }
+                    if (result.probability > 0f) {
+                        _maybeSpeech.tryEmit(Unit)
+                    }
+                    if (result.isSpeech) {
+                        _bargeInDetected.tryEmit(Unit)
+                    }
+                    // Give the dispatcher a chance to observe cancellation
+                    // between frames. Production-side the AudioRecord.read
+                    // call already blocks until a frame is available, so
+                    // this is effectively free; test-side it prevents the
+                    // reader from monopolizing the test scheduler on fakes
+                    // that return data synchronously.
+                    yield()
+                }
+            } finally {
+                // Release effects + AudioRecord in the reverse of attach order
+                // so the AudioSessionId is still valid when AEC teardown runs.
+                releaseEffects()
+                runCatching { audioSource.stop() }
+                runCatching { audioSource.release() }
+                _aecAttached.value = false
+            }
+        }
+    }
+
+    /**
+     * Cancel the reader loop and release the mic + effects. Safe to call
+     * repeatedly and safe to call before [start]. Returns immediately; the
+     * actual release happens in the reader coroutine's `finally` block, which
+     * is typically a single frame later.
+     */
+    fun stop(): Job? {
+        val job = readerJob
+        if (job?.isActive == true) {
+            Log.i(TAG, "Stopping barge-in AudioRecord reader")
+        }
+        job?.cancel()
+        readerJob = null
+        return job
+    }
+
+    private suspend fun maybeAttachEffects() {
+        val sessionId = awaitNonZeroSessionId()
+        if (sessionId == 0) {
+            Log.i(
+                TAG,
+                "AEC not attached — ExoPlayer audio session id was still 0 " +
+                    "after ${AEC_SESSION_POLL_TIMEOUT_MS}ms poll; continuing " +
+                    "without effects (mic-hardware AEC from VOICE_COMMUNICATION " +
+                    "still in play)",
+            )
+            return
+        }
+
+        if (AcousticEchoCanceler.isAvailable()) {
+            try {
+                val created = AcousticEchoCanceler.create(sessionId)
+                if (created != null) {
+                    created.enabled = true
+                    aec = created
+                    _aecAttached.value = true
+                    Log.i(TAG, "AcousticEchoCanceler attached to session=$sessionId")
+                } else {
+                    Log.i(TAG, "AcousticEchoCanceler.create returned null; continuing without")
+                }
+            } catch (t: Throwable) {
+                Log.w(TAG, "AcousticEchoCanceler attach failed: ${t.message}")
+            }
+        } else {
+            Log.i(TAG, "AEC unavailable on this device; continuing without echo cancellation")
+        }
+
+        if (NoiseSuppressor.isAvailable()) {
+            try {
+                val ns = NoiseSuppressor.create(sessionId)
+                if (ns != null) {
+                    ns.enabled = true
+                    noiseSuppressor = ns
+                }
+            } catch (t: Throwable) {
+                Log.w(TAG, "NoiseSuppressor attach failed: ${t.message}")
+            }
+        }
+    }
+
+    private suspend fun awaitNonZeroSessionId(): Int {
+        val immediate = audioSessionIdProvider()
+        if (immediate != 0) return immediate
+
+        var waited = 0L
+        while (waited < AEC_SESSION_POLL_TIMEOUT_MS) {
+            delay(AEC_SESSION_POLL_INTERVAL_MS)
+            waited += AEC_SESSION_POLL_INTERVAL_MS
+            val id = audioSessionIdProvider()
+            if (id != 0) return id
+        }
+        return 0
+    }
+
+    private fun releaseEffects() {
+        aec?.let {
+            runCatching { it.enabled = false }
+            runCatching { it.release() }
+        }
+        aec = null
+        noiseSuppressor?.let {
+            runCatching { it.enabled = false }
+            runCatching { it.release() }
+        }
+        noiseSuppressor = null
+    }
+
+    /**
+     * Minimal seam over [AudioRecord] so the audio-source pipeline can be
+     * replaced with a deterministic fake in unit tests. Implementations are
+     * not thread-safe — callers promise single-threaded access from the
+     * reader coroutine.
+     */
+    internal interface AudioFrameSource {
+        /**
+         * Allocate underlying native resources. Returns true on success.
+         * Returning false from here short-circuits the listener without any
+         * downstream state flapping.
+         */
+        fun initialize(): Boolean
+
+        /** Begin streaming frames. Must be preceded by a successful [initialize]. */
+        fun start()
+
+        /** Read up to [sizeInShorts] samples into [buffer]; returns the number
+         *  of samples actually read (possibly 0 or negative for error states). */
+        fun read(buffer: ShortArray, sizeInShorts: Int): Int
+
+        /** Stop streaming. May be called multiple times. */
+        fun stop()
+
+        /** Release native resources. After this, the source is dead. */
+        fun release()
+    }
+
+    /**
+     * Real [AudioRecord]-backed frame source. Configures 16 kHz mono 16-bit
+     * PCM with [MediaRecorder.AudioSource.VOICE_COMMUNICATION] so the mic
+     * hardware AEC is engaged.
+     *
+     * The [Context] parameter is currently unused — [AudioRecord] doesn't
+     * need one — but we take it to keep the production factory signature
+     * symmetric with the rest of the audio stack (e.g. [VoiceRecorder])
+     * and to leave room for future permission-probe / audio-focus hooks
+     * without a constructor signature change.
+     */
+    @Suppress("unused", "UNUSED_PARAMETER")
+    private class AudioRecordSource(context: Context) : AudioFrameSource {
+        private var record: AudioRecord? = null
+
+        @SuppressLint("MissingPermission")
+        override fun initialize(): Boolean {
+            val sampleRate = 16_000
+            val channelConfig = AudioFormat.CHANNEL_IN_MONO
+            val encoding = AudioFormat.ENCODING_PCM_16BIT
+
+            val minBytes = AudioRecord.getMinBufferSize(sampleRate, channelConfig, encoding)
+            if (minBytes <= 0) {
+                Log.w(TAG, "AudioRecord.getMinBufferSize returned $minBytes — aborting")
+                return false
+            }
+            val ourBytes =
+                VadEngine.FRAME_SIZE_SAMPLES * BYTES_PER_SAMPLE * AUDIO_BUFFER_FRAMES
+            val bufferBytes = max(minBytes, ourBytes)
+
+            val r = try {
+                AudioRecord(
+                    MediaRecorder.AudioSource.VOICE_COMMUNICATION,
+                    sampleRate,
+                    channelConfig,
+                    encoding,
+                    bufferBytes,
+                )
+            } catch (t: Throwable) {
+                Log.w(TAG, "AudioRecord constructor threw: ${t.message}")
+                return false
+            }
+
+            if (r.state != AudioRecord.STATE_INITIALIZED) {
+                Log.w(TAG, "AudioRecord state=${r.state} (expected STATE_INITIALIZED)")
+                runCatching { r.release() }
+                return false
+            }
+
+            record = r
+            return true
+        }
+
+        override fun start() {
+            record?.startRecording()
+        }
+
+        override fun read(buffer: ShortArray, sizeInShorts: Int): Int {
+            val r = record ?: return -1
+            return r.read(buffer, 0, sizeInShorts)
+        }
+
+        override fun stop() {
+            runCatching { record?.stop() }
+        }
+
+        override fun release() {
+            runCatching { record?.release() }
+            record = null
+        }
+    }
+}

app/src/main/kotlin/com/hermesandroid/relay/audio/RealtimePcmPlayer.kt

@@ -0,0 +1,830 @@
+package com.hermesandroid.relay.audio
+
+import android.content.Context
+import android.media.AudioAttributes
+import android.media.AudioFocusRequest
+import android.media.AudioFormat
+import android.media.AudioManager
+import android.media.AudioTrack
+import android.os.Build
+import android.os.SystemClock
+import android.util.Log
+import com.hermesandroid.relay.diagnostics.DiagnosticCategory
+import com.hermesandroid.relay.diagnostics.DiagnosticSeverity
+import com.hermesandroid.relay.diagnostics.DiagnosticsLog
+import kotlinx.coroutines.flow.MutableStateFlow
+import kotlinx.coroutines.flow.StateFlow
+import kotlinx.coroutines.flow.asStateFlow
+import kotlin.math.max
+import kotlin.math.sqrt
+
+/**
+ * Small streaming PCM sink for the realtime voice dev testbench.
+ *
+ * The relay sends mono 16-bit little-endian PCM chunks over the websocket. This
+ * writes them directly to an AudioTrack so the Android Studio dev build can
+ * hear provider output without waiting for an encoded file.
+ */
+class RealtimePcmPlayer(context: Context? = null) {
+    private val trackLock = Any()
+    private val writeLock = Any()
+    private val audioManager =
+        context?.applicationContext?.getSystemService(Context.AUDIO_SERVICE) as? AudioManager
+    private val realtimeAudioAttributes = AudioAttributes.Builder()
+        .setUsage(AudioAttributes.USAGE_MEDIA)
+        .setContentType(AudioAttributes.CONTENT_TYPE_SPEECH)
+        .build()
+    private val audioFocusChangeListener = AudioManager.OnAudioFocusChangeListener { change ->
+        Log.i(TAG, "Realtime PCM audio focus change=$change")
+    }
+    private var audioTrack: AudioTrack? = null
+    private var audioFocusRequest: AudioFocusRequest? = null
+    private var audioFocusHeld: Boolean = false
+    private var currentSampleRate: Int = 0
+    private var currentVolume: Float = 1f
+    private var estimatedPlaybackEndAtMs: Long = 0L
+    private var playbackStarted: Boolean = false
+    private var pendingStartBytes: Int = 0
+    private var firstBufferedAtMs: Long = 0L
+    private var lastUnderrunCount: Int = 0
+    private var lastHeadPositionLogAtMs: Long = 0L
+    private var lastLoggedHeadFrames: Int = 0
+    private var headAdvanceConfirmed: Boolean = false
+    private var playbackStartedAtMs: Long = 0L
+    private var totalFramesWritten: Long = 0L
+    // (endFrame, rms) per written chunk — lets [playbackAmplitude] report the
+    // amplitude of the audio actually at the hardware cursor right now, instead
+    // of the chunk that most recently *arrived* over the socket.
+    private val playbackAmpQueue = ArrayDeque<FrameAmp>()
+    private var lastPlaybackGapDiagnosticAtMs: Long = 0L
+    private var lastMutedVolumeDiagnosticAtMs: Long = 0L
+    private var adaptiveStartPrebufferMs: Long = RealtimePcmBufferPolicy.START_PREBUFFER_MS
+    private var playbackGapSeenThisTrack: Boolean = false
+    private val _amplitude = MutableStateFlow(0f)
+    val amplitude: StateFlow<Float> = _amplitude.asStateFlow()
+
+    val isActive: Boolean
+        get() = synchronized(trackLock) { audioTrack != null }
+
+    val audioSessionId: Int
+        get() = synchronized(trackLock) { audioTrack?.audioSessionId ?: 0 }
+
+    fun write(pcm: ByteArray, sampleRate: Int): Float {
+        if (pcm.isEmpty()) return 0f
+        val level = computePcm16LeRms(pcm)
+        val now = SystemClock.elapsedRealtime()
+        val written = synchronized(writeLock) {
+            val track = try {
+                synchronized(trackLock) {
+                    val currentTrack = ensureTrackLocked(sampleRate)
+                    notePlaybackGapLocked(currentTrack, now)
+                    currentTrack
+                }
+            } catch (e: Exception) {
+                Log.w(TAG, "PCM track preparation failed: ${e.message}")
+                synchronized(trackLock) { releaseTrackLocked(reason = "PCM track preparation failure") }
+                return@synchronized 0
+            }
+
+            try {
+                val prerollWritten = maybeWriteStartupPreroll(track, sampleRate)
+                if (prerollWritten < 0) {
+                    Log.w(TAG, "PCM preroll write returned $prerollWritten; restarting track")
+                    synchronized(trackLock) {
+                        if (audioTrack === track) releaseTrackLocked(reason = "PCM preroll write error")
+                    }
+                    return@synchronized 0
+                }
+                // Intentionally do NOT start playback on the bare silent preroll.
+                // Starting here would begin draining ~120ms of silence with zero
+                // real audio queued, guaranteeing an immediate underrun on the
+                // first speech chunk. The real audio written just below feeds the
+                // normal start decision, and the end-of-turn flush
+                // (voice.output_audio.done) force-starts anything still buffered.
+
+                val writtenBytes = writeBlocking(track, pcm)
+                if (writtenBytes < 0) {
+                    Log.w(TAG, "PCM write returned $writtenBytes; restarting track")
+                    synchronized(trackLock) {
+                        if (audioTrack === track) releaseTrackLocked(reason = "PCM write error")
+                    }
+                    return@synchronized 0
+                }
+
+                var accepted = 0
+                if (writtenBytes > 0) {
+                    synchronized(trackLock) {
+                        if (audioTrack === track) {
+                            noteWrittenBytesLocked(writtenBytes, sampleRate)
+                            enqueuePlaybackAmplitudeLocked(level)
+                            maybeStartPlaybackLocked(track, sampleRate, force = false)
+                            updateUnderrunCursorLocked(track)
+                            logPlaybackHealthLocked(track, now)
+                            accepted = writtenBytes
+                        }
+                    }
+                }
+                accepted
+            } catch (e: Exception) {
+                Log.w(TAG, "PCM write failed: ${e.message}")
+                synchronized(trackLock) {
+                    if (audioTrack === track) releaseTrackLocked(reason = "PCM write failure")
+                }
+                return@synchronized 0
+            }
+        }
+        if (written > 0) {
+            _amplitude.value = level
+        }
+        return level
+    }
+
+    private fun writeBlocking(track: AudioTrack, pcm: ByteArray): Int =
+        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.M) {
+            track.write(pcm, 0, pcm.size, AudioTrack.WRITE_BLOCKING)
+        } else {
+            @Suppress("DEPRECATION")
+            track.write(pcm, 0, pcm.size)
+        }
+
+    fun flushBufferedPlayback(cushionMs: Long = DEFAULT_DRAIN_CUSHION_MS): Long {
+        val now = SystemClock.elapsedRealtime()
+        return synchronized(trackLock) {
+            val track = audioTrack ?: return@synchronized 0L
+            maybeStartPlaybackLocked(track, currentSampleRate, force = true)
+            val remaining = remainingPlaybackMsLocked(now, cushionMs)
+            Log.i(
+                TAG,
+                "Realtime PCM flush playState=${readPlayState(track)} " +
+                    "headFrames=${readHeadFrames(track)} remainingMs=$remaining " +
+                    "underruns=${readUnderrunCount(track)}",
+            )
+            remaining
+        }
+    }
+
+    fun stop() {
+        synchronized(writeLock) {
+            synchronized(trackLock) {
+                releaseTrackLocked(reason = "stop")
+                currentSampleRate = 0
+                estimatedPlaybackEndAtMs = 0L
+            }
+        }
+        _amplitude.value = 0f
+    }
+
+    fun estimatedRemainingPlaybackMs(cushionMs: Long = DEFAULT_DRAIN_CUSHION_MS): Long {
+        val now = SystemClock.elapsedRealtime()
+        return synchronized(trackLock) {
+            remainingPlaybackMsLocked(now, cushionMs)
+        }
+    }
+
+    fun setVolume(volume: Float) {
+        val clamped = volume.coerceIn(0f, 1f)
+        synchronized(trackLock) {
+            currentVolume = clamped
+            try { audioTrack?.setVolume(clamped) } catch (_: Exception) { }
+        }
+    }
+
+    fun duck() {
+        setVolume(0.3f)
+    }
+
+    fun unduck() {
+        setVolume(1f)
+    }
+
+    private fun releaseTrackLocked(reason: String) {
+        audioTrack?.let { track ->
+            Log.i(TAG, "Stopping streaming PCM playback ($reason)")
+            try { track.pause() } catch (_: Exception) { }
+            try { track.flush() } catch (_: Exception) { }
+            try { track.release() } catch (_: Exception) { }
+        }
+        abandonAudioFocusLocked()
+        settleAdaptivePrebufferLocked()
+        audioTrack = null
+        playbackStarted = false
+        pendingStartBytes = 0
+        firstBufferedAtMs = 0L
+        lastUnderrunCount = 0
+        lastHeadPositionLogAtMs = 0L
+        lastLoggedHeadFrames = 0
+        headAdvanceConfirmed = false
+        playbackStartedAtMs = 0L
+        totalFramesWritten = 0L
+        playbackAmpQueue.clear()
+        playbackGapSeenThisTrack = false
+    }
+
+    private fun enqueuePlaybackAmplitudeLocked(rms: Float) {
+        // [totalFramesWritten] has already been advanced past this chunk, so it
+        // is the chunk's end frame. The cursor reaches this amplitude once
+        // playbackHeadPosition passes the previous end frame.
+        playbackAmpQueue.addLast(FrameAmp(endFrame = totalFramesWritten, rms = rms))
+        while (playbackAmpQueue.size > MAX_AMP_QUEUE) playbackAmpQueue.removeFirst()
+    }
+
+    /**
+     * Amplitude of the audio currently at the hardware cursor (0 if not playing
+     * or drained). This is the playback-synced signal a UI waveform should draw:
+     * it advances with [AudioTrack.getPlaybackHeadPosition], so it matches what
+     * the user hears rather than what most recently arrived over the socket.
+     */
+    fun playbackAmplitude(): Float = synchronized(trackLock) {
+        val track = audioTrack ?: return@synchronized 0f
+        if (!playbackStarted) return@synchronized 0f
+        val head = readHeadFrames(track).toLong()
+        // Drop fully-played chunks so the head of the queue is the one playing now.
+        while (playbackAmpQueue.size > 1 && playbackAmpQueue.first().endFrame <= head) {
+            playbackAmpQueue.removeFirst()
+        }
+        amplitudeAtHead(playbackAmpQueue, head)
+    }
+
+    private fun ensureTrackLocked(sampleRate: Int): AudioTrack {
+        val existing = audioTrack
+        if (existing != null && currentSampleRate == sampleRate) {
+            return existing
+        }
+        releaseTrackLocked(reason = "sample rate changed")
+
+        val minBuffer = AudioTrack.getMinBufferSize(
+            sampleRate,
+            AudioFormat.CHANNEL_OUT_MONO,
+            AudioFormat.ENCODING_PCM_16BIT,
+        ).coerceAtLeast(sampleRate / 10 * 2)
+        val bufferSize = RealtimePcmBufferPolicy.streamBufferSize(
+            minBufferBytes = minBuffer,
+            sampleRate = sampleRate,
+        )
+        val format = AudioFormat.Builder()
+            .setEncoding(AudioFormat.ENCODING_PCM_16BIT)
+            .setSampleRate(sampleRate)
+            .setChannelMask(AudioFormat.CHANNEL_OUT_MONO)
+            .build()
+
+        val track = if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.M) {
+            AudioTrack.Builder()
+                .setAudioAttributes(realtimeAudioAttributes)
+                .setAudioFormat(format)
+                .setTransferMode(AudioTrack.MODE_STREAM)
+                .setBufferSizeInBytes(bufferSize)
+                .build()
+        } else {
+            @Suppress("DEPRECATION")
+            AudioTrack(
+                AudioManager.STREAM_MUSIC,
+                sampleRate,
+                AudioFormat.CHANNEL_OUT_MONO,
+                AudioFormat.ENCODING_PCM_16BIT,
+                bufferSize,
+                AudioTrack.MODE_STREAM,
+            )
+        }
+
+        if (track.state != AudioTrack.STATE_INITIALIZED) {
+            try { track.release() } catch (_: Exception) { }
+            throw IllegalStateException("AudioTrack failed to initialize")
+        }
+
+        requestAudioFocusLocked()
+        audioTrack = track
+        currentSampleRate = sampleRate
+        playbackStarted = false
+        pendingStartBytes = 0
+        firstBufferedAtMs = 0L
+        totalFramesWritten = 0L
+        lastUnderrunCount = readUnderrunCount(track)
+        // Log requested vs. actual allocated frames. If a device coerces our
+        // sub-second request back up to a multi-second allocation, that's the
+        // tell-tale of deep-buffer routing (the cold-start parking class) and
+        // explains a regression of the silent-first-turn bug on new hardware.
+        val requestedFrames = bufferSize / BYTES_PER_FRAME
+        val actualFrames = try { track.bufferSizeInFrames } catch (_: Exception) { -1 }
+        Log.i(
+            TAG,
+            "Initialized streaming PCM playback at ${sampleRate}Hz " +
+                "session=${track.audioSessionId} buffer=${bufferSize}B " +
+                "requestedFrames=$requestedFrames actualFrames=$actualFrames " +
+                "(${frameMs(actualFrames, sampleRate)}ms)",
+        )
+        return track
+    }
+
+    private fun frameMs(frames: Int, sampleRate: Int): Long {
+        if (frames <= 0 || sampleRate <= 0) return 0L
+        return (frames * 1000L / sampleRate)
+    }
+
+    private fun noteWrittenBytesLocked(writtenBytes: Int, sampleRate: Int) {
+        if (writtenBytes <= 0 || sampleRate <= 0) return
+        totalFramesWritten += (writtenBytes / BYTES_PER_FRAME).toLong()
+        val durationMs = ((writtenBytes / 2.0) / sampleRate * 1000.0)
+            .toLong()
+            .coerceAtLeast(1L)
+        val now = SystemClock.elapsedRealtime()
+        if (!playbackStarted) {
+            if (firstBufferedAtMs == 0L) firstBufferedAtMs = now
+            pendingStartBytes += writtenBytes
+            return
+        }
+        val base = max(now, estimatedPlaybackEndAtMs)
+        estimatedPlaybackEndAtMs = base + durationMs
+    }
+
+    private fun maybeWriteStartupPreroll(track: AudioTrack, sampleRate: Int): Int {
+        if (
+            synchronized(trackLock) {
+                playbackStarted ||
+                    pendingStartBytes > 0 ||
+                    firstBufferedAtMs > 0L ||
+                    sampleRate <= 0 ||
+                    audioTrack !== track
+            }
+        ) {
+            return 0
+        }
+
+        val prerollMs = startupPrerollMsLocked()
+        val silenceBytes = RealtimePcmBufferPolicy.bytesForDurationMs(sampleRate, prerollMs)
+        if (silenceBytes <= 0) return 0
+
+        val written = writeBlocking(track, ByteArray(silenceBytes))
+        if (written > 0) {
+            synchronized(trackLock) {
+                if (audioTrack === track) {
+                    noteWrittenBytesLocked(written, sampleRate)
+                    enqueuePlaybackAmplitudeLocked(0f) // preroll is silence
+                    Log.i(
+                        TAG,
+                        "Primed realtime PCM playback with " +
+                            "${RealtimePcmBufferPolicy.durationMsForBytes(written, sampleRate)}ms " +
+                            "silent preroll",
+                    )
+                }
+            }
+        }
+        return written
+    }
+
+    private fun startupPrerollMsLocked(): Long {
+        return RealtimePcmBufferPolicy.STARTUP_PREROLL_MS
+    }
+
+    private fun maybeStartPlaybackLocked(
+        track: AudioTrack,
+        sampleRate: Int,
+        force: Boolean,
+    ) {
+        if (playbackStarted || pendingStartBytes <= 0 || sampleRate <= 0) return
+        val now = SystemClock.elapsedRealtime()
+        val waitedMs = if (firstBufferedAtMs > 0L) now - firstBufferedAtMs else 0L
+        val decision = RealtimePcmBufferPolicy.startDecision(
+            pendingBytes = pendingStartBytes,
+            sampleRate = sampleRate,
+            waitedMs = waitedMs,
+            force = force,
+            startPrebufferMs = adaptiveStartPrebufferMs,
+        )
+        if (!decision.shouldStart) return
+
+        try {
+            requestAudioFocusLocked()
+            track.play()
+            try { track.setVolume(currentVolume) } catch (_: Exception) { }
+        } catch (e: Exception) {
+            try { track.release() } catch (_: Exception) { }
+            audioTrack = null
+            throw e
+        }
+
+        playbackStarted = true
+        estimatedPlaybackEndAtMs = now + decision.bufferedMs
+        playbackStartedAtMs = now
+        lastHeadPositionLogAtMs = now
+        lastLoggedHeadFrames = readHeadFrames(track)
+        headAdvanceConfirmed = false
+        Log.i(
+            TAG,
+            "Started streaming PCM playback at ${sampleRate}Hz " +
+                "session=${track.audioSessionId} prebuffer=${decision.bufferedMs}ms " +
+                "waited=${waitedMs}ms target=${adaptiveStartPrebufferMs}ms " +
+                "reason=${decision.reason} playState=${readPlayState(track)} " +
+                "headFrames=$lastLoggedHeadFrames ${mediaVolumeSummaryLocked()}",
+        )
+        pendingStartBytes = 0
+        firstBufferedAtMs = 0L
+        lastUnderrunCount = readUnderrunCount(track)
+    }
+
+    /**
+     * Periodically logs whether the AudioTrack hardware cursor is actually
+     * advancing. This is the decisive signal for the "speaking animation + valid
+     * PCM logs but no sound" class of bug:
+     *
+     *  - head frames advancing + still no sound → output route / volume problem
+     *    (e.g. the Samsung HAL not opening the path until a volume key nudges it).
+     *  - head frames pinned at the start value → the track was play()'d but the
+     *    mixer never pulled from it (focus / state problem on this device).
+     */
+    private fun logPlaybackHealthLocked(track: AudioTrack, now: Long) {
+        if (!playbackStarted) return
+        val headFrames = readHeadFrames(track)
+        // First-frame detection runs on EVERY write until confirmed (not gated by
+        // the throttle) and uses a fresh timestamp, so time-to-first-audio is
+        // accurate to write cadence rather than the 1s health-log window — the
+        // throttle/stale-`now` combination otherwise inflates it by ~1.5s.
+        if (!headAdvanceConfirmed && headFrames > 0) {
+            headAdvanceConfirmed = true
+            val freshNow = SystemClock.elapsedRealtime()
+            val ttfaMs = if (playbackStartedAtMs > 0L) freshNow - playbackStartedAtMs else -1L
+            Log.i(
+                TAG,
+                "Realtime PCM time-to-first-audio=${ttfaMs}ms (headFrames=$headFrames)",
+            )
+            DiagnosticsLog.record(
+                category = DiagnosticCategory.Voice,
+                severity = DiagnosticSeverity.Info,
+                title = "Realtime audio started",
+                detail = "First sample reached the speaker after ${ttfaMs}ms.",
+            )
+        }
+        if (now - lastHeadPositionLogAtMs < HEAD_POSITION_LOG_THROTTLE_MS) return
+        val advancedFrames = headFrames - lastLoggedHeadFrames
+        Log.i(
+            TAG,
+            "Realtime PCM playback health playState=${readPlayState(track)} " +
+                "headFrames=$headFrames advanced=$advancedFrames " +
+                "underruns=${readUnderrunCount(track)} ${mediaVolumeSummaryLocked()}",
+        )
+        if (advancedFrames <= 0) {
+            Log.w(
+                TAG,
+                "Realtime PCM hardware cursor not advancing (headFrames=$headFrames " +
+                    "playState=${readPlayState(track)}); audio queued but mixer is not pulling",
+            )
+            maybeRecordStuckCursorDiagnosticLocked(track, now)
+        }
+        lastHeadPositionLogAtMs = now
+        lastLoggedHeadFrames = headFrames
+    }
+
+    /**
+     * If the hardware cursor never started after [STUCK_CURSOR_DIAGNOSTIC_MS] of
+     * "playing", surface it to the in-app Diagnostics screen once per track —
+     * this is the field-visible signal for the cold-start parking class when no
+     * logcat cable is attached. Write-sampled here; the [VoiceViewModel] watchdog
+     * provides the timer-driven guarantee when writes stall.
+     */
+    private fun maybeRecordStuckCursorDiagnosticLocked(track: AudioTrack, now: Long) {
+        if (headAdvanceConfirmed || playbackStartedAtMs <= 0L) return
+        val stuckMs = now - playbackStartedAtMs
+        if (stuckMs < STUCK_CURSOR_DIAGNOSTIC_MS) return
+        if (now - lastPlaybackGapDiagnosticAtMs < PLAYBACK_GAP_DIAGNOSTIC_THROTTLE_MS) return
+        lastPlaybackGapDiagnosticAtMs = now
+        DiagnosticsLog.record(
+            category = DiagnosticCategory.Voice,
+            severity = DiagnosticSeverity.Warning,
+            title = "Realtime audio not starting",
+            detail = "Playback running ${stuckMs}ms but no audio reached the speaker " +
+                "(${mediaVolumeSummaryLocked()}).",
+        )
+    }
+
+    /**
+     * Immutable snapshot of playback progress for the [VoiceViewModel] watchdog
+     * and drain cross-check. Reads are cheap and lock-guarded.
+     */
+    fun snapshot(): RealtimePlaybackSnapshot = synchronized(trackLock) {
+        val track = audioTrack
+        RealtimePlaybackSnapshot(
+            active = track != null,
+            playbackStarted = playbackStarted,
+            headFrames = track?.let { readHeadFrames(it) } ?: 0,
+            framesWritten = totalFramesWritten,
+            sampleRate = currentSampleRate,
+            playStatePlaying = track != null && readPlayState(track) == "playing",
+            startedAtElapsedMs = playbackStartedAtMs,
+        )
+    }
+
+    private fun readHeadFrames(track: AudioTrack): Int =
+        try { track.playbackHeadPosition } catch (_: Exception) { lastLoggedHeadFrames }
+
+    private fun readPlayState(track: AudioTrack): String =
+        try {
+            when (track.playState) {
+                AudioTrack.PLAYSTATE_PLAYING -> "playing"
+                AudioTrack.PLAYSTATE_PAUSED -> "paused"
+                AudioTrack.PLAYSTATE_STOPPED -> "stopped"
+                else -> "unknown"
+            }
+        } catch (_: Exception) {
+            "error"
+        }
+
+    private fun notePlaybackGapLocked(track: AudioTrack, now: Long) {
+        if (!playbackStarted) return
+        val underrunCount = readUnderrunCount(track)
+        val platformUnderrun = underrunCount > lastUnderrunCount
+        val estimatedDrained = estimatedPlaybackEndAtMs > 0L &&
+            now > estimatedPlaybackEndAtMs + RealtimePcmBufferPolicy.UNDERFLOW_GRACE_MS
+        if (!platformUnderrun && !estimatedDrained) return
+
+        val reason = if (platformUnderrun) {
+            "platform underrun ${lastUnderrunCount}→$underrunCount"
+        } else {
+            "stream gap ${now - estimatedPlaybackEndAtMs}ms"
+        }
+        Log.w(TAG, "Realtime PCM continuing after $reason")
+        recordPlaybackGapDiagnosticLocked(now, reason)
+        playbackGapSeenThisTrack = true
+        increaseAdaptivePrebufferLocked(reason)
+
+        // Provider-native realtime streams can legitimately arrive in uneven
+        // bursts while the model decides to call tools. Keep the AudioTrack
+        // alive so already queued speech is not flushed and the next chunk can
+        // resume naturally after Android's underrun recovery.
+        if (estimatedDrained) {
+            estimatedPlaybackEndAtMs = now
+        }
+        lastUnderrunCount = underrunCount
+    }
+
+    private fun increaseAdaptivePrebufferLocked(reason: String) {
+        val previous = adaptiveStartPrebufferMs
+        adaptiveStartPrebufferMs = (adaptiveStartPrebufferMs + ADAPTIVE_PREBUFFER_STEP_MS)
+            .coerceAtMost(RealtimePcmBufferPolicy.MAX_ADAPTIVE_START_PREBUFFER_MS)
+        if (adaptiveStartPrebufferMs != previous) {
+            Log.i(
+                TAG,
+                "Realtime PCM adaptive prebuffer increased to ${adaptiveStartPrebufferMs}ms " +
+                    "after $reason",
+            )
+        }
+    }
+
+    private fun settleAdaptivePrebufferLocked() {
+        if (playbackGapSeenThisTrack) return
+        val previous = adaptiveStartPrebufferMs
+        adaptiveStartPrebufferMs = (adaptiveStartPrebufferMs - ADAPTIVE_PREBUFFER_DECAY_MS)
+            .coerceAtLeast(RealtimePcmBufferPolicy.START_PREBUFFER_MS)
+        if (adaptiveStartPrebufferMs != previous) {
+            Log.i(
+                TAG,
+                "Realtime PCM adaptive prebuffer relaxed to ${adaptiveStartPrebufferMs}ms",
+            )
+        }
+    }
+
+    private fun recordPlaybackGapDiagnosticLocked(now: Long, reason: String) {
+        if (now - lastPlaybackGapDiagnosticAtMs < PLAYBACK_GAP_DIAGNOSTIC_THROTTLE_MS) return
+        lastPlaybackGapDiagnosticAtMs = now
+        DiagnosticsLog.record(
+            category = DiagnosticCategory.Voice,
+            severity = DiagnosticSeverity.Warning,
+            title = "Realtime audio stream gap",
+            detail = reason,
+        )
+    }
+
+    private fun requestAudioFocusLocked() {
+        val manager = audioManager ?: return
+        val now = SystemClock.elapsedRealtime()
+        val mediaVolume = runCatching { manager.getStreamVolume(AudioManager.STREAM_MUSIC) }.getOrNull()
+        val maxVolume = runCatching { manager.getStreamMaxVolume(AudioManager.STREAM_MUSIC) }.getOrNull()
+        if (mediaVolume == 0 && now - lastMutedVolumeDiagnosticAtMs > MUTED_VOLUME_DIAGNOSTIC_THROTTLE_MS) {
+            lastMutedVolumeDiagnosticAtMs = now
+            Log.w(TAG, "Realtime PCM playback is starting while media volume is muted")
+            DiagnosticsLog.record(
+                category = DiagnosticCategory.Voice,
+                severity = DiagnosticSeverity.Warning,
+                title = "Realtime voice volume muted",
+                detail = "Media volume is 0/${maxVolume ?: "?"}.",
+            )
+        }
+        if (audioFocusHeld) {
+            Log.i(TAG, "Realtime PCM audio focus already held ${mediaVolumeSummaryLocked()}")
+            return
+        }
+        val result = if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.O) {
+            val request = audioFocusRequest ?: AudioFocusRequest.Builder(
+                AudioManager.AUDIOFOCUS_GAIN_TRANSIENT,
+            )
+                .setAudioAttributes(realtimeAudioAttributes)
+                .setAcceptsDelayedFocusGain(false)
+                .setOnAudioFocusChangeListener(audioFocusChangeListener)
+                .build()
+                .also { audioFocusRequest = it }
+            manager.requestAudioFocus(request)
+        } else {
+            @Suppress("DEPRECATION")
+            manager.requestAudioFocus(
+                audioFocusChangeListener,
+                AudioManager.STREAM_MUSIC,
+                AudioManager.AUDIOFOCUS_GAIN_TRANSIENT,
+            )
+        }
+        audioFocusHeld = result == AudioManager.AUDIOFOCUS_REQUEST_GRANTED
+        Log.i(
+            TAG,
+            "Realtime PCM audio focus result=$result held=$audioFocusHeld ${mediaVolumeSummaryLocked()}",
+        )
+    }
+
+    private fun abandonAudioFocusLocked() {
+        val manager = audioManager ?: return
+        if (!audioFocusHeld) return
+        runCatching {
+            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.O) {
+                audioFocusRequest?.let { manager.abandonAudioFocusRequest(it) }
+            } else {
+                @Suppress("DEPRECATION")
+                manager.abandonAudioFocus(audioFocusChangeListener)
+            }
+        }.onFailure {
+            Log.w(TAG, "Realtime PCM audio focus abandon failed: ${it.message}")
+        }
+        audioFocusHeld = false
+    }
+
+    private fun mediaVolumeSummaryLocked(): String {
+        val manager = audioManager ?: return "mediaVolume=unknown"
+        val volume = runCatching { manager.getStreamVolume(AudioManager.STREAM_MUSIC) }.getOrNull()
+        val maxVolume = runCatching { manager.getStreamMaxVolume(AudioManager.STREAM_MUSIC) }.getOrNull()
+        val musicActive = runCatching { manager.isMusicActive }.getOrNull()
+        return "mediaVolume=${volume ?: "?"}/${maxVolume ?: "?"} musicActive=${musicActive ?: "?"}"
+    }
+
+    private fun updateUnderrunCursorLocked(track: AudioTrack) {
+        val underrunCount = readUnderrunCount(track)
+        if (underrunCount > lastUnderrunCount) {
+            lastUnderrunCount = underrunCount
+        }
+    }
+
+    private fun readUnderrunCount(track: AudioTrack): Int =
+        try { track.underrunCount } catch (_: Exception) { lastUnderrunCount }
+
+    private fun remainingPlaybackMsLocked(now: Long, cushionMs: Long): Long {
+        if (audioTrack == null) return 0L
+        if (!playbackStarted) {
+            return RealtimePcmBufferPolicy.durationMsForBytes(
+                bytes = pendingStartBytes,
+                sampleRate = currentSampleRate,
+            ) + cushionMs.coerceAtLeast(0L)
+        }
+        return (estimatedPlaybackEndAtMs - now + cushionMs).coerceAtLeast(0L)
+    }
+
+    private fun computePcm16LeRms(pcm: ByteArray): Float {
+        val usable = pcm.size - (pcm.size % 2)
+        if (usable <= 0) return 0f
+
+        var sumSquares = 0.0
+        var samples = 0
+        var index = 0
+        while (index < usable) {
+            val low = pcm[index].toInt() and 0xff
+            val high = pcm[index + 1].toInt()
+            val sample = ((high shl 8) or low).toShort().toInt()
+            val normalized = sample / Short.MAX_VALUE.toDouble()
+            sumSquares += normalized * normalized
+            samples++
+            index += 2
+        }
+        if (samples == 0) return 0f
+
+        val rms = sqrt(sumSquares / samples)
+        val lifted = sqrt((rms / 0.28).coerceIn(0.0, 1.0))
+        return if (lifted.isNaN() || lifted.isInfinite()) 0f else lifted.toFloat().coerceIn(0f, 1f)
+    }
+
+    companion object {
+        private const val TAG = "RealtimePcmPlayer"
+        private const val DEFAULT_DRAIN_CUSHION_MS = 250L
+        private const val PLAYBACK_GAP_DIAGNOSTIC_THROTTLE_MS = 5_000L
+        private const val MUTED_VOLUME_DIAGNOSTIC_THROTTLE_MS = 10_000L
+        private const val ADAPTIVE_PREBUFFER_STEP_MS = 240L
+        private const val ADAPTIVE_PREBUFFER_DECAY_MS = 120L
+        private const val HEAD_POSITION_LOG_THROTTLE_MS = 1_000L
+        private const val STUCK_CURSOR_DIAGNOSTIC_MS = 1_200L
+        private const val BYTES_PER_FRAME = 2 // mono 16-bit PCM
+        private const val MAX_AMP_QUEUE = 1_024
+    }
+}
+
+/**
+ * Lock-free value snapshot of realtime playback progress, consumed by the
+ * [com.hermesandroid.relay.viewmodel.VoiceViewModel] first-frame watchdog and
+ * drain cross-check.
+ */
+data class RealtimePlaybackSnapshot(
+    val active: Boolean,
+    val playbackStarted: Boolean,
+    val headFrames: Int,
+    val framesWritten: Long,
+    val sampleRate: Int,
+    val playStatePlaying: Boolean,
+    val startedAtElapsedMs: Long,
+)
+
+/** A written PCM chunk's RMS amplitude tagged with the frame it finishes at. */
+internal data class FrameAmp(val endFrame: Long, val rms: Float)
+
+/**
+ * Returns the amplitude of the first chunk that has not finished playing
+ * ([FrameAmp.endFrame] > [headFrames]) — i.e. the audio at the cursor right now.
+ * 0 when the queue is empty or fully drained. Pure for unit testing.
+ */
+internal fun amplitudeAtHead(queue: List<FrameAmp>, headFrames: Long): Float {
+    for (entry in queue) {
+        if (entry.endFrame > headFrames) return entry.rms
+    }
+    return 0f
+}
+
+internal data class RealtimePcmStartDecision(
+    val shouldStart: Boolean,
+    val bufferedMs: Long,
+    val reason: String,
+)
+
+internal object RealtimePcmBufferPolicy {
+    // Realtime voice is latency-sensitive: the provider streams PCM at (or faster
+    // than) realtime, so the start prebuffer only needs to cover network jitter,
+    // not the whole turn. The large [STREAM_BUFFER_MS] AudioTrack buffer absorbs
+    // bursts *after* playback starts; the start thresholds just decide when the
+    // very first sample is allowed to leave the queue.
+    //
+    // A short turn whose audio arrives faster than realtime used to satisfy
+    // neither the (2.4s) prebuffer nor the (1.2s) max-wait, so it never started
+    // mid-stream and depended entirely on the end-of-turn flush. Lowering these
+    // lets streaming start on the first few chunks while keeping enough cushion
+    // to ride out jitter.
+    const val STARTUP_PREROLL_MS = 120L
+    const val START_PREBUFFER_MS = 320L
+    const val MIN_PREBUFFER_MS = 160L
+    const val MAX_PREBUFFER_WAIT_MS = 280L
+    const val MAX_ADAPTIVE_START_PREBUFFER_MS = 1_200L
+    // Keep the AudioTrack buffer modest. A multi-second buffer gets routed to
+    // Samsung's "deep buffer" output mixer, whose thread is suspended at rest and
+    // cold-starts very slowly — the hardware cursor (playbackHeadPosition) stays
+    // pinned at 0 for ~2-5s after play() even though playState=PLAYING, focus is
+    // held and volume is up. That parked window is the inaudible first/short
+    // turn. A sub-second buffer keeps playback on the primary (fast) mixer path,
+    // which begins pulling immediately. The ~700ms still absorbs normal network
+    // jitter; longer provider gaps (tool calls) underrun-and-resume regardless of
+    // buffer size and are handled by notePlaybackGapLocked.
+    const val STREAM_BUFFER_MS = 700L
+    const val UNDERFLOW_GRACE_MS = 180L
+
+    fun streamBufferSize(minBufferBytes: Int, sampleRate: Int): Int {
+        val target = bytesForDurationMs(sampleRate, STREAM_BUFFER_MS)
+        return max(minBufferBytes, target)
+    }
+
+    fun startDecision(
+        pendingBytes: Int,
+        sampleRate: Int,
+        waitedMs: Long,
+        force: Boolean,
+        startPrebufferMs: Long = START_PREBUFFER_MS,
+    ): RealtimePcmStartDecision {
+        val bufferedMs = durationMsForBytes(pendingBytes, sampleRate)
+        val targetPrebufferMs = startPrebufferMs.coerceIn(
+            START_PREBUFFER_MS,
+            MAX_ADAPTIVE_START_PREBUFFER_MS,
+        )
+        val reason = when {
+            force && pendingBytes > 0 -> "flush"
+            bufferedMs >= targetPrebufferMs -> "prebuffer"
+            bufferedMs >= MIN_PREBUFFER_MS && waitedMs >= MAX_PREBUFFER_WAIT_MS -> "max-wait"
+            else -> "buffering"
+        }
+        return RealtimePcmStartDecision(
+            shouldStart = reason != "buffering",
+            bufferedMs = bufferedMs,
+            reason = reason,
+        )
+    }
+
+    fun durationMsForBytes(bytes: Int, sampleRate: Int): Long {
+        if (bytes <= 0 || sampleRate <= 0) return 0L
+        return ((bytes / 2.0) / sampleRate * 1000.0)
+            .toLong()
+            .coerceAtLeast(1L)
+    }
+
+    fun bytesForDurationMs(sampleRate: Int, durationMs: Long): Int {
+        if (sampleRate <= 0 || durationMs <= 0L) return 0
+        return (sampleRate * 2L * durationMs / 1000L).toInt()
+    }
+
+    fun startupPrerollBytes(sampleRate: Int): Int =
+        bytesForDurationMs(sampleRate, STARTUP_PREROLL_MS)
+}

app/src/main/kotlin/com/hermesandroid/relay/audio/RealtimePcmRecorder.kt

@@ -0,0 +1,145 @@
+package com.hermesandroid.relay.audio
+
+import android.annotation.SuppressLint
+import android.media.AudioFormat
+import android.media.AudioRecord
+import android.media.MediaRecorder
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.withContext
+import java.io.ByteArrayOutputStream
+import kotlin.math.min
+import kotlin.math.sqrt
+
+/**
+ * Captures mono 16-bit PCM for realtime voice test runs.
+ *
+ * [capture] grabs a fixed short window (legacy/back-compat). [captureUntilStopped]
+ * records open-endedly until [requestStop] is called (tap-to-stop), which is what
+ * the Mic demo needs to capture a full spoken sentence.
+ */
+class RealtimePcmRecorder(
+    private val sampleRate: Int = 16_000,
+) {
+    @Volatile
+    private var capturing = false
+
+    /** Signals an in-flight [captureUntilStopped] to finish and return. */
+    fun requestStop() {
+        capturing = false
+    }
+
+    val isCapturing: Boolean
+        get() = capturing
+
+    /**
+     * Records until [requestStop] is called or [maxDurationMs] elapses, invoking
+     * [onLevel] (0..1 RMS) per read so the UI can show a live input waveform.
+     */
+    @SuppressLint("MissingPermission")
+    suspend fun captureUntilStopped(
+        maxDurationMs: Long = 15_000,
+        onLevel: ((Float) -> Unit)? = null,
+    ): ByteArray = withContext(Dispatchers.IO) {
+        val minBuffer = AudioRecord.getMinBufferSize(
+            sampleRate,
+            AudioFormat.CHANNEL_IN_MONO,
+            AudioFormat.ENCODING_PCM_16BIT,
+        ).coerceAtLeast(sampleRate / 10 * 2)
+        val maxBytes = ((sampleRate * maxDurationMs) / 1000L * 2L).toInt()
+
+        val recorder = AudioRecord.Builder()
+            .setAudioSource(MediaRecorder.AudioSource.MIC)
+            .setAudioFormat(
+                AudioFormat.Builder()
+                    .setEncoding(AudioFormat.ENCODING_PCM_16BIT)
+                    .setSampleRate(sampleRate)
+                    .setChannelMask(AudioFormat.CHANNEL_IN_MONO)
+                    .build()
+            )
+            .setBufferSizeInBytes(minBuffer)
+            .build()
+
+        val out = ByteArrayOutputStream(minBuffer * 4)
+        val buffer = ByteArray(minBuffer)
+        capturing = true
+        try {
+            recorder.startRecording()
+            while (capturing && out.size() < maxBytes) {
+                val read = recorder.read(buffer, 0, buffer.size)
+                if (read > 0) {
+                    out.write(buffer, 0, read)
+                    onLevel?.invoke(rms16Le(buffer, read))
+                } else {
+                    break
+                }
+            }
+        } finally {
+            capturing = false
+            try { recorder.stop() } catch (_: Exception) { }
+            recorder.release()
+        }
+        out.toByteArray()
+    }
+
+    @SuppressLint("MissingPermission")
+    suspend fun capture(durationMs: Long = 800): ByteArray = withContext(Dispatchers.IO) {
+        val minBuffer = AudioRecord.getMinBufferSize(
+            sampleRate,
+            AudioFormat.CHANNEL_IN_MONO,
+            AudioFormat.ENCODING_PCM_16BIT,
+        ).coerceAtLeast(sampleRate / 10 * 2)
+        val targetBytes = ((sampleRate * durationMs) / 1000L * 2L)
+            .toInt()
+            .coerceAtLeast(minBuffer)
+
+        val recorder = AudioRecord.Builder()
+            .setAudioSource(MediaRecorder.AudioSource.MIC)
+            .setAudioFormat(
+                AudioFormat.Builder()
+                    .setEncoding(AudioFormat.ENCODING_PCM_16BIT)
+                    .setSampleRate(sampleRate)
+                    .setChannelMask(AudioFormat.CHANNEL_IN_MONO)
+                    .build()
+            )
+            .setBufferSizeInBytes(minBuffer)
+            .build()
+
+        val out = ByteArrayOutputStream(targetBytes)
+        val buffer = ByteArray(minBuffer)
+        try {
+            recorder.startRecording()
+            while (out.size() < targetBytes) {
+                val read = recorder.read(
+                    buffer,
+                    0,
+                    min(buffer.size, targetBytes - out.size()),
+                )
+                if (read > 0) {
+                    out.write(buffer, 0, read)
+                } else {
+                    break
+                }
+            }
+        } finally {
+            try { recorder.stop() } catch (_: Exception) { }
+            recorder.release()
+        }
+        out.toByteArray()
+    }
+
+    private fun rms16Le(buffer: ByteArray, length: Int): Float {
+        val usable = length - (length % 2)
+        if (usable <= 0) return 0f
+        var sum = 0.0
+        var i = 0
+        while (i < usable) {
+            val low = buffer[i].toInt() and 0xff
+            val high = buffer[i + 1].toInt()
+            val sample = ((high shl 8) or low).toShort().toInt() / 32768.0
+            sum += sample * sample
+            i += 2
+        }
+        val rms = sqrt(sum / (usable / 2))
+        return sqrt((rms / 0.28).coerceIn(0.0, 1.0)).toFloat()
+    }
+}

app/src/main/kotlin/com/hermesandroid/relay/audio/VadEngine.kt

@@ -0,0 +1,266 @@
+package com.hermesandroid.relay.audio
+
+import android.content.Context
+import androidx.annotation.VisibleForTesting
+import com.hermesandroid.relay.data.BargeInSensitivity
+import com.konovalov.vad.silero.VadSilero
+import com.konovalov.vad.silero.config.FrameSize
+import com.konovalov.vad.silero.config.Mode
+import com.konovalov.vad.silero.config.SampleRate
+
+/**
+ * Voice activity detection engine for barge-in (plan unit B2).
+ *
+ * Wraps the upstream `com.github.gkonovalov.android-vad:silero` Silero VAD
+ * behind a project-internal interface so callers never see the library type —
+ * swapping to `vad-webrtc` or another backend later is a single-file change
+ * here, not a fan-out edit across [com.hermesandroid.relay.audio.BargeInListener]
+ * (B3) and [com.hermesandroid.relay.viewmodel.VoiceViewModel] (B4).
+ *
+ * ### Frame contract
+ *
+ * - 16 kHz mono 16-bit PCM.
+ * - Exactly **512 samples** per call (32 ms at 16 kHz). This is the smallest
+ *   Silero-supported frame size at 16 kHz per the library's public
+ *   `supportedParameters` map (512, 1024, 1536); 512 keeps latency tight.
+ *   The plan document references 640 samples — that was the previous library
+ *   constraint before the Silero 2.0 series dropped 160/320/640/1024 in
+ *   favour of 512/1024/1536. Use 512.
+ * - [analyze] is synchronous. Cost is one ONNX forward pass + a couple of
+ *   counter increments. Callers (B3) feed frames in a tight loop; any heap
+ *   allocation beyond the returned [VadResult] is avoided.
+ *
+ * ### Two-layer hysteresis
+ *
+ * 1. **Library layer** — Silero's own `isSpeech()` already applies an
+ *    attack/release window driven by `speechDurationMs`/`silenceDurationMs`
+ *    ([SENSITIVITY_PROFILES]). This handles per-frame wobble from the DNN.
+ * 2. **Our layer** — on top, we require `consecutiveSpeechFrames` successive
+ *    post-library `true` returns before [VadResult.isSpeech] flips to `true`.
+ *    This is the "2–3 consecutive speech frames" debouncer from the plan.
+ *
+ * The two layers compose: library filters per-frame noise, ours defends
+ * against short false-positive bursts (~40 ms) that slip through.
+ *
+ * ### Sensitivity semantics
+ *
+ * [BargeInSensitivity.Off] short-circuits: [analyze] always returns
+ * `isSpeech=false` without touching the model. Useful as a "disable without
+ * flipping the master enabled toggle" UI affordance.
+ */
+class VadEngine @VisibleForTesting internal constructor(
+    private val client: VadClient,
+    sampleRate: Int,
+) {
+
+    /**
+     * Production constructor. Builds a real Silero-backed [VadClient].
+     *
+     * @param sampleRate currently pinned to 16000 — other rates are not
+     *   supported by this engine (and the plan standardises on 16 kHz mic
+     *   capture in B3).
+     */
+    constructor(context: Context, sampleRate: Int = 16_000) : this(
+        client = SileroVadClient(context.applicationContext, sampleRate.toSampleRate()),
+        sampleRate = sampleRate,
+    )
+
+    init {
+        require(sampleRate == 16_000) {
+            "VadEngine currently supports only 16 kHz sample rate; got $sampleRate"
+        }
+    }
+
+    @Volatile
+    private var sensitivity: BargeInSensitivity = BargeInSensitivity.Default
+
+    @Volatile
+    private var profile: SensitivityProfile = SENSITIVITY_PROFILES.getValue(BargeInSensitivity.Default)
+        .also { client.applyProfile(it) }
+
+    // Rolling counters for the second-layer "N consecutive speech frames"
+    // hysteresis. These are touched only from [analyze], which callers drive
+    // single-threaded from B3's audio-read loop, so no synchronization is
+    // required beyond reading the latest [profile] volatile.
+    private var consecutiveSpeechCount: Int = 0
+    private var debounced: Boolean = false
+
+    /**
+     * Analyze one frame of 16-bit PCM audio.
+     *
+     * @param frame exactly [FRAME_SIZE_SAMPLES] (512) samples at 16 kHz. Any
+     *   other size is rejected by the Silero backend.
+     * @return a [VadResult] whose [VadResult.isSpeech] incorporates both the
+     *   library's internal attack/release and our N-consecutive debouncer;
+     *   [VadResult.probability] is a coarse 0f/1f signal derived from the
+     *   pre-debounce library decision (Silero's public API exposes only the
+     *   boolean, not the raw confidence).
+     */
+    fun analyze(frame: ShortArray): VadResult {
+        if (sensitivity == BargeInSensitivity.Off) {
+            return VadResult.NOT_SPEECH
+        }
+
+        val rawSpeech = client.isSpeech(frame)
+
+        if (rawSpeech) {
+            if (consecutiveSpeechCount < profile.consecutiveSpeechFrames) {
+                consecutiveSpeechCount++
+            }
+            if (consecutiveSpeechCount >= profile.consecutiveSpeechFrames) {
+                debounced = true
+            }
+        } else {
+            consecutiveSpeechCount = 0
+            debounced = false
+        }
+
+        return if (debounced) {
+            VadResult(isSpeech = true, probability = 1f)
+        } else {
+            VadResult(isSpeech = false, probability = if (rawSpeech) 1f else 0f)
+        }
+    }
+
+    /**
+     * Apply a sensitivity preset. Updates the library's attack/release
+     * durations and our debouncer's `consecutive` count. Safe to call from
+     * the UI thread; takes effect on the next [analyze].
+     */
+    fun setSensitivity(sensitivity: BargeInSensitivity) {
+        this.sensitivity = sensitivity
+        val newProfile = SENSITIVITY_PROFILES.getValue(sensitivity)
+        profile = newProfile
+        client.applyProfile(newProfile)
+        // Reset the second-layer debouncer so a sensitivity change doesn't
+        // latch a stale speech count from the previous profile.
+        consecutiveSpeechCount = 0
+        debounced = false
+    }
+
+    /** Release the underlying ONNX session and native resources. */
+    fun close() {
+        client.close()
+    }
+
+    companion object {
+        /** Samples per analyze-call at 16 kHz (32 ms). */
+        const val FRAME_SIZE_SAMPLES: Int = 512
+
+        /**
+         * Sensitivity → `(libraryMode, speechDurationMs, silenceDurationMs,
+         * consecutiveSpeechFrames)` map. Tunings come from the B2 unit spec
+         * in `docs/plans/2026-04-17-voice-barge-in.md`.
+         *
+         * The Silero library does not accept an arbitrary threshold float
+         * — it hardcodes one per [Mode]. So we lean on [Mode] for threshold
+         * and use `speech/silenceDurationMs` for the library-layer
+         * attack/release, with our own `consecutiveSpeechFrames` for the
+         * second-layer debouncer.
+         *
+         * Mode mapping (more aggressive = lower threshold = more sensitive):
+         *   - [BargeInSensitivity.Low]  → [Mode.VERY_AGGRESSIVE] (high thr)
+         *   - [BargeInSensitivity.Default] → [Mode.AGGRESSIVE]
+         *   - [BargeInSensitivity.High] → [Mode.NORMAL] (lowest thr)
+         *
+         * NOTE: "aggressive" in the Silero library refers to how aggressively
+         * it rejects non-speech (higher threshold), so Low-sensitivity UX
+         * maps to the MORE aggressive library mode.
+         */
+        internal val SENSITIVITY_PROFILES: Map<BargeInSensitivity, SensitivityProfile> = mapOf(
+            BargeInSensitivity.Off to SensitivityProfile(
+                mode = Mode.VERY_AGGRESSIVE,
+                attackMs = 0,
+                releaseMs = 0,
+                consecutiveSpeechFrames = Int.MAX_VALUE,
+            ),
+            BargeInSensitivity.Low to SensitivityProfile(
+                mode = Mode.VERY_AGGRESSIVE,
+                attackMs = 80,
+                releaseMs = 300,
+                consecutiveSpeechFrames = 3,
+            ),
+            BargeInSensitivity.Default to SensitivityProfile(
+                mode = Mode.AGGRESSIVE,
+                attackMs = 50,
+                releaseMs = 250,
+                consecutiveSpeechFrames = 2,
+            ),
+            BargeInSensitivity.High to SensitivityProfile(
+                mode = Mode.NORMAL,
+                attackMs = 30,
+                releaseMs = 200,
+                consecutiveSpeechFrames = 1,
+            ),
+        )
+    }
+
+    /**
+     * Internal seam over the Silero library so unit tests can replace the
+     * native ONNX-backed client with a deterministic fake. Not exposed
+     * publicly — callers always go through [VadEngine].
+     */
+    internal interface VadClient {
+        fun isSpeech(frame: ShortArray): Boolean
+        fun applyProfile(profile: SensitivityProfile)
+        fun close()
+    }
+
+    internal data class SensitivityProfile(
+        val mode: Mode,
+        val attackMs: Int,
+        val releaseMs: Int,
+        val consecutiveSpeechFrames: Int,
+    )
+
+    private class SileroVadClient(
+        context: Context,
+        sampleRate: SampleRate,
+    ) : VadClient {
+        // Built lazily with a default profile so construction doesn't race
+        // with an initial [applyProfile] call from [VadEngine.init].
+        private val vad: VadSilero = VadSilero(
+            context = context,
+            sampleRate = sampleRate,
+            frameSize = FrameSize.FRAME_SIZE_512,
+            mode = Mode.AGGRESSIVE,
+            speechDurationMs = 50,
+            silenceDurationMs = 250,
+        )
+
+        override fun isSpeech(frame: ShortArray): Boolean = vad.isSpeech(frame)
+
+        override fun applyProfile(profile: SensitivityProfile) {
+            vad.mode = profile.mode
+            vad.speechDurationMs = profile.attackMs
+            vad.silenceDurationMs = profile.releaseMs
+        }
+
+        override fun close() {
+            vad.close()
+        }
+    }
+}
+
+/**
+ * Result of a single [VadEngine.analyze] call.
+ *
+ * [isSpeech] is the post-debounce decision callers should act on.
+ * [probability] is a best-effort confidence hint — Silero's public API
+ * exposes only a boolean, so we surface a coarse 0f/1f until we swap to a
+ * backend that gives us the raw score.
+ */
+data class VadResult(
+    val isSpeech: Boolean,
+    val probability: Float,
+) {
+    companion object {
+        internal val NOT_SPEECH = VadResult(isSpeech = false, probability = 0f)
+    }
+}
+
+private fun Int.toSampleRate(): SampleRate = when (this) {
+    8_000 -> SampleRate.SAMPLE_RATE_8K
+    16_000 -> SampleRate.SAMPLE_RATE_16K
+    else -> error("Unsupported sample rate: $this")
+}

app/src/main/kotlin/com/hermesandroid/relay/audio/VoicePlayer.kt

@@ -0,0 +1,433 @@
+package com.hermesandroid.relay.audio
+
+import android.content.Context
+import android.media.audiofx.Visualizer
+import android.util.Log
+import androidx.annotation.OptIn
+import androidx.core.net.toUri
+import androidx.media3.common.MediaItem
+import androidx.media3.common.Player
+import androidx.media3.common.util.UnstableApi
+import androidx.media3.exoplayer.ExoPlayer
+import androidx.media3.exoplayer.analytics.AnalyticsListener
+import kotlinx.coroutines.flow.MutableStateFlow
+import kotlinx.coroutines.flow.StateFlow
+import kotlinx.coroutines.flow.asStateFlow
+import kotlinx.coroutines.flow.combine
+import kotlinx.coroutines.flow.first
+import java.io.File
+import kotlin.math.sqrt
+
+/**
+ * Plays TTS audio files emitted by the relay's `/voice/synthesize` endpoint
+ * and exposes a live [amplitude] flow for the MorphingSphere / UI meter.
+ *
+ * Backed by a single Media3 [ExoPlayer] that lives for the lifetime of this
+ * [VoicePlayer] instance. [play] appends a new [MediaItem] to the player's
+ * queue so adjacent TTS sentences play back-to-back without the per-file
+ * codec re-init seam that the old `MediaPlayer` implementation produced.
+ * This is the foundation of the Wave 1 gapless-playback work in the voice
+ * quality pass plan — V5 in `docs/plans/2026-04-16-voice-quality-pass.md`.
+ *
+ * Amplitude is computed from [Visualizer] PCM waveform RMS — one waveform
+ * snapshot is captured every ~40 ms (the visualizer's default capture rate)
+ * and reduced to a 0..1 float. On devices that don't allow Visualizer
+ * construction (missing MODIFY_AUDIO_SETTINGS or OEM quirks) we log and
+ * continue with amplitude pinned at 0 rather than crashing the voice session.
+ *
+ * The Visualizer is attached exactly once against the ExoPlayer's
+ * [ExoPlayer.getAudioSessionId]. There is a known gotcha where re-attaching
+ * the Visualizer on every track transition invalidates the session id — the
+ * single-attach lifecycle here sidesteps it entirely. The single attach is
+ * triggered by whichever of {playback became live, a real session id landed}
+ * arrives last, so a late AudioTrack allocation (deep-buffer cold-start) can't
+ * leave amplitude pinned at 0 for the turn — see [attachVisualizerIfPlaying].
+ * That promptness matters because the voice overlay gates its output waveform
+ * on the first real playback-amplitude frame, so the visual follows audible
+ * speech instead of leading it.
+ *
+ * @param context used for [ExoPlayer.Builder]. Application context is fine;
+ *   the player holds no view references.
+ * @param exoPlayerFactory seam for unit tests — production defaults to a
+ *   real Media3 `ExoPlayer.Builder` with `setHandleAudioBecomingNoisy`.
+ *   Tests inject a MockK mock directly to avoid
+ *   `mockkConstructor(ExoPlayer.Builder::class)`, which fails on the
+ *   JVM unit test classpath because Media3's `Builder` static init
+ *   chain pulls in android.os.Looper etc. that aren't shadowed there.
+ */
+@OptIn(UnstableApi::class)
+class VoicePlayer(
+    context: Context,
+    exoPlayerFactory: (Context) -> ExoPlayer = ::defaultExoPlayer,
+) {
+
+    companion object {
+        private const val TAG = "VoicePlayer"
+        private const val VISUALIZER_SIZE_BYTES = 1024
+    }
+
+    private val _amplitude = MutableStateFlow(0f)
+    val amplitude: StateFlow<Float> = _amplitude.asStateFlow()
+
+    // Mirrors the most recent value passed to [setVolume] / [duck] / [unduck].
+    // ExoPlayer's own `volume` getter is the source of truth for the audio
+    // pipeline, but we keep a local copy so callers can introspect current
+    // ducking state without racing the underlying ExoPlayer thread, and so
+    // future reconfig paths (reconstruct ExoPlayer, swap sink, etc.) can
+    // re-apply the same volume without losing the caller's intent.
+    @Volatile private var currentVolume: Float = 1f
+
+    // Tracked via Player.Listener.onIsPlayingChanged so awaitCompletion can
+    // suspend on the combined (isPlaying, mediaItemCount) signal without
+    // polling the player from arbitrary threads.
+    private val _isPlaying = MutableStateFlow(false)
+
+    // Logical count of media items still owned by this playback turn. ExoPlayer
+    // retains played playlist items after STATE_ENDED, so this cannot mirror
+    // mediaItemCount blindly at end-of-queue.
+    private val _queueCount = MutableStateFlow(0)
+
+    private var visualizer: Visualizer? = null
+    private var visualizerAttached = false
+
+    // Thread-safe mirror of [ExoPlayer.getAudioSessionId]. ExoPlayer is
+    // thread-confined — every accessor (the audioSessionId getter included)
+    // calls verifyApplicationThread() and throws "Player is accessed on the
+    // wrong thread" if touched off the player's construction thread. The
+    // barge-in pipeline reads [audioSessionId] from BargeInListener's
+    // Dispatchers.IO reader coroutine to attach AcousticEchoCanceler, so we
+    // can't expose the raw getter. Instead we cache the id from the
+    // main-thread Media3 callbacks below and serve the getter from this
+    // @Volatile field. (Fixes the legacy-TTS + barge-in crash where the
+    // first sentence played for ~2 syllables before the IO read threw.)
+    @Volatile private var cachedAudioSessionId: Int = 0
+
+    private val exoPlayer: ExoPlayer = exoPlayerFactory(context.applicationContext)
+
+    init {
+        // AnalyticsListener callbacks are delivered on the player's
+        // application (main) thread, so caching the id here is the
+        // authoritative, thread-correct way to track it as Media3 allocates
+        // and reallocates the underlying AudioTrack.
+        exoPlayer.addAnalyticsListener(object : AnalyticsListener {
+            override fun onAudioSessionIdChanged(
+                eventTime: AnalyticsListener.EventTime,
+                audioSessionId: Int,
+            ) {
+                cachedAudioSessionId = audioSessionId
+                // Deep-buffer cold-start guard. On some OEM pipelines the
+                // AudioTrack — and therefore a real (non-zero) session id —
+                // isn't allocated until *after* onIsPlayingChanged(true) has
+                // already fired. In that race the isPlaying-driven attach
+                // below ran with id == 0, no-oped, and isPlaying will not
+                // toggle again for the rest of a continuous TTS turn, so the
+                // Visualizer would never attach and [amplitude] would stay
+                // pinned at 0 for the whole turn. The output waveform gates
+                // its unfold on the first real playback-amplitude frame, so a
+                // never-firing amplitude leaves it stuck in the folded
+                // processing/spinner shape even though audio is audible.
+                // Attaching here — the moment a real session id lands while
+                // playback is already live — makes the first-audible-frame
+                // signal reliable regardless of when the track allocates.
+                attachVisualizerIfPlaying()
+            }
+        })
+        exoPlayer.addListener(object : Player.Listener {
+            override fun onIsPlayingChanged(isPlaying: Boolean) {
+                _isPlaying.value = isPlaying
+                if (!isPlaying) _amplitude.value = 0f
+                // Lazily attach the Visualizer the first time playback
+                // actually begins — the audio session id is stable from
+                // player construction on Media3 1.x but some OEM pipelines
+                // don't allocate the track until playback starts.
+                if (isPlaying) {
+                    // Belt-and-braces with the analytics listener above: this
+                    // runs on the main thread too, so reading the getter here
+                    // is safe and guarantees the cache is warm by the time
+                    // playback is audible (and thus by the time barge-in
+                    // starts its IO reader). If the id isn't ready yet, the
+                    // analytics callback above re-tries the attach the instant
+                    // it lands (see attachVisualizerIfPlaying).
+                    cachedAudioSessionId = exoPlayer.audioSessionId
+                    attachVisualizerIfPlaying()
+                }
+            }
+
+            override fun onMediaItemTransition(
+                mediaItem: MediaItem?,
+                reason: Int,
+            ) {
+                // Refresh on every transition — covers auto-advance drain
+                // at end-of-queue and explicit seekToNext paths.
+                _queueCount.value = exoPlayer.mediaItemCount
+            }
+
+            override fun onPlaybackStateChanged(state: Int) {
+                when (state) {
+                    Player.STATE_ENDED -> {
+                        // Media3 keeps consumed playlist entries around. Clear
+                        // them here so awaitCompletion observes a true drain and
+                        // voice mode can leave Speaking when the last TTS chunk ends.
+                        exoPlayer.clearMediaItems()
+                        _queueCount.value = 0
+                        _isPlaying.value = false
+                        _amplitude.value = 0f
+                    }
+                    Player.STATE_IDLE -> {
+                        if (exoPlayer.mediaItemCount == 0) {
+                            _queueCount.value = 0
+                        }
+                    }
+                }
+            }
+        })
+    }
+
+    /**
+     * Append [audioFile] to the ExoPlayer queue. If the player is idle, also
+     * [ExoPlayer.prepare] and [ExoPlayer.play]. Non-blocking — completion is
+     * delivered via [awaitCompletion], which now observes the entire queue
+     * rather than a single file.
+     */
+    fun play(audioFile: File) {
+        val wasIdle = exoPlayer.mediaItemCount == 0 &&
+            exoPlayer.playbackState != Player.STATE_READY &&
+            exoPlayer.playbackState != Player.STATE_BUFFERING
+        exoPlayer.addMediaItem(MediaItem.fromUri(audioFile.toUri()))
+        _queueCount.value = exoPlayer.mediaItemCount
+        if (wasIdle) {
+            exoPlayer.prepare()
+            exoPlayer.play()
+        } else if (!exoPlayer.isPlaying && exoPlayer.playWhenReady.not()) {
+            // Queue had drained but player wasn't torn down — restart.
+            exoPlayer.play()
+        }
+    }
+
+    /**
+     * Suspend until the ExoPlayer queue is drained AND playback has stopped.
+     *
+     * **Semantic change from the old MediaPlayer implementation.** Previously
+     * this returned when the *current file* completed. Now it returns when
+     * the entire logical queue has been consumed — i.e. `_queueCount == 0 &&
+     * !isPlaying`. This matches the gapless-playback model where adjacent
+     * sentences play back-to-back from the same ExoPlayer, and it's exactly
+     * what the V4 prefetch pipelining rewrite needs (synth worker can enqueue
+     * N+1 while play worker is still awaiting queue-drain on N).
+     *
+     * If a caller appends new items to the queue while this is suspended,
+     * the wait extends through the new items as well.
+     *
+     * Cancellable. If the caller cancels, playback is left running — use
+     * [stop] for a hard teardown.
+     */
+    suspend fun awaitCompletion() {
+        // Fast-path: already idle.
+        if (_queueCount.value == 0 && !_isPlaying.value) return
+        combine(_queueCount, _isPlaying) { count, playing -> count == 0 && !playing }
+            .first { drained -> drained }
+    }
+
+    /**
+     * Hard teardown of the current playback session. Clears the queue,
+     * stops ExoPlayer, releases the Visualizer, and resets amplitude.
+     * The ExoPlayer itself is kept alive for reuse — the next [play] call
+     * will re-prepare it. Safe to call repeatedly.
+     */
+    fun stop() {
+        exoPlayer.clearMediaItems()
+        exoPlayer.stop()
+        _queueCount.value = 0
+        _isPlaying.value = false
+
+        visualizer?.let { v ->
+            try { v.enabled = false } catch (_: Exception) { /* ignore */ }
+            try { v.release() } catch (_: Exception) { /* ignore */ }
+        }
+        visualizer = null
+        visualizerAttached = false
+
+        _amplitude.value = 0f
+    }
+
+    /**
+     * True if the ExoPlayer has any queued media items (playing or paused
+     * mid-queue). Matches the old semantic of "there's audio in flight".
+     */
+    fun isPlaying(): Boolean = _queueCount.value > 0
+
+    /**
+     * Current ExoPlayer audio session id. Returns `0` until the underlying
+     * [android.media.AudioTrack] has been allocated — Media3 defers that
+     * allocation to first playback on most devices. Callers that need a
+     * non-zero session id (barge-in's [android.media.audiofx.AcousticEchoCanceler]
+     * attach path in [com.hermesandroid.relay.audio.BargeInListener]) should
+     * poll this property briefly rather than assume it's hot-ready at
+     * [VoicePlayer] construction time.
+     *
+     * **Thread-safe.** Backed by [cachedAudioSessionId] rather than the raw
+     * `ExoPlayer.getAudioSessionId()` getter, because ExoPlayer is
+     * thread-confined and [BargeInListener] reads this from its
+     * `Dispatchers.IO` reader coroutine. Reading the raw getter off-main
+     * throws `IllegalStateException: Player is accessed on the wrong thread`.
+     * The cache is populated from main-thread Media3 callbacks (the
+     * [AnalyticsListener.onAudioSessionIdChanged] hook and `onIsPlayingChanged`).
+     *
+     * Exposed read-only. B4 reads it via a provider lambda so the listener
+     * can re-check across the 1 s poll window without holding a stale
+     * reference.
+     */
+    val audioSessionId: Int
+        get() = cachedAudioSessionId
+
+    /**
+     * Set the playback volume of the underlying ExoPlayer.
+     *
+     * **Barge-in use case.** The barge-in pipeline (see
+     * `docs/plans/2026-04-17-voice-barge-in.md`, unit B6) runs the mic
+     * through a Silero VAD while TTS plays. On a *single* "maybe speech"
+     * frame — one positive frame that hasn't yet passed the hysteresis
+     * debounce — we soft-duck via [duck] instead of hard-stopping. If the
+     * speech is confirmed (enough consecutive positive frames pass the
+     * debounce), [VoiceViewModel] calls the hard-stop path
+     * (`interruptSpeaking()`); if the frame was a false positive, a
+     * watchdog re-calls [unduck] to restore full volume. The result is a
+     * fast-reacting but false-positive-tolerant interruption feel.
+     *
+     * @param volume linear gain in the range `0f..1f`; values outside this
+     *   range are clamped. Forwarded verbatim to `ExoPlayer.volume`.
+     */
+    fun setVolume(volume: Float) {
+        val clamped = volume.coerceIn(0f, 1f)
+        currentVolume = clamped
+        exoPlayer.volume = clamped
+    }
+
+    /**
+     * Soft-duck TTS to 30% of full volume. See [setVolume] for context —
+     * used by barge-in on a single VAD positive frame, before the
+     * hysteresis debounce confirms an actual interruption.
+     */
+    fun duck() {
+        setVolume(0.3f)
+    }
+
+    /**
+     * Restore TTS to full volume. Pair with [duck]; safe to call even if
+     * not currently ducked.
+     */
+    fun unduck() {
+        setVolume(1.0f)
+    }
+
+    /**
+     * Fully release the underlying ExoPlayer. Call when the owning scope is
+     * being destroyed; the VoicePlayer instance is unusable after this.
+     */
+    fun release() {
+        stop()
+        exoPlayer.release()
+    }
+
+    /**
+     * Attach the [Visualizer] iff playback is live and we haven't attached for
+     * this session yet. Idempotent and main-thread-only: both call sites
+     * ([Player.Listener.onIsPlayingChanged] and the [AnalyticsListener]'s
+     * `onAudioSessionIdChanged`) are delivered on the player's application
+     * thread, so the [visualizerAttached] check needs no extra synchronization.
+     *
+     * The delegate [attachVisualizer] still no-ops (without latching
+     * [visualizerAttached]) when the cached session id is 0, which preserves
+     * the retry: whichever of {isPlaying, valid session id} arrives last drives
+     * the single attach. This is the cold-start race fix — see the
+     * `onAudioSessionIdChanged` comment in `init`.
+     */
+    private fun attachVisualizerIfPlaying() {
+        if (visualizerAttached || !_isPlaying.value) return
+        attachVisualizer(cachedAudioSessionId)
+    }
+
+    private fun attachVisualizer(audioSessionId: Int) {
+        if (audioSessionId == 0) {
+            // ExoPlayer returns 0 before the audio track is allocated; retry
+            // on the next playback-start event.
+            return
+        }
+        try {
+            val viz = Visualizer(audioSessionId)
+            viz.captureSize = VISUALIZER_SIZE_BYTES.coerceIn(
+                Visualizer.getCaptureSizeRange()[0],
+                Visualizer.getCaptureSizeRange()[1],
+            )
+            viz.setDataCaptureListener(
+                object : Visualizer.OnDataCaptureListener {
+                    override fun onWaveFormDataCapture(
+                        visualizer: Visualizer?,
+                        waveform: ByteArray?,
+                        samplingRate: Int,
+                    ) {
+                        if (waveform == null || waveform.isEmpty()) return
+                        _amplitude.value = computeRms(waveform)
+                    }
+
+                    override fun onFftDataCapture(
+                        visualizer: Visualizer?,
+                        fft: ByteArray?,
+                        samplingRate: Int,
+                    ) { /* unused */ }
+                },
+                Visualizer.getMaxCaptureRate() / 2,
+                true, // waveform
+                false, // fft
+            )
+            viz.enabled = true
+            visualizer = viz
+            visualizerAttached = true
+        } catch (e: Exception) {
+            // Some devices refuse Visualizer (MODIFY_AUDIO_SETTINGS denied,
+            // OEM restrictions). Fall back to flat-zero amplitude rather
+            // than killing the voice session. Mark as "attached" so we don't
+            // keep retrying on every isPlaying transition.
+            Log.w(TAG, "Visualizer unavailable — amplitude stuck at 0: ${e.message}")
+            _amplitude.value = 0f
+            visualizer = null
+            visualizerAttached = true
+        }
+    }
+
+    /**
+     * RMS of an 8-bit unsigned PCM waveform, mapped to 0..1. Visualizer
+     * emits signed bytes centered at 128 (0x80), so the first step is to
+     * re-center at 0.
+     *
+     * Guards: empty waveform short-circuits to 0 to avoid `0.0 / 0 = NaN`,
+     * and the final result is NaN-filtered before returning. A single NaN
+     * amplitude frame would otherwise propagate through `animateFloatAsState`
+     * and cause Android 15 to log `setRequestedFrameRate frameRate=NaN` on
+     * every draw pass.
+     */
+    private fun computeRms(waveform: ByteArray): Float {
+        if (waveform.isEmpty()) return 0f
+        var sumSq = 0.0
+        for (b in waveform) {
+            val sample = (b.toInt() and 0xFF) - 128
+            sumSq += (sample * sample).toDouble()
+        }
+        val rms = sqrt(sumSq / waveform.size)
+        // 128 is the theoretical max deviation for re-centered 8-bit PCM.
+        val normalized = (rms / 128.0).toFloat()
+        return if (normalized.isNaN() || normalized.isInfinite()) 0f
+               else normalized.coerceIn(0f, 1f)
+    }
+}
+
+/**
+ * Production ExoPlayer factory — used as the default for [VoicePlayer].
+ * Split out as a top-level function so unit tests can swap it for a
+ * MockK mock without touching Media3's `Builder` class loader.
+ */
+@OptIn(UnstableApi::class)
+private fun defaultExoPlayer(context: Context): ExoPlayer =
+    ExoPlayer.Builder(context)
+        .setHandleAudioBecomingNoisy(true)
+        .build()

app/src/main/kotlin/com/hermesandroid/relay/audio/VoiceRecorder.kt

@@ -0,0 +1,280 @@
+package com.hermesandroid.relay.audio
+
+import android.annotation.SuppressLint
+import android.content.Context
+import android.media.AudioFormat
+import android.media.AudioRecord
+import android.media.MediaRecorder
+import android.util.Log
+import kotlinx.coroutines.flow.MutableStateFlow
+import kotlinx.coroutines.flow.StateFlow
+import kotlinx.coroutines.flow.asStateFlow
+import java.io.ByteArrayOutputStream
+import java.io.File
+import java.io.IOException
+import java.util.concurrent.CountDownLatch
+import java.util.concurrent.TimeUnit
+import java.util.concurrent.atomic.AtomicBoolean
+import kotlin.math.sqrt
+
+/**
+ * Captures the user's voice as 16 kHz mono PCM and writes a `.wav` file for
+ * the relay STT endpoint. The raw PCM is retained for the server-mediated
+ * `/voice/realtime/{session}` path so the main voice UI can send the same utterance
+ * through the realtime websocket without opening a second microphone stream.
+ *
+ * A live [amplitude] flow is exposed for the UI (MorphingSphere + meter). The
+ * value is computed from the same PCM frames that are written to disk, which
+ * keeps legacy STT fallback and realtime voice testing on a single capture
+ * path.
+ */
+class VoiceRecorder(
+    private val context: Context,
+    @Suppress("UNUSED_PARAMETER") private val scope: kotlinx.coroutines.CoroutineScope,
+) {
+
+    companion object {
+        private const val TAG = "VoiceRecorder"
+        private const val SAMPLE_RATE = 16_000
+        private const val BYTES_PER_SAMPLE = 2
+        private const val CHANNEL_COUNT = 1
+        private const val MAX_AMPLITUDE_SHORT = 32_767f
+        private const val MAX_PCM_BYTES = 25 * 1024 * 1024
+
+        // Keep the perceptual curve from the previous MediaRecorder-backed
+        // implementation so the on-screen meter feels the same.
+        private const val NOISE_FLOOR = 0.01f
+        private const val SPEECH_CEILING = 0.35f
+    }
+
+    private val _amplitude = MutableStateFlow(0f)
+    val amplitude: StateFlow<Float> = _amplitude.asStateFlow()
+
+    val sampleRate: Int get() = SAMPLE_RATE
+
+    private val bufferLock = Any()
+    private val stopRequested = AtomicBoolean(false)
+    private var audioRecord: AudioRecord? = null
+    private var currentOutputFile: File? = null
+    private var readThread: Thread? = null
+    private var readDone: CountDownLatch? = null
+    private var pcmBuffer = ByteArrayOutputStream(SAMPLE_RATE * BYTES_PER_SAMPLE * 4)
+    private var lastPcmBytes: ByteArray = ByteArray(0)
+
+    /**
+     * Begin a new recording. Returns the output [File] that will contain WAV
+     * audio once [stopRecording] is called.
+     */
+    @SuppressLint("MissingPermission")
+    fun startRecording(): File {
+        if (audioRecord != null) {
+            Log.w(TAG, "startRecording called while another recording is in flight; stopping it first")
+            try {
+                stopRecording()
+            } catch (_: Exception) {
+                releaseRecorder()
+            }
+        }
+
+        val minBuffer = AudioRecord.getMinBufferSize(
+            SAMPLE_RATE,
+            AudioFormat.CHANNEL_IN_MONO,
+            AudioFormat.ENCODING_PCM_16BIT,
+        ).coerceAtLeast(SAMPLE_RATE / 10 * BYTES_PER_SAMPLE)
+
+        val outFile = File(context.cacheDir, "voice_rec_${System.currentTimeMillis()}.wav")
+        currentOutputFile = outFile
+        synchronized(bufferLock) {
+            pcmBuffer = ByteArrayOutputStream(SAMPLE_RATE * BYTES_PER_SAMPLE * 4)
+            lastPcmBytes = ByteArray(0)
+        }
+        stopRequested.set(false)
+        _amplitude.value = 0f
+
+        val recorder = AudioRecord.Builder()
+            .setAudioSource(MediaRecorder.AudioSource.MIC)
+            .setAudioFormat(
+                AudioFormat.Builder()
+                    .setEncoding(AudioFormat.ENCODING_PCM_16BIT)
+                    .setSampleRate(SAMPLE_RATE)
+                    .setChannelMask(AudioFormat.CHANNEL_IN_MONO)
+                    .build()
+            )
+            .setBufferSizeInBytes(minBuffer * 2)
+            .build()
+
+        if (recorder.state != AudioRecord.STATE_INITIALIZED) {
+            recorder.release()
+            currentOutputFile = null
+            throw IllegalStateException("AudioRecord failed to initialize")
+        }
+
+        try {
+            recorder.startRecording()
+        } catch (e: Exception) {
+            recorder.release()
+            currentOutputFile = null
+            throw e
+        }
+
+        audioRecord = recorder
+        val done = CountDownLatch(1)
+        readDone = done
+        readThread = Thread(
+            {
+                readPcmLoop(recorder, minBuffer)
+                done.countDown()
+            },
+            "HermesVoiceRecorder",
+        ).also { it.start() }
+        return outFile
+    }
+
+    /**
+     * Stop the active recording, write the WAV container, and return it.
+     */
+    fun stopRecording(): File {
+        val file = currentOutputFile
+            ?: throw IllegalStateException("stopRecording called with no active recording")
+
+        val record = audioRecord
+        stopRequested.set(true)
+        if (record != null) {
+            try {
+                record.stop()
+            } catch (e: IllegalStateException) {
+                Log.w(TAG, "AudioRecord.stop threw; recording may be empty: ${e.message}")
+            }
+        }
+        readDone?.await(1, TimeUnit.SECONDS)
+        releaseRecorder()
+
+        val pcm = synchronized(bufferLock) {
+            pcmBuffer.toByteArray().also { lastPcmBytes = it }
+        }
+        writeWav(file, pcm)
+        _amplitude.value = 0f
+        return file
+    }
+
+    fun isRecording(): Boolean = audioRecord != null && !stopRequested.get()
+
+    fun lastPcmBytes(): ByteArray = synchronized(bufferLock) {
+        lastPcmBytes.copyOf()
+    }
+
+    /**
+     * Release any recorder resources without returning a file.
+     */
+    fun cancel() {
+        stopRequested.set(true)
+        audioRecord?.let { record ->
+            try { record.stop() } catch (_: Exception) { }
+        }
+        readDone?.await(500, TimeUnit.MILLISECONDS)
+        releaseRecorder()
+        currentOutputFile?.let { file ->
+            try { file.delete() } catch (_: Exception) { }
+        }
+        currentOutputFile = null
+        synchronized(bufferLock) {
+            pcmBuffer.reset()
+            lastPcmBytes = ByteArray(0)
+        }
+        _amplitude.value = 0f
+    }
+
+    private fun readPcmLoop(record: AudioRecord, minBuffer: Int) {
+        val buffer = ByteArray(minBuffer)
+        while (!stopRequested.get()) {
+            val read = try {
+                record.read(buffer, 0, buffer.size)
+            } catch (e: Exception) {
+                Log.w(TAG, "AudioRecord.read failed: ${e.message}")
+                break
+            }
+            if (read > 0) {
+                synchronized(bufferLock) {
+                    if (pcmBuffer.size() + read <= MAX_PCM_BYTES) {
+                        pcmBuffer.write(buffer, 0, read)
+                    } else {
+                        stopRequested.set(true)
+                    }
+                }
+                updateAmplitude(buffer, read)
+            }
+        }
+    }
+
+    private fun updateAmplitude(buffer: ByteArray, read: Int) {
+        var peak = 0
+        var index = 0
+        val usable = read - (read % BYTES_PER_SAMPLE)
+        while (index < usable) {
+            val low = buffer[index].toInt() and 0xff
+            val high = buffer[index + 1].toInt()
+            val sample = (high shl 8) or low
+            val abs = kotlin.math.abs(sample.coerceIn(Short.MIN_VALUE.toInt(), Short.MAX_VALUE.toInt()))
+            if (abs > peak) peak = abs
+            index += BYTES_PER_SAMPLE
+        }
+        val raw01 = (peak.toFloat() / MAX_AMPLITUDE_SHORT).coerceIn(0f, 1f)
+        val floored = ((raw01 - NOISE_FLOOR) / (SPEECH_CEILING - NOISE_FLOOR))
+            .coerceIn(0f, 1f)
+        _amplitude.value = sqrt(floored)
+    }
+
+    private fun releaseRecorder() {
+        audioRecord?.let { record ->
+            try { record.release() } catch (_: Exception) { }
+        }
+        audioRecord = null
+        readThread = null
+        readDone = null
+    }
+
+    private fun writeWav(file: File, pcm: ByteArray) {
+        try {
+            file.outputStream().use { out ->
+                out.write(wavHeader(pcm.size))
+                out.write(pcm)
+            }
+        } catch (e: IOException) {
+            throw IOException("Failed to write WAV recording: ${e.message}", e)
+        }
+    }
+
+    private fun wavHeader(pcmBytes: Int): ByteArray {
+        val totalDataLen = pcmBytes + 36
+        val byteRate = SAMPLE_RATE * CHANNEL_COUNT * BYTES_PER_SAMPLE
+        return ByteArray(44).also { header ->
+            fun ascii(offset: Int, value: String) {
+                value.encodeToByteArray().copyInto(header, offset)
+            }
+            fun leInt(offset: Int, value: Int) {
+                header[offset] = (value and 0xff).toByte()
+                header[offset + 1] = ((value shr 8) and 0xff).toByte()
+                header[offset + 2] = ((value shr 16) and 0xff).toByte()
+                header[offset + 3] = ((value shr 24) and 0xff).toByte()
+            }
+            fun leShort(offset: Int, value: Int) {
+                header[offset] = (value and 0xff).toByte()
+                header[offset + 1] = ((value shr 8) and 0xff).toByte()
+            }
+
+            ascii(0, "RIFF")
+            leInt(4, totalDataLen)
+            ascii(8, "WAVE")
+            ascii(12, "fmt ")
+            leInt(16, 16)
+            leShort(20, 1)
+            leShort(22, CHANNEL_COUNT)
+            leInt(24, SAMPLE_RATE)
+            leInt(28, byteRate)
+            leShort(32, CHANNEL_COUNT * BYTES_PER_SAMPLE)
+            leShort(34, 16)
+            ascii(36, "data")
+            leInt(40, pcmBytes)
+        }
+    }
+}

app/src/main/kotlin/com/hermesandroid/relay/audio/VoiceSfxPlayer.kt

@@ -0,0 +1,146 @@
+package com.hermesandroid.relay.audio
+
+import android.content.Context
+import android.media.AudioAttributes
+import android.media.AudioFormat
+import android.media.AudioTrack
+import android.util.Log
+import kotlin.math.PI
+import kotlin.math.sin
+
+/**
+ * Tiny synthesized-PCM chime player for voice-mode enter/exit feedback.
+ *
+ * Two buffers are generated once at construction — an ascending sweep
+ * (440 → 660 Hz, a perfect fifth) for enter, and its mirror (660 → 440 Hz)
+ * for exit. Both use the same attack / hold / decay envelope so the pair
+ * sounds symmetrical. Played via [AudioTrack] in [AudioTrack.MODE_STATIC]
+ * so replays are low-latency — the buffer is written once and we just
+ * rewind with [AudioTrack.reloadStaticData] on each trigger.
+ *
+ * Construction and every runtime call is wrapped in try/catch: some OEM
+ * devices refuse AudioTrack under unusual states (busy audio HAL, no route)
+ * and we never want a UI chime to crash voice mode.
+ */
+class VoiceSfxPlayer(@Suppress("UNUSED_PARAMETER") context: Context) {
+
+    private val enterTrack: AudioTrack? = buildChimeTrack(ascending = true)
+    private val exitTrack: AudioTrack? = buildChimeTrack(ascending = false)
+
+    fun playEnter() {
+        playTrack(enterTrack)
+    }
+
+    fun playExit() {
+        playTrack(exitTrack)
+    }
+
+    fun release() {
+        try { enterTrack?.release() } catch (e: Exception) { Log.w(TAG, "enter release failed: ${e.message}") }
+        try { exitTrack?.release() } catch (e: Exception) { Log.w(TAG, "exit release failed: ${e.message}") }
+    }
+
+    // ---------------------------------------------------------------------
+
+    private fun playTrack(track: AudioTrack?) {
+        if (track == null) return
+        try {
+            // Rewind the static buffer before each play so repeat invocations
+            // start from frame 0. stop() is a no-op if it's already stopped.
+            if (track.playState == AudioTrack.PLAYSTATE_PLAYING) {
+                track.pause()
+            }
+            track.stop()
+            track.reloadStaticData()
+            track.play()
+        } catch (e: Exception) {
+            Log.w(TAG, "chime play failed: ${e.message}")
+        }
+    }
+
+    private fun buildChimeTrack(ascending: Boolean): AudioTrack? {
+        return try {
+            val pcm = synthesizeSweep(ascending)
+            val bytes = pcm.size * 2 // 16-bit = 2 bytes/sample
+            val attrs = AudioAttributes.Builder()
+                // Assistant chime — closest semantic match for a voice-mode ping.
+                .setUsage(AudioAttributes.USAGE_ASSISTANT)
+                .setContentType(AudioAttributes.CONTENT_TYPE_SONIFICATION)
+                .build()
+            val format = AudioFormat.Builder()
+                .setSampleRate(SAMPLE_RATE)
+                .setEncoding(AudioFormat.ENCODING_PCM_16BIT)
+                .setChannelMask(AudioFormat.CHANNEL_OUT_MONO)
+                .build()
+            val track = AudioTrack.Builder()
+                .setAudioAttributes(attrs)
+                .setAudioFormat(format)
+                .setBufferSizeInBytes(bytes)
+                .setTransferMode(AudioTrack.MODE_STATIC)
+                .build()
+            val written = track.write(pcm, 0, pcm.size)
+            if (written < 0) {
+                Log.w(TAG, "AudioTrack.write returned $written; skipping chime")
+                track.release()
+                return null
+            }
+            track
+        } catch (e: Exception) {
+            Log.w(TAG, "AudioTrack construction failed: ${e.message}")
+            null
+        }
+    }
+
+    /**
+     * Generate a 200 ms sine sweep with a fast attack / smooth decay envelope.
+     * Peak amplitude capped at 0.35 of full-scale so it reads as a subtle UI
+     * chime rather than a notification.
+     */
+    private fun synthesizeSweep(ascending: Boolean): ShortArray {
+        val totalSamples = (SAMPLE_RATE * DURATION_SEC).toInt()
+        val attackSamples = (SAMPLE_RATE * ATTACK_SEC).toInt()
+        val decaySamples = (SAMPLE_RATE * DECAY_SEC).toInt()
+        val out = ShortArray(totalSamples)
+
+        val startHz = if (ascending) LOW_HZ else HIGH_HZ
+        val endHz = if (ascending) HIGH_HZ else LOW_HZ
+
+        // Accumulate phase from instantaneous frequency so the sweep is
+        // continuous — computing sin(2π·f(t)·t) directly produces chirp
+        // artifacts because f is itself a function of t.
+        var phase = 0.0
+        for (i in 0 until totalSamples) {
+            val t = i.toDouble() / totalSamples
+            val freq = startHz + (endHz - startHz) * t
+            phase += 2.0 * PI * freq / SAMPLE_RATE
+
+            // Envelope: linear ramp up over attack, smooth cosine fade over decay.
+            val env = when {
+                i < attackSamples -> i.toFloat() / attackSamples
+                i >= totalSamples - decaySamples -> {
+                    val d = (totalSamples - i).toFloat() / decaySamples
+                    // Half-cosine ease: 0 → 1 as d goes 0 → 1.
+                    (0.5f * (1f - kotlin.math.cos(PI.toFloat() * d)))
+                }
+                else -> 1f
+            }
+
+            val sample = sin(phase).toFloat() * env * PEAK_AMPLITUDE
+            out[i] = (sample * Short.MAX_VALUE).toInt()
+                .coerceIn(Short.MIN_VALUE.toInt(), Short.MAX_VALUE.toInt())
+                .toShort()
+        }
+        return out
+    }
+
+    companion object {
+        private const val TAG = "VoiceSfxPlayer"
+        private const val SAMPLE_RATE = 44100
+        private const val DURATION_SEC = 0.20f
+        private const val ATTACK_SEC = 0.015f
+        private const val DECAY_SEC = 0.040f
+        private const val LOW_HZ = 440.0
+        private const val HIGH_HZ = 660.0
+        private const val PEAK_AMPLITUDE = 0.35f
+    }
+}

app/src/main/kotlin/com/hermesandroid/relay/auth/CertPinStore.kt

@@ -0,0 +1,150 @@
+package com.hermesandroid.relay.auth
+
+import android.content.Context
+import android.util.Base64
+import android.util.Log
+import com.hermesandroid.relay.data.PairingPreferences
+import kotlinx.coroutines.runBlocking
+import okhttp3.CertificatePinner
+import java.net.URI
+import java.security.MessageDigest
+import java.security.cert.Certificate
+import java.security.cert.X509Certificate
+
+/**
+ * Trust-on-first-use (TOFU) certificate pinning store.
+ *
+ * Records the SHA-256 fingerprint of the peer certificate the first time we
+ * successfully connect over wss to a given host:port. Subsequent connects
+ * build an OkHttp [CertificatePinner] with the stored pin. If the cert
+ * changes, OkHttp will refuse the connection and our reconnect loop will
+ * surface it as a loud error.
+ *
+ * Scope and limitations:
+ *  - Only applies to `wss://` — `ws://` is unencrypted, pinning is moot.
+ *  - Pin format is OkHttp's `sha256/<base64>` — matches what
+ *    [CertificatePinner.pin] expects.
+ *  - Pins are keyed by `host:port` (lowercase). If the user re-pairs via QR
+ *    we wipe the pin for that host via [removePinFor] so the next connect
+ *    re-TOFUs against the new cert.
+ *  - Wildcards and SAN matching are NOT supported — only exact host matches.
+ *    Relay operators running a single host per port is the common case.
+ *
+ * Storage lives in DataStore via [PairingPreferences.setTofuPin].
+ */
+class CertPinStore(private val context: Context) {
+
+    companion object {
+        private const val TAG = "CertPinStore"
+
+        /**
+         * Compute the OkHttp-compatible `sha256/<base64>` pin string for an
+         * [X509Certificate]. Mirrors [CertificatePinner.pin] internally.
+         */
+        fun fingerprint(cert: X509Certificate): String {
+            val spki = cert.publicKey.encoded
+            val digest = MessageDigest.getInstance("SHA-256").digest(spki)
+            val b64 = Base64.encodeToString(digest, Base64.NO_WRAP)
+            return "sha256/$b64"
+        }
+
+        /** Extract `host:port` from a ws/wss URL. Returns null on malformed input. */
+        fun hostPortFromUrl(wsUrl: String): String? {
+            return try {
+                val uri = URI(wsUrl.trim())
+                val host = uri.host ?: return null
+                val port = when {
+                    uri.port > 0 -> uri.port
+                    uri.scheme.equals("wss", ignoreCase = true) -> 443
+                    uri.scheme.equals("https", ignoreCase = true) -> 443
+                    else -> 80
+                }
+                "${host.lowercase()}:$port"
+            } catch (_: Exception) {
+                null
+            }
+        }
+
+        /** True when the URL is secure (wss/https) and pinning is meaningful. */
+        fun isPinnableUrl(url: String): Boolean {
+            val trimmed = url.trim().lowercase()
+            return trimmed.startsWith("wss://") || trimmed.startsWith("https://")
+        }
+    }
+
+    /**
+     * Snapshot of all stored pins. Blocks on the DataStore Flow — caller
+     * should be off the main thread. Used by [buildPinnerSnapshot] which is
+     * called from OkHttp builder setup.
+     */
+    private fun getPinsBlocking(): Map<String, String> =
+        runBlocking { PairingPreferences.getTofuPins(context) }
+
+    /**
+     * Build an OkHttp [CertificatePinner] from the current pin store. Empty
+     * pin store → returns [CertificatePinner.DEFAULT], which allows any cert
+     * (so first-time TOFU still works — we record on first successful connect).
+     */
+    fun buildPinnerSnapshot(): CertificatePinner {
+        val pins = getPinsBlocking()
+        if (pins.isEmpty()) return CertificatePinner.DEFAULT
+        val builder = CertificatePinner.Builder()
+        for ((hostPort, pin) in pins) {
+            val host = hostPort.substringBefore(':')
+            builder.add(host, pin)
+        }
+        return builder.build()
+    }
+
+    /**
+     * Record a pin for a host. Called from the WebSocket listener's `onOpen`
+     * when we have a successful connection and can read the peer certs from
+     * the response handshake. Idempotent — if the pin already matches, we
+     * simply overwrite with the same value.
+     *
+     * If there's already a pin for this host and the new fingerprint differs,
+     * this logs a loud warning but still overwrites. The intended safe path
+     * for cert rotation is a re-pair through the QR flow, which calls
+     * [removePinFor] before the next connect.
+     */
+    suspend fun recordPinIfAbsent(url: String, peerCerts: List<Certificate>) {
+        if (!isPinnableUrl(url)) return
+        val hostPort = hostPortFromUrl(url) ?: return
+        val leaf = peerCerts.firstOrNull() as? X509Certificate ?: return
+
+        val newPin = fingerprint(leaf)
+        val existing = PairingPreferences.getTofuPins(context)[hostPort]
+
+        if (existing == null) {
+            Log.i(TAG, "TOFU: recording new pin for $hostPort -> $newPin")
+            PairingPreferences.setTofuPin(context, hostPort, newPin)
+        } else if (existing != newPin) {
+            // If a mismatched pin survives into this code path, something
+            // bypassed the OkHttp CertificatePinner check. Log it loudly so
+            // it shows up in bug reports. Keep the existing pin — do NOT
+            // silently overwrite.
+            Log.e(
+                TAG,
+                "TOFU: pin MISMATCH for $hostPort (stored=$existing, peer=$newPin). " +
+                    "Keeping stored pin. Re-pair to accept the new certificate."
+            )
+        }
+    }
+
+    /**
+     * Wipe the stored pin for a host. Called when the user explicitly re-pairs
+     * from a QR — the new pairing is an implicit trust-reset.
+     */
+    suspend fun removePinFor(url: String) {
+        val hostPort = hostPortFromUrl(url) ?: return
+        Log.i(TAG, "TOFU: removing pin for $hostPort (re-pair)")
+        PairingPreferences.removeTofuPin(context, hostPort)
+    }
+
+    /**
+     * Snapshot the list of currently pinned hosts. Suspending version for UI
+     * use — backs [PairedDevicesScreen]'s security badge hints.
+     */
+    suspend fun listPinnedHosts(): List<String> =
+        PairingPreferences.getTofuPins(context).keys.toList()
+}

app/src/main/kotlin/com/hermesandroid/relay/auth/PairedSession.kt

@@ -0,0 +1,88 @@
+package com.hermesandroid.relay.auth
+
+import kotlinx.serialization.SerialName
+import kotlinx.serialization.Serializable
+
+/**
+ * Snapshot of the currently-paired session held by [AuthManager].
+ *
+ * Populated from the server's `auth.ok` payload after a successful pair
+ * and persisted alongside the session token. Exposed to the UI via
+ * [AuthManager.currentPairedSession] so screens can display expiry, grants,
+ * and transport posture without reaching into [android.content.SharedPreferences].
+ *
+ * @property token the long-lived relay session token. Same value carried in
+ *           the legacy `AuthState.Paired(token)`.
+ * @property deviceName the human-readable device name the phone sent during
+ *           pairing. Mirrored back here for UI display.
+ * @property expiresAt epoch seconds at which the server says the session
+ *           expires — or `null` when the user chose "never expire" at the
+ *           TTL picker. `null` is a first-class value, not a missing field.
+ * @property grants per-channel expiry map. Known keys include `"chat"`,
+ *           `"terminal"`, `"bridge"`, `"tui"`, `"voice:config"`,
+ *           `"voice:stt"`, and `"voice:tts"`; future server-defined keys are
+ *           tolerated. Values are epoch seconds or `null` for "never".
+ *           Missing channels = server didn't grant that channel to this device.
+ * @property transportHint the transport the server advises the phone to
+ *           use, for UX labeling only. `"wss"` / `"ws"` / `null` when the
+ *           server didn't provide a hint.
+ * @property firstSeen epoch seconds of when this session record was created
+ *           locally (from `System.currentTimeMillis() / 1000`).
+ * @property hasHardwareStorage whether the [SessionTokenStore] that persists
+ *           the token reports StrongBox-backed storage. Drives the 🛡 badge
+ *           in the paired devices screen.
+ */
+data class PairedSession(
+    val token: String,
+    val deviceName: String,
+    val expiresAt: Long?,
+    val grants: Map<String, Long?>,
+    val transportHint: String?,
+    val firstSeen: Long,
+    val hasHardwareStorage: Boolean,
+) {
+    /** True when the session has no expiry — the user picked "Never" at pair time. */
+    val neverExpires: Boolean get() = expiresAt == null
+
+    /**
+     * True when the server-issued `expires_at` is in the past. Computed on
+     * read (not stored) so the UI can render "Expired" bands the moment the
+     * clock rolls over without needing an observer.
+     */
+    fun isExpired(nowSeconds: Long = System.currentTimeMillis() / 1000L): Boolean {
+        val expiry = expiresAt ?: return false
+        return expiry < nowSeconds
+    }
+}
+
+/**
+ * A single paired device as returned by the relay's `GET /sessions` endpoint.
+ *
+ * One phone = one entry. When the phone is looking at its own entry,
+ * [isCurrent] is true. Used by [PairedDevicesScreen] to render revocable
+ * device cards.
+ *
+ * Wire contract: matches the sibling Python agent's response shape. Extra
+ * fields are tolerated via `ignoreUnknownKeys = true` so the server can grow
+ * the shape without breaking existing phones.
+ */
+@Serializable
+data class PairedDeviceInfo(
+    @SerialName("token_prefix")
+    val tokenPrefix: String,
+    @SerialName("device_name")
+    val deviceName: String = "",
+    @SerialName("device_id")
+    val deviceId: String = "",
+    @SerialName("created_at")
+    val createdAt: Double? = null,
+    @SerialName("last_seen")
+    val lastSeen: Double? = null,
+    @SerialName("expires_at")
+    val expiresAt: Double? = null,
+    val grants: Map<String, Double?> = emptyMap(),
+    @SerialName("transport_hint")
+    val transportHint: String? = null,
+    @SerialName("is_current")
+    val isCurrent: Boolean = false,
+)

app/src/main/kotlin/com/hermesandroid/relay/auth/SessionTokenStore.kt

@@ -0,0 +1,437 @@
+package com.hermesandroid.relay.auth
+
+import android.content.Context
+import android.content.SharedPreferences
+import android.os.Build
+import android.util.Log
+import androidx.security.crypto.EncryptedSharedPreferences
+import androidx.security.crypto.MasterKey
+import java.util.concurrent.ConcurrentHashMap
+
+/**
+ * Process-global cache for encrypted stores, keyed by prefs-file name.
+ *
+ * `EncryptedSharedPreferences.create()` unwraps a Tink keyset via a KeyStore op
+ * (~0.6–1 s on StrongBox), and Tink serializes those process-globally — so a
+ * second build of the SAME file is pure waste (the measured cold-start
+ * `Long monitor contention … AndroidKeysetManager.build()` with `waiters=1..4`).
+ *
+ * Caching by file name means each file's keyset builds ONCE process-wide. The
+ * cache is **synchronous** ([ConcurrentHashMap.computeIfAbsent], which holds a
+ * per-key lock so the build runs at most once per file) precisely so the SAME
+ * instance serves both the suspend token path (callers wrap this in
+ * [kotlinx.coroutines.Dispatchers.IO]) AND the synchronous OkHttp cookie-jar
+ * path — which is how the dashboard cookies now ride the connection's
+ * already-built token keyset instead of building a second one.
+ *
+ * The build is ~1 s on StrongBox: call only from IO / OkHttp threads, never the
+ * main thread.
+ */
+internal object SecureStoreCache {
+    private val instances = ConcurrentHashMap<String, SessionTokenStore>()
+
+    fun getOrBuild(prefsName: String, build: () -> SessionTokenStore): SessionTokenStore =
+        instances.computeIfAbsent(prefsName) { build() }
+}
+
+/**
+ * Build the raw encrypted store for [prefsName] — Keystore-backed when possible,
+ * self-healing legacy fallback, in-memory last resort. No migration. Shared by
+ * the token store and the dashboard cookie store so a given file always yields
+ * the SAME backend, via [SecureStoreCache].
+ */
+internal fun buildRawTokenStore(context: Context, prefsName: String): SessionTokenStore =
+    KeystoreTokenStore.tryCreate(context, prefsName)
+        ?: runCatching { LegacyEncryptedPrefsTokenStore(context, prefsName) }
+            .getOrElse { InMemoryTokenStore() }
+
+/**
+ * Abstraction over the storage backend for the relay session token + API key
+ * + device ID.
+ *
+ * Two implementations exist:
+ *
+ *  - [KeystoreTokenStore] — preferred. Uses [MasterKey] with
+ *    `setRequestStrongBoxBacked(true)` on Android P+ devices that report a
+ *    dedicated secure element (`PackageManager.FEATURE_STRONGBOX_KEYSTORE`).
+ *    Falls back to AES256_GCM on TEE when StrongBox isn't available.
+ *
+ *  - [LegacyEncryptedPrefsTokenStore] — fallback. The plain
+ *    `MasterKey.Builder().setKeyScheme(AES256_GCM)` path that the pre-
+ *    overhaul [AuthManager] used. Still strong — AES256_GCM is hardware-
+ *    backed on almost every shipping device — but lacks the StrongBox
+ *    attestation guarantee.
+ *
+ * Why an interface: we want to migrate existing installs off the legacy path
+ * without forcing users to re-pair. [AuthManager] picks the best available
+ * store, one-shot copies the legacy prefs in, and clears them. See
+ * `migrateFromLegacyIfNeeded` in [AuthManager].
+ *
+ * The store reports whether it's actually hardware-backed via
+ * [hasHardwareBackedStorage] so the UI can show a "🛡 hardware-backed" badge
+ * on the paired-device card.
+ */
+interface SessionTokenStore {
+    /**
+     * True when the underlying [MasterKey] is backed by a dedicated secure
+     * element (StrongBox). A `false` here doesn't mean "insecure" — it just
+     * means the key is in TEE or software-emulated, depending on the device.
+     */
+    val hasHardwareBackedStorage: Boolean
+
+    fun getString(key: String): String?
+    fun putString(key: String, value: String)
+    fun remove(key: String)
+    fun contains(key: String): Boolean
+
+    /** Wipe every entry — used by `resetAppData` / "factory reset" in Settings. */
+    fun clearAll()
+}
+
+// ---------------------------------------------------------------------------
+// Keystore-backed implementation
+// ---------------------------------------------------------------------------
+
+/**
+ * [SessionTokenStore] using [EncryptedSharedPreferences] backed by a
+ * [MasterKey] requesting StrongBox when available.
+ *
+ * On Android P+ devices with `FEATURE_STRONGBOX_KEYSTORE`, the master key
+ * lives in the dedicated secure element and all crypto ops happen there.
+ * On older devices or devices without StrongBox, this silently falls back
+ * to TEE-backed AES256_GCM — still hardware-backed on virtually every real
+ * phone.
+ */
+class KeystoreTokenStore private constructor(
+    private val context: Context,
+    private val wantsStrongBox: Boolean,
+    override val hasHardwareBackedStorage: Boolean,
+    private val prefsName: String,
+) : SessionTokenStore {
+
+    // Mutable so [resetPrefs] can swap in a fresh instance after a corrupted
+    // file is deleted. This field initializer runs [buildPrefs] eagerly, so it
+    // CAN throw (e.g. AEADBadTagException on a corrupt keyset) — but the
+    // constructor is private and only reachable via [tryCreate], which wraps
+    // construction in try/catch and degrades to the legacy store. The
+    // directly-constructed legacy path self-heals instead; see
+    // [LegacyEncryptedPrefsTokenStore.buildPrefsResilient].
+    private var prefs: SharedPreferences = buildPrefs()
+
+    private fun buildPrefs(): SharedPreferences {
+        val builder = MasterKey.Builder(context)
+            .setKeyScheme(MasterKey.KeyScheme.AES256_GCM)
+        if (wantsStrongBox) {
+            try {
+                builder.setRequestStrongBoxBacked(true)
+            } catch (e: Exception) {
+                Log.w(TAG, "StrongBox request failed, falling back: ${e.message}")
+            }
+        }
+        val masterKey = builder.build()
+        return EncryptedSharedPreferences.create(
+            context,
+            prefsName,
+            masterKey,
+            EncryptedSharedPreferences.PrefKeyEncryptionScheme.AES256_SIV,
+            EncryptedSharedPreferences.PrefValueEncryptionScheme.AES256_GCM
+        )
+    }
+
+    /**
+     * Nuke a corrupted EncryptedSharedPreferences file and rebuild a fresh
+     * one. Triggered from any read/write that throws — the typical failure
+     * mode is the master key getting rotated out from under us during a
+     * Studio reinstall, after which every decrypt fails with
+     * `AEADBadTagException` (or sometimes a wrapped `GeneralSecurityException`)
+     * forever. The cure is to delete the file so the next pair flow re-stores
+     * everything against a fresh key.
+     *
+     * Best-effort: swallow exceptions from the `clear()` and
+     * `deleteSharedPreferences` calls themselves, since they can also throw
+     * when the underlying state is wedged.
+     */
+    private fun resetPrefs() {
+        try {
+            prefs.edit().clear().apply()
+        } catch (_: Exception) { /* expected on a wedged file */ }
+        try {
+            context.deleteSharedPreferences(prefsName)
+        } catch (e: Exception) {
+            Log.w(TAG, "deleteSharedPreferences($prefsName) failed: ${e.message}")
+        }
+        prefs = buildPrefs()
+    }
+
+    companion object {
+        private const val TAG = "KeystoreTokenStore"
+
+        /**
+         * Default EncryptedSharedPreferences filename. Pre-multi-connection
+         * installs have all their auth state in this single file —
+         * connection 0 re-uses it as-is via
+         * [Connection.LEGACY_TOKEN_STORE_KEY] so no user-visible migration is
+         * needed.
+         */
+        const val DEFAULT_PREFS_NAME = "hermes_companion_auth_hw"
+
+        /**
+         * Try to build a [KeystoreTokenStore] on the current device. Returns
+         * null when any step throws (some older OEM ROMs have broken
+         * AndroidKeystore implementations — we don't want the app to brick
+         * itself trying to create a master key).
+         *
+         * [prefsName] selects the EncryptedSharedPreferences file — defaults
+         * to [DEFAULT_PREFS_NAME] for backwards compat with the
+         * single-connection call sites. Multi-connection callers pass a
+         * per-connection filename built via
+         * [com.hermesandroid.relay.data.Connection.buildTokenStoreKey].
+         *
+         * Also fires a one-shot read probe so a pre-corrupted file from a
+         * previous install gets healed during construction rather than on the
+         * first user-driven read. The probe routes through the instance's
+         * own [getString], so if it throws, [resetPrefs] runs and we end up
+         * with a fresh empty prefs file — not a permanently broken store.
+         */
+        fun tryCreate(
+            context: Context,
+            prefsName: String = DEFAULT_PREFS_NAME,
+        ): KeystoreTokenStore? {
+            return try {
+                val wantsStrongBox = Build.VERSION.SDK_INT >= Build.VERSION_CODES.P &&
+                    context.packageManager.hasSystemFeature(
+                        android.content.pm.PackageManager.FEATURE_STRONGBOX_KEYSTORE
+                    )
+                val store = KeystoreTokenStore(
+                    context = context.applicationContext,
+                    wantsStrongBox = wantsStrongBox,
+                    hasHardwareBackedStorage = wantsStrongBox,
+                    prefsName = prefsName,
+                )
+                // Force a read so a wedged file from a prior install heals
+                // here rather than at the first user-visible call.
+                store.contains("__init_probe__")
+                store
+            } catch (e: Exception) {
+                // Broken Keystore, expired key, etc. — fall back to legacy.
+                Log.w(TAG, "KeystoreTokenStore init failed: ${e.message}")
+                null
+            }
+        }
+    }
+
+    override fun getString(key: String): String? {
+        return try {
+            prefs.getString(key, null)
+        } catch (e: Exception) {
+            Log.w(TAG, "getString($key) failed — wiping corrupted prefs: ${e.message}")
+            resetPrefs()
+            null
+        }
+    }
+
+    override fun putString(key: String, value: String) {
+        try {
+            prefs.edit().putString(key, value).apply()
+        } catch (e: Exception) {
+            Log.w(TAG, "putString($key) failed — rebuilding prefs and retrying: ${e.message}")
+            resetPrefs()
+            try {
+                prefs.edit().putString(key, value).apply()
+            } catch (e2: Exception) {
+                Log.w(TAG, "putString($key) retry after reset failed: ${e2.message}")
+            }
+        }
+    }
+
+    override fun remove(key: String) {
+        try {
+            prefs.edit().remove(key).apply()
+        } catch (e: Exception) {
+            Log.w(TAG, "remove($key) failed: ${e.message}")
+            resetPrefs()
+        }
+    }
+
+    override fun contains(key: String): Boolean {
+        return try {
+            prefs.contains(key)
+        } catch (e: Exception) {
+            Log.w(TAG, "contains($key) failed — wiping corrupted prefs: ${e.message}")
+            resetPrefs()
+            false
+        }
+    }
+
+    override fun clearAll() {
+        try {
+            prefs.edit().clear().apply()
+        } catch (e: Exception) {
+            Log.w(TAG, "clearAll failed — falling back to file delete: ${e.message}")
+            resetPrefs()
+        }
+    }
+}
+
+// ---------------------------------------------------------------------------
+// Legacy fallback implementation
+// ---------------------------------------------------------------------------
+
+/**
+ * The original [EncryptedSharedPreferences] path — uses the same file name
+ * as pre-overhaul [AuthManager]. Instances of this class serve a dual role:
+ * (a) fallback for devices where [KeystoreTokenStore.tryCreate] fails, and
+ * (b) migration source for reading existing session tokens out of the legacy
+ * prefs on first launch after the update.
+ */
+class LegacyEncryptedPrefsTokenStore(
+    context: Context,
+    private val prefsName: String = LEGACY_PREFS_NAME,
+) : SessionTokenStore {
+
+    companion object {
+        const val LEGACY_PREFS_NAME = "hermes_companion_auth"
+        private const val TAG = "LegacyEncryptedPrefs"
+    }
+
+    private val appContext: Context = context.applicationContext
+
+    // Mutable so [resetPrefs] can swap in a fresh instance after a corrupted
+    // file is deleted. See [KeystoreTokenStore.resetPrefs] for the rationale.
+    //
+    // Built via [buildPrefsResilient] so a corrupt keyset can't crash the
+    // constructor. Unlike [KeystoreTokenStore], this class is `new`-ed
+    // directly (it's the fallback when KeystoreTokenStore.tryCreate returns
+    // null, and the migration source), so there's no tryCreate-style guard
+    // upstream — the healing has to live here.
+    private var prefs: SharedPreferences = buildPrefsResilient()
+
+    /**
+     * Build the encrypted prefs, healing a corrupted keyset on the way.
+     *
+     * [EncryptedSharedPreferences.create] decrypts the Tink keyset eagerly, so
+     * a stale/corrupt legacy file throws [javax.crypto.AEADBadTagException]
+     * (AES-GCM tag mismatch) right here in the constructor. This is the classic
+     * post-upgrade / post-restore failure: the encrypted blob persists but the
+     * hardware master key it was sealed against is gone or rotated. Delete the
+     * file and rebuild a fresh keyset against the current master key rather
+     * than letting the exception escape and force-close the app — the token in
+     * the unreadable file was lost anyway, so the user simply re-pairs.
+     */
+    private fun buildPrefsResilient(): SharedPreferences =
+        try {
+            buildPrefs()
+        } catch (e: Exception) {
+            Log.w(TAG, "Initial legacy prefs build failed — wiping corrupted file and rebuilding: ${e.message}")
+            try {
+                appContext.deleteSharedPreferences(prefsName)
+            } catch (e2: Exception) {
+                Log.w(TAG, "deleteSharedPreferences($prefsName) failed: ${e2.message}")
+            }
+            buildPrefs()
+        }
+
+    private fun buildPrefs(): SharedPreferences {
+        val masterKey = MasterKey.Builder(appContext)
+            .setKeyScheme(MasterKey.KeyScheme.AES256_GCM)
+            .build()
+        return EncryptedSharedPreferences.create(
+            appContext,
+            prefsName,
+            masterKey,
+            EncryptedSharedPreferences.PrefKeyEncryptionScheme.AES256_SIV,
+            EncryptedSharedPreferences.PrefValueEncryptionScheme.AES256_GCM
+        )
+    }
+
+    private fun resetPrefs() {
+        try {
+            prefs.edit().clear().apply()
+        } catch (_: Exception) { /* expected on a wedged file */ }
+        try {
+            appContext.deleteSharedPreferences(prefsName)
+        } catch (e: Exception) {
+            Log.w(TAG, "deleteSharedPreferences($prefsName) failed: ${e.message}")
+        }
+        prefs = buildPrefs()
+    }
+
+    // AES256_GCM via MasterKey is hardware-backed (TEE) on essentially every
+    // shipping Android device — but we don't have the StrongBox attestation
+    // guarantee, so we report false here. The UI uses this to decide whether
+    // to render the shield badge.
+    override val hasHardwareBackedStorage: Boolean = false
+
+    override fun getString(key: String): String? {
+        return try {
+            prefs.getString(key, null)
+        } catch (e: Exception) {
+            Log.w(TAG, "getString($key) failed — wiping legacy prefs: ${e.message}")
+            resetPrefs()
+            null
+        }
+    }
+
+    override fun putString(key: String, value: String) {
+        try {
+            prefs.edit().putString(key, value).apply()
+        } catch (e: Exception) {
+            Log.w(TAG, "putString($key) failed — rebuilding legacy prefs and retrying: ${e.message}")
+            resetPrefs()
+            try {
+                prefs.edit().putString(key, value).apply()
+            } catch (e2: Exception) {
+                Log.w(TAG, "putString($key) retry after reset failed: ${e2.message}")
+            }
+        }
+    }
+
+    override fun remove(key: String) {
+        try {
+            prefs.edit().remove(key).apply()
+        } catch (e: Exception) {
+            Log.w(TAG, "remove($key) failed: ${e.message}")
+            resetPrefs()
+        }
+    }
+
+    override fun contains(key: String): Boolean {
+        return try {
+            prefs.contains(key)
+        } catch (e: Exception) {
+            Log.w(TAG, "contains($key) failed — wiping legacy prefs: ${e.message}")
+            resetPrefs()
+            false
+        }
+    }
+
+    override fun clearAll() {
+        try {
+            prefs.edit().clear().apply()
+        } catch (e: Exception) {
+            Log.w(TAG, "clearAll failed — falling back to file delete: ${e.message}")
+            resetPrefs()
+        }
+    }
+}
+
+// ---------------------------------------------------------------------------
+// In-memory last-resort implementation
+// ---------------------------------------------------------------------------
+
+/**
+ * Non-persistent [SessionTokenStore]. Used only when BOTH the Keystore and the
+ * (self-healing) legacy encrypted store fail to construct — i.e. the device's
+ * AndroidKeystore is so broken it can't even build a fresh key. Tokens live for
+ * the process lifetime only, so the user re-pairs on the next cold start, but
+ * the app stays up instead of force-closing. See [AuthManager.store].
+ */
+class InMemoryTokenStore : SessionTokenStore {
+    private val map = java.util.concurrent.ConcurrentHashMap<String, String>()
+    override val hasHardwareBackedStorage: Boolean = false
+    override fun getString(key: String): String? = map[key]
+    override fun putString(key: String, value: String) { map[key] = value }
+    override fun remove(key: String) { map.remove(key) }
+    override fun contains(key: String): Boolean = map.containsKey(key)
+    override fun clearAll() { map.clear() }
+}

app/src/main/kotlin/com/hermesandroid/relay/bridge/AutoDisableWorker.kt

@@ -0,0 +1,131 @@
+package com.hermesandroid.relay.bridge
+
+import android.Manifest
+import android.annotation.SuppressLint
+import android.app.NotificationChannel
+import android.app.NotificationManager
+import android.app.PendingIntent
+import android.content.Context
+import android.content.Intent
+import android.content.pm.PackageManager
+import android.os.Build
+import android.util.Log
+import androidx.core.app.NotificationCompat
+import androidx.core.app.NotificationManagerCompat
+import androidx.core.content.ContextCompat
+import com.hermesandroid.relay.MainActivity
+import com.hermesandroid.relay.R
+import com.hermesandroid.relay.accessibility.HermesAccessibilityService
+
+/**
+ * Phase 3 — safety-rails `bridge-safety-rails`
+ *
+ * Canonical "turn the bridge off after idle" unit of work. Not a real
+ * `androidx.work.CoroutineWorker` — the project intentionally does not
+ * depend on androidx.work — but its shape mirrors one exactly: a single
+ * suspend [run] method that performs the work and returns.
+ *
+ * Why this pattern instead of dropping a WorkManager dep:
+ *  - Auto-disable is a pure in-memory decision: the toggle lives in our
+ *    own DataStore, no inter-process scheduling is required.
+ *  - Android's AlarmManager / WorkManager are needed when the work must
+ *    survive process death. For bridge, process death already implies
+ *    the service is disconnected and the master toggle re-evaluates
+ *    fresh on the next launch. So a coroutine-owned `delay` does it.
+ *  - Every command reschedules the timer, so the idle window is always
+ *    reset against wall clock. No drift concerns.
+ *
+ * When WorkManager is added later (say, if notif-listener needs background-posted
+ * notifications on a schedule), this file is a natural upgrade point:
+ * change the class to `CoroutineWorker(appContext, params)` and have
+ * [BridgeSafetyManager.rescheduleAutoDisable] enqueue a [OneTimeWorkRequest]
+ * instead of launching a local coroutine.
+ */
+class AutoDisableWorker(private val context: Context) {
+
+    companion object {
+        private const val TAG = "AutoDisableWorker"
+        private const val CHANNEL_ID = "bridge_auto_disable"
+        private const val CHANNEL_NAME = "Bridge auto-disable"
+        private const val NOTIFICATION_ID = 3821
+    }
+
+    /**
+     * Execute the auto-disable: flip the master toggle off and post a
+     * one-shot "bridge paused" notification. Idempotent — safe to call
+     * twice (the second call just re-writes the same DataStore value
+     * and overrides the existing notification).
+     */
+    suspend fun run() {
+        try {
+            HermesAccessibilityService.setMasterEnabled(context, false)
+        } catch (t: Throwable) {
+            Log.w(TAG, "run: failed to flip master toggle", t)
+        }
+        postNotification()
+    }
+
+    // Lint can't trace through [hasPostNotificationsPermission] to see that
+    // we early-return when the runtime grant isn't held, and the notify()
+    // call is also wrapped in runCatching to swallow SecurityException as
+    // a belt-and-braces. Suppress here rather than inlining the check —
+    // the helper exists so the same gate can grow more conditions later
+    // without each call site re-implementing it. Both IDs are needed:
+    // `NotificationPermission` is the notify()-specific check (POST_NOTIFICATIONS
+    // on API 33+); `MissingPermission` is the generic fallback.
+    @SuppressLint("MissingPermission", "NotificationPermission")
+    private fun postNotification() {
+        ensureChannel()
+        if (!hasPostNotificationsPermission()) {
+            Log.i(TAG, "POST_NOTIFICATIONS not granted — skipping auto-disable notification")
+            return
+        }
+
+        val tapIntent = Intent(context, MainActivity::class.java).apply {
+            flags = Intent.FLAG_ACTIVITY_NEW_TASK or Intent.FLAG_ACTIVITY_CLEAR_TOP
+        }
+        val pendingFlags = PendingIntent.FLAG_UPDATE_CURRENT or PendingIntent.FLAG_IMMUTABLE
+        val tapPending = PendingIntent.getActivity(context, 0, tapIntent, pendingFlags)
+
+        val builder = NotificationCompat.Builder(context, CHANNEL_ID)
+            .setSmallIcon(R.mipmap.ic_launcher)
+            .setContentTitle("Bridge auto-disabled")
+            .setContentText("Paused after idle — tap to re-enable in the Bridge tab.")
+            .setStyle(NotificationCompat.BigTextStyle().bigText(
+                "Hermes bridge was idle for too long, so device control has been turned off " +
+                    "automatically. Open the Bridge tab to turn it back on if you still need it."
+            ))
+            .setContentIntent(tapPending)
+            .setAutoCancel(true)
+            .setOnlyAlertOnce(true)
+            .setPriority(NotificationCompat.PRIORITY_DEFAULT)
+
+        runCatching {
+            NotificationManagerCompat.from(context).notify(NOTIFICATION_ID, builder.build())
+        }.onFailure { Log.w(TAG, "postNotification: notify failed", it) }
+    }
+
+    private fun ensureChannel() {
+        if (Build.VERSION.SDK_INT < Build.VERSION_CODES.O) return
+        val nm = context.getSystemService(NotificationManager::class.java) ?: return
+        val existing = nm.getNotificationChannel(CHANNEL_ID)
+        if (existing != null) return
+        val channel = NotificationChannel(
+            CHANNEL_ID,
+            CHANNEL_NAME,
+            NotificationManager.IMPORTANCE_DEFAULT,
+        ).apply {
+            description = "Fires once when the bridge auto-disables after being idle."
+            setShowBadge(false)
+        }
+        nm.createNotificationChannel(channel)
+    }
+
+    private fun hasPostNotificationsPermission(): Boolean {
+        if (Build.VERSION.SDK_INT < Build.VERSION_CODES.TIRAMISU) return true
+        return ContextCompat.checkSelfPermission(
+            context,
+            Manifest.permission.POST_NOTIFICATIONS
+        ) == PackageManager.PERMISSION_GRANTED
+    }
+}

app/src/main/kotlin/com/hermesandroid/relay/bridge/BridgeForegroundService.kt

@@ -0,0 +1,407 @@
+package com.hermesandroid.relay.bridge
+
+import android.annotation.SuppressLint
+import android.app.NotificationChannel
+import android.app.NotificationManager
+import android.app.PendingIntent
+import android.app.Service
+import android.content.Context
+import android.content.Intent
+import android.content.pm.ServiceInfo
+import android.os.Build
+import android.os.IBinder
+import android.util.Log
+import androidx.core.app.NotificationCompat
+import com.hermesandroid.relay.MainActivity
+import com.hermesandroid.relay.R
+import com.hermesandroid.relay.accessibility.HermesAccessibilityService
+import com.hermesandroid.relay.accessibility.MediaProjectionHolder
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.SupervisorJob
+import kotlinx.coroutines.cancel
+import kotlinx.coroutines.launch
+
+/**
+ * Phase 3 — safety-rails `bridge-safety-rails`
+ *
+ * Persistent foreground service that signals "Hermes agent has device
+ * control" to the user whenever the bridge master toggle is on. The
+ * notification is:
+ *
+ *  - Ongoing (can't be swiped away)
+ *  - Two actions: "Disable" (broadcast into the master toggle) and
+ *    "Settings" (deep-link into BridgeSafetySettingsScreen)
+ *  - Channel `bridge_foreground` at DEFAULT importance (we do NOT want
+ *    heads-up because that would pop over every screen the agent taps)
+ *
+ * # Foreground service type
+ *
+ * On Android 10+ foreground services must declare a `foregroundServiceType`.
+ * For Tier 5 we use `specialUse` with the justification string
+ * "Persistent indicator that the Hermes agent has device control, per
+ * Tier 5 safety rails." Play Store review allowance is declared in the
+ * manifest `<property name="...SPECIAL_USE"/>`.
+ *
+ * We deliberately do NOT use `FOREGROUND_SERVICE_MEDIA_PROJECTION` here
+ * even though accessibility's `ScreenCapture.kt` uses MediaProjection — that
+ * permission is already declared, and binding the foreground service to
+ * mediaProjection would couple its lifecycle to the current screen-grant,
+ * which doesn't match our "always on while bridge is active" semantics.
+ *
+ * # Lifecycle wiring
+ *
+ * [BridgeViewModel] observes the master-toggle StateFlow and calls
+ * [start] / [stop] on transitions. The service itself does not observe
+ * the toggle — it's a passive "I'm on" indicator, and bundling the flow
+ * subscription into the service would mean the service owns its own
+ * coroutine scope + we'd need to worry about bind/unbind timing. Simpler
+ * to have the ViewModel drive it.
+ */
+class BridgeForegroundService : Service() {
+
+    companion object {
+        private const val TAG = "BridgeForegroundSvc"
+
+        const val CHANNEL_ID = "bridge_foreground"
+        private const val CHANNEL_NAME = "Bridge active"
+        const val NOTIFICATION_ID = 4712
+
+        const val ACTION_START = "com.hermesandroid.relay.bridge.START"
+        const val ACTION_STOP = "com.hermesandroid.relay.bridge.STOP"
+        const val ACTION_DISABLE = "com.hermesandroid.relay.bridge.DISABLE"
+        const val ACTION_OPEN_SETTINGS = "com.hermesandroid.relay.bridge.OPEN_SETTINGS"
+
+        // === PHASE3-bridge-ui-followup: MediaProjection upgrade action ===
+        // Fired by MainActivity.mediaProjectionLauncher after the user has
+        // granted the system consent dialog. Carries the resultCode + data
+        // Intent the launcher received. The service handles this by:
+        //   1. Calling startForeground AGAIN with the dual SPECIAL_USE |
+        //      MEDIA_PROJECTION type bitmask (legal NOW because consent
+        //      has been granted).
+        //   2. Calling MediaProjectionHolder.acceptGrantInsideForegroundService
+        //      to construct and store the projection.
+        // Splitting the FGS type slot out of the initial start-up is
+        // critical: Android 14+ silently auto-revokes any projection created
+        // by a service that called startForeground(type=mediaProjection)
+        // BEFORE the consent dialog was granted. The previous code had
+        // mediaProjection in the initial type bitmask the moment the master
+        // toggle flipped on, which is exactly that violation. Symptom:
+        // "I tap Allow but the row never turns green" — Bailey, 2026-04-13.
+        const val ACTION_GRANT_PROJECTION = "com.hermesandroid.relay.bridge.GRANT_PROJECTION"
+        const val EXTRA_RESULT_CODE = "com.hermesandroid.relay.bridge.RESULT_CODE"
+        const val EXTRA_RESULT_DATA = "com.hermesandroid.relay.bridge.RESULT_DATA"
+        // === END PHASE3-bridge-ui-followup ===
+
+        fun start(context: Context) {
+            val intent = Intent(context.applicationContext, BridgeForegroundService::class.java)
+                .setAction(ACTION_START)
+            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.O) {
+                context.applicationContext.startForegroundService(intent)
+            } else {
+                context.applicationContext.startService(intent)
+            }
+        }
+
+        fun stop(context: Context) {
+            // Use stopService() rather than startService(ACTION_STOP) — on
+            // Android 15+ (target SDK 35), the system routes ANY intent to
+            // a service with foregroundServiceType through the foreground
+            // watchdog and demands a startForeground call within 5s, even
+            // if the intent is an internal "please shut down" message. By
+            // going through stopService() we bypass onStartCommand entirely
+            // and call onDestroy directly — clean shutdown, no watchdog.
+            val intent = Intent(context.applicationContext, BridgeForegroundService::class.java)
+            context.applicationContext.stopService(intent)
+        }
+
+        /**
+         * Fire-and-forget: hand the consent result off to the foreground
+         * service so it can upgrade its FGS type to include MEDIA_PROJECTION
+         * and construct the projection. Called from
+         * `MainActivity.mediaProjectionLauncher` immediately after the user
+         * grants the system consent dialog.
+         *
+         * The service must already be running (master toggle on) — that is
+         * guaranteed by `BridgeViewModel.requestScreenCapture()` which gates
+         * the consent flow on the master toggle being on.
+         */
+        fun grantMediaProjection(context: Context, resultCode: Int, data: Intent) {
+            val intent = Intent(context.applicationContext, BridgeForegroundService::class.java)
+                .setAction(ACTION_GRANT_PROJECTION)
+                .putExtra(EXTRA_RESULT_CODE, resultCode)
+                .putExtra(EXTRA_RESULT_DATA, data)
+            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.O) {
+                context.applicationContext.startForegroundService(intent)
+            } else {
+                context.applicationContext.startService(intent)
+            }
+        }
+    }
+
+    // True after we've successfully called startForeground with the
+    // mediaProjection type slot (i.e. after consent + grant). Drives the
+    // type bitmask passed to subsequent startForeground calls so we don't
+    // accidentally drop the slot on a re-start.
+    private var hasMediaProjectionType: Boolean = false
+
+    private val scope = CoroutineScope(SupervisorJob() + Dispatchers.IO)
+
+    override fun onBind(intent: Intent?): IBinder? = null
+
+    override fun onStartCommand(intent: Intent?, flags: Int, startId: Int): Int {
+        Log.i(TAG, "onStartCommand action=${intent?.action} flags=$flags startId=$startId")
+        // === PHASE3-bridge-ui-followup: always startForeground first ===
+        // CRITICAL: on Android 15+ (target SDK 35), ANY intent delivered to
+        // a service that declares foregroundServiceType in the manifest —
+        // including intents dispatched via Context.startService() — gets
+        // tracked by the system's foreground-service watchdog. The service
+        // has 5 seconds to call startForeground() or the system throws
+        // ForegroundServiceDidNotStartInTimeException and crashes the app.
+        //
+        // Symptom we hit on 2026-04-13: opening the Bridge tab → BridgeViewModel
+        // collector fires masterToggle (initial value false) → calls
+        // BridgeForegroundService.stop(ctx) → startService(ACTION_STOP) →
+        // service onStartCommand handles ACTION_STOP, calls stopForeground
+        // and stopSelf without ever calling startForeground → 5s later the
+        // system kills the process.
+        //
+        // The fix: ALWAYS call startForeground at the top of onStartCommand,
+        // before any action branching. The brief notification flash for
+        // stop-only paths is acceptable; the alternative (using a bound
+        // service or broadcast receiver for control commands) is a much
+        // bigger refactor for the same outcome.
+        startForegroundNotification()
+        // === END PHASE3-bridge-ui-followup ===
+
+        when (intent?.action) {
+            ACTION_STOP -> {
+                Log.i(TAG, "ACTION_STOP → stopping foreground service")
+                hasMediaProjectionType = false
+                stopForeground(STOP_FOREGROUND_REMOVE)
+                stopSelf()
+                return START_NOT_STICKY
+            }
+            ACTION_DISABLE -> {
+                Log.i(TAG, "ACTION_DISABLE → flipping master toggle off")
+                scope.launch {
+                    runCatching {
+                        HermesAccessibilityService.setMasterEnabled(applicationContext, false)
+                    }.onFailure { Log.w(TAG, "master toggle write failed", it) }
+                }
+                // Keep the service alive until BridgeViewModel sees the
+                // toggle flip and calls stop(); that's the canonical path.
+                return START_STICKY
+            }
+            ACTION_OPEN_SETTINGS -> {
+                Log.i(TAG, "ACTION_OPEN_SETTINGS → launching MainActivity with deep-link to bridge safety")
+                // PHASE3-safety-rails-followup: deep-link to BridgeSafetySettingsScreen.
+                // MainActivity reads EXTRA_NAV_ROUTE in onCreate / onNewIntent
+                // and emits it on the NavRouteRequest SharedFlow, which RelayApp
+                // collects and forwards to the NavController. The route string
+                // is hardcoded here on purpose to avoid pulling the entire
+                // ui.RelayApp graph into the bridge service classpath — if you
+                // change Screen.BridgeSafetySettings.route in RelayApp.kt,
+                // change it here too.
+                val launch = Intent(this, MainActivity::class.java).apply {
+                    addFlags(Intent.FLAG_ACTIVITY_NEW_TASK or Intent.FLAG_ACTIVITY_CLEAR_TOP)
+                    putExtra(MainActivity.EXTRA_NAV_ROUTE, "settings/bridge_safety")
+                }
+                runCatching { startActivity(launch) }
+                return START_STICKY
+            }
+            ACTION_GRANT_PROJECTION -> {
+                // === PHASE3-bridge-ui-followup: post-consent FGS type upgrade ===
+                // The launcher result has just landed in MainActivity. The
+                // top-of-onStartCommand call already brought us into the
+                // foreground (with SPECIAL_USE only). Now flip the type
+                // flag and call startForeground AGAIN to upgrade to
+                // SPECIAL_USE | MEDIA_PROJECTION — legal NOW because the
+                // consent has been granted — then construct the projection
+                // from inside the foreground state. Two startForeground
+                // calls on the same service is well-supported; the second
+                // just changes the type bitmask.
+                Log.i(TAG, "ACTION_GRANT_PROJECTION → upgrading FGS type and accepting grant")
+                hasMediaProjectionType = true
+                startForegroundNotification()
+                val resultCode = intent.getIntExtra(EXTRA_RESULT_CODE, 0)
+                val data: Intent? = if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.TIRAMISU) {
+                    intent.getParcelableExtra(EXTRA_RESULT_DATA, Intent::class.java)
+                } else {
+                    @Suppress("DEPRECATION")
+                    intent.getParcelableExtra(EXTRA_RESULT_DATA)
+                }
+                val accepted = MediaProjectionHolder.acceptGrantInsideForegroundService(
+                    this, resultCode, data
+                )
+                if (!accepted) {
+                    // Rolling back the type slot keeps us honest: if the
+                    // user actually denied (or the API failed), we shouldn't
+                    // claim a grant we don't have. Re-run startForeground
+                    // with SPECIAL_USE only so the FGS type matches reality.
+                    Log.w(TAG, "grant not accepted — reverting FGS to SPECIAL_USE only")
+                    hasMediaProjectionType = false
+                    startForegroundNotification()
+                }
+                return START_STICKY
+                // === END PHASE3-bridge-ui-followup ===
+            }
+        }
+
+        // Fall-through for ACTION_START / null intent — startForegroundNotification
+        // was already called at the top of this method.
+        return START_STICKY
+    }
+
+    /**
+     * Foreground services legitimately survive task removal — the service
+     * instance stays alive even after the user swipes the app from recents,
+     * which is the behavior we want for the bridge itself (agent-driven
+     * phone control via WSS should keep working when the user "closes" the
+     * app). BUT the MediaProjection that powers screen capture should NOT
+     * outlive task removal: the system-level screen-cast indicator icon in
+     * Android's status bar stays visible for the duration of the projection,
+     * and a user who swiped the app away would understandably read that
+     * icon as "the app I just closed is still recording my screen." That's
+     * the exact class of trust failure we can't afford for an
+     * accessibility-controlling app.
+     *
+     * Fix: on task removal, revoke only the projection (the bridge stays
+     * alive) and downgrade the FGS type back to SPECIAL_USE-only so
+     * startForeground reflects reality and the MEDIA_PROJECTION system
+     * indicator disappears. Next time the user reopens the app and
+     * re-enables screenshots, a fresh consent dialog appears — which is
+     * the correct UX for a privacy-sensitive capability.
+     *
+     * Caught 2026-04-15 by Bailey: the screen-cast icon persisted in the
+     * status bar even after force-stopping the app from recents.
+     */
+    override fun onTaskRemoved(rootIntent: Intent?) {
+        super.onTaskRemoved(rootIntent)
+        Log.i(
+            TAG,
+            "onTaskRemoved: user swiped app — revoking MediaProjection, " +
+                "keeping bridge alive for agent control",
+        )
+        runCatching { MediaProjectionHolder.revoke() }
+        if (hasMediaProjectionType) {
+            hasMediaProjectionType = false
+            runCatching { startForegroundNotification() }
+        }
+    }
+
+    override fun onDestroy() {
+        // Reset state so a fresh service instance starts in the
+        // SPECIAL_USE-only configuration. Also drop any held MediaProjection
+        // — a projection without an active bridge is meaningless and the
+        // next bridge enable should always prompt for fresh consent.
+        hasMediaProjectionType = false
+        runCatching { MediaProjectionHolder.revoke() }
+        scope.cancel()
+        super.onDestroy()
+    }
+
+    // ForegroundServiceType: lint requires the manifest `<service>` to declare
+    // `foregroundServiceType` for targetSdk >= 34. The SIDELOAD manifest does
+    // (specialUse|mediaProjection) + declares the matching FOREGROUND_SERVICE_*
+    // permissions. The GOOGLEPLAY flavor deliberately omits this service AND
+    // those permissions (no device-control capability for Play-Store
+    // compliance), so this code is unreachable there — the service can't be
+    // started without a manifest declaration. Lint analyzes the merged
+    // googlePlay manifest and can't see the sideload guarantee, so suppress
+    // here rather than weaken googlePlay by granting it specialUse.
+    @SuppressLint("ForegroundServiceType")
+    private fun startForegroundNotification() {
+        ensureChannel()
+        val notification = buildNotification()
+        try {
+            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.UPSIDE_DOWN_CAKE) {
+                // === PHASE3-bridge-ui-followup: gated MediaProjection type slot ===
+                // CRITICAL: on Android 14+, startForeground(type=mediaProjection)
+                // is only legal AFTER the user has granted the system consent
+                // dialog. Calling it before — even if you intend to "wait
+                // until consent arrives" — makes the eventual projection
+                // get auto-revoked by the system within a frame, with no
+                // app-visible error.
+                //
+                // So we start with SPECIAL_USE only when the bridge first
+                // comes up (master toggle on, no projection yet), and the
+                // ACTION_GRANT_PROJECTION handler upgrades us to
+                // SPECIAL_USE | MEDIA_PROJECTION right after consent and
+                // before getMediaProjection. That's why this method reads
+                // [hasMediaProjectionType] instead of always OR-ing both.
+                //
+                // Both subtypes share this single notification + this single
+                // service. Manifest lists both in `foregroundServiceType`.
+                val typeMask = if (hasMediaProjectionType) {
+                    ServiceInfo.FOREGROUND_SERVICE_TYPE_SPECIAL_USE or
+                        ServiceInfo.FOREGROUND_SERVICE_TYPE_MEDIA_PROJECTION
+                } else {
+                    ServiceInfo.FOREGROUND_SERVICE_TYPE_SPECIAL_USE
+                }
+                startForeground(NOTIFICATION_ID, notification, typeMask)
+                // === END PHASE3-bridge-ui-followup ===
+            } else if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.Q) {
+                // Q..U: the type arg is required on Q+ too, but
+                // FOREGROUND_SERVICE_TYPE_SPECIAL_USE is Android 14+.
+                // Fall through to the plain startForeground on Q..T —
+                // AGP will attach the manifest-declared type automatically.
+                startForeground(NOTIFICATION_ID, notification)
+            } else {
+                startForeground(NOTIFICATION_ID, notification)
+            }
+        } catch (t: Throwable) {
+            Log.w(TAG, "startForeground failed — bridge indicator will not be visible", t)
+            stopSelf()
+        }
+    }
+
+    private fun buildNotification(): android.app.Notification {
+        val tapIntent = Intent(this, MainActivity::class.java).apply {
+            flags = Intent.FLAG_ACTIVITY_CLEAR_TOP or Intent.FLAG_ACTIVITY_SINGLE_TOP
+        }
+        val pendingFlags = PendingIntent.FLAG_UPDATE_CURRENT or PendingIntent.FLAG_IMMUTABLE
+        val tapPending = PendingIntent.getActivity(this, 0, tapIntent, pendingFlags)
+
+        val disableIntent = Intent(this, BridgeForegroundService::class.java)
+            .setAction(ACTION_DISABLE)
+        val disablePending = PendingIntent.getService(this, 1, disableIntent, pendingFlags)
+
+        val settingsIntent = Intent(this, BridgeForegroundService::class.java)
+            .setAction(ACTION_OPEN_SETTINGS)
+        val settingsPending = PendingIntent.getService(this, 2, settingsIntent, pendingFlags)
+
+        return NotificationCompat.Builder(this, CHANNEL_ID)
+            .setSmallIcon(R.mipmap.ic_launcher)
+            .setContentTitle("Hermes agent has device control")
+            .setContentText("Bridge is active — tap Disable to stop at any time.")
+            .setStyle(NotificationCompat.BigTextStyle().bigText(
+                "The Hermes agent can currently read the screen and perform " +
+                    "actions on your behalf through the accessibility service. " +
+                    "Tap Disable to turn this off immediately."
+            ))
+            .setContentIntent(tapPending)
+            .setOngoing(true)
+            .setOnlyAlertOnce(true)
+            .setPriority(NotificationCompat.PRIORITY_DEFAULT)
+            .setCategory(NotificationCompat.CATEGORY_SERVICE)
+            .addAction(0, "Disable", disablePending)
+            .addAction(0, "Settings", settingsPending)
+            .build()
+    }
+
+    private fun ensureChannel() {
+        if (Build.VERSION.SDK_INT < Build.VERSION_CODES.O) return
+        val nm = getSystemService(NotificationManager::class.java) ?: return
+        if (nm.getNotificationChannel(CHANNEL_ID) != null) return
+        val channel = NotificationChannel(
+            CHANNEL_ID,
+            CHANNEL_NAME,
+            NotificationManager.IMPORTANCE_DEFAULT,
+        ).apply {
+            description = "Persistent indicator while the Hermes agent has device control."
+            setShowBadge(false)
+        }
+        nm.createNotificationChannel(channel)
+    }
+}