release: Android 1.4.6 and Plugin 1.4.2 (#208 )

Play preflight passed for the exact release tree. Publishes Android 1.4.6 and Plugin 1.4.2.
merge: sync main website release into dev
2026-07-15 20:28:27 -04:00 · 2026-07-15 20:15:33 -04:00 · 2026-07-15 20:03:54 -04:00 · 2026-07-15 20:03:26 -04:00 · 2026-07-15 20:02:50 -04:00 · 2026-07-15 19:57:50 -04:00
571 changed files with 75266 additions and 26422 deletions
@@ -0,0 +1,53 @@
+name: Translation correction
+description: Report or propose a clearer translation for one locale.
+title: "[Translation]: "
+labels: ["translation"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        English defines the product meaning. Translation corrections are applied to the canonical locale catalog and credited through Git history.
+  - type: input
+    id: locale
+    attributes:
+      label: Language and locale
+      placeholder: Spanish (es), Simplified Chinese (zh-Hans), etc.
+    validations:
+      required: true
+  - type: input
+    id: location
+    attributes:
+      label: Screen and current text
+      description: Name the screen, resource key if known, and current translated wording.
+    validations:
+      required: true
+  - type: textarea
+    id: correction
+    attributes:
+      label: Suggested correction
+      description: Include the corrected text and what the English source means in this context.
+    validations:
+      required: true
+  - type: dropdown
+    id: proficiency
+    attributes:
+      label: Language familiarity
+      options:
+        - Native speaker
+        - Fluent speaker
+        - Professional translator
+        - Learner or machine-assisted report
+        - Prefer not to say
+    validations:
+      required: true
+  - type: checkboxes
+    id: sensitive
+    attributes:
+      label: Sensitive meaning
+      options:
+        - label: This affects permissions, privacy, security, destructive actions, payments, or recovery instructions.
+  - type: textarea
+    id: context
+    attributes:
+      label: Additional context
+      description: Optional screenshot, regional preference, or explanation of why the existing wording is misleading.
@@ -12,10 +12,22 @@

 -

+## Lineage / contributor credit
+
+<!--
+If this PR salvages or supersedes earlier work, link every source PR and name
+the original contributor(s). Preserve original commit authors where practical;
+otherwise use verified Co-authored-by trailers. Write "N/A" for original work.
+-->
+
+- Source PR(s): N/A
+- Attribution preserved by: N/A
+
 ## Checklist

 - [ ] Target branch is `dev` unless this is a release PR
 - [ ] Android changes: lint and focused unit tests ran, or rationale is listed above
+- [ ] Translation changes: locale status/review references are accurate, `python scripts/check-android-locales.py` ran, and device/emulator review is documented, or N/A
 - [ ] Server changes: focused `python -m unittest ...` checks ran, or rationale is listed above
 - [ ] Desktop changes: `npm run build` or a narrower documented check ran, or rationale is listed above
 - [ ] Docs/site changes: docs build or link check ran, or rationale is listed above
@@ -23,3 +35,4 @@
 - [ ] Commit messages follow [Conventional Commits](https://www.conventionalcommits.org/)
 - [ ] CHANGELOG.md updated (if user-facing)
 - [ ] Public writing hygiene checked: no secrets, private infrastructure, personal names, or AI/process narration
+- [ ] Salvaged work links the source PR and preserves contributor authorship, or N/A
@@ -3,6 +3,7 @@ updates:
  # Gradle dependencies
  - package-ecosystem: "gradle"
    directory: "/"
+    target-branch: "dev"
    schedule:
      interval: "weekly"
      day: "monday"
@@ -24,10 +25,12 @@ updates:
        patterns:
          - "junit*"
          - "androidx.compose.ui:ui-test*"
+          - "io.github.takahirom.roborazzi*"

  # GitHub Actions
  - package-ecosystem: "github-actions"
    directory: "/"
+    target-branch: "dev"
    schedule:
      interval: "weekly"
    labels:
@@ -0,0 +1,43 @@
+'use strict';
+
+function classifyCiPaths(paths) {
+  const forceAll = paths.some((path) => [
+    '.github/workflows/ci-required.yml',
+    '.github/scripts/classify-ci-paths.cjs',
+    '.github/scripts/classify-ci-paths.test.cjs',
+  ].includes(path));
+  const exact = (values) => paths.some((path) => values.includes(path));
+  const under = (prefixes) => paths.some((path) => prefixes.some((prefix) => path.startsWith(prefix)));
+
+  return {
+    android: forceAll || under(['app/', 'relay-core/', 'relay-ui/', 'ui-preview/', 'quest/', 'gradle/']) || exact([
+      'build.gradle.kts', 'settings.gradle.kts', 'gradle.properties', 'gradlew', 'gradlew.bat',
+      'scripts/check-android-locales.py', 'scripts/android-locale-harness.py',
+      'scripts/check-android-collection-apis.py', '.github/workflows/ci-android.yml',
+      '.github/workflows/play-preflight-android.yml',
+      '.github/workflows/approve-release-android.yml',
+      '.github/workflows/release-android.yml',
+    ]),
+    desktop: forceAll || under(['desktop/']) || exact([
+      '.github/workflows/ci-desktop.yml',
+    ]),
+    plugin: forceAll || paths.some((path) => /^plugin\/[^/]+\.py$/.test(path)) ||
+      under(['plugin/relay/', 'plugin/tools/', 'plugin/tests/', 'relay_server/', 'hermes_relay_bootstrap/']) || exact([
+        'plugin/plugin.yaml', 'pyproject.toml', 'scripts/check-plugin-version-sync.py',
+        'scripts/check-server-version-sync.py', 'scripts/bump-plugin-version.sh',
+        'scripts/bump-server-version.sh', '.github/workflows/ci-plugin.yml',
+      ]),
+    dashboard: forceAll || under(['plugin/dashboard/']) || exact([
+      '.github/workflows/ci-dashboard.yml',
+    ]),
+    contract: forceAll ||
+      under(['app/src/main/kotlin/com/hermesandroid/relay/network/upstream/']) || exact([
+        'scripts/check-upstream-route-contract.py', '.github/workflows/ci-contract.yml',
+      ]),
+    docs: forceAll || under(['user-docs/']) || exact([
+      '.github/workflows/docs.yml',
+    ]),
+  };
+}
+
+module.exports = { classifyCiPaths };
@@ -0,0 +1,34 @@
+'use strict';
+
+const assert = require('node:assert/strict');
+const { classifyCiPaths } = require('./classify-ci-paths.cjs');
+
+const none = {
+  android: false,
+  desktop: false,
+  plugin: false,
+  dashboard: false,
+  contract: false,
+  docs: false,
+};
+
+assert.deepEqual(classifyCiPaths(['README.md']), none);
+assert.deepEqual(classifyCiPaths(['desktop/src/cli.ts']), { ...none, desktop: true });
+assert.deepEqual(classifyCiPaths(['relay-core/src/main/kotlin/Wire.kt']), { ...none, android: true });
+assert.deepEqual(classifyCiPaths(['plugin/relay/server.py']), { ...none, plugin: true });
+assert.deepEqual(classifyCiPaths(['plugin/dashboard/src/App.tsx']), { ...none, dashboard: true });
+assert.deepEqual(classifyCiPaths(['user-docs/index.md']), { ...none, docs: true });
+assert.deepEqual(
+  classifyCiPaths(['app/src/main/kotlin/com/hermesandroid/relay/network/upstream/DashboardApiClient.kt']),
+  { ...none, android: true, contract: true },
+);
+assert.deepEqual(classifyCiPaths(['.github/workflows/ci-required.yml']), {
+  android: true,
+  desktop: true,
+  plugin: true,
+  dashboard: true,
+  contract: true,
+  docs: true,
+});
+
+console.log('CI path classification tests passed.');
@@ -0,0 +1,100 @@
+# Hermes-Relay-Android — explicit public release approval
+#
+# Run from main only after the automated Play preflight passes and the release
+# PR has merged. Starting this workflow is the release approval. Creating the
+# stable tag triggers Play submission first, then GitHub publication.
+
+name: Approve Android Release
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Approved Android version (for example 1.4.3)"
+        required: true
+        type: string
+
+permissions:
+  contents: write
+  actions: write
+
+concurrency:
+  group: approve-android-release
+  cancel-in-progress: false
+
+jobs:
+  approve:
+    name: Verify preflight and create release tag
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - name: Validate approval request
+        id: metadata
+        env:
+          REQUESTED_VERSION: ${{ inputs.version }}
+        run: |
+          if [ "$GITHUB_REF" != "refs/heads/main" ]; then
+            echo "::error::Approve Android Release must run from main, not $GITHUB_REF"
+            exit 1
+          fi
+          TOML_VERSION=$(grep -oP 'appVersionName\s*=\s*"\K[^"]+' gradle/libs.versions.toml)
+          if [ "$REQUESTED_VERSION" != "$TOML_VERSION" ]; then
+            echo "::error::Requested version $REQUESTED_VERSION does not match appVersionName $TOML_VERSION"
+            exit 1
+          fi
+
+          echo "version=$TOML_VERSION" >> "$GITHUB_OUTPUT"
+          echo "tree=$(git rev-parse 'HEAD^{tree}')" >> "$GITHUB_OUTPUT"
+
+      - name: Verify this exact release tree passed Play preflight
+        env:
+          GH_TOKEN: ${{ github.token }}
+          VERSION: ${{ steps.metadata.outputs.version }}
+          RELEASE_TREE: ${{ steps.metadata.outputs.tree }}
+        run: |
+          ARTIFACT_NAME="play-preflight-${VERSION}-${RELEASE_TREE}"
+          COUNT=$(gh api "/repos/${GITHUB_REPOSITORY}/actions/artifacts?name=${ARTIFACT_NAME}" \
+            --jq '[.artifacts[] | select(.expired == false)] | length')
+          if [ "$COUNT" -lt 1 ]; then
+            echo "::error::No successful Play preflight found for version $VERSION with tree $RELEASE_TREE"
+            exit 1
+          fi
+          echo "Verified Play preflight proof: $ARTIFACT_NAME"
+
+      - name: Ensure release tag does not already exist
+        env:
+          GH_TOKEN: ${{ github.token }}
+          VERSION: ${{ steps.metadata.outputs.version }}
+        run: |
+          if gh api "/repos/${GITHUB_REPOSITORY}/git/ref/tags/android-v${VERSION}" >/dev/null 2>&1; then
+            echo "::error::Tag android-v${VERSION} already exists"
+            exit 1
+          fi
+
+      - name: Create approved Android release tag
+        env:
+          GH_TOKEN: ${{ github.token }}
+          VERSION: ${{ steps.metadata.outputs.version }}
+        run: |
+          gh api --method POST "/repos/${GITHUB_REPOSITORY}/git/refs" \
+            -f ref="refs/tags/android-v${VERSION}" \
+            -f sha="$GITHUB_SHA"
+
+      - name: Start the tag release workflow
+        env:
+          GH_TOKEN: ${{ github.token }}
+          VERSION: ${{ steps.metadata.outputs.version }}
+        run: |
+          gh workflow run release-android.yml \
+            --ref="android-v${VERSION}" \
+            -f version="$VERSION"
+
+      - name: Approval summary
+        run: |
+          echo "## Android release approved" >> "$GITHUB_STEP_SUMMARY"
+          echo "" >> "$GITHUB_STEP_SUMMARY"
+          echo "Created \`android-v${{ steps.metadata.outputs.version }}\` from main at \`$GITHUB_SHA\`." >> "$GITHUB_STEP_SUMMARY"
+          echo "The release workflow was dispatched at that tag. It will submit the preflighted Play draft before creating the public GitHub Release." >> "$GITHUB_STEP_SUMMARY"
@@ -1,7 +1,7 @@
 # Hermes-Relay — Android CI Pipeline
 #
-# Runs on pushes to main/dev and on PRs targeting main/dev, scoped to
-# Android-affecting paths so Python-only changes don't spin up the JVM.
+# Runs directly on Android-affecting pushes to main/dev and is called by the
+# path-aware required-check workflow for relevant pull requests.
 #
 # Pipeline: lint, build, and focused tests run concurrently. PRs build debug
 # APKs before merge; dev pushes keep lint/tests only to avoid duplicate
@@ -15,28 +15,28 @@
 name: CI — Android

 on:
+  workflow_call:
  push:
    branches: [main, dev]
    paths:
      - "app/**"
+      - "relay-core/**"
+      - "relay-ui/**"
+      - "ui-preview/**"
+      - "quest/**"
      - "gradle/**"
      - "build.gradle.kts"
      - "settings.gradle.kts"
      - "gradle.properties"
      - "gradlew"
      - "gradlew.bat"
+      - "scripts/check-android-locales.py"
+      - "scripts/android-locale-harness.py"
+      - "scripts/check-android-collection-apis.py"
      - ".github/workflows/ci-android.yml"
-  pull_request:
-    branches: [main, dev]
-    paths:
-      - "app/**"
-      - "gradle/**"
-      - "build.gradle.kts"
-      - "settings.gradle.kts"
-      - "gradle.properties"
-      - "gradlew"
-      - "gradlew.bat"
-      - ".github/workflows/ci-android.yml"
+      - ".github/workflows/play-preflight-android.yml"
+      - ".github/workflows/approve-release-android.yml"
+      - ".github/workflows/release-android.yml"

 # Cancel in-progress runs for the same branch/PR, but let main and dev finish
 concurrency:
@@ -53,7 +53,7 @@ jobs:
    timeout-minutes: 20
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7

      - name: Set up JDK 17
        uses: actions/setup-java@v5
@@ -66,6 +66,12 @@ jobs:
        with:
          cache-read-only: ${{ github.ref != 'refs/heads/main' && github.ref != 'refs/heads/dev' }}

+      - name: Validate translation catalogs
+        run: python3 scripts/check-android-locales.py
+
+      - name: Reject unsafe Android collection APIs
+        run: python3 scripts/check-android-collection-apis.py
+
      - name: Run Android lint
        run: ./gradlew lint --console=plain

@@ -79,7 +85,7 @@ jobs:
    timeout-minutes: 25
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7

      - name: Set up JDK 17
        uses: actions/setup-java@v5
@@ -123,7 +129,7 @@ jobs:
    continue-on-error: ${{ github.ref != 'refs/heads/main' && github.base_ref != 'main' }}
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7

      - name: Set up JDK 17
        uses: actions/setup-java@v5
@@ -138,14 +144,27 @@ jobs:

      # The broad Gradle `test` aggregate currently hangs in deferred JVM test
      # suites tracked by issue #32. Keep CI release-relevant until that suite is
-      # split: pairing URL derivation plus connection switching are the stable
-      # Android regression slice for the active release work.
+      # split: run the stable connection slice plus focused Chat/Voice state,
+      # parser, layout, and accessibility regressions for the active release.
      - name: Run focused Android unit tests
        run: |
          ./gradlew :app:testSideloadDebugUnitTest \
            --tests com.hermesandroid.relay.network.ArchitectureBoundaryTest \
            --tests com.hermesandroid.relay.network.relay.RelayUrlDeriverTest \
            --tests com.hermesandroid.relay.viewmodel.ConnectionSwitchTest \
+            --tests com.hermesandroid.relay.util.ServerAddressTest \
+            --tests com.hermesandroid.relay.util.IssueReportAndDiagnosticsTest \
+            --tests com.hermesandroid.relay.data.AppLanguageTest \
+            --tests com.hermesandroid.relay.viewmodel.ChatStreamRecoveryTest \
+            --tests com.hermesandroid.relay.viewmodel.ChatViewModelRealtimeTurnTest \
+            --tests com.hermesandroid.relay.network.relay.RealtimeVoiceEventParsingTest \
+            --tests com.hermesandroid.relay.voice.VoiceCommandInterpreterTest \
+            --tests com.hermesandroid.relay.data.VoiceModePresetTest \
+            --tests com.hermesandroid.relay.ui.components.BackgroundTaskCardTest \
+            --tests com.hermesandroid.relay.ui.components.DotMatrixIndicatorTest \
+            --tests com.hermesandroid.relay.ui.components.AttachmentGalleryLayoutTest \
+            --tests com.hermesandroid.relay.ui.components.MarkdownStreamingParserTest \
+            --tests com.hermesandroid.relay.ui.screens.ChatUnreadStateTest \
            --console=plain

      # Upload reports only for failures. Successful PR report uploads add
@@ -174,7 +193,7 @@ jobs:
    timeout-minutes: 35
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7

      - name: Set up JDK 17
        uses: actions/setup-java@v5
@@ -192,3 +211,9 @@ jobs:
      # smoke; the goal is to exercise the build, not to produce a shippable AAB.
      - name: Build release bundles + APKs (both flavors, debug-signed)
        run: ./gradlew bundleRelease assembleRelease --console=plain
+
+      - name: Scan release DEX for unsupported collection APIs
+        run: |
+          python3 scripts/check-android-collection-apis.py \
+            --apk app/build/outputs/apk/googlePlay/release/*.apk \
+            --apk app/build/outputs/apk/sideload/release/*.apk
@@ -6,24 +6,19 @@
 # boot, no pip install, no model keys); see scripts/check-upstream-route-contract.py
 # for the design + tradeoff (catches renamed/removed routes; not runtime auth).
 #
-# PR/push runs check a pinned ref (non-flaky); the weekly schedule tracks
-# upstream `main` as a drift siren so a route rename surfaces on our clock.
+# Required-PR and direct push runs check a pinned ref (non-flaky); the weekly
+# schedule tracks upstream `main` as a drift siren.

 name: CI — Upstream Contract

 on:
+  workflow_call:
  push:
    branches: [main, dev]
    paths:
      - "scripts/check-upstream-route-contract.py"
      - ".github/workflows/ci-contract.yml"
      - "app/src/main/kotlin/com/hermesandroid/relay/network/upstream/**"
-  pull_request:
-    branches: [main, dev]
-    paths:
-      - "scripts/check-upstream-route-contract.py"
-      - ".github/workflows/ci-contract.yml"
-      - "app/src/main/kotlin/com/hermesandroid/relay/network/upstream/**"
  schedule:
    - cron: "0 6 * * 1" # Mondays 06:00 UTC — upstream-drift siren (tracks main)
  workflow_dispatch:
@@ -44,7 +39,7 @@ jobs:
    timeout-minutes: 10
    steps:
      - name: Checkout hermes-relay
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7

      - name: Resolve upstream ref
        id: ref
@@ -64,7 +59,7 @@ jobs:
          echo "Checking standard-path route contract against upstream ref: $REF"

      - name: Checkout vanilla upstream (no plugin, no bootstrap)
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
        with:
          repository: NousResearch/hermes-agent
          ref: ${{ steps.ref.outputs.ref }}
@@ -1,16 +1,12 @@
 name: CI dashboard plugin

 on:
+  workflow_call:
  push:
    branches: [main, dev]
    paths:
      - "plugin/dashboard/**"
      - ".github/workflows/ci-dashboard.yml"
-  pull_request:
-    branches: [main, dev]
-    paths:
-      - "plugin/dashboard/**"
-      - ".github/workflows/ci-dashboard.yml"

 permissions:
  contents: read
@@ -25,10 +21,10 @@ jobs:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7

      - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
        with:
          node-version: "22"
          cache: npm
@@ -1,15 +1,12 @@
 name: CI desktop

 on:
+  workflow_call:
  push:
    branches: [main, dev]
    paths:
      - 'desktop/**'
      - '.github/workflows/ci-desktop.yml'
-  pull_request:
-    paths:
-      - 'desktop/**'
-      - '.github/workflows/ci-desktop.yml'

 permissions:
  contents: read
@@ -26,10 +23,10 @@ jobs:
      run:
        working-directory: desktop
    steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7

      - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
        with:
          node-version: '22'
          cache: npm
@@ -38,9 +35,15 @@ jobs:
      - name: Install deps
        run: npm ci

+      - name: Verify CLI and tray versions are synchronized
+        run: npm run check:version-sync
+
      - name: Type-check
        run: npm run type-check

+      - name: Test typed stream rendering
+        run: npm test
+
      - name: Build (tsc → dist/)
        run: npm run build

@@ -62,10 +65,10 @@ jobs:
      run:
        working-directory: desktop
    steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7

      - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
        with:
          node-version: '22'
          cache: npm
@@ -90,10 +93,10 @@ jobs:
      run:
        working-directory: desktop
    steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7

      - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
        with:
          node-version: '22'
          cache: npm
@@ -105,6 +108,12 @@ jobs:
      - name: Install deps
        run: npm ci

+      - name: Check tray formatting
+        run: npm run tray:fmt
+
+      - name: Lint tray shell
+        run: npm run tray:lint
+
      - name: Cargo check tray shell
        run: npm run tray:check

@@ -1,40 +1,18 @@
 # Hermes-Relay — Plugin CI Pipeline
 #
-# Runs on pushes to main/dev and on PRs targeting main/dev, scoped to
-# plugin-affecting paths so Android-only changes don't spin up the
-# Python toolchain.
+# Runs directly on plugin-affecting pushes to main/dev and is called by the
+# path-aware required-check workflow for relevant pull requests.
 #
 # Pipeline: syntax-check and focused plugin tests run concurrently.

 name: CI — Plugin

 on:
+  workflow_call:
  push:
    branches: [main, dev]
    paths:
-      - "plugin/__init__.py"
-      - "plugin/android_tool.py"
-      - "plugin/cli.py"
-      - "plugin/pair.py"
-      - "plugin/plugin.yaml"
-      - "plugin/relay/**"
-      - "plugin/tools/**"
-      - "plugin/tests/**"
-      - "relay_server/**"
-      - "hermes_relay_bootstrap/**"
-      - "pyproject.toml"
-      - "scripts/check-plugin-version-sync.py"
-      - "scripts/check-server-version-sync.py"
-      - "scripts/bump-plugin-version.sh"
-      - "scripts/bump-server-version.sh"
-      - ".github/workflows/ci-plugin.yml"
-  pull_request:
-    branches: [main, dev]
-    paths:
-      - "plugin/__init__.py"
-      - "plugin/android_tool.py"
-      - "plugin/cli.py"
-      - "plugin/pair.py"
+      - "plugin/*.py"
      - "plugin/plugin.yaml"
      - "plugin/relay/**"
      - "plugin/tools/**"
@@ -63,7 +41,7 @@ jobs:
    timeout-minutes: 10
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7

      - name: Set up Python 3.11
        uses: actions/setup-python@v6
@@ -102,7 +80,7 @@ jobs:
    continue-on-error: ${{ github.ref != 'refs/heads/main' && github.base_ref != 'main' }}
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7

      - name: Set up Python 3.11
        uses: actions/setup-python@v6
@@ -111,7 +89,12 @@ jobs:

      - name: Install dependencies
        run: |
-          pip install -r relay_server/requirements.txt
+          # Editable install pulls the full runtime dependency set from
+          # pyproject.toml (requests, aiohttp, segno, httpx, websocket-client,
+          # pyyaml). test_native_layout_imports imports the whole relay module
+          # chain in a clean subprocess, so the minimal relay_server/requirements
+          # set is not enough on its own.
+          pip install -e .
          pip install pytest responses

      - name: Run focused Plugin tests
@@ -119,4 +102,5 @@ jobs:
          python -m pytest \
            plugin/tests/test_relay_security.py \
            plugin/tests/test_voice_routes.py \
-            plugin/tests/test_session_grants.py
+            plugin/tests/test_session_grants.py \
+            plugin/tests/test_native_layout_imports.py
@@ -1,49 +1,137 @@
-# Required-checks sentinel — always runs on every PR + push to main/dev so
-# branch protection on `main` has a check name it can rely on, regardless
-# of which paths the PR touches.
+# Path-aware required CI for pull requests targeting main or dev.
 #
-# Why this exists. The other CI workflows (`ci-android.yml`, `ci-plugin.yml`,
-# `ci-desktop.yml`) are scoped via `paths:` filters so a docs-only or
-# desktop-only PR doesn't spin up the Android toolchain. Branch protection's
-# "required status checks" treat a check that doesn't run as failing — so
-# any PR that didn't touch the protected paths was blocked from merging,
-# even with all the relevant gates green. We were admin-overriding every
-# desktop-only PR. Same for relay-touching PRs (the protection rule named
-# `Relay Check (Python)` didn't even match any actual job — broken since
-# day one).
-#
-# This sentinel + claude-review become the only required checks. The
-# path-filtered workflows still run when relevant and surface their
-# results on the PR — visible, clickable, but advisory rather than
-# blocking. Reviewers (human + claude-review) eyeball them. This is the
-# standard pattern for monorepos with path-filtered CI.
-#
-# Trade-off acknowledged: a broken Android build on an Android-touching
-# PR could merge if the reviewer ignores the failing CI badge. Mitigation:
-# claude-review reads CI conclusions in its review prompt + the project's
-# release-merge cadence catches issues before they reach a tag. If a
-# stricter gate is later wanted, fold it into this workflow as a job that
-# fans out to the path-filtered work — but the simplest version (just an
-# `echo`) is what's needed to make branch protection useful again today.
+# The change detector selects the existing surface workflows, which are exposed
+# through workflow_call. The final job keeps one stable branch-protection check
+# while ensuring that every relevant build or test actually completed.

 name: Required checks

 on:
-  push:
-    branches: [main, dev]
  pull_request:
    branches: [main, dev]
+    types: [opened, synchronize, reopened, ready_for_review]
+
+permissions:
+  contents: read
+  pull-requests: read

-# Cancel in-progress runs for the same branch/PR. Doesn't matter much for
-# a 5-second job, but matches every other workflow's concurrency shape.
 concurrency:
  group: ci-required-${{ github.ref }}
-  cancel-in-progress: ${{ github.ref != 'refs/heads/main' && github.ref != 'refs/heads/dev' }}
+  cancel-in-progress: true

 jobs:
+  changes:
+    name: Detect affected surfaces
+    runs-on: ubuntu-latest
+    outputs:
+      android: ${{ steps.filter.outputs.android }}
+      desktop: ${{ steps.filter.outputs.desktop }}
+      plugin: ${{ steps.filter.outputs.plugin }}
+      dashboard: ${{ steps.filter.outputs.dashboard }}
+      contract: ${{ steps.filter.outputs.contract }}
+      docs: ${{ steps.filter.outputs.docs }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7
+
+      - name: Test path classifier
+        run: node .github/scripts/classify-ci-paths.test.cjs
+
+      - name: Classify changed files
+        id: filter
+        uses: actions/github-script@v8
+        with:
+          script: |
+            const files = await github.paginate(github.rest.pulls.listFiles, {
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              pull_number: context.issue.number,
+              per_page: 100,
+            });
+            const paths = files.map((file) => file.filename);
+            const { classifyCiPaths } = require(
+              `${process.env.GITHUB_WORKSPACE}/.github/scripts/classify-ci-paths.cjs`,
+            );
+            const outputs = classifyCiPaths(paths);
+
+            for (const [surface, affected] of Object.entries(outputs)) {
+              core.setOutput(surface, affected ? 'true' : 'false');
+            }
+            core.notice(`Changed paths: ${paths.join(', ')}`);
+            core.notice(`Selected checks: ${Object.entries(outputs).filter(([, value]) => value).map(([key]) => key).join(', ') || 'none'}`);
+
+  android:
+    needs: changes
+    if: needs.changes.outputs.android == 'true'
+    uses: ./.github/workflows/ci-android.yml
+
+  desktop:
+    needs: changes
+    if: needs.changes.outputs.desktop == 'true'
+    uses: ./.github/workflows/ci-desktop.yml
+
+  plugin:
+    needs: changes
+    if: needs.changes.outputs.plugin == 'true'
+    uses: ./.github/workflows/ci-plugin.yml
+
+  dashboard:
+    needs: changes
+    if: needs.changes.outputs.dashboard == 'true'
+    uses: ./.github/workflows/ci-dashboard.yml
+
+  contract:
+    needs: changes
+    if: needs.changes.outputs.contract == 'true'
+    uses: ./.github/workflows/ci-contract.yml
+
+  docs:
+    name: Build public docs
+    needs: changes
+    if: needs.changes.outputs.docs == 'true'
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: user-docs
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - uses: actions/setup-node@v7
+        with:
+          node-version: 24
+          cache: npm
+          cache-dependency-path: user-docs/package-lock.json
+
+      - run: npm ci
+      - run: npm run build
+
  guard:
    name: Required checks
+    if: always()
+    needs: [changes, android, desktop, plugin, dashboard, contract, docs]
    runs-on: ubuntu-latest
+    env:
+      CHANGES_RESULT: ${{ needs.changes.result }}
+      ANDROID_RESULT: ${{ needs.android.result }}
+      DESKTOP_RESULT: ${{ needs.desktop.result }}
+      PLUGIN_RESULT: ${{ needs.plugin.result }}
+      DASHBOARD_RESULT: ${{ needs.dashboard.result }}
+      CONTRACT_RESULT: ${{ needs.contract.result }}
+      DOCS_RESULT: ${{ needs.docs.result }}
    steps:
-      - name: OK
-        run: echo "Required-checks sentinel — see ci-required.yml header for context."
+      - name: Require every selected check to pass
+        shell: bash
+        run: |
+          failed=0
+          for check in CHANGES ANDROID DESKTOP PLUGIN DASHBOARD CONTRACT DOCS; do
+            result_var="${check}_RESULT"
+            result="${!result_var}"
+            echo "$check: $result"
+            case "$result" in
+              success|skipped) ;;
+              *) failed=1 ;;
+            esac
+          done
+          exit "$failed"
@@ -0,0 +1,39 @@
+name: Website CI
+
+on:
+  pull_request:
+    paths:
+      - "website/**"
+      - "assets/screenshots/02_chat.png"
+      - "assets/screenshots/03_voice.png"
+      - "assets/screenshots/06_manage.png"
+      - "docs/media/screenshots.json"
+      - ".github/workflows/ci-website.yml"
+  push:
+    branches: [main, dev]
+    paths:
+      - "website/**"
+      - "assets/screenshots/02_chat.png"
+      - "assets/screenshots/03_voice.png"
+      - "assets/screenshots/06_manage.png"
+      - "docs/media/screenshots.json"
+      - ".github/workflows/ci-website.yml"
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: website
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+          cache-dependency-path: website/package-lock.json
+      - run: npm ci
+      - run: npm run build
@@ -1,90 +0,0 @@
-name: Claude Code Review
-
-on:
-  pull_request:
-    types: [opened, synchronize, ready_for_review, reopened]
-    # Optional: Only run on specific file changes
-    # paths:
-    #   - "src/**/*.ts"
-    #   - "src/**/*.tsx"
-    #   - "src/**/*.js"
-    #   - "src/**/*.jsx"
-
-jobs:
-  claude-review:
-    # Optional: Filter by PR author
-    # if: |
-    #   github.event.pull_request.user.login == 'external-contributor' ||
-    #   github.event.pull_request.user.login == 'new-developer' ||
-    #   github.event.pull_request.author_association == 'FIRST_TIME_CONTRIBUTOR'
-    runs-on: ubuntu-latest
-    timeout-minutes: 20
-    permissions:
-      contents: read
-      pull-requests: read
-      issues: read
-      id-token: write
-    env:
-      # Any dev -> main PR is, by the branching model, the aggregate release PR
-      # (main only ever receives release merges from dev). Detect it by base+head
-      # alone — a title-format match (e.g. "release:") is fragile and silently
-      # let a "Release v1.0.0 …"-titled PR run the full review and time out.
-      IS_RELEASE_PR: ${{ github.event.pull_request.base.ref == 'main' && github.event.pull_request.head.ref == 'dev' }}
-      # Bot-authored PRs such as Dependabot do not receive the same secret
-      # surface as human-authored PRs, and Claude Code rejects bot actors unless
-      # explicitly allow-listed. Keep the required check green with a no-op and
-      # rely on the dependency CI/status checks for those PRs.
-      IS_BOT_PR: ${{ github.event.pull_request.user.type == 'Bot' }}
-
-    steps:
-      - name: Skip aggregate release PR review
-        if: env.IS_RELEASE_PR == 'true'
-        run: |
-          echo "Skipping Claude Code Review for aggregate dev -> main release PR."
-          echo "Feature work is reviewed before it lands on dev; release PRs are gated by CI and release metadata checks."
-
-      - name: Skip bot-authored PR review
-        if: env.IS_BOT_PR == 'true'
-        run: |
-          echo "Skipping Claude Code Review for bot-authored PR."
-          echo "Bot PRs are gated by Required checks plus their path-specific CI jobs."
-
-      - name: Checkout repository
-        if: env.IS_RELEASE_PR != 'true' && env.IS_BOT_PR != 'true'
-        uses: actions/checkout@v4
-        with:
-          # Depth 2 includes the pull_request merge commit's first parent, which
-          # lets the next step detect whether this PR changes the workflow file.
-          fetch-depth: 2
-
-      - name: Detect Claude review workflow changes
-        if: env.IS_RELEASE_PR != 'true' && env.IS_BOT_PR != 'true'
-        id: changed-workflow
-        shell: bash
-        run: |
-          if git rev-parse --verify HEAD^1 >/dev/null 2>&1 &&
-             git diff --name-only HEAD^1 HEAD | grep -Fxq ".github/workflows/claude-code-review.yml"; then
-            echo "claude_review_workflow=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "claude_review_workflow=false" >> "$GITHUB_OUTPUT"
-          fi
-
-      - name: Skip Claude review workflow self-change
-        if: env.IS_RELEASE_PR != 'true' && env.IS_BOT_PR != 'true' && steps.changed-workflow.outputs.claude_review_workflow == 'true'
-        run: |
-          echo "Skipping Claude Code Review because this PR changes the review workflow itself."
-          echo "The Claude action requires this workflow file to match the default branch before it can exchange the app token."
-
-      - name: Run Claude Code Review
-        if: env.IS_RELEASE_PR != 'true' && env.IS_BOT_PR != 'true' && steps.changed-workflow.outputs.claude_review_workflow != 'true'
-        timeout-minutes: 15
-        id: claude-review
-        uses: anthropics/claude-code-action@v1
-        with:
-          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
-          plugin_marketplaces: 'https://github.com/anthropics/claude-code.git'
-          plugins: 'code-review@claude-code-plugins'
-          prompt: '/code-review:code-review ${{ github.repository }}/pull/${{ github.event.pull_request.number }}'
-          # See https://github.com/anthropics/claude-code-action/blob/main/docs/usage.md
-          # or https://code.claude.com/docs/en/cli-reference for available options
-
@@ -1,50 +0,0 @@
-name: Claude Code
-
-on:
-  issue_comment:
-    types: [created]
-  pull_request_review_comment:
-    types: [created]
-  issues:
-    types: [opened, assigned]
-  pull_request_review:
-    types: [submitted]
-
-jobs:
-  claude:
-    if: |
-      (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
-      (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
-      (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||
-      (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      pull-requests: read
-      issues: read
-      id-token: write
-      actions: read # Required for Claude to read CI results on PRs
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 1
-
-      - name: Run Claude Code
-        id: claude
-        uses: anthropics/claude-code-action@v1
-        with:
-          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
-
-          # This is an optional setting that allows Claude to read CI results on PRs
-          additional_permissions: |
-            actions: read
-
-          # Optional: Give a custom prompt to Claude. If this is not specified, Claude will perform the instructions specified in the comment that tagged it.
-          # prompt: 'Update the pull request description to include a summary of changes.'
-
-          # Optional: Add claude_args to customize behavior and configuration
-          # See https://github.com/anthropics/claude-code-action/blob/main/docs/usage.md
-          # or https://code.claude.com/docs/en/cli-reference for available options
-          # claude_args: '--allowed-tools Bash(gh pr *)'
-
@@ -13,7 +13,7 @@ jobs:
    steps:
      - name: Fetch Dependabot metadata
        id: metadata
-        uses: dependabot/fetch-metadata@v2
+        uses: dependabot/fetch-metadata@v3
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}

@@ -31,12 +31,12 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
        with:
          fetch-depth: 0  # Full history for lastUpdated timestamps

      - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
        with:
          # Node 24 ships npm 11, matching the npm that generates
          # user-docs/package-lock.json. On npm 10 (Node 20), `npm ci` rejects
@@ -0,0 +1,65 @@
+name: Issue Triage
+
+on:
+  issues:
+    types: [opened]
+  workflow_dispatch:
+    inputs:
+      issue_number:
+        description: "Issue number to label again"
+        required: true
+        type: string
+
+concurrency:
+  group: issue-triage-${{ github.event.issue.number || github.event.inputs.issue_number }}
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+  issues: write
+
+jobs:
+  auto-label:
+    if: >
+      github.event_name == 'workflow_dispatch' ||
+      (github.event_name == 'issues' && github.event.issue.user.type != 'Bot')
+    runs-on: ubuntu-latest
+    steps:
+      - name: Label from title prefix and issue area
+        uses: actions/github-script@v8
+        env:
+          ISSUE_NUMBER: ${{ github.event.issue.number || github.event.inputs.issue_number }}
+        with:
+          script: |
+            const issue_number = Number(process.env.ISSUE_NUMBER);
+            const { data: issue } = await github.rest.issues.get({
+              owner: context.repo.owner, repo: context.repo.repo, issue_number,
+            });
+            const title = (issue.title || '').toLowerCase();
+            const body = (issue.body || '').toLowerCase();
+            const haystack = `${title}\n${body}`;
+            const labels = [];
+
+            if (title.startsWith('[bug]')) labels.push('bug');
+            else if (title.startsWith('[feature]') || title.startsWith('[feat]')) labels.push('enhancement');
+            else if (title.startsWith('[docs]')) labels.push('documentation');
+
+            if (/\b(cli|desktop|terminal|daemon|pty|hermes-relay (install|binary|tray))\b/.test(haystack)) labels.push('area:cli');
+            else if (/\b(dashboard|plugin ui|react)\b/.test(haystack)) labels.push('area:dashboard');
+            else if (/\b(relay|plugin|aiohttp|python|pairing|voice (transcribe|synthesize)|bridge (endpoint|route))\b/.test(haystack)) labels.push('area:plugin');
+            else if (/\b(readme|user-?docs|documentation)\b/.test(haystack)) labels.push('area:docs');
+            else if (/\b(android|app|compose|apk|phone|samsung|gradle|chat|voice|notification|sphere|keystore)\b/.test(haystack)) labels.push('area:android');
+
+            if (!labels.length) {
+              core.info('No deterministic label matched; leaving the issue for maintainer triage.');
+              return;
+            }
+
+            try {
+              await github.rest.issues.addLabels({
+                owner: context.repo.owner, repo: context.repo.repo, issue_number, labels,
+              });
+              core.info(`Applied labels: ${labels.join(', ')}`);
+            } catch (error) {
+              core.warning(`Could not apply ${labels.join(', ')}: ${error.message}`);
+            }
@@ -7,7 +7,7 @@ on:
      - "assets/play-store-icon-512.png"
      - "assets/play-store-feature-1024x500.png"
      - "docs/media/screenshots.json"
-      - "app/src/googlePlay/play/default-language.txt"
+      - "app/src/googlePlay/play/*.txt"
      - "app/src/googlePlay/play/listings/**"
      - "scripts/screenshots.py"
      - ".github/workflows/play-listing.yml"
@@ -20,7 +20,7 @@ on:
      - "assets/play-store-icon-512.png"
      - "assets/play-store-feature-1024x500.png"
      - "docs/media/screenshots.json"
-      - "app/src/googlePlay/play/default-language.txt"
+      - "app/src/googlePlay/play/*.txt"
      - "app/src/googlePlay/play/listings/**"
      - "scripts/screenshots.py"
      - ".github/workflows/play-listing.yml"
@@ -41,7 +41,7 @@ jobs:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7

      - name: Set up Python
        uses: actions/setup-python@v6
@@ -67,7 +67,7 @@ jobs:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7

      - name: Set up JDK 17
        uses: actions/setup-java@v5
@@ -0,0 +1,154 @@
+# Hermes-Relay-Android — private Google Play preflight
+#
+# Run manually from the final dev or untagged main tree before creating
+# android-v*. The job
+# builds the same signed release artifacts, scans final DEX, and uploads the
+# Google Play bundle as a production DRAFT. A successful upload is the automated
+# Play gate while no public GitHub Release or sideload APK exists. Console-only
+# pre-review and pre-launch reports are informational and do not block release.
+
+name: Play Preflight — Android
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Android version to preflight (for example 1.4.3)"
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+concurrency:
+  group: play-preflight-android
+  cancel-in-progress: false
+
+jobs:
+  preflight:
+    name: Build and upload private Play draft
+    runs-on: ubuntu-latest
+    timeout-minutes: 40
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Require final release branch and matching version
+        id: metadata
+        env:
+          REQUESTED_VERSION: ${{ inputs.version }}
+        run: |
+          if [ "$GITHUB_REF" != "refs/heads/dev" ] && [ "$GITHUB_REF" != "refs/heads/main" ]; then
+            echo "::error::Run Play preflight from dev or untagged main, not $GITHUB_REF"
+            exit 1
+          fi
+
+          TOML_VERSION=$(grep -oP 'appVersionName\s*=\s*"\K[^"]+' gradle/libs.versions.toml)
+          VERSION_CODE=$(grep -oP 'appVersionCode\s*=\s*"\K[^"]+' gradle/libs.versions.toml)
+          if [ "$REQUESTED_VERSION" != "$TOML_VERSION" ]; then
+            echo "::error::Requested version $REQUESTED_VERSION does not match appVersionName $TOML_VERSION"
+            exit 1
+          fi
+
+          echo "version=$TOML_VERSION" >> "$GITHUB_OUTPUT"
+          echo "version_code=$VERSION_CODE" >> "$GITHUB_OUTPUT"
+          echo "tree=$(git rev-parse 'HEAD^{tree}')" >> "$GITHUB_OUTPUT"
+
+      - name: Require Play and release-signing secrets
+        env:
+          PLAY_SERVICE_ACCOUNT_JSON: ${{ secrets.PLAY_SERVICE_ACCOUNT_JSON }}
+          HERMES_KEYSTORE_BASE64: ${{ secrets.HERMES_KEYSTORE_BASE64 }}
+        run: |
+          if [ -z "$PLAY_SERVICE_ACCOUNT_JSON" ]; then
+            echo "::error::PLAY_SERVICE_ACCOUNT_JSON is required for Play preflight"
+            exit 1
+          fi
+          if [ -z "$HERMES_KEYSTORE_BASE64" ]; then
+            echo "::error::HERMES_KEYSTORE_BASE64 is required for Play preflight"
+            exit 1
+          fi
+
+      - name: Set up JDK 17
+        uses: actions/setup-java@v5
+        with:
+          distribution: temurin
+          java-version: 17
+
+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@v6
+        with:
+          cache-read-only: false
+
+      - name: Validate release metadata and source compatibility
+        run: |
+          python3 scripts/check-version-tracks.py
+          python3 scripts/check-android-locales.py
+          python3 scripts/check-android-collection-apis.py
+          python3 -m json.tool app/src/main/assets/changelog.json >/dev/null
+
+      - name: Decode release keystore
+        env:
+          HERMES_KEYSTORE_BASE64: ${{ secrets.HERMES_KEYSTORE_BASE64 }}
+        run: |
+          echo "$HERMES_KEYSTORE_BASE64" | base64 -d > "$RUNNER_TEMP/release.keystore"
+          echo "HERMES_KEYSTORE_PATH=$RUNNER_TEMP/release.keystore" >> "$GITHUB_ENV"
+
+      - name: Build final release artifacts
+        env:
+          HERMES_KEYSTORE_PASSWORD: ${{ secrets.HERMES_KEYSTORE_PASSWORD }}
+          HERMES_KEY_ALIAS: ${{ secrets.HERMES_KEY_ALIAS }}
+          HERMES_KEY_PASSWORD: ${{ secrets.HERMES_KEY_PASSWORD }}
+        run: ./gradlew bundleRelease assembleRelease --console=plain
+
+      - name: Scan final release DEX
+        run: |
+          python3 scripts/check-android-collection-apis.py \
+            --apk app/build/outputs/apk/googlePlay/release/*.apk \
+            --apk app/build/outputs/apk/sideload/release/*.apk
+
+      - name: Upload private production draft to Play
+        env:
+          PLAY_SERVICE_ACCOUNT_JSON: ${{ secrets.PLAY_SERVICE_ACCOUNT_JSON }}
+          HERMES_KEYSTORE_PASSWORD: ${{ secrets.HERMES_KEYSTORE_PASSWORD }}
+          HERMES_KEY_ALIAS: ${{ secrets.HERMES_KEY_ALIAS }}
+          HERMES_KEY_PASSWORD: ${{ secrets.HERMES_KEY_PASSWORD }}
+        run: |
+          trap 'rm -f play-service-account.json' EXIT
+          printf '%s' "$PLAY_SERVICE_ACCOUNT_JSON" > play-service-account.json
+          ./gradlew publishGooglePlayReleaseBundle \
+            --track=production \
+            --release-status=draft \
+            --resolution-strategy=ignore \
+            --release-name="Hermes-Relay ${{ steps.metadata.outputs.version }}"
+
+      - name: Record successful preflight for the exact commit
+        run: |
+          mkdir -p app/build/reports
+          cat > app/build/reports/play-preflight.json <<EOF
+          {
+            "version": "${{ steps.metadata.outputs.version }}",
+            "versionCode": "${{ steps.metadata.outputs.version_code }}",
+            "commit": "$GITHUB_SHA",
+            "tree": "${{ steps.metadata.outputs.tree }}",
+            "track": "production",
+            "status": "draft"
+          }
+          EOF
+
+      - name: Upload preflight proof
+        uses: actions/upload-artifact@v7
+        with:
+          name: play-preflight-${{ steps.metadata.outputs.version }}-${{ steps.metadata.outputs.tree }}
+          path: app/build/reports/play-preflight.json
+          if-no-files-found: error
+          retention-days: 30
+
+      - name: Preflight summary
+        run: |
+          echo "## Play preflight ready" >> "$GITHUB_STEP_SUMMARY"
+          echo "" >> "$GITHUB_STEP_SUMMARY"
+          echo "- Version: **${{ steps.metadata.outputs.version }}** (code ${{ steps.metadata.outputs.version_code }})" >> "$GITHUB_STEP_SUMMARY"
+          echo "- Commit: \`$GITHUB_SHA\`" >> "$GITHUB_STEP_SUMMARY"
+          echo "- Release tree: \`${{ steps.metadata.outputs.tree }}\`" >> "$GITHUB_STEP_SUMMARY"
+          echo "- Play track/status: **Production draft**" >> "$GITHUB_STEP_SUMMARY"
+          echo "" >> "$GITHUB_STEP_SUMMARY"
+          echo "The signed build, DEX scan, and Play draft upload passed. Ensure this exact release tree is on main, then run **Approve Android Release** from main. Console-only reports are informational and non-blocking." >> "$GITHUB_STEP_SUMMARY"
@@ -11,9 +11,19 @@ on:
  push:
    tags:
      - "android-v*"
+  # Approve Android Release creates its tag with GITHUB_TOKEN, whose tag event
+  # does not recursively start workflows. It explicitly dispatches this file
+  # at that tag instead. Manual tag pushes continue to use the push trigger.
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Approved Android version"
+        required: true
+        type: string

 permissions:
  contents: write
+  actions: read
  id-token: write

 jobs:
@@ -22,12 +32,26 @@ jobs:
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.version.outputs.version }}
+      version_code: ${{ steps.version.outputs.version_code }}
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7

      - name: Extract version from tag
        id: version
-        run: echo "version=${GITHUB_REF#refs/tags/android-v}" >> $GITHUB_OUTPUT
+        env:
+          DISPATCHED_VERSION: ${{ inputs.version }}
+        run: |
+          REF_VERSION="${GITHUB_REF#refs/tags/android-v}"
+          if [ "$GITHUB_REF" = "$REF_VERSION" ]; then
+            REF_VERSION="$DISPATCHED_VERSION"
+          fi
+          if [ -n "$DISPATCHED_VERSION" ] && [ "$DISPATCHED_VERSION" != "$REF_VERSION" ]; then
+            echo "::error::Dispatched version $DISPATCHED_VERSION does not match ref version $REF_VERSION"
+            exit 1
+          fi
+          VERSION_CODE=$(grep -oP 'appVersionCode\s*=\s*"\K[^"]+' gradle/libs.versions.toml)
+          echo "version=$REF_VERSION" >> "$GITHUB_OUTPUT"
+          echo "version_code=$VERSION_CODE" >> "$GITHUB_OUTPUT"

      - name: Verify version sync
        run: |
@@ -44,13 +68,30 @@ jobs:

          echo "Version validated: $TAG_VERSION"

+      - name: Require successful Play preflight for this exact release tree
+        if: ${{ !contains(steps.version.outputs.version, '-') }}
+        env:
+          GH_TOKEN: ${{ github.token }}
+          VERSION: ${{ steps.version.outputs.version }}
+        run: |
+          RELEASE_TREE=$(git rev-parse 'HEAD^{tree}')
+          ARTIFACT_NAME="play-preflight-${VERSION}-${RELEASE_TREE}"
+          COUNT=$(gh api "/repos/${GITHUB_REPOSITORY}/actions/artifacts?name=${ARTIFACT_NAME}" \
+            --jq '[.artifacts[] | select(.expired == false)] | length')
+          if [ "$COUNT" -lt 1 ]; then
+            echo "::error::No successful Play preflight found for version $VERSION with tree $RELEASE_TREE"
+            echo "Run Play Preflight from the final dev tree, merge that unchanged tree to main, then approve the release."
+            exit 1
+          fi
+          echo "Play preflight proof found: $ARTIFACT_NAME"
+
  ci:
    name: CI Checks
    needs: validate
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7

      - name: Set up JDK 17
        uses: actions/setup-java@v5
@@ -63,6 +104,12 @@ jobs:
        with:
          cache-read-only: false

+      - name: Validate release metadata and Android API compatibility
+        run: |
+          python3 scripts/check-version-tracks.py
+          python3 scripts/check-android-locales.py
+          python3 scripts/check-android-collection-apis.py
+
      # Keep the tag release gate aligned with CI — Android's broad Gradle
      # `test` aggregate currently hangs in deferred JVM suites tracked by
      # issue #32, so the release gate runs the stable connection/pairing slice.
@@ -79,7 +126,7 @@ jobs:
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7

      - name: Set up JDK 17
        uses: actions/setup-java@v5
@@ -116,6 +163,12 @@ jobs:
        #   app/build/outputs/bundle/sideloadRelease/hermes-relay-<version>-sideload-release.aab
        run: ./gradlew bundleRelease assembleRelease

+      - name: Scan release DEX for unsupported collection APIs
+        run: |
+          python3 scripts/check-android-collection-apis.py \
+            --apk app/build/outputs/apk/googlePlay/release/*.apk \
+            --apk app/build/outputs/apk/sideload/release/*.apk
+
      - name: List produced artifacts (debug aid)
        run: |
          echo "=== APK outputs ==="
@@ -127,12 +180,40 @@ jobs:
        # Flavor dimension adds an extra path segment to the AGP output layout.
        # APKs live under `apk/<flavor>/release/`, AABs under `bundle/<flavor>Release/`
        # (note the concatenated camelCase — AGP path quirk, documented but
-        # different between APK and AAB). The globs below match both flavors.
+        # different between APK and AAB). Checksums cover EXACTLY the files
+        # attached to the GitHub Release (see the 2-asset policy on the
+        # release step below) so SHA256SUMS.txt matches the assets 1:1.
        run: |
          cd app/build/outputs
-          sha256sum apk/*/release/*.apk bundle/*Release/*.aab > SHA256SUMS.txt
+          sha256sum apk/sideload/release/*.apk bundle/googlePlayRelease/*.aab > SHA256SUMS.txt
          cat SHA256SUMS.txt

+      - name: Require Play credentials for stable release
+        env:
+          PLAY_SERVICE_ACCOUNT_JSON: ${{ secrets.PLAY_SERVICE_ACCOUNT_JSON }}
+        if: ${{ !contains(needs.validate.outputs.version, '-') }}
+        run: |
+          if [ -z "$PLAY_SERVICE_ACCOUNT_JSON" ]; then
+            echo "::error::PLAY_SERVICE_ACCOUNT_JSON is required for stable Android releases"
+            exit 1
+          fi
+
+      - name: Submit preflighted Play draft to production review
+        env:
+          PLAY_SERVICE_ACCOUNT_JSON: ${{ secrets.PLAY_SERVICE_ACCOUNT_JSON }}
+        if: ${{ !contains(needs.validate.outputs.version, '-') }}
+        run: |
+          trap 'rm -f play-service-account.json' EXIT
+          printf '%s' "$PLAY_SERVICE_ACCOUNT_JSON" > play-service-account.json
+          ./gradlew promoteGooglePlayReleaseArtifact \
+            --update=production \
+            --version-code=${{ needs.validate.outputs.version_code }} \
+            --release-status=completed \
+            --release-name="Hermes-Relay ${{ needs.validate.outputs.version }}"
+
+      # Public distribution happens only after Play accepts the production
+      # submission above. This keeps a Play-detected release blocker from
+      # appearing after the sideload APK is already public.
      - name: Create GitHub Release
        uses: softprops/action-gh-release@v3
        with:
@@ -140,50 +221,13 @@ jobs:
          tag_name: android-v${{ needs.validate.outputs.version }}
          body_path: RELEASE_NOTES.md
          prerelease: ${{ contains(needs.validate.outputs.version, '-') }}
-          # Attach all four flavored artifacts — users sideload the
-          # `hermes-relay-<version>-sideload-release.apk` for the full
-          # Phase 3 / Tier 3/4/6 feature set; the
-          # `hermes-relay-<version>-googlePlay-release.aab` is what gets
-          # uploaded to Play Console. APK twin of the googlePlay flavor
-          # and AAB twin of the sideload flavor are included for parity
-          # (useful for diff tooling, not primary downloads).
+          # Deliberate 2-asset policy (#144): attach ONLY the installable
+          # sideload APK and Play AAB, plus checksums covering those files.
          files: |
-            app/build/outputs/apk/*/release/*.apk
-            app/build/outputs/bundle/*Release/*.aab
+            app/build/outputs/apk/sideload/release/*.apk
+            app/build/outputs/bundle/googlePlayRelease/*.aab
            app/build/outputs/SHA256SUMS.txt

-      - name: Upload to Play Console (production draft)
-        env:
-          PLAY_SERVICE_ACCOUNT_JSON: ${{ secrets.PLAY_SERVICE_ACCOUNT_JSON }}
-          HERMES_KEYSTORE_PASSWORD: ${{ secrets.HERMES_KEYSTORE_PASSWORD }}
-          HERMES_KEY_ALIAS: ${{ secrets.HERMES_KEY_ALIAS }}
-          HERMES_KEY_PASSWORD: ${{ secrets.HERMES_KEY_PASSWORD }}
-        # Runs only when the Play service-account secret is configured AND this is
-        # a stable tag (prereleases — versions containing a dash — are skipped so
-        # an `-rc.N` build never lands on the production listing). HERMES_KEYSTORE_PATH
-        # was exported into $GITHUB_ENV by the "Decode release keystore" step above
-        # and persists across steps in this job, so the AAB is release-signed.
-        #
-        # `publishGooglePlayReleaseBundle` is the flavor-scoped task — only the
-        # googlePlay AAB is uploaded (sideload is disabled via playConfigs in
-        # app/build.gradle.kts). The play{} block pins releaseStatus = DRAFT, so the
-        # build lands on the Production track as a DRAFT: CI does the upload, a human
-        # clicks "Start rollout" in Play Console. A bad tag can never auto-go-live.
-        if: ${{ env.PLAY_SERVICE_ACCOUNT_JSON != '' && !contains(needs.validate.outputs.version, '-') }}
-        run: |
-          printf '%s' "$PLAY_SERVICE_ACCOUNT_JSON" > play-service-account.json
-          ./gradlew publishGooglePlayReleaseBundle --track=production
-          rm -f play-service-account.json
-
-      - name: Play upload skipped (no secret)
-        env:
-          PLAY_SERVICE_ACCOUNT_JSON: ${{ secrets.PLAY_SERVICE_ACCOUNT_JSON }}
-        if: ${{ env.PLAY_SERVICE_ACCOUNT_JSON == '' }}
-        run: |
-          echo "ℹ️  PLAY_SERVICE_ACCOUNT_JSON not set — skipped Play Console upload." \
-            "GitHub Release artifacts are still published; upload to Play manually" \
-            "(see RELEASE.md §5)." >> "$GITHUB_STEP_SUMMARY"
-
      - name: Release summary
        env:
          HERMES_KEYSTORE_BASE64: ${{ secrets.HERMES_KEYSTORE_BASE64 }}
@@ -8,17 +8,66 @@ permissions:
  contents: write

 jobs:
-  build-cli-binaries:
-    name: Build cross-platform CLI binaries via Bun compile
+  validate-release:
+    name: Validate tag, branch, and version metadata
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: desktop
+    outputs:
+      version: ${{ steps.version.outputs.version }}
    steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v7
+        with:
+          node-version: '22'
+          cache: npm
+          cache-dependency-path: desktop/package-lock.json
+
+      - name: Install deps
+        run: npm ci
+
+      - name: Extract and validate tag version
+        id: version
+        shell: bash
+        run: |
+          set -euo pipefail
+          version="${GITHUB_REF_NAME#cli-v}"
+          if [[ -z "$version" || "$version" == "$GITHUB_REF_NAME" ]]; then
+            echo "Expected a cli-v* tag, got $GITHUB_REF_NAME" >&2
+            exit 1
+          fi
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+          npm run check:version-sync -- --expect "$version"
+
+      - name: Verify tagged commit belongs to main
+        shell: bash
+        working-directory: .
+        run: |
+          set -euo pipefail
+          git fetch origin main --no-tags
+          tag_commit="$(git rev-parse "${GITHUB_REF_NAME}^{commit}")"
+          if ! git merge-base --is-ancestor "$tag_commit" origin/main; then
+            echo "CLI releases must be tagged from main; $tag_commit is not in origin/main" >&2
+            exit 1
+          fi
+
+  build-cli-binaries:
+    name: Build cross-platform CLI binaries via Bun compile
+    runs-on: ubuntu-latest
+    needs: validate-release
+    defaults:
+      run:
+        working-directory: desktop
+    steps:
+      - uses: actions/checkout@v7

      - name: Setup Node.js (for npm ci + tsc)
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
        with:
          node-version: '22'
          cache: npm
@@ -35,6 +84,9 @@ jobs:
      - name: Type-check
        run: npm run type-check

+      - name: Test CLI
+        run: npm test
+
      - name: Build dist/ (tsc)
        run: npm run build

@@ -100,14 +152,15 @@ jobs:
  build-windows-tray-installer:
    name: Build Windows tray installer
    runs-on: windows-latest
+    needs: validate-release
    defaults:
      run:
        working-directory: desktop
    steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7

      - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
        with:
          node-version: '22'
          cache: npm
@@ -130,20 +183,18 @@ jobs:
      - name: Build dist/ (tsc)
        run: npm run build

+      - name: Check and lint tray shell
+        run: npm run tray:fmt && npm run tray:lint
+
      - name: Test tray shell
        run: npm run tray:test

+      - name: Install NSIS
+        run: choco install nsis --yes --no-progress
+
      - name: Build tray installer
        run: npm run tray:build

-      - name: Normalize installer asset name
-        shell: pwsh
-        run: |
-          New-Item -ItemType Directory -Force -Path dist/tray | Out-Null
-          $installer = Get-ChildItem -Path tray/src-tauri/target/release/bundle/nsis -Filter '*_x64-setup.exe' | Select-Object -First 1
-          if (-not $installer) { throw 'NSIS installer was not produced' }
-          Copy-Item -Force $installer.FullName dist/tray/hermes-relay-desktop-windows-x64-setup.exe
-
      - name: Smoke-test tray exe launch
        shell: pwsh
        run: |
@@ -154,17 +205,22 @@ jobs:
          New-Item -ItemType Directory -Force -Path $smokeHome | Out-Null
          $env:USERPROFILE = $smokeHome
          $env:HOME = $smokeHome
-          $proc = Start-Process -FilePath tray/src-tauri/target/release/hermes-relay-desktop.exe -WindowStyle Hidden -PassThru
+          $env:HERMES_RELAY_CLI_PATH = (Resolve-Path dist/bin/hermes-relay-win-x64.exe).Path
+          $proc = Start-Process -FilePath tray/target/release/hermes-relay-tray.exe -WindowStyle Hidden -PassThru
          Start-Sleep -Seconds 5
          if ($proc.HasExited) { throw "tray app exited early with code $($proc.ExitCode)" }
+          $proc.Refresh()
+          if ($proc.MainWindowHandle -ne 0) { throw 'menu-only systray created an application window' }
+          $traySize = (Get-Item tray/target/release/hermes-relay-tray.exe).Length
+          if ($traySize -gt 5242880) { throw "tray executable exceeds 5 MiB: $traySize bytes" }
          Stop-Process -Id $proc.Id -Force
-          Write-Host "tray launch smoke OK pid=$($proc.Id)"
+          Write-Host "menu-only tray launch smoke OK pid=$($proc.Id) bytes=$traySize"

      - name: Upload Windows tray release asset
        uses: actions/upload-artifact@v4
        with:
-          name: cli-windows-tray-installer
-          path: desktop/dist/tray/hermes-relay-desktop-windows-x64-setup.exe
+          name: cli-windows-installer
+          path: desktop/dist/tray/hermes-relay-windows-x64-setup.exe
          retention-days: 7

  publish-release:
@@ -176,13 +232,13 @@ jobs:
    steps:
      # Needed so CLI_RELEASE_NOTES.md is available to render into the release body
      # (the other publish-release steps only consume downloaded build artifacts).
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7

      - name: Extract CLI version
        id: version
        run: echo "version=${GITHUB_REF_NAME#cli-v}" >> "$GITHUB_OUTPUT"

-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
        with:
          path: release-assets

@@ -221,5 +277,5 @@ jobs:
            release-assets/cli-binaries/hermes-relay-linux-x64
            release-assets/cli-binaries/hermes-relay-darwin-x64
            release-assets/cli-binaries/hermes-relay-darwin-arm64
-            release-assets/cli-windows-tray-installer/hermes-relay-desktop-windows-x64-setup.exe
+            release-assets/cli-windows-installer/hermes-relay-windows-x64-setup.exe
            release-assets/SHA256SUMS.txt
@@ -16,7 +16,7 @@ jobs:
    outputs:
      version: ${{ steps.version.outputs.version }}
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7

      - name: Extract version from tag
        id: version
@@ -33,7 +33,7 @@ jobs:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7

      - name: Set up Python 3.11
        uses: actions/setup-python@v6
@@ -68,7 +68,7 @@ jobs:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7

      - name: Set up Python 3.11
        uses: actions/setup-python@v6
@@ -77,6 +77,9 @@ hermes-agent-fork/
 .claude/
 .claude-launcher/

+# Per-issue dev-loop brief generated by scripts/start-issue.sh into each worktree
+ISSUE-BRIEF.md
+
 # Kotlin compiler cache
 .kotlin/

@@ -88,5 +91,5 @@ keystore.properties
 .smoke-relay.pid
 .smoke-relay.log

-# Generated tray frontend vendor assets copied from desktop/node_modules
+# Legacy generated desktop tray assets may remain after upgrading a worktree.
 desktop/tray/ui/vendor/
@@ -32,6 +32,19 @@ then `docs/spec.md` and `docs/decisions.md`.
  zero runtime deps, strict TS + ES modules, ship compiled `dist/`. Full
  per-language style and the dev loop live in CLAUDE.md → "Code Style".

+## Review guidelines
+
+- Report only actionable correctness, security, compatibility, or release-risk
+  findings; avoid stylistic preferences unless they violate a documented rule.
+- Treat the vanilla Hermes upstream boundary as release-critical. Flag any
+  default-path dependency on relay-only or fork-only server behavior.
+- Check that changes preserve public-repo writing hygiene and do not expose
+  secrets, private infrastructure, or personal information.
+- Use the affected surface's CI result as evidence, but do not imply Android UI
+  or device behavior was proven without an explicit on-device verification.
+- Prioritize findings that warrant holding the merge. State the impacted path
+  and the concrete failure mode.
+
 ## Public-repo writing hygiene

 Everything committed is public. In CHANGELOG, DEVLOG, README, docs, and release
@@ -6,23 +6,248 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/), and this

 ## [Unreleased]

+## [Android 1.4.6] - 2026-07-15
+
 ### Added

- **Desktop CLI: `hermes-relay audit`.** Shows what the remote agent has actually run on this machine through the desktop tools — tool, status, and a short detail per call — read from a local log, no network or auth. Answers "what did the agent just do?" at a glance.
- **Desktop CLI: `hermes-relay relay`.** Inspect the relay server itself: `relay info` (version, uptime, sessions — on the relay host), `relay security` (runtime auth toggles), and `relay context` (audit the system-prompt context the relay injects into the agent, which works from a remote machine with your session).
- **Desktop CLI: background daemon.** `hermes-relay daemon start` runs the headless tool router in the background (no console window, survives closing the terminal), with `daemon stop` and `daemon status` to manage it. `daemon status` reports state, uptime, relay, and advertised-tool count; bare `daemon` still runs in the foreground. Logs go to `~/.hermes/daemon.log`.
- **Desktop CLI: per-command help.** Every subcommand now answers `--help`, and `devices`/`sessions`/`plugins`/`voice`/`relay` print their own usage (sub-commands, flags, examples) instead of a terse "unknown sub-verb".
- **Desktop CLI: startup banner.** A slim "Hermes Relay" wordmark shows atop `--help`, the first-run welcome, and the chat REPL — and `hermes-relay logo` prints it on demand. Suppressed for piped/`--json`/`--no-color` output.
-
-### Changed
-
- **Desktop CLI: visual + ergonomics refresh.** A single color theme across the CLI, aligned tables for `devices`/`sessions`, status dots for on/off states, and progress spinners for slow operations (the multi-endpoint pairing probe and the gateway connect) so nothing looks hung. Errors now suggest the fix (e.g. re-pair on auth failure).
- **Desktop CLI: smoother pairing.** The multi-endpoint probe shows per-endpoint progress and latency; a near-expiry session warns before it fails and prints the exact re-pair command; and a bare `ws://host` (no port) defaults to `:8767`.
- **Desktop CLI: voice + consent transparency.** `voice` now surfaces enhanced-voice capabilities (Gemini tone tags / persona, xAI speech tags); the desktop-tool consent prompt is clear that it persists per relay and points at `hermes-relay audit`; and computer-use's observe → grant → act flow is documented in `--help`.
+- **Profile display order and visibility are customizable per connection.** The profile manager can reorder every profile, including Server default, selectively hide inactive profiles, restore hidden active profiles, and reset the saved presentation without changing server configuration.
+- **Agent icons can come from the phone or paired host.** The profile manager offers the Android document picker and can import conventional host files such as `avatar.png` or `profile.jpg`, storing a per-connection/profile copy on the phone.

 ### Fixed

- **Crash when a dashboard connection drops mid-check.** A transient network blip on the dashboard session check (e.g. a pooled connection aborting over Tailscale) could close the app: the check returned a result type but re-threw the network error instead of reporting it, and it surfaced on the main thread. The check now reports the failure cleanly, and the connection probe degrades gracefully instead of ever crashing.
+- **Profile image import reports host compatibility accurately.** Android now distinguishes an older Relay without the optional avatar endpoint from a profile that genuinely has no conventional image, and presents the system file picker as a clear fallback.
+- **Server-default chats use one profile session scope.** Android resolves the Server default row through Hermes' sticky active profile before Gateway create/resume and dashboard session operations, so the drawer, transcript, writes, and agent no longer split across different profile databases when the dashboard was launched under another profile.
+
+## [Plugin 1.4.2] - 2026-07-15
+
+### Added
+
+- **Profile avatars are available to paired clients.** Relay discovers conventional direct-child profile images such as `avatar.png` and `profile.jpg`, validates their type, size, and profile boundary, and serves them through an authenticated profile route.
+
+### Fixed
+
+- **Relay follows Hermes' sticky active profile.** The advertised Server default identity, model, SOUL, profile metadata, and avatar now come from the profile selected by Hermes' `active_profile` marker instead of always describing the root profile.
+
+## [1.4.5] - 2026-07-15
+
+### Fixed
+
+- **Running Android chats survive session switching.** On the upstream Gateway path, opening another chat, profile, draft, or Thread now detaches the visible stream without interrupting Hermes. Each running session keeps its own durable UI checkpoint, reconnects the shared event socket across route loss, and reattaches through `session.activate`/`session.resume` when selected again. SSE fallback remains intentionally single-stream and cancels on navigation.
+- **Expired Gateway prompts no longer remain actionable.** Android collapses matching secret and sudo cards when Hermes emits their expiry events, recognizes late expired responses, and is ready for an upstream session-scoped approval-expiry contract without guessing the server timeout.
+- **Provider wait notices stay transient.** Canonical Hermes provider-wait, reconnect, and continuation notices now use Chat's live status line instead of accumulating in the assistant reasoning transcript.
+
+## [0.4.0-alpha.2] - 2026-07-13
+
+### Added
+
+- **Desktop chat can use Relay typed streaming over WSS.** The opt-in `--relay-chat` mode sends `chat.send`, renders typed `stream.event` v1 assistant/tool/artifact/memory/skill/error lifecycles, de-duplicates reconnect events, and preserves the existing gateway chat path as the default.
+- **Pending computer-use grants are manageable from the CLI.** `hermes-relay grants` lists and interactively approves or rejects local grant-bridge requests, with explicit `approve`, `reject`, and JSON forms for scripts.
+- **Desktop use has a durable CLI control plane.** `hermes-relay computer-use` persists enablement, reports daemon and grant state, and cancels active task-scoped grants through the local daemon bridge.
+
+### Changed
+
+- **The optional Windows systray is a native context menu for the CLI.** The WebView dashboard, embedded terminals, overlays, chat, sessions, plugins, voice, and settings windows were removed. The sub-megabyte tray now invokes the single installed CLI for TUI, pairing, daemon control, grants, audit, and logs.
+- **Systray daemon controls are state- and privilege-aware.** The menu cross-checks PID liveness, identifies User versus Administrator daemons, disables invalid lifecycle actions, shows pending-grant counts and version metadata, toggles sign-in startup, and requests UAC only for an explicit elevated daemon start or restart.
+- **Systray desktop-use controls preserve safety across restart and elevation.** The menu enables or disables the persistent capability, displays active grant mode and expiry, raises a native pending-approval alert, supports immediate cancellation, and warns while Administrator input authority is active.
+- **CLI and tray releases use one synchronized version contract.** A single npm lifecycle keeps package, compiled CLI, Cargo, and installer metadata aligned; local verification and tag CI reject drift, off-main release tags, and untested CLI changes before publishing.
+
+### Fixed
+
+- **Compiled CLI diagnostics report the physical executable.** `hermes-relay doctor` no longer mistakes Bun's virtual embedded path for the installed binary, so PATH and install-directory checks describe the executable that actually launched.
+
+## [1.4.4] - 2026-07-12
+
+### Added
+
+- **Android adds AI-assisted Spanish.** A repeatable translation harness and freshness checks keep catalogs structurally complete while tracking fluent review separately.
+- **Diagnostics exposes the Relay contract.** A manual refresh reports the installed plugin version, protocol version, capability count, profile enablement state, and last-check time; shared issue reports include sanitized Android and device metadata.
+- **What’s New links to complete release history.** The polished modal now provides direct access to every bundled version, with large-text screenshot coverage.
+
+### Fixed
+
+- **Profile operations stay inside the selected Hermes profile.** Session list, history, rename, delete, and in-flight recovery no longer fall through to the default database after a scoped failure; optimistic writes roll back and repeated recovery failures stop cleanly.
+
+## [1.4.3] - 2026-07-11
+
+### Added
+
+- **Language switching is available inside the app.** Settings → Appearance now offers System default, English, and Simplified Chinese, stays synchronized with Android's per-app language setting, and persists the choice on Android 12 and lower.
+
+### Fixed
+
+- **Release builds reject unsupported collection APIs.** CI now scans Kotlin sources and final minified APK bytecode for Java 21 list endpoint calls that can crash on Android versions before API 35.
+
+## [1.4.2] - 2026-07-11
+
+### Added
+
+- **Android now supports Simplified Chinese.** Chat, Manage, Voice, connection setup, settings, diagnostics, notifications, accessibility labels, and both product flavors follow the device language, with Android per-app language discovery on supported versions.
+- **Localization is contributor-ready.** CI enforces resource, plural, and format-argument parity; translated README and VitePress entry points establish a repeatable path for adding languages without duplicating fast-moving technical references.
+
+### Fixed
+
+- **Connection scan and queued-message counts use proper plurals.** Count formatting no longer depends on English-only suffix arguments and cannot fail when a locale needs a different plural structure.
+
+## [1.4.1] - 2026-07-11
+
+### Added
+
+- **Background work is visible in Standard Chat.** A live process strip opens a mobile process sheet with running or recent state, output, elapsed time, Stop, and Dismiss controls. It remains compatible with older Hermes servers that do not expose process details.
+- **Background work has a clearer Chat home.** Realtime work appears as a titled task card with working, waiting, delivery, and completion states, queued work, and an expandable tool timeline.
+- **Multi-image messages open as galleries.** Adjacent images render in a compact grid and open at the selected image in a swipeable viewer while preserving sensitive-media reveal and original-file actions.
+- **Voice gains commands and presets.** Spoken commands can stop speech, cancel background work, pause or resume listening, repeat a result, or start Standard voice chat. Hands-free, Low latency, Careful tools, and Quiet presets tune existing interaction settings.
+
+### Changed
+
+- **Streaming Chat content stays steadier and more readable.** Settled prose and headings adopt final Markdown styling during generation, wide tables scroll with readable columns, the thinking indicator respects system motion and TalkBack settings, and the jump-to-bottom control counts unread messages.
+- **Offline Demo mode no longer starts Voice.** The mic action now explains locally that a Hermes connection is required.
+
+### Fixed
+
+- **An in-flight Chat turn survives reopening the app.** Session-backed replies restore partial text, live reasoning, lifecycle status, tool/subagent cards, background-task state, and unanswered approval or clarification cards. Current Hermes gateways reattach to the same running turn; older or finished sessions reconcile from history without duplicating the prompt or losing the final answer.
+- **Realtime Agent delivery is protected.** Hermes results use exact provider speech where supported, delivery validation, generation-safe confirmation, and a single relay-TTS fallback if the provider closes or rejects delivery. Voice commands no longer leave synthetic cancellation turns or mute a later background answer.
+- **Standard Chat receives background-process completions automatically.** When Hermes completes detached work and starts a follow-up turn on the originating Gateway session, Android shows the unsolicited assistant stream in the open conversation and reconciles history after a cold reconnect. The synthetic process prompt is rendered as a compact process notice rather than a user-authored message.
+
+## [1.4.0] - 2026-07-09
+
+### Added
+
+- **Android model pickers can refresh the server catalog.** Chat's model sheet and Manage's main/profile model dialogs now expose upstream's explicit **Refresh Models** action, so dynamic/custom provider model lists can be reloaded on demand without making every picker open probe providers.
+- **Server-backed session cleanup plumbing.** The dashboard client now supports single-session export, the upstream `/api/sessions/prune` route with a mandatory dry-run preview before destructive apply, plus soft archive/restore helpers and an `archived` session-list filter for the Manage surface.
+- **Notification triggers MVP.** Settings → Notifications now has explicit opt-in proactive rules for the Notification companion: match by app package plus optional title/text filters, post a safe local "Ask Hermes?" prompt, show the latest trigger activity, and pause everything instantly with a kill switch.
+- **Android bridge: multi-device targeting.** The relay can keep multiple Android bridge clients connected at once, route commands by `device` selector (`phone`, `pixel`, `fold`, `boox`, `note`, `notemax`, `tablet`, or device ID), expose `/bridge/devices` and `/bridge/select-active`, and advertise an optional `device` argument on the `android_*` tool schemas.
+- **Voice: a second long request gets queued, not refused.** Ask for another long task while one is already running in the background and it's now queued (up to three) and starts automatically when the current one finishes — with a short spoken transition. The task card shows "+N queued", and cancelling the current task clears the queue.
+- **Voice: background answers start speaking sooner and can never be silently lost.** The spoken summary now streams as it's generated (it used to be held until fully complete — a noticeable dead gap, then the whole answer at once). Delivery is verified two ways: the summary must actually reflect the answer's content (not just avoid known filler phrases), and if no spoken delivery lands within 30 seconds the answer is posted as text instead of vanishing.
+- **Voice: tap the finished-task card to hear the answer again.** After a background task's card settles to "finished," tapping it replays the delivered answer. The card also now shows in the compact voice view (it previously existed only in the full-screen layout), a "Drafting the answer…" status appears as the reply is being composed, and leaving voice mode with a task still running leaves a note in chat so the work stays visible.
+- **Voice: quick questions answered while a background task runs.** Realtime voice used to refuse *any* second request while a long task ran in the background — even a two-second lookup. A quick second ask is now answered inline on a side session (within the same few-second window that decides backgrounding); anything that turns out to be long still gets the "a task is already running" answer, and the running task is never disturbed.
+- **Voice: the background-task card no longer vanishes mid-answer.** The card used to disappear the instant the spoken answer started (exactly when the waveform returned), reading as the task being lost. It now settles to a "Background task finished." state, lingers for a few seconds while the answer plays, then dismisses itself — and its ✕ during that settled state just dismisses the card instead of sending a cancel.
+- **Voice: the "Thinking" pill no longer spins forever.** The server streams its drafting text as an internal pseudo-tool that never reports completion, and the app rendered it as a live tool pill — which then ran indefinitely in both chat and the voice overlay. Internal tool events no longer become pills (their text still feeds the thinking trace).
+- **Voice: background-task answers can't be lost to a stray cancel.** Tapping cancel/stop after a background task had already finished used to mark the finished run "cancelled" — losing the answer that was about to be spoken. Cancel now only cancels a run that's actually still running; stopping the current speech works as before.
+- **Voice: no more spoken run IDs or phantom queue state.** The realtime voice model no longer reads 32-character run IDs aloud after starting a background task (identifiers stay out of everything it's asked to speak), no longer claims a request was queued unless the relay accepted it, and a completed task's answer is spoken directly — deferral filler like "one moment while I look that up" in place of a finished result now triggers the fallback that speaks the real answer.
+- **Voice: finished-task answers keep the realtime voice.** A completed background task's answer is now spoken by the same realtime voice you've been talking to — read word for word from the authoritative Hermes answer — instead of switching to the standard TTS voice mid-conversation. The answer always lands: if the realtime model goes off-script or the provider connection drops, standard TTS speaks it, and if you start talking mid-delivery it's posted as text instead of interrupting you. The "When the answer is ready" setting keeps its four modes (Exact / Summary / Notify / Show), now explained behind an info icon in Voice Settings.
+- **Voice: realtime models refreshed.** OpenAI realtime now defaults to `gpt-realtime-2.1` (with the cheaper `gpt-realtime-2.1-mini` selectable), the versioned `grok-voice-think-fast-1.0` pin is available alongside xAI's `grok-voice-latest` alias, and session logs record which model the provider *actually* served — so provider-side alias moves no longer happen invisibly.
+- **Voice: session logs clean up after themselves.** Realtime voice session logs are swept after 14 days by default (`realtime_voice.run_retention_days`, 0 disables), and the per-response TTS audio capture is now opt-in debug tooling (`debug_audio_tap`) instead of an always-on multi-MB tap.
+- **Voice: one-command delivery health report.** `python -m plugin.relay.realtime_agent.report` summarizes recent voice deliveries — how many were spoken by the realtime voice vs fell back to TTS or text, and why — for quick health checks after live testing.
+
+### Changed
+
+- **Bootstrap compatibility layer slimmed to true gaps.** The optional compatibility hook no longer injects session CRUD/messages or the legacy skills list — current Hermes serves those natively; it now covers only surfaces with no native replacement yet (session search, memory, legacy skill detail/toggle, config, available-models, and the slash-command middleware). Older pre-session-API Hermes builds degrade to the standard completions/runs chat paths.
+- **Dependency floor: aiohttp ≥ 3.14.1.** Raised from 3.9 across plugin requirements and package metadata to the patched line covering the 2026 aiohttp security advisories.
+
+### Fixed
+
+- **Realtime voice recovers after background route loss.** A recorded turn now waits for a relay-confirmed resumed socket, retains unacknowledged follow-up PCM for replay, and reports transport rejection instead of sitting on a dead persistent connection. Resume handshakes are coalesced, and the relay requires a valid resume claim before replacing the active phone socket, so a slower stale connection cannot detach background-result delivery. Long-lived sessions start their bounded retry window when the route actually drops instead of at voice-mode entry, and a bare socket open cannot reset it. Late callbacks from a retired session are ignored. Exiting voice mode clears its detached reconnect and confirmation state before another session opens; rejected or unacknowledged cancels no longer leave an undismissable background-task pill. Provider transcription no longer impersonates active microphone capture, Stop settles the local turn even when the route is gone, and provisional `Listening...` / `Still working...` rows cannot remain stuck in chat.
+- **xAI exact background answers bypass model deferral.** Non-structured **Exact** deliveries now use xAI's provider-native forced speech event, preserving the selected realtime voice and normal assistant history while speaking the authoritative Hermes answer without asking the model to follow a read-verbatim prompt. Structured results and summary modes still use natural model summarization, and the validator plus standard-TTS fallback remain as safety nets.
+- **Background voice handoffs no longer repeat themselves.** If the realtime provider already spoke an acknowledgement before calling Hermes, promotion keeps that first line and suppresses the redundant "running in the background" follow-up; silent tool calls still receive the configured spoken handoff. Provider protocols that report both response creation and output-item creation now also produce one client `response.started` event instead of two.
+- **Realtime voice model and voice picks now apply to the next session.** Voice Settings persists the selected Realtime Agent model and voice per connection/profile and sends both when opening a session, so choosing a pinned model immediately controls the next session instead of requiring **Save realtime agent** to rewrite the relay config. The active voice UI reflects the override, changing it retires any prewarmed session, and the choice survives an app restart.
+- **Fresh realtime sessions emit one ready event.** Android's required `session.start` acknowledgement no longer causes the relay to send a second `voice.session.ready`, avoiding duplicate event IDs and duplicate session-ready telemetry on every new voice conversation.
+- **Relay media can no longer serve credential files.** `/media/by-path` now always blocks paths that resolve into credential or system locations (`~/.hermes/.env`, `auth.json`, `config.yaml`, OAuth/MCP token stores, `pairing/`, `~/.ssh`, and similar) even in the default permissive mode — mirroring upstream Hermes' media-delivery hardening — so a prompt-injected `MEDIA:` marker can't deliver live secrets to a paired phone. Symlinks are resolved before the check, and the relay's own QR-signing secret and session-token store are covered too.
+- **Long agent turns no longer die or duplicate at the transport.** Gateway chat (Android and the desktop CLI) now gives `prompt.submit` up to 30 minutes to acknowledge — matching upstream desktop and the server's own turn ceiling — instead of short generic RPC timeouts that could falsely fall back to SSE (duplicating the turn on Android) or kill a legitimately long deep-reasoning turn. Turn liveness is governed by idle-progress watchdogs (no events at all for a stretch), never a hard cap while output is still streaming.
+- **Manage → Models keeps providers that still need keys.** Newer Hermes hides unconfigured providers from the model catalog unless a management UI opts in; Android Manage now opts in and keeps rendering greyed provider rows with their key-setup guidance on both old and new servers. In-chat model picking is unchanged (configured providers only).
+- **Phone-local context actually reaches the server on fallback chat paths.** The sessions/runs streaming payloads carried voice-intent traces, card dispatches, and attachments in fields the server never reads — silently dropping them. That context now rides channels the server actually consumes (a per-turn context digest, real history fields where they exist, inline images on the completions path), and any attachment with no supported channel is reported instead of silently discarded.
+- **Relay plugin works under the native `hermes plugins install` path.** The plugin's runtime imports assumed the repo's editable layout, so upstream's native installer (which loads plugins under its own package namespace) broke `hermes relay start` and `hermes pair` with `ModuleNotFoundError: No module named 'plugin'`. All runtime imports are now package-relative, the dashboard module boots correctly when the upstream web server loads it standalone, and `hermes relay doctor` now exercises the real import chain so this class of breakage can't pass doctor again. (#165)
+- **Installer handles modern venv layouts.** `install.sh` now autodetects the classic venv, uv-managed `.venv`, and containerized layouts — and everything it generates (the systemd unit and all four command shims) points at the interpreter it actually detected instead of a hardcoded classic path. On immutable container images it steers to the native install path with a clear message instead of dying mid-run. (#165)
+- **Doctor catches dashboard URLs pointed at the wrong Hermes surface.** `hermes relay doctor` now distinguishes the dashboard/Manage surface from an API-server/headless backend URL and tells operators to use `hermes dashboard` when a configured dashboard URL is actually pointing at `hermes serve` / the API server.
+- **Doctor and installer catch stale duplicate plugin copies.** The gateway plugin loader picks a discovered plugin by manifest name, so a second directory declaring `name: hermes-relay` (a leftover backup copy or a stray extra install) could win and make the gateway load stale code — silently ignoring every later deploy. `hermes relay doctor` now warns when more than one directory under the plugins dir declares the same plugin name, and `install.sh` removes any such duplicate so only the canonical plugin symlink remains.
+- **Crash-safety on Android 14 and earlier.** Built against SDK 35, Kotlin's `removeFirst()`/`removeLast()` resolve to the new Java `List` methods that don't exist below Android 15, crashing older devices. All such calls in the app are now `removeAt(...)`, and Tink (pulled in by encrypted storage) is pinned ahead of the transitive version whose `HybridConfig` tripped the same Google Play pre-launch check.
+- **No crash when a relay address is malformed.** A corrupt or hand-edited pairing address with an invalid host could crash the app the moment it opened the relay connection (the connection is built on a background thread, so the error escaped uncaught). A bad relay address is now handled as a normal connection failure — shown as disconnected with a "re-pair to refresh" note — instead of crashing. The same guard now also covers the relay's media, session, and voice HTTP calls. (relay half of #131)
+- **Voice: cleaner error recovery.** A failed or timed-out voice turn no longer shows the same error twice (the top overlay banner and a duplicate bottom banner) and can now be **dismissed**, not just retried — so a stuck error state can't block the screen.
+- **Voice: fallback-spoken answers no longer play into a frozen overlay.** When an answer is delivered by the standard TTS fallback (or replayed from the finished-task card), the voice screen now shows the waveform and the answer text while it speaks — previously it sat on "Thinking" with no visuals even though audio was playing.
+- **Voice: a quiet realtime session no longer dies with a raw provider error.** xAI ends a realtime conversation after 900 seconds of inactivity, and no keepalive traffic resets that timer — so a voice session left open through a long background task (or simply left open) died with a raw provider error. That provider timeout is now treated as routine expiry: the session ends cleanly with no error banner, and your next voice turn transparently opens a fresh provider conversation that picks up from the same durable Hermes chat session.
+- **No crash when a malformed server address reaches a chat send.** The three streaming chat paths built their HTTP request before any error handling, so a corrupt or hand-edited API URL could throw instead of failing the turn gracefully. They now surface "Invalid server address — edit the connection's API URL or re-pair" through the normal in-chat error channel (closes the remaining #131 crash-class gap).
+- **Demo mode: typing a message now gets an honest reply.** Sending a message in the offline demo used to do nothing (the composer silently ignored it, reading as broken). The demo now echoes your message and answers with a short notice explaining it's an offline sample, pointing at the Connect action to chat for real.
+- **Voice: realtime conversations reliably reach your chat history.** Turns the realtime voice model answers directly (without calling Hermes) are folded into the chat session on your next message — but on the default gateway connection that hand-off could be deferred indefinitely, so the agent never learned what was said in voice. The turn that carries them now routes so the sync actually lands. Synced voice turns also render cleanly when a chat reloads: a quiet "Realtime Agent" chip instead of a raw provenance footnote, and no more duplicated voice exchange after the sync.
+
+## [1.3.0] - 2026-07-06
+
+### Added
+
+- **Voice settings: edit your server's voice engine.** Voice settings now has a **Server voice config** section that reads and writes the host's text-to-speech and speech-to-text settings — provider, voice, model, language, and per-provider options — over the dashboard, the same config the official desktop app edits. It includes an **ElevenLabs voice picker** that lists the voices available on your server's ElevenLabs key (and tells you when no key is set). Works on the no-plugin (Standard) path; sign in to Manage to use it.
+- **Desktop CLI: `hermes-relay audit`.** Shows what the remote agent has actually run on this machine through the desktop tools — tool, status, and a short detail per call — read from a local log, no network or auth. Answers "what did the agent just do?" at a glance.
+- **Desktop CLI: `hermes-relay relay`.** Inspect the relay server itself: `relay info` (version, uptime, sessions — on the relay host), `relay security` (runtime auth toggles), `relay context` (audit the system-prompt context the relay injects into the agent, which works from a remote machine with your session), and `relay queue` (list — or `--clear` / `--cancel <id>` — the messages your agent queued for an offline phone; on the relay host).
+- **Desktop CLI: background daemon.** `hermes-relay daemon start` runs the headless tool router in the background (no console window, survives closing the terminal), with `daemon stop` and `daemon status` to manage it. `daemon status` reports state, uptime, relay, and advertised-tool count; bare `daemon` still runs in the foreground. Logs go to `~/.hermes/daemon.log`.
+- **Desktop CLI: per-command help.** Every subcommand now answers `--help`, and `devices`/`sessions`/`plugins`/`voice`/`relay` print their own usage (sub-commands, flags, examples) instead of a terse "unknown sub-verb".
+- **Desktop CLI: startup banner.** A slim "Hermes Relay" wordmark shows atop `--help`, the first-run welcome, and the chat REPL — and `hermes-relay logo` prints it on demand. Suppressed for piped/`--json`/`--no-color` output.
+- **Animated "thinking" indicator.** While a reply streams, the in-bubble working indicator can now be a small dot-matrix animation instead of the three dots. Pick a motion (Wave, Pulse, Bounce, Sparkle) and a color (match-text or a brand accent) in Chat settings, with a live preview. It follows light/dark and your app theme, and goes static when animations are turned off.
+- **Proactive messages from the agent to your phone.** Your Hermes agent can reach out to the paired phone on its own — via `send_message target=phone` or a cron `deliver=phone`. Messages surface as a system notification, collect in a dedicated Hermes inbox, and can be injected into the active chat to continue the conversation (selected per message). Off by default and gated on pairing: nothing is pushed unless you enable it on the server (`PHONE_ENABLED`) and opt in on the phone ("Let Hermes message me"). Delivered over the existing relay connection through the upstream platform-plugin API (no fork).
+- **Reply to your agent's messages (two-way).** A proactive message is now a conversation, not a one-way ping: reply straight from the notification (inline Reply) or from the Hermes inbox, and your answer goes back to the agent and continues the same thread. The phone behaves like any other Hermes messaging platform — the reply arrives as an inbound message the agent processes and answers. Rides the same paired relay connection; no extra setup beyond the proactive opt-in above. If your phone is offline when the agent answers, the message is queued and delivered when you reconnect — not lost.
+- **Pick your font.** A Font picker in Appearance sets the app-wide typeface — **Inter** (the new default), **Nunito**, or your **system** font — each previewed in its own face and applied instantly across the app, no restart. Code and timestamps stay monospaced. (Bundled faces are SIL OFL.)
+- **Quick Controls in Settings.** A Quick Controls card at the top of Settings groups the switches you flip most often — **Persistent connection** and **Turn-complete alerts** — so they're one tap from the Settings root instead of buried in a sub-screen.
+- **Connections: a cleaner list and a tabbed detail.** Settings → Connections is now a scannable list — each server shows an **Active** badge and an at-a-glance capability summary (API · Dashboard · Voice · Relay) — and tapping a server opens a focused detail screen with **Overview**, **Routes**, **Advanced**, and **Security** tabs. Rename / re-pair / revoke / remove moved into the detail's **⋮** menu, and **relay sessions** (review and revoke the phones paired with that server) get a clear home under Security.
+- **Keep connected through deep sleep (sideload).** When **Persistent connection** is on, Settings offers a one-tap "Allow unrestricted battery" prompt so the connection survives Android's deep-sleep (Doze) — without it, the OS pauses background networking after the screen's been off a while even with a foreground service. (Sideload only; Google Play restricts this permission.)
+
+### Changed
+
+- **Reporting a diagnostic now files the right kind of issue.** The Report button on a diagnostics entry used to turn routine log lines into "[Bug]" GitHub issues with an empty template. Now informational entries first ask "what were you expecting to happen?" and file as a "[Diagnostic]" question, error entries keep the direct bug flow, and every report carries the connection mode you were actually on instead of a placeholder line. (#155, #154, #146)
+- **Simpler release downloads.** Each Android release on GitHub now attaches just two files — the tap-to-install sideload APK and the Play Store upload bundle — plus checksums, with the release notes leading with the one file most people want. The extra "parity/testing" artifacts are gone from the release page (still reproducible from the tag via CI). (#144)
+- **Clearer, snappier voice capture and playback.** Voice now engages the device's echo-cancellation and noise-suppression while recording (matching the desktop's microphone setup), and requests audio focus before the first reply so the opening words aren't clipped on a cold start. Listening timing also matches the official desktop: auto-stop ~1.25s after you stop speaking (was 3s), give up after 12s with no speech, and cap a turn at 60s.
+- **Refreshed chat look.** Message bubbles are wider and denser, each assistant turn shows a small Hermes avatar to its left (once per group), and code blocks are richer — a language label, a copy button, and a clearer inset so fenced code and inline `code` no longer blend into the bubble.
+- **Desktop CLI: visual + ergonomics refresh.** A single color theme across the CLI, aligned tables for `devices`/`sessions`, status dots for on/off states, and progress spinners for slow operations (the multi-endpoint pairing probe and the gateway connect) so nothing looks hung. Errors now suggest the fix (e.g. re-pair on auth failure).
+- **Desktop CLI: smoother pairing.** The multi-endpoint probe shows per-endpoint progress and latency; a near-expiry session warns before it fails and prints the exact re-pair command; and a bare `ws://host` (no port) defaults to `:8767`.
+- **Desktop CLI: voice + consent transparency.** `voice` now surfaces enhanced-voice capabilities (Gemini tone tags / persona, xAI speech tags); the desktop-tool consent prompt is clear that it persists per relay and points at `hermes-relay audit`; and computer-use's observe → grant → act flow is documented in `--help`.
+- **Persistent connection (was "keep chat connected").** The background keep-alive and its notification are reframed from a "chat connection" to your overall connection to Hermes — it holds the app's connection open in the background so messages and live features stay responsive, and for relay-paired setups also keeps device control and notification mirroring reachable. The toggle moved out of Chat settings into the new top-level Quick Controls card.
+- **Chat is the home; simpler top-level navigation.** The Chat / Manage / Bridge mode strip is gone — Chat is now full-height, and Manage and Bridge are reached from Settings (Settings → Hermes management / Bridge), each with a back arrow to Chat. Terminal and Settings remain quick icons in the chat top bar.
+- **Gentler reconnects when your server is unreachable.** After the server has been unreachable for a while, the app stops retrying every ~15 seconds and drops to a slower poll — easier on the battery — and still reconnects immediately the moment the network changes or the server comes back.
+- **Connection status stays out of your way.** Connection feedback now sits exactly where it matters and never covers the nav or shifts the screen. Your **agent's** connection shows in the header subtitle under the agent name — it reads *Reconnecting…* / *Connecting…* / *Disconnected* and crossfades back to the model when it recovers, the same place messaging apps put it. The **relay** link (bridge / terminal / voice) shows only as a small amber *Reconnecting…* cue in the bottom status strip, since it doesn't block chat. Returning to the app from the background is now fully silent instead of flashing a misleading "connection changed" for the same connection re-handshaking.
+- **Realtime voice: quieter progress.** The periodic spoken status updates during a long task ("Using cronjob…") are now off by default — the agent speaks at the milestones that matter (task started in background, finished, or failed) and the visual progress chip covers the in-between. A server setting brings the timed narration back if you prefer it.
+- **Realtime voice: a live background-task chip.** The "working on it" chip in voice mode now actually shows what's happening: the current step ("Running command"), how many steps have finished, and a running timer — with a pulse so you can tell it's alive. It also reads the connection honestly ("Reconnecting — your task is still running" during a blip, "Done — delivering the answer…" while the reply queues up), and a ✕ on the chip cancels the task outright.
+- **Realtime voice: snappier long-task handoffs and first turns.** When a clearly long-running tool starts (cron, desktop, browser work), the agent hands the task to the background right away instead of waiting out the full grace period — and the voice session now warms up when you open voice mode, so the first turn skips the connection setup it used to pay.
+
+### Removed
+
+- **Two voice controls that did nothing.** The disabled "Auto-TTS" toggle and the "STT language" picker under "Coming soon" in Voice settings are gone: the official desktop doesn't read every typed message aloud, and speech-to-text language is a server-side setting now editable in the new Server voice config section.
+
+### Fixed
+
+- **Realtime voice: you can keep talking while a background task runs.** Progress updates from a background task were flipping the voice UI back into "Thinking" with a Stop button on every tick, so the mic never came back until the task finished. Progress now feeds only the task chip; the conversation stays open the whole time.
+- **Realtime voice: leaving voice mode no longer cancels a running task.** Exiting (or tapping Stop to interrupt speech) used to kill an in-flight background task and could overwrite its already-delivered answer with "Cancelled." in the chat. Exit now detaches — the task keeps running and the result arrives on your next session or as a notification — and a delivered answer always keeps its text (a Stopped badge marks a genuine cancel). The chip's ✕ remains the one deliberate way to cancel.
+- **Long answers are no longer lost when the connection drops mid-turn.** On slow local models (or skills that delegate long background work), the phone could drop the stream mid-turn — the server finishes and saves the answer, but the chat sat on "Still working…" forever. The app now detects the dropped stream and quietly re-checks the conversation until the finished answer arrives, then completes the turn normally (with the usual done-notification if you've backgrounded the app). Switching chats or sending something new cancels the wait. (#166)
+- **Onboarding slides fit every screen.** Intro slide text could run past the bottom of the screen with no way to scroll on short displays or large font sizes. Slides now scroll when needed and compact their artwork on short viewports, so no setup guidance is unreachable. (#145)
+- **Docs: fixed stale setup labels and broken links.** The setup guide referenced a "Vanilla Hermes" button the app hasn't shown since v1.2.2 (it's labeled "Hermes"), several deep links into the getting-started page were dead, and the README under-counted the available phone tools. (docs site)
+- **Back button on Manage and Bridge now works.** The back arrow on the Manage ("Hermes management") and Bridge screens did nothing — it tried to jump to Chat in a way that silently no-op'd. Back now reliably returns to the screen you opened it from.
+- **Dropped relay connections from a status-report race.** The phone's periodic device-status report could occasionally be sent to the relay *before* the connection had finished authenticating, which made the relay reject the whole connection and forced a reconnect. The app now holds every message until the connection is authenticated, so the handshake always completes first.
+- **Fewer needless connection re-checks when switching apps.** Returning to the app after a quick glance at another app no longer triggers a full connection re-probe (and the brief "checking…" flash) when the connection was already healthy — it only re-checks after a longer absence or if something actually looks off.
+- **No more scary "server isn't accepting connections" pop-up on first load.** A bare bottom message could flash on cold start while the app was still establishing its first connection (the background session-list load failing before the server was reachable). That state is now shown only by the themed connection banner at the top — the redundant pop-up is suppressed for cold-start/reconnect bootstrapping, while real failures while you're using the app still surface normally.
+- **Reconnect loop on remote (Tailscale) connections.** Connecting from off your home network could make chat loop — repeatedly reconnecting before it finally settled — because a brief route-probe miss flipped the active route back to the (unreachable) home address and rebuilt the chat connection against it. The app now keeps the last working route through a transient miss, tolerates a slow first handshake on remote links, and absorbs VPN-interface churn, so a remote connection settles quickly instead of thrashing.
+- **Realtime voice: background tasks survive a brief disconnect.** Asking the voice agent to run a longer task in the background no longer loses the result to a momentary network drop — the server keeps the run alive across the reconnect and delivers the answer once you're back, and a task that runs too long is now stopped cleanly instead of hanging silently.
+- **Realtime voice: the spoken answer is no longer dropped when a background task finishes.** When the agent completed a longer background task, a harmless internal provider notice was being treated as a fatal error and closed the voice session right as the reply was about to be spoken (surfacing an "xAI realtime error" toast with Retry). Those transient notices no longer end the turn, so the answer is actually spoken.
+- **Realtime voice: the answer waits for you instead of playing to a dead connection.** If a background task finishes while your phone is disconnected, the spoken summary is now held and delivered when the voice session reconnects — and the phone keeps retrying that reconnect for several minutes instead of giving up after one attempt. If the voice session is gone for good, the result arrives as a notification instead (the full answer is always in the chat).
+- **Realtime voice: asking for a second task while one is running no longer breaks the first.** The agent now tells you the earlier task is still in progress (wait, check status, or cancel) instead of silently losing its result.
+
+## [1.2.6] - 2026-06-27
+
+### Added
+
+- **Session drawer refresh.** A refresh button in the session drawer re-pulls the chat list on demand, so a title the server generates a moment after a turn shows up without waiting for the next reload.
+
+### Changed
+
+- **Calmer connection status.** Transient connection status — reconnecting, checking, LAN↔Tailscale handoffs — now renders as a thin banner at the top that takes its own space (the screen slides down) instead of a card floating over the chat. The floating alert is reserved for persistent errors. Frequent confirmations (copied, profiles updated, profile/personality switches) moved to the same top banner instead of the bottom pop-up.
+
+### Fixed
+
+- **Chats stuck showing "Untitled".** The session drawer no longer overwrites a chat's first-message preview with a blank title when the server hasn't auto-named it yet (and the SSE path never does), so chats stop reading "Untitled"; titles also reconcile once the turn settles. (#133)
+- **Rename on a non-default agent profile.** Renaming a chat while a non-default profile is active now persists to that profile's own store instead of the shared one — matching the earlier session-delete fix.
+
+## [1.2.5] - 2026-06-27
+
+### Added
+
+- **Demo mode.** A "Try the demo" option on the setup / Connect screen — and on the empty chat screen if you skip setup — opens an offline preview of the real Chat UI: a sample conversation with Markdown, a tool-progress card, and a rich card, with zero setup and zero network (works in airplane mode). A persistent "Demo mode — sample data, not connected" banner offers a one-tap Connect that opens the real setup wizard; other tabs show a friendly "connect your Hermes server" empty state. Lets a first-run user — or a Play reviewer with no server — see what the app does before connecting.
+
+### Fixed
+
+- **Crash when a non-address is entered as a server URL.** Typing or pasting non-URL text (for example a label, or a line copied from the docs) into the API server or Dashboard URL field could force-close the app on the Manage / sign-in screen: the value was handed to the networking layer as a host, which rejected it with an uncaught error on the main thread. The setup fields now reject anything that isn't a valid host or `http(s)://` URL with an inline error, and the dashboard and voice request paths treat a malformed address as "unreachable" instead of ever crashing. (#131, #132)
+
+## [1.2.4] - 2026-06-25
+
+### Added
+
+- **Connection security indicator.** The chat status chip, the connection card, and the route picker now show at a glance whether your connection is encrypted — 🔒 **Encrypted · TLS**, 🛡️ **Encrypted · Tailscale** (both secure), 🛡️ **Mixed routes**, or ⚠️ **Not encrypted** — and tapping it opens a per-transport breakdown (chat, API, relay tools). A Tailscale/WireGuard route is now correctly shown as encrypted rather than implied insecure. Adds a new "Is my connection secure?" docs page explaining the difference between TLS and overlay (WireGuard) encryption.
+
+### Fixed
+
+- **Crash when a dashboard connection drops mid-check.** A transient network blip on the dashboard session check (e.g. a pooled connection aborting or timing out over Tailscale) could close the app: the check returned a result type but re-threw the network error instead of reporting it, and it surfaced on the main thread. The check now reports the failure cleanly, and the connection probe degrades gracefully instead of ever crashing. (#129)

 ## [1.2.3] - 2026-06-23

@@ -1380,7 +1605,12 @@ MVP release — native Android companion app for Hermes agent with direct API ch
 - **Dev scripts** — build, install, run, test, relay via scripts/dev.bat
 - **ProGuard rules** — okhttp-sse, markdown renderer, intellij-markdown parser

-[Unreleased]: https://github.com/Codename-11/hermes-relay/compare/android-v1.0.0...HEAD
+[Unreleased]: https://github.com/Codename-11/hermes-relay/compare/android-v1.4.4...HEAD
+[1.4.4]: https://github.com/Codename-11/hermes-relay/compare/android-v1.4.3...android-v1.4.4
+[1.4.3]: https://github.com/Codename-11/hermes-relay/compare/android-v1.4.2...android-v1.4.3
+[1.4.2]: https://github.com/Codename-11/hermes-relay/compare/android-v1.4.1...android-v1.4.2
+[1.4.1]: https://github.com/Codename-11/hermes-relay/compare/android-v1.4.0...android-v1.4.1
+[1.4.0]: https://github.com/Codename-11/hermes-relay/compare/android-v1.3.0...android-v1.4.0
 [1.0.0]: https://github.com/Codename-11/hermes-relay/compare/android-v0.8.0...android-v1.0.0
 [0.8.1]: https://github.com/Codename-11/hermes-relay/compare/android-v0.8.0...android-v0.8.1
 [0.8.0]: https://github.com/Codename-11/hermes-relay/compare/v0.7.0...android-v0.8.0
@@ -4,9 +4,9 @@

 ## What This Is

-A native Android app (Kotlin + Jetpack Compose) paired with an optional Python relay plugin/server (aiohttp) for the Hermes agent platform. Vanilla Hermes chat, Manage, and dashboard voice work against unmodified upstream Hermes. Relay adds phone control, terminal, remote desktop tooling, extra voice engines, and dashboard Relay management.
+A native Android app (Kotlin + Jetpack Compose) paired with an optional Python relay plugin/server (aiohttp) for the Hermes agent platform. Vanilla Hermes chat, Manage, and dashboard voice work against unmodified upstream Hermes. The Relay plugin adds phone control, terminal, remote desktop tooling, extra voice engines, and dashboard Relay management via the official Hermes web dashboard.

-**Current state:** v1.0.0 stable. The default no-plugin path supports chat, Manage, and voice on vanilla upstream Hermes. Chat auto-prefers the dashboard `/api/ws` gateway transport when Manage auth is ready, then falls back to API-server SSE routes. Vanilla Hermes voice uses dashboard `/api/audio/*` with the Manage session. Relay remains an additive power path for terminal, bridge/device control, notification companion, extra/provider-native voice, remote access, and desktop tooling. Two Android product flavors ship: `googlePlay` (conservative, no unattended Device Control surface) and `sideload` (full-capability).
+**Current state:** Reference latest released version for stable state and current dev branch for working state. The default no-plugin path supports chat, Manage, and voice on vanilla upstream Hermes. Chat auto-prefers the dashboard `/api/ws` gateway transport when Manage auth is ready, then falls back to API-server SSE routes. Vanilla Hermes voice uses dashboard `/api/audio/*` with the Manage session. Relay remains an additive power path for terminal, bridge/device control, notification companion, extra/provider-native voice, remote access, and desktop tooling. Two Android product flavors ship: `googlePlay` (conservative, no unattended Device Control surface) and `sideload` (full-capability).

 ## Architecture

@@ -25,60 +25,66 @@ The Vanilla Hermes path must stay upstream-only. API-server bearer auth and dash

 **Vanilla Hermes endpoints (confirmed in hermes-agent source):**

-| Endpoint | Purpose | Tool Call Format |
-|----------|---------|-----------------|
-| `POST /v1/chat/completions` | OpenAI-compatible chat (stream=true for SSE) | Inline markdown text (`` `💻 terminal` ``) — no separate tool events |
-| `POST /v1/runs` | Start an agent run | Returns `run_id` |
-| `GET /v1/runs/{run_id}/events` | SSE stream of run lifecycle events | **Structured events**: `tool.started`, `tool.completed`, `message.delta`, `reasoning.available`, `run.completed`, `run.failed` |
-| `POST /v1/responses` | OpenAI Responses API format | Structured `function_call` objects (non-streaming only) |
-| `GET /v1/capabilities` | Machine-readable feature + endpoint discovery | Use before assuming optional surfaces exist |
-| `GET /v1/models` | List available models | — |
-| `GET /v1/skills` | Read-only skill list for the API-server agent | `{"object":"list","data":[...]}` |
-| `GET /v1/toolsets` | Read-only API-server toolset inventory | `{"object":"list","platform":"api_server","data":[...]}` |
-| `GET/POST/PATCH/DELETE /api/sessions/*` | Native session CRUD, messages, fork, sync chat, SSE chat | Upstream merged via NousResearch/hermes-agent PR #33134 |
-| `GET /health` | Health check | — |
-| `GET/POST/PATCH/DELETE /api/jobs/*` | Cron job management (api_server surface) | — |
+
+| Endpoint                                | Purpose                                                  | Tool Call Format                                                                                                               |
+| --------------------------------------- | -------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------ |
+| `POST /v1/chat/completions`             | OpenAI-compatible chat (stream=true for SSE)             | Inline markdown text (``💻 terminal``) — no separate tool events                                                               |
+| `POST /v1/runs`                         | Start an agent run                                       | Returns `run_id`                                                                                                               |
+| `GET /v1/runs/{run_id}/events`          | SSE stream of run lifecycle events                       | **Structured events**: `tool.started`, `tool.completed`, `message.delta`, `reasoning.available`, `run.completed`, `run.failed` |
+| `POST /v1/responses`                    | OpenAI Responses API format                              | Structured `function_call` objects (non-streaming only)                                                                        |
+| `GET /v1/capabilities`                  | Machine-readable feature + endpoint discovery            | Use before assuming optional surfaces exist                                                                                    |
+| `GET /v1/models`                        | List available models                                    | —                                                                                                                              |
+| `GET /v1/skills`                        | Read-only skill list for the API-server agent            | `{"object":"list","data":[...]}`                                                                                               |
+| `GET /v1/toolsets`                      | Read-only API-server toolset inventory                   | `{"object":"list","platform":"api_server","data":[...]}`                                                                       |
+| `GET/POST/PATCH/DELETE /api/sessions/*` | Native session CRUD, messages, fork, sync chat, SSE chat | Upstream merged via NousResearch/hermes-agent PR #33134                                                                        |
+| `GET /health`                           | Health check                                             | —                                                                                                                              |
+| `GET/POST/PATCH/DELETE /api/jobs/*`     | Cron job management (api_server surface)                 | —                                                                                                                              |
+

 **Compatibility endpoints (not all native upstream API-server routes):**

 Upstream main now contains the focused session-control API (`#33134`) and read-only skills/toolsets (`#33016`). The original broad PR [#8556](https://github.com/NousResearch/hermes-agent/pull/8556) was closed as superseded. Keep these distinctions straight:

 1. **Native upstream** — `/api/sessions`, `/api/sessions/{id}/messages`, `/api/sessions/{id}/chat`, `/api/sessions/{id}/chat/stream`, `/v1/capabilities`, `/v1/skills`, and `/v1/toolsets` exist in current `gateway/platforms/api_server.py`.
-2. **Bootstrap compatibility** (`plugin/hermes_relay_bootstrap/`) — monkey-patches aiohttp on startup via `.pth` file for older or partial core builds. It skips native routes per method/path and should be retired per surface, not treated as the preferred path. The repo-root `hermes_relay_bootstrap/` package is a legacy import shim.
+2. **Bootstrap compatibility** (`plugin/hermes_relay_bootstrap/`) — monkey-patches aiohttp on startup via `.pth` file, injecting only compatibility-only surfaces (session search, memory, legacy skill detail/toggle, config, available-models, slash middleware). Sessions CRUD/messages/fork and the legacy skills list are **retired** — native upstream owns them (#33134/#33016) and the bootstrap carries no fallback for old builds. Native routes still win per method/path for the remaining set. The repo-root `hermes_relay_bootstrap/` package is a legacy import shim.
 3. **Legacy fork branches** — useful as lineage only. Do not cite `feat/session-api` / `#8556` as the current upstream contract.

-| Endpoint | Purpose | Provided by |
-|----------|---------|-------------|
-| `GET /api/sessions` (CRUD) | Session list/create/rename/delete/fork | Native upstream (#33134); bootstrap only for old builds |
-| `GET /api/sessions/{id}/messages` | Conversation history | Native upstream (#33134); bootstrap only for old builds |
-| `POST /api/sessions/{id}/chat` | Synchronous session chat | Native upstream (#33134) |
-| `POST /api/sessions/{id}/chat/stream` | Session-based SSE chat | Native upstream (#33134); bootstrap does NOT inject |
-| `GET /v1/skills`, `GET /v1/toolsets` | Read-only skill/toolset discovery | Native upstream (#33016) |
-| `GET /api/sessions/search` | Full-text message search | Bootstrap/fork legacy; not in current upstream main |
-| `GET /api/config`, `PATCH /api/config` | Personalities + model config | Bootstrap/fork legacy or dashboard web-server surface; not current API-server upstream |
-| `GET /api/skills`, `/{name}` | Legacy skill discovery/detail | Bootstrap/fork legacy; prefer native `/v1/skills` for lists |
-| `PUT /api/skills/toggle` | Enable/disable installed skill | `hermes_cli/web_server.py` dashboard surface; bootstrap stub returns 501 |
-| `GET/POST/PATCH/DELETE /api/memory` | Memory CRUD | Bootstrap/fork legacy; not current API-server upstream |
-| `GET /api/available-models` | Provider model list | Bootstrap/fork legacy; not current API-server upstream |
+
+| Endpoint                               | Purpose                                | Provided by                                                                            |
+| -------------------------------------- | -------------------------------------- | -------------------------------------------------------------------------------------- |
+| `GET /api/sessions` (CRUD)             | Session list/create/rename/delete/fork | Native upstream (#33134); bootstrap injection retired                                  |
+| `GET /api/sessions/{id}/messages`      | Conversation history                   | Native upstream (#33134); bootstrap injection retired                                  |
+| `POST /api/sessions/{id}/chat`         | Synchronous session chat               | Native upstream (#33134)                                                               |
+| `POST /api/sessions/{id}/chat/stream`  | Session-based SSE chat                 | Native upstream (#33134); bootstrap does NOT inject                                    |
+| `GET /v1/skills`, `GET /v1/toolsets`   | Read-only skill/toolset discovery      | Native upstream (#33016)                                                               |
+| `GET /api/sessions/search`             | Full-text message search               | Bootstrap/fork legacy; not in current upstream main                                    |
+| `GET /api/config`, `PATCH /api/config` | Personalities + model config           | Bootstrap/fork legacy or dashboard web-server surface; not current API-server upstream |
+| `GET /api/skills/{name}`               | Legacy skill detail                    | Bootstrap compat; list (`GET /api/skills`) retired — use native `/v1/skills`           |
+| `PUT /api/skills/toggle`               | Enable/disable installed skill         | `hermes_cli/web_server.py` dashboard surface; bootstrap stub returns 501               |
+| `GET/POST/PATCH/DELETE /api/memory`    | Memory CRUD                            | Bootstrap/fork legacy; not current API-server upstream                                 |
+| `GET /api/available-models`            | Provider model list                    | Bootstrap/fork legacy; not current API-server upstream                                 |
+

 The Android client probes per-endpoint capability via `HermesApiClient.probeCapabilities()` (returns `ServerCapabilities`). When `streamingEndpoint = "auto"`, `ConnectionViewModel.resolveStreamingEndpoint()` picks `sessions`, `completions`, or `runs` based on the capability snapshot.

 **Dashboard web server (separate surface — standard Manage / Desktop remote gateway):**

-hermes-agent ships a second web server at `hermes_cli/web_server.py` that hosts the React admin dashboard at `hermes_cli/web_dist/`. It has its **own** `/api/*` routes that **do not live on `api_server.py`** — notably: `GET/PUT /api/config` (full tree), `GET /api/config/schema`, `GET /api/config/defaults`, `GET/PUT /api/config/raw` (YAML text), `GET/PUT/DELETE /api/env` + `POST /api/env/reveal`, `PUT /api/skills/toggle`, `/api/cron/jobs/*` (different shape from `/api/jobs/*`), `/api/providers/oauth/*`, `/api/dashboard/themes`, `/api/dashboard/plugins`, `/api/model/info` + `/api/model/options` + `POST /api/model/set`, `/api/profiles/*` (CRUD, `POST /api/profiles/active`, per-profile soul/description/model), `/api/mcp/*`, `/api/logs`, `/api/analytics/usage`, and **`POST /api/audio/transcribe` + `POST /api/audio/speak`** (base64 data-url contract, built for hermes-desktop voice). The API server has **no audio routes** — its `/v1/capabilities` advertises `audio_api: false`; PR #8199 (`/v1/audio/*`) is the canonical future surface but is unmerged. Android's **Vanilla Hermes (no-plugin) voice** therefore rides this dashboard surface via `StandardHermesVoiceClient` with the per-connection dashboard cookie session (Manage sign-in unlocks voice); `AutoVoiceAudioClient` prefers Relay when paired and falls back to standard.
+hermes-agent ships a second web server at `hermes_cli/web_server.py` that hosts the React admin dashboard at `hermes_cli/web_dist/`. It has its **own** `/api/*` routes that **do not live on `api_server.py`** — notably: `GET/PUT /api/config` (full tree), `GET /api/config/schema`, `GET /api/config/defaults`, `GET/PUT /api/config/raw` (YAML text), `GET/PUT/DELETE /api/env` + `POST /api/env/reveal`, `PUT /api/skills/toggle`, `/api/cron/jobs/*` (different shape from `/api/jobs/*`), `/api/providers/oauth/*`, `/api/dashboard/themes`, `/api/dashboard/plugins`, `/api/model/info` + `/api/model/options` + `POST /api/model/set`, `/api/profiles/*` (CRUD, `POST /api/profiles/active`, per-profile soul/description/model), `/api/mcp/*`, `/api/logs`, `/api/analytics/usage`, and `**POST /api/audio/transcribe` + `POST /api/audio/speak`** (base64 data-url contract, built for hermes-desktop voice). The API server has **no audio routes** — its `/v1/capabilities` advertises `audio_api: false`; PR #8199 (`/v1/audio/*`) is the canonical future surface but is unmerged. Android's **Vanilla Hermes (no-plugin) voice** therefore rides this dashboard surface via `StandardHermesVoiceClient` with the per-connection dashboard cookie session (Manage sign-in unlocks voice); `AutoVoiceAudioClient` prefers Relay when paired and falls back to standard.

 Current upstream supports two auth modes on this surface. Loopback dashboards still use the injected `window.__HERMES_SESSION_TOKEN__` path. Remote/non-loopback dashboards use the Desktop-style dashboard auth gate: `/api/status` advertises `auth_required` and providers, `/auth/password-login` handles password providers, `/auth/login?provider=...` handles Nous/OIDC redirects, `/api/auth/me` returns the verified session, and `/api/auth/ws-ticket` mints a short-lived ticket for `/api/ws` / `/api/pty`. This dashboard session is **not** an `API_SERVER_KEY`. Android uses it for Manage, Vanilla Hermes voice, and the gateway chat transport. `/api/ws` is backed by `tui_gateway/server.py` (what hermes-desktop + the Ink TUI speak) and is the only upstream surface with **live** `reasoning.delta`/`thinking.delta` streaming; the api_server SSE paths remain the SSE fallback. Relay-only capabilities remain behind Relay pairing. **Do not proxy dashboard auth or dashboard admin APIs over the relay.**

 **Tool call rendering paths:**
+
 1. **Runs API** — Emits `tool.started`/`tool.completed` as real SSE events → `ToolProgressCard` in real-time.
 2. **Sessions API** — Native upstream emits structured SSE (`run.started`, `message.started`, `assistant.delta`, `tool.progress`, `tool.started/completed/failed`, `assistant.completed`, `run.completed`, `done`). `run.completed.messages` can reconcile authoritative per-turn transcript.
-3. **Annotation parser** — Fallback for servers emitting inline markdown annotations (`` `💻 terminal` ``).
+3. **Annotation parser** — Fallback for servers emitting inline markdown annotations (``💻 terminal``).

 ## Key Instructions
+
 - **Vanilla Hermes path = upstream-only.** The default (no-plugin) connection path — gateway/API chat, Manage, and Vanilla Hermes voice via the dashboard surface — must work against **unmodified upstream hermes-agent**: no fork patches, no bespoke server config as a dependency. The app ships on Google Play to users whose servers we don't control. Features that need server-side changes go through upstream PRs (with graceful degradation until merged) or live behind the opt-in relay plugin.
 - **Always verify upstream before assuming an endpoint exists.** Check `gateway/platforms/api_server.py` in hermes-agent. If an endpoint isn't there, document whether bootstrap injects it or it requires the fork.
 - If we use a non-standard endpoint, ensure `probeCapabilities()` covers it and the auto-resolver degrades gracefully.
- **Bootstrap maintenance:** Retire `plugin/hermes_relay_bootstrap/` per surface. Sessions and read-only skills/toolsets now have native upstream replacements; config, memory, legacy skill detail/toggle, available-models, and slash middleware still need explicit replacement decisions before full removal.
+- **Bootstrap maintenance:** Retire `plugin/hermes_relay_bootstrap/` per surface. Done: sessions CRUD/messages/fork and the legacy skills list are retired from the bootstrap (native upstream #33134/#33016, no old-build fallback kept). Remaining: config, memory, legacy skill detail/toggle, available-models, session search, and slash middleware still need explicit replacement decisions before full removal.

 ## Repository Layout

@@ -115,6 +121,7 @@ hermes-android/
 │   │   ├── transport/       # RelayTransport (reconnect state machine + TLS probe TOFU)
 │   │   └── lib/             # gracefulExit, rpc, circularBuffer (vendored)
 │   └── scripts/             # install.sh + install.ps1 curl/iwr one-liners
+├── website/                 ← Astro product/marketing site (static Coolify/Nixpacks deployment)
 ├── plugin/                  ← Hermes agent plugin
 │   ├── android_tool.py      # 18 android_* tool handlers
 │   ├── pair.py              # QR pairing implementation
@@ -131,6 +138,7 @@ hermes-android/
 ## Project Conventions

 ### File Structure
+
 - **Root-level:** README.md, CLAUDE.md, AGENTS.md, DEVLOG.md, TODO.md, .gitignore
 - **docs/** — spec, decisions, security, and any other long-form documentation
 - **DEVLOG.md** — update at end of each work session with what was done + verification (the factual record of *what happened*). It churns; do NOT park forward work here.
@@ -149,15 +157,17 @@ This is a **public, distributed repo** — every committed file (CHANGELOG, DEVL
 - **DEVLOG.md** is a committed, factual engineering log — what changed, why, and verification — depersonalized and third-person, not a diary.

 ### Code Style — Android (Kotlin)
+
 - **Jetpack Compose** — no XML layouts. Material 3 / Material You.
 - **kotlinx.serialization** — not Gson. Type-safe, faster.
 - **OkHttp** for WebSocket + SSE — `okhttp` for WSS relay, `okhttp-sse` for API streaming
 - **Single-activity** — Compose Navigation for all routing
 - **Namespace (Kotlin source tree):** `com.hermesandroid.relay` — stable, drives on-disk layout + class FQCNs
 - **applicationId:** `com.axiomlabs.hermesrelay` (googlePlay), `com.axiomlabs.hermesrelay.sideload` (sideload)
- **Min SDK 26, Target SDK 35, Compile SDK 36** / **Kotlin 2.0+**, JVM toolchain 17
+- **Min SDK 26, Target SDK 35, Compile SDK 37** / **Kotlin 2.0+**, JVM toolchain 17

 ### Code Style — Desktop CLI (Node/TypeScript)
+
 - **Node ≥21** — uses built-in global `WebSocket` (no `ws`/`undici` dep). Strict TS, ES modules, `NodeNext` resolution.
 - **Zero runtime deps** — `@types/node` + `tsx`/`rimraf`/`typescript` are devDeps only. Ship compiled `dist/`, not tsx.
 - **One binary, subcommands** — idiomatic for Node CLIs (codex, continue, vite pattern). Bare invocation is `chat`.
@@ -165,11 +175,13 @@ This is a **public, distributed repo** — every committed file (CHANGELOG, DEVL
 - **Dev loop:** `npx tsx src/cli.ts <args>` (no rebuild). `npm run build` + `npm link` before pushing to verify the bin shim. Never ship tsx in the published tarball — pre-build with `tsc` so Windows `npm install -g` can cmd-shim the JS directly.

 ### Code Style — Server (Python)
+
 - **aiohttp** — async, matches existing Hermes relay patterns
 - **Type hints everywhere** — Python 3.11+ syntax
 - **asyncio** — no threading; **structured logging** — use `logging`, not print()

 ### Git
+
 - **Conventional Commits:** `feat`, `fix`, `docs`, `refactor`, `test`, `chore`
 - **Branching model (as of 2026-04-19):** `main` + `dev`. Feature branches target `dev`, not `main`. `main` receives only release merges (and tags). No straight-to-main exemption — even single-file typos go through `dev`.
 - **Merge style:** `git merge --no-ff` — no squash. Preserves per-commit trail for agent-team branches on every merge in the chain (feature → dev → main).
@@ -179,166 +191,169 @@ This is a **public, distributed repo** — every committed file (CHANGELOG, DEVL
 - **Branch protection** on `main` — direct push blocked; only release-merge PRs from `dev` land here. `dev` also requires CI to pass on PRs but accepts feature-branch merges freely.

 ### Testing
+
 - **Android:** JUnit + Compose testing for UI, MockK for mocks
 - **Python:** `python -m unittest plugin.tests.test_<name>` — avoid bare `pytest` (conftest imports `responses` which may not be installed in the venv)
 - **CI is split by path:** `.github/workflows/ci-android.yml` runs on app/Gradle changes; `.github/workflows/ci-plugin.yml` runs on plugin/Python changes. Both trigger on pushes to `main` and `dev` and on PRs targeting either. Build + tests must pass before merge to `dev`; release-merge to `main` requires the same.

 ## Key Files

-| File | Why |
-|------|-----|
-| `docs/spec.md` | Full specification — protocol, UI layouts, phases, dependencies |
-| `docs/decisions.md` | Architecture decisions — framework choice, channel design, auth model |
-| `AGENTS.md` | Universal agent entry point — points here + the non-negotiables (standard-path, commits, writing hygiene) |
-| `docs/mcp-tooling.md` | MCP server setup — android-tools-mcp + mobile-mcp; `android_*` tool usage patterns |
-| **App — Core** | |
-| `ui/RelayApp.kt` | Main scaffold — bottom nav, Compose navigation |
-| `viewmodel/ChatViewModel.kt` | Chat orchestration — send, stream, cancel, slash commands |
-| `viewmodel/ConnectionViewModel.kt` | Dual connection model (API + relay); `resolveStreamingEndpoint()`; derived `relayUiState` flow + `markPaired` hook stamp the active Connection |
-| `viewmodel/RelayUiState.kt` | Shared sealed state for the relay row — 5 cases + `asBadgeState()` / `statusText()` extensions; 5s grace window before Stale |
-| `network/HermesApiClient.kt` | Direct HTTP/SSE — `sendRunStream()`, `sendChatStream()`, `probeCapabilities()` |
-| `network/GatewayChatClient.kt` | Gateway chat transport — JSON-RPC over dashboard `/api/ws` (tui_gateway); live `reasoning.delta`; fresh ws-ticket per connect; per-turn SSE fallback via `onPreflightFailure`; `prewarm()` (connect+resume off the send path); `setKeepAliveInBackground()` suppresses the 120s idle-close |
-| `network/GatewayKeepAliveService.kt` | Opt-in `specialUse` foreground service (BOTH flavors; declared in main manifest; Play needs a Console FGS declaration) holding the process up so the gateway socket survives background/Doze; driven by ConnectionViewModel from the `KEY_GATEWAY_KEEP_ALIVE` toggle; stops on task-removal |
-| `data/GatewayKeepAlivePrefs.kt` | Shared `KEY_GATEWAY_KEEP_ALIVE` pref key + `Context.setGatewayKeepAlive()` — used by ConnectionViewModel (StateFlow/setter) and the FGS Stop action |
-| `network/GatewayEventMapper.kt` | Pure-JVM gateway event→callback mapping for one turn; unknown event types silently ignored; tui_gateway usage-key translation |
-| `network/GatewayModels.kt` | `GatewayAvailability`, `ActiveTurnHandle`, `GatewayTurnCallbacks` (all members REQUIRED — forces dispatchOn main-thread wrap), `GatewayAsk`, `GatewaySubagentEvent`, `resolveStreamingEndpointPreference()` |
-| `ui/components/ChatInputBar.kt` | Redesigned input bar — pill field, one trailing slot morphing Send/Voice/Stop/Steer/Queue, no slash button (long-press + opens palette) |
-| `ui/components/SubagentLane.kt` | Per-taskIndex subagent progress lane — guide rail, compact tool rows, auto-collapse |
-| `notifications/TurnCompleteNotifier.kt` | Turn-complete local notification when backgrounded — channel `chat_turn_complete`, cancel on resume, settings-gated |
-| `network/ConnectionManager.kt` | WSS to relay with auto-reconnect; rebuilds OkHttpClient with fresh CertPinner on connect |
-| `network/ChannelMultiplexer.kt` | Envelope routing by channel; `sendNotification()` for notification outbound |
-| `network/handlers/ChatHandler.kt` | Chat message state, streaming events, tool annotation parser |
-| `network/models/SessionModels.kt` | Session, message, SSE event data models |
-| `data/FeatureFlags.kt` | Feature gating — DEV_MODE + DataStore overrides; `BuildFlavor` (googlePlay/sideload Tier flags) |
-| **App — Auth** | |
-| `auth/AuthManager.kt` | Wires SessionTokenStore + CertPinStore; parses auth.ok; `applyServerIssuedCodeAndReset()` |
-| `auth/SessionTokenStore.kt` | Keystore (StrongBox) + EncryptedSharedPrefs fallback; lossless migration on upgrade |
-| `auth/CertPinStore.kt` | TOFU cert pinning — SHA-256 SPKI per host:port in DataStore |
-| `auth/PairedSession.kt` | PairedSession state + PairedDeviceInfo wire model |
-| `data/Endpoint.kt` | `EndpointCandidate` / `ApiEndpoint` / `RelayEndpoint` — multi-endpoint pairing (ADR 24); `displayLabel()` for LAN/Tailscale/Public/Custom chips |
-| `network/RelayHttpClient.kt` | OkHttp for /media, /sessions (list/revoke/extend), /health |
-| **App — Bridge** | |
-| `network/handlers/BridgeCommandHandler.kt` | Routes `bridge.command` → ActionExecutor; full path inventory + safety-rail integration |
-| `viewmodel/BridgeViewModel.kt` | BridgeScreen VM — masterToggle, bridgeStatus, permissionStatus, activityLog |
-| `bridge/BridgeSafetyManager.kt` | Blocklist + destructive-verb confirmation + auto-disable timer; fails-closed on /call and /send_sms |
-| `data/BridgeSafetyPreferences.kt` | DataStore for blocklist, destructive verbs, auto-disable minutes, confirmation timeout |
-| `ui/screens/BridgeScreen.kt` | Bridge UI — master → permission checklist → [Advanced] → unattended → safety → activity log (v0.4.1 reorder) |
-| `ui/components/UnattendedAccessRow.kt` | Unattended toggle card (sideload); `enabled=masterEnabled`; inline `KeyguardDetectedAlert` |
-| `ui/components/UnattendedGlobalBanner.kt` | 28dp amber strip at scaffold top when master+unattended on (sideload); tap → Bridge tab |
-| `bridge/BridgeStatusOverlay.kt` | WindowManager overlay; `ConfirmationOverlayHost`; requires `SavedStateRegistryOwner` init order (CREATED→restore→RESUMED) |
-| `accessibility/HermesAccessibilityService.kt` | AccessibilityService subclass; `@Volatile instance` singleton for BridgeCommandHandler |
-| `accessibility/ScreenReader.kt` | UI tree → ScreenContent; `findNodeBoundsByText()`, `findFocusedInput()` |
-| `accessibility/ActionExecutor.kt` | Gesture/text dispatch via GestureDescription + ACTION_SET_TEXT; pressKey maps vocab only |
-| **App — Voice** | |
-| `voice/VoiceViewModel.kt` | Voice turn state machine; TTS queue; `ignoreAssistantId`; `errorEvents: SharedFlow` |
-| `audio/VoiceRecorder.kt` | MediaRecorder wrapper; perceptual amplitude curve; `.m4a` at 16kHz/64kbps |
-| `audio/VoicePlayer.kt` | Media3 ExoPlayer (gapless TTS queue) + Visualizer; amplitude StateFlow; `awaitCompletion()` via coroutine; `audioSessionId` is a thread-safe `@Volatile` cache |
-| `network/RelayVoiceClient.kt` | OkHttp for `/voice/transcribe`, `/synthesize`, `/config` |
-| `voice/VoiceBridgeIntentHandler.kt` | Interface routing voice utterances to bridge; impls per flavor via factory |
-| `voice/VoiceIntentClassifier.kt` | Regex phone-control classifier (sideload only); false-negatives preferred over false-positives |
-| `ui/components/VoiceModeOverlay.kt` | Full-screen voice UI — MorphingSphere + VoiceWaveform + mic button |
-| `ui/components/MorphingSphere.kt` | Compose renderer for the agent sphere — delegates math to `MorphingSphereCore` |
-| `ui/components/MorphingSphereCore.kt` | Platform-agnostic sphere algorithm (`kotlin.math` only) — single source of truth; mirrored byte-for-byte in `preview/web/sphere.js` |
-| `preview/web/` | Zero-dep browser harness — live `index.html` preview + `parity-check.mjs`; paired with `MorphingSphereCoreParityTest` (JVM) for struct/full checksum diffing |
-| `user-docs/.vitepress/theme/components/SphereMark.vue` | Docs-site sphere embed — imports `preview/web/sphere.js` directly; autonomous fbm drift + pointer-proximity gaze/state blend; `<ClientOnly>` + `IntersectionObserver` + `prefers-reduced-motion` aware |
-| **App — Media + Notifications** | |
-| `util/MediaCacheWriter.kt` | `cacheDir/hermes-media/` LRU writer; returns FileProvider URIs |
-| `util/MediaSaver.kt` | Save/share/open for chat media — MediaStore scoped-storage save (Pictures/Download `Hermes-Relay`, no perms on API 29+; pre-Q → share sheet); FileProvider share staging; remote-byte fetch; magic-byte image-MIME sniff for correct extensions |
-| `ui/components/ChatImageViewer.kt` | Full-screen image viewer — pinch-zoom/pan (`detectTransformGestures`), double-tap 1×/2.5×, Share/Save/Close; `ChatImageViewerSource` decouples Coil-model/bitmap display from a suspend `bytesProvider` so Save keeps original bytes |
-| `ui/components/InboundAttachmentCard.kt` | Discord-style attachment card for images/video/audio/pdf/text/generic; image tap → ChatImageViewer, file card long-press → Open/Share/Save menu |
-| `ui/components/ChatImageContent.kt` | Parses `![alt](src)` out of assistant content; remote http(s) → Coil (tap → ChatImageViewer), server-local/failed → inline "can't render" notice with the path |
-| `data/HermesCard.kt` | `CARD:{json}` envelope (ADR 26) — type/accent/fields/actions; kotlinx.serialization |
-| `ui/components/HermesCardBubble.kt` | Rich-card renderer — accent stripe + FlowRow actions + dispatch stamp collapse |
-| `viewmodel/CardDispatchSyncBuilder.kt` | Twin of VoiceIntentSyncBuilder — synthesizes card dispatches as `hermes_card_action` OpenAI pairs for session memory |
-| `notifications/HermesNotificationCompanion.kt` | NotificationListenerService; cold-start buffer (50); forwards via ChannelMultiplexer |
-| `util/RelayErrorClassifier.kt` | `classifyError(Throwable, context) → HumanError`; used by Voice/Chat/Connection |
-| `util/TurnLatencyTracer.kt` | One `TurnLatency` INFO line per chat turn — `warm/cold` + `connect/session/submit/ttfe/ttft/done@…ms`; gateway + 3 SSE paths use it for desktop-comparable latency diagnosis; durations only |
-| **Relay — Server** | |
-| `plugin/relay/server.py` | Canonical relay — WSS + HTTP routes; bridge, media, voice, session, pairing handlers. `handle_pairing_mint` mirrors `pair.py:762` — top-level = API server, `relay.{url,code}` nested |
-| `plugin/relay/auth.py` | PairingManager, SessionManager, RateLimiter; `math.inf` for never-expire |
-| `plugin/relay/channels/bridge.py` | Bridge handler — `handle_command()` mints request_id, awaits response, 30s timeout |
-| `plugin/relay/channels/notifications.py` | Bounded deque (100) of notification metadata; in-memory only |
-| `plugin/relay/media.py` | MediaRegistry — LRU token store; `strict_sandbox` off by default for `/media/by-path` |
-| `plugin/relay/voice.py` | Voice endpoints — transcribe, synthesize, voice_config; lazy tool imports |
-| `plugin/relay/qr_sign.py` | HMAC-SHA256 QR signing; secret at `~/.hermes/hermes-relay-qr-secret`; canonical form preserves `endpoints` array order + role strings verbatim (ADR 24) |
-| `plugin/relay/tailscale.py` | First-class Tailscale helper (ADR 25) — `status()` / `enable(port)` / `disable(port)` / `canonical_upstream_present()`; safe-absent via shell-out to `tailscale` CLI |
-| `plugin/relay/_env_bootstrap.py` | Loads `~/.hermes/.env` before relay imports; called from both entry points |
-| **Plugin — Tools + Installer** | |
-| `plugin/tools/android_tool.py` | 18 `android_*` tool handlers (14 baseline + send_sms, call, search_contacts, return_to_hermes); `android_screenshot` first consumer of `register_media()` |
-| `plugin/tools/android_navigate.py` | Vision-driven navigation loop; up to 20 iterations; `llm_gap` error until vision client wired |
-| `plugin/pair.py` | QR payload builder + CLI; `build_payload(sign=True)`; `--register-code` fallback |
-| `plugin/doctor.py` | `hermes relay doctor`; checks standard upstream API/dashboard reachability, Relay loopback state, plugin layout, and compat hook state |
-| `plugin/compat.py` | `hermes relay compat status/install/remove`; owns the optional `hermes_relay_bootstrap.pth` lifecycle |
-| `plugin/hermes_relay_bootstrap/` | Plugin-owned runtime compatibility patch; skips native routes per method/path; retire only after remaining config/memory/legacy skill/slash gaps are handled |
-| `install.sh` | Canonical installer — 6 steps; idempotent; drops `hermes-relay-update` shim |
-| `uninstall.sh` | Canonical uninstaller; reverses install.sh; never touches `.env` or `state.db` |
-| `hermes_relay_bootstrap/` | Legacy import shim for old `.pth` files and editable installs |
-| **Plugin — Dashboard** | |
-| `plugin/dashboard/manifest.json` | Declares tab, entry bundle, and FastAPI module for hermes-agent discovery |
-| `plugin/dashboard/plugin_api.py` | FastAPI router proxying 5 routes to relay over loopback; `/pairing` body = API-server overrides (host/port/tls/api_key), relay URL auto-derived |
-| `plugin/dashboard/src/index.jsx` | React root registering `hermes-relay` plugin with 4-tab shell |
-| `plugin/dashboard/dist/index.js` | Committed IIFE bundle loaded verbatim by dashboard |
-| **Desktop CLI** | |
-| `desktop/package.json` | `@hermes-relay/cli` package manifest — Node ≥21, one `hermes-relay` bin, pre-built dist |
-| `desktop/bin/hermes-relay.js` | Tiny shim: `import('../dist/cli.js').then(m => m.main())` + error surfacing |
-| `desktop/src/chatAttach.ts` | captureClipboardImage / captureScreenshot / readImageFile; ships base64 to server via `image.attach.bytes` RPC before next prompt.submit |
-| `desktop/src/cli.ts` | argv parser + subcommand dispatcher — bare → `shell` (PTY), positional-only → `chat`; command-scoped `--help` falls through to each command |
-| `desktop/src/lib/theme.ts` | Shared ANSI palette + `colorEnabled()` + `Theme` (semantic helpers, `statusDot`) — single visual language; `--no-color`/`NO_COLOR`/TTY aware |
-| `desktop/src/lib/table.ts` | Zero-dep column-aligned table renderer (ANSI-width aware, last column flexes to terminal width) — used by devices/sessions/audit |
-| `desktop/src/lib/spinner.ts` | Stderr braille spinner for slow ops (pair probe, gateway connect); no-op when piped/quiet/json |
-| `desktop/src/lib/usage.ts` | `UsageSpec` + `renderUsage`/`printUsage`/`unknownSubcommand` — per-subcommand `--help` + self-documenting sub-verb fallback |
-| `desktop/src/lib/hints.ts` | `suggestedFix(err, ctx)` → next-step command (re-pair on auth fail, etc.); `formatError` renders error + hint |
-| `desktop/src/lib/logo.ts` | Slim box-drawing "Hermes Relay" wordmark; shown atop `--help`, first-run welcome, REPL header, and `hermes-relay logo`; theme/no-color aware |
-| `desktop/src/lib/auditLog.ts` | Local desktop-tool audit JSONL (`~/.hermes/desktop-audit.jsonl`); router appends per dispatch; backs `audit` command (relay's ring is loopback-only) |
-| `desktop/src/lib/daemonStatus.ts` | Daemon heartbeat file (`~/.hermes/daemon-status.json`) + `isPidAlive` liveness; backs `daemon --status` |
-| `desktop/src/commands/audit.ts` | `hermes-relay audit` — tails the local audit log into a table (WHEN/TOOL/STATUS/DETAIL); `--limit`, `--json` |
-| `desktop/src/commands/relay.ts` | `hermes-relay relay info/security/context` — relay-server management surface; info/security loopback-only, context works remote with bearer |
-| `desktop/src/commands/chat.ts` | REPL + one-shot + piped-stdin; `runOneTurn` returns `{promise, cancel}` for safe SIGINT; auto-wires `DesktopToolRouter` when consented |
-| `desktop/src/commands/shell.ts` | Pipes the `terminal` relay channel to raw-mode stdin/stdout; post-attach `exec hermes` 350ms after tmux settles; `Ctrl+A .` detach / `Ctrl+A k` kill / `Ctrl+A Ctrl+A` literal |
-| `desktop/src/commands/pair.ts` | Either 6-char code + `--remote`, or full v3 QR via `--pair-qr` — probes + picks endpoint, records role; `--grant-tools` (TTY prompt) / `--auto-grant-tools` (silent) stamp `toolsConsented` so `daemon` works without a `shell` round-trip |
-| `desktop/src/commands/tools.ts` | `tools.list` RPC → enabled/available toolsets; `--verbose` lists individual tools |
-| `desktop/src/commands/status.ts` | Local read of `~/.hermes/remote-sessions.json`; renders `grants:` + `expires:` + `route:`; `--json` redacts tokens, `--reveal-tokens` opts in |
-| `desktop/src/commands/devices.ts` | Server-side session management — `GET/DELETE/PATCH /sessions` via `fetch` over http(s)://host:port; `list` / `revoke <prefix>` / `extend <prefix> --ttl <s>` |
-| `desktop/src/banner.ts` | `buildConnectBanner({url, meta, endpointRole})` → "Connected via LAN (plain) — server 0.6.0"; `humanExpiry()` for TTL formatting |
-| `desktop/src/endpoint.ts` | `EndpointCandidate` / `EndpointRole` types + `displayLabel()` — mirrors Android `data/Endpoint.kt` |
-| `desktop/src/pairingQr.ts` | `decodePairingPayload` (JSON or base64), `payloadToCandidates` (v3 verbatim / v1–v2 synthesized), `probeCandidatesByPriority` (`Promise.any` within tier, `AbortSignal.any`, 4s timeout, 60s cache) |
-| `desktop/src/certPin.ts` | `extractSpkiSha256(der)` via `crypto.X509Certificate` + `publicKey.export({type:'spki'})`; `pinKey(url)`, `comparePins()`, `isSecureUrl()` |
-| `desktop/src/tools/router.ts` | `DesktopToolRouter.attach(relay)` — `onChannel('desktop')` dispatch under 30s `AbortController`; heartbeat enriched with host/platform/version/uptime_ms + sticky `last_error` for `desktop_health` |
-| `desktop/src/tools/handlerSet.ts` | Single source of truth for the desktop tool map — `DESKTOP_HANDLERS` + `DESKTOP_ADVERTISED_TOOLS`; consumed by `chat.ts` / `shell.ts` / `daemon.ts` so adding a tool is a one-file change |
-| `desktop/src/tools/consent.ts` | `ensureToolsConsent(url)` — stored per-URL in `toolsConsented`; TTY prompt; non-TTY fails closed |
-| `desktop/src/tools/handlers/fs.ts` | `readFileHandler` / `writeFileHandler` / `patchHandler` — strict unified-diff applier, no fuzz |
-| `desktop/src/tools/handlers/terminal.ts` | `bash -lc` / `cmd /c`, SIGKILL on timeout or abort, returns `{stdout, stderr, exit_code, duration_ms}` |
-| `desktop/src/tools/handlers/powershell.ts` | Spawns `pwsh`/`powershell` directly with `-Command -`, script piped via stdin — no cmd.exe quote-mangling; auto-picks pwsh > powershell |
-| `desktop/src/tools/handlers/process.ts` | `spawn_detached` (unref'd, returns pid+log_path), `list_processes` (tasklist /FO CSV — no /V to dodge window-title latency), `kill_process`, `find_pid_by_port` (netstat/lsof/ss) |
-| `desktop/src/tools/handlers/jobs.ts` | Job API — `~/.hermes/desktop-jobs/<id>/{stdout.log, stderr.log, meta.json}` is source of truth across daemon restarts; `taskkill /T` on Windows so build trees die fully |
-| `desktop/src/tools/handlers/transfer.ts` | `copy_directory` via `fs.cp`, `zip`/`unzip` via tar > zip > PowerShell probe, `checksum` streamed (sha256/sha1/md5) |
-| `desktop/src/tools/handlers/search.ts` | ripgrep with pure-Node fallback, skips `.git`/`node_modules`/`dist`/`.next`/`.cache` |
-| `desktop/src/renderer.ts` | Streams `message.delta` → stdout, tool events → decorated lines; NO_COLOR / --json / --quiet aware |
-| `desktop/src/pairing.ts` | readline-based 6-char prompt (`A-Z0-9`); headless mirror of TUI's Ink prompt; `validatePairingPayloadString` discriminated-union wrapper |
-| `desktop/src/credentials.ts` | Precedence: `--token` → `--pair-qr` (probe+pair) → `--code` → stored → prompt; returns `Credentials{sessionToken?, pairingCode?, resolvedEndpoint?}` |
-| `desktop/src/transport/RelayTransport.ts` | Fork of ui-tui's transport + reconnect state machine (`idle/connecting/connected/reconnecting`, exp backoff 1→30s, 5min on 429, gate re-check post-sleep) + pre-WS TLS probe for TOFU |
-| `desktop/src/remoteSessions.ts` | Same file path as TUI (`~/.hermes/remote-sessions.json`, 0600); schema widened with `grants`, `ttlExpiresAt`, `endpointRole`, `toolsConsented`; `saveSession` back-compat overload |
-| `desktop/src/commands/daemon.ts` | Headless WSS + tool router for always-on access; JSON-line logs; fails closed on missing consent unless `--allow-tools` with explicit `--token` |
-| `desktop/src/commands/doctor.ts` | Local-only diagnostic report — version / binary path / PATH / sessions / daemon detection; `--json` for support-paste; omits tokens entirely |
-| `desktop/src/relayUrlPrompt.ts` | First-run URL fallback — `resolveFirstRunUrl()` auto-picks single stored session, numbered picker for multiple, welcome banner for zero; throws on non-interactive + ambiguous |
-| `desktop/src/version.ts` | Build-time-generated constant (`npm run gen:version` before every build) — Bun compiled binaries can't read package.json via `__dirname` so version is embedded at build |
-| `desktop/scripts/install.sh` / `install.ps1` | curl/iwr one-liner installers — download prebuilt Bun binary (no Node required), SHA256-verified, API-resolver for `latest` that includes prereleases, version-aware pre/post-install readback |
-| `desktop/scripts/uninstall.sh` / `uninstall.ps1` | 3-tier removal — default (binary + PATH), `--purge` (also wipes `~/.hermes/remote-sessions.json`), `--service` (stub for future service installers); Windows iex-safe env-var fallback |
-| `desktop/README.md` | User-facing install + usage reference |
-| **Desktop CLI — dev iteration** | |
-| `npm run smoke` (in `desktop/`) | Builds Windows binary + runs `--version` / `--help` / `doctor`, fails loud on zero-output. Local pre-flight before cutting any tag. |
-| `npm run gen:version` | Regenerates `src/version.ts` from `package.json`. Runs automatically before every `build` / `build:bin:*`. |
-| `release-cli.yml → Smoke-test Linux binary` step | CI-side equivalent: runs compiled Linux binary through the same 3-command check before uploading assets. Catches silent-exit-0 + segfault classes. |
-| **Server — Desktop tool routing (Phase B)** | |
-| `plugin/relay/channels/desktop.py` | Mirrors `bridge.py` — `desktop.command`/`desktop.response`/`desktop.status`, UUID-correlated futures, 30s timeout, single-client MVP, per-session advertised-tools set |
-| `plugin/tools/desktop_tool.py` | 24 `desktop_*` tools (fs/shell/powershell/process/jobs/transfer/health) — registers with `tools.registry` under `desktop` toolset; per-tool `check_fn` pings `/desktop/_ping?tool=<name>`; `desktop_health` is `_RELAY_ONLY` and pings `/desktop/health` so it works even when the client is wedged |
-| **Gradle modules — experimental Quest/XR (in development)** | |
-| `relay-core/` | [EXPERIMENTAL] Android library (`com.axiomlabs.hermesrelay.core`) — shared pairing/transport/terminal/voice/wire for the Quest port; not yet wired into the shipped `:app` |
-| `relay-ui/` | [EXPERIMENTAL] Android library (`com.axiomlabs.hermesrelay.ui`) — shared Compose UI (sphere, terminal WebView, QR scanner) for the Quest port; carries its own sphere copy |
-| `quest/` | [EXPERIMENTAL] Meta Spatial SDK Quest/XR app — gradle `includeBuild("quest")`; needs further development, not shipped |
-| **Tooling — dev iteration (not shipped)** | |
-| `ui-preview/` | Desktop Compose Hot Reload harness — JVM Compose for Desktop; source-shares `MorphingSphereCore` from `:relay-ui`; `Main.kt` gallery; see `ui-preview/README.md` |
-| `app/src/test/.../screenshots/StoreScreenshotTest.kt` | Roborazzi host-side store/docs screenshot renderer — deterministic, no device, exact 1080×2160; reuses real components+chrome with mock data; `capture(name, themeId){…}` renders any view; see `docs/screenshot-automation.md` §Deterministic rendering (JDK-21 + no-plugin gotchas) |
+
+| File                                                        | Why                                                                                                                                                                                                                                                                                                 |
+| ----------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `docs/spec.md`                                              | Full specification — protocol, UI layouts, phases, dependencies                                                                                                                                                                                                                                     |
+| `docs/decisions.md`                                         | Architecture decisions — framework choice, channel design, auth model                                                                                                                                                                                                                               |
+| `AGENTS.md`                                                 | Universal agent entry point — points here + the non-negotiables (standard-path, commits, writing hygiene)                                                                                                                                                                                           |
+| `docs/mcp-tooling.md`                                       | MCP server setup — android-tools-mcp + mobile-mcp; `android_*` tool usage patterns                                                                                                                                                                                                                  |
+| **App — Core**                                              |                                                                                                                                                                                                                                                                                                     |
+| `ui/RelayApp.kt`                                            | Main scaffold (Scaffold + Compose nav); Chat is home — no mode strip, Manage/Bridge reached via Settings; `bottomBar` is a status pill, not a NavigationBar                                                                                                                                         |
+| `viewmodel/ChatViewModel.kt`                                | Chat orchestration — send, stream, cancel, slash commands                                                                                                                                                                                                                                           |
+| `viewmodel/ConnectionViewModel.kt`                          | Dual connection model (API + relay); `resolveStreamingEndpoint()`; derived `relayUiState` flow + `markPaired` hook stamp the active Connection                                                                                                                                                      |
+| `viewmodel/RelayUiState.kt`                                 | Shared sealed state for the relay row — 5 cases + `asBadgeState()` / `statusText()` extensions; 5s grace window before Stale                                                                                                                                                                        |
+| `network/HermesApiClient.kt`                                | Direct HTTP/SSE — `sendRunStream()`, `sendChatStream()`, `probeCapabilities()`                                                                                                                                                                                                                      |
+| `network/GatewayChatClient.kt`                              | Gateway chat transport — JSON-RPC over dashboard `/api/ws` (tui_gateway); live `reasoning.delta`; fresh ws-ticket per connect; per-turn SSE fallback via `onPreflightFailure`; `prewarm()` (connect+resume off the send path); `setKeepAliveInBackground()` suppresses the 120s idle-close          |
+| `network/GatewayKeepAliveService.kt`                        | Opt-in `specialUse` foreground service (BOTH flavors; declared in main manifest; Play needs a Console FGS declaration) holding the process up so the gateway socket survives background/Doze; driven by ConnectionViewModel from the `KEY_GATEWAY_KEEP_ALIVE` toggle; stops on task-removal         |
+| `data/GatewayKeepAlivePrefs.kt`                             | Shared `KEY_GATEWAY_KEEP_ALIVE` pref key + `Context.setGatewayKeepAlive()` — used by ConnectionViewModel (StateFlow/setter) and the FGS Stop action                                                                                                                                                 |
+| `network/GatewayEventMapper.kt`                             | Pure-JVM gateway event→callback mapping for one turn; unknown event types silently ignored; tui_gateway usage-key translation                                                                                                                                                                       |
+| `network/GatewayModels.kt`                                  | `GatewayAvailability`, `ActiveTurnHandle`, `GatewayTurnCallbacks` (all members REQUIRED — forces dispatchOn main-thread wrap), `GatewayAsk`, `GatewaySubagentEvent`, `resolveStreamingEndpointPreference()`                                                                                         |
+| `ui/components/ChatInputBar.kt`                             | Redesigned input bar — pill field, one trailing slot morphing Send/Voice/Stop/Steer/Queue, no slash button (long-press + opens palette)                                                                                                                                                             |
+| `ui/components/SubagentLane.kt`                             | Per-taskIndex subagent progress lane — guide rail, compact tool rows, auto-collapse                                                                                                                                                                                                                 |
+| `notifications/TurnCompleteNotifier.kt`                     | Turn-complete local notification when backgrounded — channel `chat_turn_complete`, cancel on resume, settings-gated                                                                                                                                                                                 |
+| `network/ConnectionManager.kt`                              | WSS to relay with auto-reconnect; rebuilds OkHttpClient with fresh CertPinner on connect                                                                                                                                                                                                            |
+| `network/ChannelMultiplexer.kt`                             | Envelope routing by channel; `sendNotification()` for notification outbound                                                                                                                                                                                                                         |
+| `network/handlers/ChatHandler.kt`                           | Chat message state, streaming events, tool annotation parser                                                                                                                                                                                                                                        |
+| `network/models/SessionModels.kt`                           | Session, message, SSE event data models                                                                                                                                                                                                                                                             |
+| `data/FeatureFlags.kt`                                      | Feature gating — DEV_MODE + DataStore overrides; `BuildFlavor` (googlePlay/sideload Tier flags)                                                                                                                                                                                                     |
+| **App — Auth**                                              |                                                                                                                                                                                                                                                                                                     |
+| `auth/AuthManager.kt`                                       | Wires SessionTokenStore + CertPinStore; parses auth.ok; `applyServerIssuedCodeAndReset()`                                                                                                                                                                                                           |
+| `auth/SessionTokenStore.kt`                                 | Keystore (StrongBox) + EncryptedSharedPrefs fallback; lossless migration on upgrade                                                                                                                                                                                                                 |
+| `auth/CertPinStore.kt`                                      | TOFU cert pinning — SHA-256 SPKI per host:port in DataStore                                                                                                                                                                                                                                         |
+| `auth/PairedSession.kt`                                     | PairedSession state + PairedDeviceInfo wire model                                                                                                                                                                                                                                                   |
+| `data/Endpoint.kt`                                          | `EndpointCandidate` / `ApiEndpoint` / `RelayEndpoint` — multi-endpoint pairing (ADR 24); `displayLabel()` for LAN/Tailscale/Public/Custom chips                                                                                                                                                     |
+| `network/RelayHttpClient.kt`                                | OkHttp for /media, /sessions (list/revoke/extend), /health                                                                                                                                                                                                                                          |
+| **App — Bridge**                                            |                                                                                                                                                                                                                                                                                                     |
+| `network/handlers/BridgeCommandHandler.kt`                  | Routes `bridge.command` → ActionExecutor; full path inventory + safety-rail integration                                                                                                                                                                                                             |
+| `viewmodel/BridgeViewModel.kt`                              | BridgeScreen VM — masterToggle, bridgeStatus, permissionStatus, activityLog                                                                                                                                                                                                                         |
+| `bridge/BridgeSafetyManager.kt`                             | Blocklist + destructive-verb confirmation + auto-disable timer; fails-closed on /call and /send_sms                                                                                                                                                                                                 |
+| `data/BridgeSafetyPreferences.kt`                           | DataStore for blocklist, destructive verbs, auto-disable minutes, confirmation timeout                                                                                                                                                                                                              |
+| `ui/screens/BridgeScreen.kt`                                | Bridge UI — master → permission checklist → [Advanced] → unattended → safety → activity log (v0.4.1 reorder)                                                                                                                                                                                        |
+| `ui/components/UnattendedAccessRow.kt`                      | Unattended toggle card (sideload); `enabled=masterEnabled`; inline `KeyguardDetectedAlert`                                                                                                                                                                                                          |
+| `ui/components/UnattendedGlobalBanner.kt`                   | 28dp amber strip at scaffold top when master+unattended on (sideload); tap → Bridge tab                                                                                                                                                                                                             |
+| `bridge/BridgeStatusOverlay.kt`                             | WindowManager overlay; `ConfirmationOverlayHost`; requires `SavedStateRegistryOwner` init order (CREATED→restore→RESUMED)                                                                                                                                                                           |
+| `accessibility/HermesAccessibilityService.kt`               | AccessibilityService subclass; `@Volatile instance` singleton for BridgeCommandHandler                                                                                                                                                                                                              |
+| `accessibility/ScreenReader.kt`                             | UI tree → ScreenContent; `findNodeBoundsByText()`, `findFocusedInput()`                                                                                                                                                                                                                             |
+| `accessibility/ActionExecutor.kt`                           | Gesture/text dispatch via GestureDescription + ACTION_SET_TEXT; pressKey maps vocab only                                                                                                                                                                                                            |
+| **App — Voice**                                             |                                                                                                                                                                                                                                                                                                     |
+| `voice/VoiceViewModel.kt`                                   | Voice turn state machine; TTS queue; `ignoreAssistantId`; `errorEvents: SharedFlow`                                                                                                                                                                                                                 |
+| `audio/VoiceRecorder.kt`                                    | MediaRecorder wrapper; perceptual amplitude curve; `.m4a` at 16kHz/64kbps                                                                                                                                                                                                                           |
+| `audio/VoicePlayer.kt`                                      | Media3 ExoPlayer (gapless TTS queue) + Visualizer; amplitude StateFlow; `awaitCompletion()` via coroutine; `audioSessionId` is a thread-safe `@Volatile` cache                                                                                                                                      |
+| `network/RelayVoiceClient.kt`                               | OkHttp for `/voice/transcribe`, `/synthesize`, `/config`                                                                                                                                                                                                                                            |
+| `voice/VoiceBridgeIntentHandler.kt`                         | Interface routing voice utterances to bridge; impls per flavor via factory                                                                                                                                                                                                                          |
+| `voice/VoiceIntentClassifier.kt`                            | Regex phone-control classifier (sideload only); false-negatives preferred over false-positives                                                                                                                                                                                                      |
+| `ui/components/VoiceModeOverlay.kt`                         | Full-screen voice UI — MorphingSphere + VoiceWaveform + mic button                                                                                                                                                                                                                                  |
+| `ui/components/MorphingSphere.kt`                           | Compose renderer for the agent sphere — delegates math to `MorphingSphereCore`                                                                                                                                                                                                                      |
+| `ui/components/MorphingSphereCore.kt`                       | Platform-agnostic sphere algorithm (`kotlin.math` only) — single source of truth; mirrored byte-for-byte in `preview/web/sphere.js`                                                                                                                                                                 |
+| `preview/web/`                                              | Zero-dep browser harness — live `index.html` preview + `parity-check.mjs`; paired with `MorphingSphereCoreParityTest` (JVM) for struct/full checksum diffing                                                                                                                                        |
+| `user-docs/.vitepress/theme/components/SphereMark.vue`      | Docs-site sphere embed — imports `preview/web/sphere.js` directly; autonomous fbm drift + pointer-proximity gaze/state blend; `<ClientOnly>` + `IntersectionObserver` + `prefers-reduced-motion` aware                                                                                              |
+| **App — Media + Notifications**                             |                                                                                                                                                                                                                                                                                                     |
+| `util/MediaCacheWriter.kt`                                  | `cacheDir/hermes-media/` LRU writer; returns FileProvider URIs                                                                                                                                                                                                                                      |
+| `util/MediaSaver.kt`                                        | Save/share/open for chat media — MediaStore scoped-storage save (Pictures/Download `Hermes-Relay`, no perms on API 29+; pre-Q → share sheet); FileProvider share staging; remote-byte fetch; magic-byte image-MIME sniff for correct extensions                                                     |
+| `ui/components/ChatImageViewer.kt`                          | Full-screen image viewer — pinch-zoom/pan (`detectTransformGestures`), double-tap 1×/2.5×, Share/Save/Close; `ChatImageViewerSource` decouples Coil-model/bitmap display from a suspend `bytesProvider` so Save keeps original bytes                                                                |
+| `ui/components/InboundAttachmentCard.kt`                    | Discord-style attachment card for images/video/audio/pdf/text/generic; image tap → ChatImageViewer, file card long-press → Open/Share/Save menu                                                                                                                                                     |
+| `ui/components/ChatImageContent.kt`                         | Parses `![alt](src)` out of assistant content; remote http(s) → Coil (tap → ChatImageViewer), server-local/failed → inline "can't render" notice with the path                                                                                                                                      |
+| `data/HermesCard.kt`                                        | `CARD:{json}` envelope (ADR 26) — type/accent/fields/actions; kotlinx.serialization                                                                                                                                                                                                                 |
+| `ui/components/HermesCardBubble.kt`                         | Rich-card renderer — accent stripe + FlowRow actions + dispatch stamp collapse                                                                                                                                                                                                                      |
+| `viewmodel/CardDispatchSyncBuilder.kt`                      | Twin of VoiceIntentSyncBuilder — synthesizes card dispatches as `hermes_card_action` OpenAI pairs for session memory                                                                                                                                                                                |
+| `notifications/HermesNotificationCompanion.kt`              | NotificationListenerService; cold-start buffer (50); forwards via ChannelMultiplexer                                                                                                                                                                                                                |
+| `util/RelayErrorClassifier.kt`                              | `classifyError(Throwable, context) → HumanError`; used by Voice/Chat/Connection                                                                                                                                                                                                                     |
+| `util/TurnLatencyTracer.kt`                                 | One `TurnLatency` INFO line per chat turn — `warm/cold` + `connect/session/submit/ttfe/ttft/done@…ms`; gateway + 3 SSE paths use it for desktop-comparable latency diagnosis; durations only                                                                                                        |
+| **Relay — Server**                                          |                                                                                                                                                                                                                                                                                                     |
+| `plugin/relay/server.py`                                    | Canonical relay — WSS + HTTP routes; bridge, media, voice, session, pairing handlers. `handle_pairing_mint` mirrors `pair.py:762` — top-level = API server, `relay.{url,code}` nested                                                                                                               |
+| `plugin/relay/auth.py`                                      | PairingManager, SessionManager, RateLimiter; `math.inf` for never-expire                                                                                                                                                                                                                            |
+| `plugin/relay/channels/bridge.py`                           | Bridge handler — `handle_command()` mints request_id, awaits response, 30s timeout                                                                                                                                                                                                                  |
+| `plugin/relay/channels/notifications.py`                    | Bounded deque (100) of notification metadata; in-memory only                                                                                                                                                                                                                                        |
+| `plugin/relay/media.py`                                     | MediaRegistry — LRU token store; `strict_sandbox` off by default for `/media/by-path`                                                                                                                                                                                                               |
+| `plugin/relay/voice.py`                                     | Voice endpoints — transcribe, synthesize, voice_config; lazy tool imports                                                                                                                                                                                                                           |
+| `plugin/relay/qr_sign.py`                                   | HMAC-SHA256 QR signing; secret at `~/.hermes/hermes-relay-qr-secret`; canonical form preserves `endpoints` array order + role strings verbatim (ADR 24)                                                                                                                                             |
+| `plugin/relay/tailscale.py`                                 | First-class Tailscale helper (ADR 25) — `status()` / `enable(port)` / `disable(port)` / `canonical_upstream_present()`; safe-absent via shell-out to `tailscale` CLI                                                                                                                                |
+| `plugin/relay/_env_bootstrap.py`                            | Loads `~/.hermes/.env` before relay imports; called from both entry points                                                                                                                                                                                                                          |
+| **Plugin — Tools + Installer**                              |                                                                                                                                                                                                                                                                                                     |
+| `plugin/tools/android_tool.py`                              | 18 `android_*` tool handlers (14 baseline + send_sms, call, search_contacts, return_to_hermes); `android_screenshot` first consumer of `register_media()`                                                                                                                                           |
+| `plugin/tools/android_navigate.py`                          | Vision-driven navigation loop; up to 20 iterations; `llm_gap` error until vision client wired                                                                                                                                                                                                       |
+| `plugin/pair.py`                                            | QR payload builder + CLI; `build_payload(sign=True)`; `--register-code` fallback                                                                                                                                                                                                                    |
+| `plugin/doctor.py`                                          | `hermes relay doctor`; checks standard upstream API/dashboard reachability, Relay loopback state, plugin layout, and compat hook state                                                                                                                                                              |
+| `plugin/compat.py`                                          | `hermes relay compat status/install/remove`; owns the optional `hermes_relay_bootstrap.pth` lifecycle                                                                                                                                                                                               |
+| `plugin/hermes_relay_bootstrap/`                            | Plugin-owned runtime compatibility patch — compat-only surfaces (session search, memory, skill detail/toggle, config, available-models, slash middleware); sessions + skills-list injection retired (#33134/#33016)                                                                                 |
+| `install.sh`                                                | Canonical installer — 6 steps; idempotent; drops `hermes-relay-update` shim                                                                                                                                                                                                                         |
+| `uninstall.sh`                                              | Canonical uninstaller; reverses install.sh; never touches `.env` or `state.db`                                                                                                                                                                                                                      |
+| `hermes_relay_bootstrap/`                                   | Legacy import shim for old `.pth` files and editable installs                                                                                                                                                                                                                                       |
+| **Plugin — Dashboard**                                      |                                                                                                                                                                                                                                                                                                     |
+| `plugin/dashboard/manifest.json`                            | Declares tab, entry bundle, and FastAPI module for hermes-agent discovery                                                                                                                                                                                                                           |
+| `plugin/dashboard/plugin_api.py`                            | FastAPI router proxying 5 routes to relay over loopback; `/pairing` body = API-server overrides (host/port/tls/api_key), relay URL auto-derived                                                                                                                                                     |
+| `plugin/dashboard/src/index.jsx`                            | React root registering `hermes-relay` plugin with 4-tab shell                                                                                                                                                                                                                                       |
+| `plugin/dashboard/dist/index.js`                            | Committed IIFE bundle loaded verbatim by dashboard                                                                                                                                                                                                                                                  |
+| **Desktop CLI**                                             |                                                                                                                                                                                                                                                                                                     |
+| `desktop/package.json`                                      | `@hermes-relay/cli` package manifest — Node ≥21, one `hermes-relay` bin, pre-built dist                                                                                                                                                                                                             |
+| `desktop/bin/hermes-relay.js`                               | Tiny shim: `import('../dist/cli.js').then(m => m.main())` + error surfacing                                                                                                                                                                                                                         |
+| `desktop/src/chatAttach.ts`                                 | captureClipboardImage / captureScreenshot / readImageFile; ships base64 to server via `image.attach.bytes` RPC before next prompt.submit                                                                                                                                                            |
+| `desktop/src/cli.ts`                                        | argv parser + subcommand dispatcher — bare → `shell` (PTY), positional-only → `chat`; command-scoped `--help` falls through to each command                                                                                                                                                         |
+| `desktop/src/lib/theme.ts`                                  | Shared ANSI palette + `colorEnabled()` + `Theme` (semantic helpers, `statusDot`) — single visual language; `--no-color`/`NO_COLOR`/TTY aware                                                                                                                                                        |
+| `desktop/src/lib/table.ts`                                  | Zero-dep column-aligned table renderer (ANSI-width aware, last column flexes to terminal width) — used by devices/sessions/audit                                                                                                                                                                    |
+| `desktop/src/lib/spinner.ts`                                | Stderr braille spinner for slow ops (pair probe, gateway connect); no-op when piped/quiet/json                                                                                                                                                                                                      |
+| `desktop/src/lib/usage.ts`                                  | `UsageSpec` + `renderUsage`/`printUsage`/`unknownSubcommand` — per-subcommand `--help` + self-documenting sub-verb fallback                                                                                                                                                                         |
+| `desktop/src/lib/hints.ts`                                  | `suggestedFix(err, ctx)` → next-step command (re-pair on auth fail, etc.); `formatError` renders error + hint                                                                                                                                                                                       |
+| `desktop/src/lib/logo.ts`                                   | Slim box-drawing "Hermes Relay" wordmark; shown atop `--help`, first-run welcome, REPL header, and `hermes-relay logo`; theme/no-color aware                                                                                                                                                        |
+| `desktop/src/lib/auditLog.ts`                               | Local desktop-tool audit JSONL (`~/.hermes/desktop-audit.jsonl`); router appends per dispatch; backs `audit` command (relay's ring is loopback-only)                                                                                                                                                |
+| `desktop/src/lib/daemonStatus.ts`                           | Daemon heartbeat file (`~/.hermes/daemon-status.json`) + `isPidAlive` liveness; backs `daemon --status`                                                                                                                                                                                             |
+| `desktop/src/commands/audit.ts`                             | `hermes-relay audit` — tails the local audit log into a table (WHEN/TOOL/STATUS/DETAIL); `--limit`, `--json`                                                                                                                                                                                        |
+| `desktop/src/commands/relay.ts`                             | `hermes-relay relay info/security/context/queue` — relay-server management surface; info/security/queue loopback-only, context works remote with bearer; `queue` lists/cancels the agent→phone outbound buffer (`--clear` / `--cancel <id>`)                                                        |
+| `desktop/src/commands/chat.ts`                              | REPL + one-shot + piped-stdin; `runOneTurn` returns `{promise, cancel}` for safe SIGINT; auto-wires `DesktopToolRouter` when consented                                                                                                                                                              |
+| `desktop/src/commands/shell.ts`                             | Pipes the `terminal` relay channel to raw-mode stdin/stdout; post-attach `exec hermes` 350ms after tmux settles; `Ctrl+A .` detach / `Ctrl+A k` kill / `Ctrl+A Ctrl+A` literal                                                                                                                      |
+| `desktop/src/commands/pair.ts`                              | Either 6-char code + `--remote`, or full v3 QR via `--pair-qr` — probes + picks endpoint, records role; `--grant-tools` (TTY prompt) / `--auto-grant-tools` (silent) stamp `toolsConsented` so `daemon` works without a `shell` round-trip                                                          |
+| `desktop/src/commands/tools.ts`                             | `tools.list` RPC → enabled/available toolsets; `--verbose` lists individual tools                                                                                                                                                                                                                   |
+| `desktop/src/commands/status.ts`                            | Local read of `~/.hermes/remote-sessions.json`; renders `grants:` + `expires:` + `route:`; `--json` redacts tokens, `--reveal-tokens` opts in                                                                                                                                                       |
+| `desktop/src/commands/devices.ts`                           | Server-side session management — `GET/DELETE/PATCH /sessions` via `fetch` over http(s)://host:port; `list` / `revoke <prefix>` / `extend <prefix> --ttl <s>`                                                                                                                                        |
+| `desktop/src/banner.ts`                                     | `buildConnectBanner({url, meta, endpointRole})` → "Connected via LAN (plain) — server 0.6.0"; `humanExpiry()` for TTL formatting                                                                                                                                                                    |
+| `desktop/src/endpoint.ts`                                   | `EndpointCandidate` / `EndpointRole` types + `displayLabel()` — mirrors Android `data/Endpoint.kt`                                                                                                                                                                                                  |
+| `desktop/src/pairingQr.ts`                                  | `decodePairingPayload` (JSON or base64), `payloadToCandidates` (v3 verbatim / v1–v2 synthesized), `probeCandidatesByPriority` (`Promise.any` within tier, `AbortSignal.any`, 4s timeout, 60s cache)                                                                                                 |
+| `desktop/src/certPin.ts`                                    | `extractSpkiSha256(der)` via `crypto.X509Certificate` + `publicKey.export({type:'spki'})`; `pinKey(url)`, `comparePins()`, `isSecureUrl()`                                                                                                                                                          |
+| `desktop/src/tools/router.ts`                               | `DesktopToolRouter.attach(relay)` — `onChannel('desktop')` dispatch under 30s `AbortController`; heartbeat enriched with host/platform/version/uptime_ms + sticky `last_error` for `desktop_health`                                                                                                 |
+| `desktop/src/tools/handlerSet.ts`                           | Single source of truth for the desktop tool map — `DESKTOP_HANDLERS` + `DESKTOP_ADVERTISED_TOOLS`; consumed by `chat.ts` / `shell.ts` / `daemon.ts` so adding a tool is a one-file change                                                                                                           |
+| `desktop/src/tools/consent.ts`                              | `ensureToolsConsent(url)` — stored per-URL in `toolsConsented`; TTY prompt; non-TTY fails closed                                                                                                                                                                                                    |
+| `desktop/src/tools/handlers/fs.ts`                          | `readFileHandler` / `writeFileHandler` / `patchHandler` — strict unified-diff applier, no fuzz                                                                                                                                                                                                      |
+| `desktop/src/tools/handlers/terminal.ts`                    | `bash -lc` / `cmd /c`, SIGKILL on timeout or abort, returns `{stdout, stderr, exit_code, duration_ms}`                                                                                                                                                                                              |
+| `desktop/src/tools/handlers/powershell.ts`                  | Spawns `pwsh`/`powershell` directly with `-Command -`, script piped via stdin — no cmd.exe quote-mangling; auto-picks pwsh &gt; powershell                                                                                                                                                          |
+| `desktop/src/tools/handlers/process.ts`                     | `spawn_detached` (unref'd, returns pid+log_path), `list_processes` (tasklist /FO CSV — no /V to dodge window-title latency), `kill_process`, `find_pid_by_port` (netstat/lsof/ss)                                                                                                                   |
+| `desktop/src/tools/handlers/jobs.ts`                        | Job API — `~/.hermes/desktop-jobs/<id>/{stdout.log, stderr.log, meta.json}` is source of truth across daemon restarts; `taskkill /T` on Windows so build trees die fully                                                                                                                            |
+| `desktop/src/tools/handlers/transfer.ts`                    | `copy_directory` via `fs.cp`, `zip`/`unzip` via tar &gt; zip &gt; PowerShell probe, `checksum` streamed (sha256/sha1/md5)                                                                                                                                                                           |
+| `desktop/src/tools/handlers/search.ts`                      | ripgrep with pure-Node fallback, skips `.git`/`node_modules`/`dist`/`.next`/`.cache`                                                                                                                                                                                                                |
+| `desktop/src/renderer.ts`                                   | Streams `message.delta` → stdout, tool events → decorated lines; NO_COLOR / --json / --quiet aware                                                                                                                                                                                                  |
+| `desktop/src/pairing.ts`                                    | readline-based 6-char prompt (`A-Z0-9`); headless mirror of TUI's Ink prompt; `validatePairingPayloadString` discriminated-union wrapper                                                                                                                                                            |
+| `desktop/src/credentials.ts`                                | Precedence: `--token` → `--pair-qr` (probe+pair) → `--code` → stored → prompt; returns `Credentials{sessionToken?, pairingCode?, resolvedEndpoint?}`                                                                                                                                                |
+| `desktop/src/transport/RelayTransport.ts`                   | Fork of ui-tui's transport + reconnect state machine (`idle/connecting/connected/reconnecting`, exp backoff 1→30s, 5min on 429, gate re-check post-sleep) + pre-WS TLS probe for TOFU                                                                                                               |
+| `desktop/src/remoteSessions.ts`                             | Same file path as TUI (`~/.hermes/remote-sessions.json`, 0600); schema widened with `grants`, `ttlExpiresAt`, `endpointRole`, `toolsConsented`; `saveSession` back-compat overload                                                                                                                  |
+| `desktop/src/commands/daemon.ts`                            | Headless WSS + tool router for always-on access; JSON-line logs; fails closed on missing consent unless `--allow-tools` with explicit `--token`                                                                                                                                                     |
+| `desktop/src/commands/doctor.ts`                            | Local-only diagnostic report — version / binary path / PATH / sessions / daemon detection; `--json` for support-paste; omits tokens entirely                                                                                                                                                        |
+| `desktop/src/relayUrlPrompt.ts`                             | First-run URL fallback — `resolveFirstRunUrl()` auto-picks single stored session, numbered picker for multiple, welcome banner for zero; throws on non-interactive + ambiguous                                                                                                                      |
+| `desktop/src/version.ts`                                    | Build-time-generated constant (`npm run gen:version` before every build) — Bun compiled binaries can't read package.json via `__dirname` so version is embedded at build                                                                                                                            |
+| `desktop/scripts/install.sh` / `install.ps1`                | curl/iwr one-liner installers — download prebuilt Bun binary (no Node required), SHA256-verified, API-resolver for `latest` that includes prereleases, version-aware pre/post-install readback                                                                                                      |
+| `desktop/scripts/uninstall.sh` / `uninstall.ps1`            | 3-tier removal — default (binary + PATH), `--purge` (also wipes `~/.hermes/remote-sessions.json`), `--service` (stub for future service installers); Windows iex-safe env-var fallback                                                                                                              |
+| `desktop/README.md`                                         | User-facing install + usage reference                                                                                                                                                                                                                                                               |
+| **Desktop CLI — dev iteration**                             |                                                                                                                                                                                                                                                                                                     |
+| `npm run smoke` (in `desktop/`)                             | Builds Windows binary + runs `--version` / `--help` / `doctor`, fails loud on zero-output. Local pre-flight before cutting any tag.                                                                                                                                                                 |
+| `npm run gen:version`                                       | Regenerates `src/version.ts` from `package.json`. Runs automatically before every `build` / `build:bin:*`.                                                                                                                                                                                          |
+| `release-cli.yml → Smoke-test Linux binary` step            | CI-side equivalent: runs compiled Linux binary through the same 3-command check before uploading assets. Catches silent-exit-0 + segfault classes.                                                                                                                                                  |
+| **Server — Desktop tool routing (Phase B)**                 |                                                                                                                                                                                                                                                                                                     |
+| `plugin/relay/channels/desktop.py`                          | Mirrors `bridge.py` — `desktop.command`/`desktop.response`/`desktop.status`, UUID-correlated futures, 30s timeout, single-client MVP, per-session advertised-tools set                                                                                                                              |
+| `plugin/tools/desktop_tool.py`                              | 24 `desktop_*` tools (fs/shell/powershell/process/jobs/transfer/health) — registers with `tools.registry` under `desktop` toolset; per-tool `check_fn` pings `/desktop/_ping?tool=<name>`; `desktop_health` is `_RELAY_ONLY` and pings `/desktop/health` so it works even when the client is wedged |
+| **Gradle modules — experimental Quest/XR (in development)** |                                                                                                                                                                                                                                                                                                     |
+| `relay-core/`                                               | [EXPERIMENTAL] Android library (`com.axiomlabs.hermesrelay.core`) — shared pairing/transport/terminal/voice/wire for the Quest port; not yet wired into the shipped `:app`                                                                                                                          |
+| `relay-ui/`                                                 | [EXPERIMENTAL] Android library (`com.axiomlabs.hermesrelay.ui`) — shared Compose UI (sphere, terminal WebView, QR scanner) for the Quest port; carries its own sphere copy                                                                                                                          |
+| `quest/`                                                    | [EXPERIMENTAL] Meta Spatial SDK Quest/XR app — gradle `includeBuild("quest")`; needs further development, not shipped                                                                                                                                                                               |
+| **Tooling — dev iteration (not shipped)**                   |                                                                                                                                                                                                                                                                                                     |
+| `ui-preview/`                                               | Desktop Compose Hot Reload harness — JVM Compose for Desktop; source-shares `MorphingSphereCore` from `:relay-ui`; `Main.kt` gallery; see `ui-preview/README.md`                                                                                                                                    |
+| `app/src/test/.../screenshots/StoreScreenshotTest.kt`       | Roborazzi host-side store/docs screenshot renderer — deterministic, no device, exact 1080×2160; reuses real components+chrome with mock data; `capture(name, themeId){…}` renders any view; see `docs/screenshot-automation.md` §Deterministic rendering (JDK-21 + no-plugin gotchas)               |
+

 ## What NOT to Do

@@ -349,15 +364,18 @@ This is a **public, distributed repo** — every committed file (CHANGELOG, DEVL
 - **Don't put documentation in root** — long-form docs go in `docs/`
 - **Don't forget DEVLOG.md** — update it (record *what happened*)
 - **Don't bury follow-ups** — deferred work / known gaps go in `TODO.md`, never in DEVLOG or one-off code/doc comments
+- **Don't touch production / remote hosts** — automation and orchestrated agents must NEVER SSH into, deploy to, pull/restart/reconfigure, or push code to a live/remote Hermes host. Building, on-device testing, and server deployment are owner-driven (see Server Deployment). Stop at committing on your branch; surface "this needs a deploy/on-device check" rather than doing it.

 ## MCP Tooling

 Two MCP servers are configured for AI-assisted development. See `docs/mcp-tooling.md` for full reference.

-| Server | Layer | Requires |
-|--------|-------|----------|
+
+| Server              | Layer                                                           | Requires                                 |
+| ------------------- | --------------------------------------------------------------- | ---------------------------------------- |
 | `android-tools-mcp` | IDE/Build — Compose previews, Gradle, code search, Android docs | Android Studio running with project open |
-| `mobile-mcp` | Device/Runtime — tap, swipe, screenshot, app management | ADB + connected device/emulator |
+| `mobile-mcp`        | Device/Runtime — tap, swipe, screenshot, app management         | ADB + connected device/emulator          |
+

 ## Dev Workflow

@@ -396,35 +414,44 @@ Curls every bridge HTTP route via `localhost:8767`. Catches the silent-drop regr

 Server is a Linux box running hermes-agent with hermes-relay editable-installed (`pip install -e`). Sensitive details (IP, user, secrets) in `~/SYSTEM.md` on the server — not in this repo.

-| What | Where |
-|---|---|
-| hermes-agent repo | `~/.hermes/hermes-agent/` |
-| hermes-relay clone | `~/.hermes/hermes-relay/` |
-| Plugin symlink | `~/.hermes/plugins/hermes-relay` → `~/.hermes/hermes-relay/plugin` |
-| Config | `~/.hermes/config.yaml` + `~/.hermes/.env` |
-| Relay log | `journalctl --user -u hermes-relay -f` |
+
+| What               | Where                                                              |
+| ------------------ | ------------------------------------------------------------------ |
+| hermes-agent repo  | `~/.hermes/hermes-agent/`                                          |
+| hermes-relay clone | `~/.hermes/hermes-relay/`                                          |
+| Plugin symlink     | `~/.hermes/plugins/hermes-relay` → `~/.hermes/hermes-relay/plugin` |
+| Config             | `~/.hermes/config.yaml` + `~/.hermes/.env`                         |
+| Relay log          | `journalctl --user -u hermes-relay -f`                             |
+

 **Update:** `hermes-relay-update` (idempotent, re-fetches install.sh). Or manually: `git pull --ff-only && systemctl --user restart hermes-relay`.

 **Compat hook:** `hermes relay compat status/install/remove` manages only the
+
 optional `hermes_relay_bootstrap.pth` startup hook. New installs load the
+
 plugin-owned bootstrap from `plugin/hermes_relay_bootstrap/`; the repo-root
+
 package is only a legacy import shim. Vanilla Hermes chat, Manage, and dashboard voice
+
 must not depend on this hook.

 **Key conventions:**
- Phone re-pairs after each relay restart (SessionManager is in-memory; wiped on restart)
+
+- Phone pairing **survives** relay restart — `SessionManager` persists sessions to `~/.hermes/hermes-relay-sessions.json` (`server.py:88-90`, `persistence_path` from `RelayConfig.from_env`); a trusted-device refresh token recovers a lost/revoked/reset session without a new QR scan. (Only the in-memory *live-connection presence* clears on restart; the phone reconnects automatically.)
 - Use `python -m unittest` not `pytest` — conftest imports `responses` which may not be installed
 - `_env_bootstrap.py` loads `~/.hermes/.env` on every relay start — no stale API keys

 ### Where Python vs. Kotlin changes land

-| Change type | Who restarts? | Command |
-|---|---|---|
-| Plugin tool (`android_tool.py` etc.) | `hermes-gateway.service` | `systemctl --user restart hermes-gateway` |
-| Relay code (`plugin/relay/*.py`) | `hermes-relay.service` | `systemctl --user restart hermes-relay` |
-| Pair CLI / skill files | — | No restart — fresh process / scanned on invocation |
-| Android app | Bailey (Studio) | Studio run button |
+
+| Change type                          | Who restarts?            | Command                                            |
+| ------------------------------------ | ------------------------ | -------------------------------------------------- |
+| Plugin tool (`android_tool.py` etc.) | `hermes-gateway.service` | `systemctl --user restart hermes-gateway`          |
+| Relay code (`plugin/relay/*.py`)     | `hermes-relay.service`   | `systemctl --user restart hermes-relay`            |
+| Pair CLI / skill files               | —                        | No restart — fresh process / scanned on invocation |
+| Android app                          | Bailey (Studio)          | Studio run button                                  |
+

 ### Release Process

@@ -434,58 +461,63 @@ See [RELEASE.md](RELEASE.md) for the full recipe.
 - **Relay plugin version source:** `pyproject.toml`; keep plugin/dashboard metadata synced with `scripts/check-plugin-version-sync.py`; bump with `scripts/bump-plugin-version.sh`
 - **Desktop CLI version source:** `desktop/package.json`; regenerate `desktop/src/version.ts` with `npm run gen:version`
 - **Track audit:** `python scripts/check-version-tracks.py` reports Android, plugin, and CLI versions without forcing them to match
- **`appVersionCode` is monotonic** — always increment across Android prereleases
+- `**appVersionCode` is monotonic** — always increment across Android prereleases
 - **Cut a release:** bump the target surface → commit → merge `dev` to `main` → tag with `android-v*`, `plugin-v*`, or `cli-v*` → push tag → CI builds + GitHub Release
 - **Required secrets:** `HERMES_KEYSTORE_BASE64`, `HERMES_KEYSTORE_PASSWORD`, `HERMES_KEY_ALIAS`, `HERMES_KEY_PASSWORD`

 ## Integration Points

-| Surface | Endpoint | Notes |
-|---------|----------|-------|
-| Chat (gateway) | Dashboard `POST /api/auth/ws-ticket` -> WS `/api/ws` | Vanilla Hermes dashboard/tui_gateway path; live thinking/reasoning; requires dashboard auth |
-| Chat streaming | `POST /v1/runs` → `GET /v1/runs/{id}/events` | Structured tool events; async run-control path |
-| Chat (sessions) | `POST /api/sessions/{id}/chat/stream` | Native upstream session-persisted SSE; preferred when capability probe finds it |
-| Chat (compat) | `POST /v1/chat/completions` (stream=true) | Inline tool annotations only |
-| Session CRUD | `GET/POST/PATCH/DELETE /api/sessions` | Native upstream (#33134); bootstrap fallback only for old builds |
-| Manage | Dashboard `/api/status`, `/api/auth/me`, `/api/config`, `/api/profiles/*`, `/api/env`, `/api/model/*`, `/api/mcp/*` | Vanilla Hermes dashboard surface; do not proxy through Relay |
-| Vanilla Hermes voice | Dashboard `POST /api/audio/transcribe`, `POST /api/audio/speak` | Vanilla Hermes no-plugin voice; uses dashboard session from Manage |
-| Pairing (QR) | `POST /pairing/register` (loopback only) | Via `/hermes-relay-pair` or `hermes-pair` shim; accepts optional `endpoints` for multi-endpoint QRs |
-| Pairing (multi-endpoint) | QR `endpoints` array (ADR 24) | `hermes: 3` schema; ordered `lan`/`tailscale`/`public`/... candidates; phone re-probes on network change |
-| Pairing auth | WSS `auth.ok` payload | Includes `expires_at`, `grants`, `transport_hint` |
-| Tailscale Serve (ADR 25) | `hermes-relay-tailscale enable\|disable\|status` CLI | Fronts loopback `:8767` with `tailscale serve --bg --https=<port>`; auto-retires on upstream PR #9295 |
-| Inbound media (token) | `GET /media/{token}` | Bearer auth; 24h TTL |
-| Inbound media (path) | `GET /media/by-path?path=<abs>` | Permissive by default; `RELAY_MEDIA_STRICT_SANDBOX=1` to restrict |
-| Session management | `GET /sessions`, `DELETE /sessions/{prefix}`, `PATCH /sessions/{prefix}` | List/revoke/extend; RelayHttpClient |
-| Voice transcribe | `POST /voice/transcribe` | multipart/form-data; bearer auth |
-| Voice synthesize | `POST /voice/synthesize` | JSON → audio/mpeg; max 5000 chars |
-| Voice config | `GET /voice/config` | Returns current tts/stt provider info |
-| Plugin diagnostics | `hermes relay doctor --json` | Reports upstream route reachability, Relay loopback state, plugin layout, and legacy bootstrap state |
-| Compat hook lifecycle | `hermes relay compat status/install/remove` | Optional legacy API compatibility hook; not required for the standard path |
-| Notifications | `GET /notifications/recent?limit=N` | Loopback callers skip bearer |
-| Relay health | `GET /health` on `:8767` | Used by `RelayHttpClient.probeHealth()` |
-| Capabilities | `GET /v1/capabilities` plus targeted `HEAD` probes | Prefer capabilities when present; HEAD probes keep mixed-version fallback working |
-| Desktop CLI (tui channel) | WSS `tui.attach` / `tui.rpc.request` / `tui.rpc.event` | Same channel + envelopes as the Ink TUI — the CLI just renders events as plain lines. Zero server changes. |
-| Desktop CLI (terminal channel) | WSS `terminal.attach` / `terminal.input` / `terminal.output` / `terminal.resize` / `terminal.detached` | Existing channel (shared with Android). CLI `shell` subcommand attaches, injects `clear; exec hermes\n` 350ms after ack, pipes raw bytes. `Ctrl+A .` detaches (tmux preserved), `Ctrl+A k` kills. |
-| Desktop CLI tool visibility | `tools.list` RPC on the shared tui channel | Returns `{toolsets: [{name, description, tool_count, enabled, tools:[]}]}`; surfaced by `hermes-relay tools` |
-| Desktop CLI devices | HTTP `GET/DELETE/PATCH /sessions` on the relay's same port | Wrapped by `hermes-relay devices list | revoke <prefix> | extend <prefix> --ttl <s>`; bearer token from stored session; token prefix only (never full token) |
-| Desktop tool routing (Phase B) | WSS `desktop.command` (s→c) + `desktop.response` (c→s) + `desktop.status` (c→s heartbeat) | New channel. Hermes calls `desktop_read_file(path)` → Python handler POSTs to `/desktop/desktop_read_file` → relay forwards over `desktop.command` → Node client's `DesktopToolRouter` runs the handler locally → response bubbles back. Mirror of Android's `bridge.command` pattern. |
-| Desktop tool check_fn | HTTP `GET /desktop/_ping?tool=<name>` | Returns 200 if a client is connected AND advertises this tool; 503 otherwise. Hermes uses this to fail the tool quickly when no desktop client is live, instead of waiting 30s for the dispatch timeout. |
-| Desktop health | HTTP `GET /desktop/health` | Returns full status snapshot — connected/host/platform/version/pid/uptime/advertised_tools/last_error/recent_commands. Loopback-only. Backs the `desktop_health` agent tool, which intentionally does NOT round-trip through the client so it remains callable when other tools are wedged. |
+
+| Surface                        | Endpoint                                                                                                            | Notes                                                                                                                                                                                                                                                                                       |
+| ------------------------------ | ------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Chat (gateway)                 | Dashboard `POST /api/auth/ws-ticket` -&gt; WS `/api/ws`                                                             | Vanilla Hermes dashboard/tui_gateway path; live thinking/reasoning; requires dashboard auth                                                                                                                                                                                                 |
+| Chat streaming                 | `POST /v1/runs` → `GET /v1/runs/{id}/events`                                                                        | Structured tool events; async run-control path                                                                                                                                                                                                                                              |
+| Chat (sessions)                | `POST /api/sessions/{id}/chat/stream`                                                                               | Native upstream session-persisted SSE; preferred when capability probe finds it                                                                                                                                                                                                             |
+| Chat (compat)                  | `POST /v1/chat/completions` (stream=true)                                                                           | Inline tool annotations only                                                                                                                                                                                                                                                                |
+| Session CRUD                   | `GET/POST/PATCH/DELETE /api/sessions`                                                                               | Native upstream (#33134); bootstrap fallback retired                                                                                                                                                                                                                                        |
+| Manage                         | Dashboard `/api/status`, `/api/auth/me`, `/api/config`, `/api/profiles/*`, `/api/env`, `/api/model/*`, `/api/mcp/*` | Vanilla Hermes dashboard surface; do not proxy through Relay                                                                                                                                                                                                                                |
+| Vanilla Hermes voice           | Dashboard `POST /api/audio/transcribe`, `POST /api/audio/speak`                                                     | Vanilla Hermes no-plugin voice; uses dashboard session from Manage                                                                                                                                                                                                                          |
+| Pairing (QR)                   | `POST /pairing/register` (loopback only)                                                                            | Via `/hermes-relay-pair` or `hermes-pair` shim; accepts optional `endpoints` for multi-endpoint QRs                                                                                                                                                                                         |
+| Pairing (multi-endpoint)       | QR `endpoints` array (ADR 24)                                                                                       | `hermes: 3` schema; ordered `lan`/`tailscale`/`public`/... candidates; phone re-probes on network change                                                                                                                                                                                    |
+| Pairing auth                   | WSS `auth.ok` payload                                                                                               | Includes `expires_at`, `grants`, `transport_hint`                                                                                                                                                                                                                                           |
+| Tailscale Serve (ADR 25)       | `hermes-relay-tailscale enable|disable|status` CLI                                                                  | Fronts loopback `:8767` with `tailscale serve --bg --https=<port>`; auto-retires on upstream PR #9295                                                                                                                                                                                       |
+| Inbound media (token)          | `GET /media/{token}`                                                                                                | Bearer auth; 24h TTL                                                                                                                                                                                                                                                                        |
+| Inbound media (path)           | `GET /media/by-path?path=<abs>`                                                                                     | Permissive by default; `RELAY_MEDIA_STRICT_SANDBOX=1` to restrict                                                                                                                                                                                                                           |
+| Session management             | `GET /sessions`, `DELETE /sessions/{prefix}`, `PATCH /sessions/{prefix}`                                            | List/revoke/extend; RelayHttpClient                                                                                                                                                                                                                                                         |
+| Voice transcribe               | `POST /voice/transcribe`                                                                                            | multipart/form-data; bearer auth                                                                                                                                                                                                                                                            |
+| Voice synthesize               | `POST /voice/synthesize`                                                                                            | JSON → audio/mpeg; max 5000 chars                                                                                                                                                                                                                                                           |
+| Voice config                   | `GET /voice/config`                                                                                                 | Returns current tts/stt provider info                                                                                                                                                                                                                                                       |
+| Plugin diagnostics             | `hermes relay doctor --json`                                                                                        | Reports upstream route reachability, Relay loopback state, plugin layout, and legacy bootstrap state                                                                                                                                                                                        |
+| Compat hook lifecycle          | `hermes relay compat status/install/remove`                                                                         | Optional legacy API compatibility hook; not required for the standard path                                                                                                                                                                                                                  |
+| Notifications                  | `GET /notifications/recent?limit=N`                                                                                 | Loopback callers skip bearer                                                                                                                                                                                                                                                                |
+| Relay health                   | `GET /health` on `:8767`                                                                                            | Used by `RelayHttpClient.probeHealth()`                                                                                                                                                                                                                                                     |
+| Capabilities                   | `GET /v1/capabilities` plus targeted `HEAD` probes                                                                  | Prefer capabilities when present; HEAD probes keep mixed-version fallback working                                                                                                                                                                                                           |
+| Desktop CLI (tui channel)      | WSS `tui.attach` / `tui.rpc.request` / `tui.rpc.event`                                                              | Same channel + envelopes as the Ink TUI — the CLI just renders events as plain lines. Zero server changes.                                                                                                                                                                                  |
+| Desktop CLI (terminal channel) | WSS `terminal.attach` / `terminal.input` / `terminal.output` / `terminal.resize` / `terminal.detached`              | Existing channel (shared with Android). CLI `shell` subcommand attaches, injects `clear; exec hermes\n` 350ms after ack, pipes raw bytes. `Ctrl+A .` detaches (tmux preserved), `Ctrl+A k` kills.                                                                                           |
+| Desktop CLI tool visibility    | `tools.list` RPC on the shared tui channel                                                                          | Returns `{toolsets: [{name, description, tool_count, enabled, tools:[]}]}`; surfaced by `hermes-relay tools`                                                                                                                                                                                |
+| Desktop CLI devices            | HTTP `GET/DELETE/PATCH /sessions` on the relay's same port                                                          | Wrapped by `hermes-relay devices list                                                                                                                                                                                                                                                       |
+| Desktop tool routing (Phase B) | WSS `desktop.command` (s→c) + `desktop.response` (c→s) + `desktop.status` (c→s heartbeat)                           | New channel. Hermes calls `desktop_read_file(path)` → Python handler POSTs to `/desktop/desktop_read_file` → relay forwards over `desktop.command` → Node client's `DesktopToolRouter` runs the handler locally → response bubbles back. Mirror of Android's `bridge.command` pattern.      |
+| Desktop tool check_fn          | HTTP `GET /desktop/_ping?tool=<name>`                                                                               | Returns 200 if a client is connected AND advertises this tool; 503 otherwise. Hermes uses this to fail the tool quickly when no desktop client is live, instead of waiting 30s for the dispatch timeout.                                                                                    |
+| Desktop health                 | HTTP `GET /desktop/health`                                                                                          | Returns full status snapshot — connected/host/platform/version/pid/uptime/advertised_tools/last_error/recent_commands. Loopback-only. Backs the `desktop_health` agent tool, which intentionally does NOT round-trip through the client so it remains callable when other tools are wedged. |
+

 ## Upstream References

-| Topic | Upstream File |
-|-------|--------------|
-| API endpoints | `gateway/platforms/api_server.py` — all registered HTTP routes |
-| Platform adapter interface | `gateway/platforms/base.py` — `BasePlatformAdapter` abstract class |
-| Adding a platform | `gateway/platforms/ADDING_A_PLATFORM.md` — 16-step checklist |
-| Platform registration | `gateway/run.py` → `_create_adapter()`, `gateway/config.py` → `Platform` enum |
-| Channel directory | `gateway/channel_directory.py` — how platforms/channels are enumerated |
-| Send message routing | `tools/send_message_tool.py` → `platform_map` dict |
-| SSE streaming (runs) | `gateway/platforms/api_server.py` → runs endpoint, `_on_tool_progress` |
+
+| Topic                      | Upstream File                                                                 |
+| -------------------------- | ----------------------------------------------------------------------------- |
+| API endpoints              | `gateway/platforms/api_server.py` — all registered HTTP routes                |
+| Platform adapter interface | `gateway/platforms/base.py` — `BasePlatformAdapter` abstract class            |
+| Adding a platform          | `gateway/platforms/ADDING_A_PLATFORM.md` — 16-step checklist                  |
+| Platform registration      | `gateway/run.py` → `_create_adapter()`, `gateway/config.py` → `Platform` enum |
+| Channel directory          | `gateway/channel_directory.py` — how platforms/channels are enumerated        |
+| Send message routing       | `tools/send_message_tool.py` → `platform_map` dict                            |
+| SSE streaming (runs)       | `gateway/platforms/api_server.py` → runs endpoint, `_on_tool_progress`        |
+

 ## Related Projects

- **[hermes-agent](https://github.com/NousResearch/hermes-agent)** — the agent platform (gateway, WebAPI, plugin system)
- **[android-tools-mcp](https://github.com/Codename-11/android-tools-mcp)** — our fork of Android Studio MCP bridge (Compose previews, Gradle, docs)
- **[mobile-mcp](https://github.com/mobile-next/mobile-mcp)** — device control MCP server (ADB, tap/swipe, screenshots)
+- [**hermes-agent**](https://github.com/NousResearch/hermes-agent) — the agent platform (gateway, WebAPI, plugin system)
+- [**android-tools-mcp**](https://github.com/Codename-11/android-tools-mcp) — our fork of Android Studio MCP bridge (Compose previews, Gradle, docs)
+- [**mobile-mcp**](https://github.com/mobile-next/mobile-mcp) — device control MCP server (ADB, tap/swipe, screenshots)
+
@@ -1,53 +1,63 @@
 # Hermes-Relay-CLI v__VERSION__

-**Release Date:** 2026-06-21
-**Since the previous CLI release:** a first-class command surface — activity audit, relay inspection, a background daemon, a polished visual layer, and v1.2.0 server parity.
+**Release Date:** 2026-07-13

-This is a broad CLI uplift: new commands for seeing what the agent did and inspecting the relay, a daemon you can run in the background, and a consistent themed interface with per-command help. Everything is additive — existing commands, flags, and scripts keep working.
+This alpha makes the desktop direction explicit: Hermes-Relay is a real CLI/TUI with an optional Windows right-click systray—not a second desktop application. The old Tauri/WebView dashboard and its embedded windows are gone. The installed CLI remains the single source of behavior for pairing, TUI, daemon management, grants, audit, diagnostics, chat, voice, and tools.

-**Experimental phase.** Assets are unsigned — Windows SmartScreen and macOS Gatekeeper will warn on first launch. Windows ships a tray installer as the primary desktop surface; CLI binaries remain available for terminal/headless use and for macOS/Linux.
+**Experimental phase.** Assets are unsigned, so Windows SmartScreen and macOS Gatekeeper may warn on first launch. Standalone CLI binaries ship for Windows x64, Linux x64, and macOS x64/arm64; the optional native systray is Windows-only.

 ## What's changed

 ### Added
- **`hermes-relay audit`** — see what the remote agent has run on this machine through the desktop tools (tool, status, detail), read from a local log. No network, no auth; works whether the relay is local or remote.
- **`hermes-relay relay`** — inspect the relay server: `relay context` audits the system-prompt context the relay injects into the agent (works from any paired machine), and `relay info` / `relay security` report server state for operators on the relay host.
- **Background daemon.** `hermes-relay daemon start` runs the headless tool router in the background — no console window, survives closing the terminal — with `daemon stop` and `daemon status` to manage it. Bare `daemon` still runs in the foreground. Logs go to `~/.hermes/daemon.log`.
- **Per-command help.** Every subcommand answers `--help`, and `devices` / `sessions` / `plugins` / `voice` / `relay` print their own usage (sub-commands, flags, examples) instead of a terse "unknown sub-verb".
- **Startup banner.** A slim "Hermes Relay" wordmark shows atop `--help`, the first-run welcome, and the chat REPL; `hermes-relay logo` prints it on demand. Suppressed for piped / `--json` / `--no-color` output.
+
+- **Persistent desktop-use control.** `hermes-relay computer-use status|enable|disable|cancel` stores one local preference, reports daemon privilege and active/pending grants, and can end an active task-scoped grant without relying on a GUI.
+- **Headless grant review.** `hermes-relay grants` lists pending local computer-use requests and supports interactive review plus explicit `approve`, `reject`, and JSON forms for scripts.
+- **Typed Relay chat option.** `chat --relay-chat` sends `chat.send` over WSS and renders typed `stream.event` v1 assistant, tool, artifact, memory, skill, and error lifecycles while preserving the existing gateway path as the default.
+- **Release-parity verification.** One version contract now keeps the npm package, compiled CLI, Rust tray, lockfile, and installer metadata aligned. The Windows verification target covers TypeScript, compiled-binary smoke tests, Rust formatting/lint/check/tests, and installer packaging.

 ### Changed
- **Visual + ergonomics refresh.** One consistent color theme across the CLI, aligned tables for `devices` / `sessions`, on/off status dots, and progress spinners for slow operations (the multi-endpoint pairing probe and the gateway connect) so nothing looks hung. Errors now suggest the fix (e.g. re-pair on auth failure).
- **Smoother pairing.** The multi-endpoint probe shows per-endpoint progress and latency; a near-expiry session warns before it fails and prints the exact re-pair command; and a bare `ws://host` (no port) defaults to `:8767`.
- **Voice + consent transparency.** `voice` now surfaces enhanced-voice capabilities (Gemini tone tags / persona, xAI speech tags); the desktop-tool consent prompt is clear that it persists per relay and points at `hermes-relay audit`; and computer-use's observe → grant → act flow is documented in `--help`.
+
+- **Menu-only Windows systray.** The optional tray is a small native Rust process with no application window, WebView, overlay, embedded terminal, chat view, voice view, or settings dashboard. Interactive actions open the installed CLI in a normal terminal.
+- **State- and privilege-aware daemon control.** The menu reports PID-backed daemon state and User/Administrator privilege, disables invalid lifecycle actions, and requests UAC only when **Start/Restart daemon as Administrator…** is explicitly chosen. The tray itself remains unprivileged.
+- **Visible desktop-use safety.** The tray shows enablement, active grant mode and expiry, warns when an Administrator control grant is active, raises a native alert for pending approvals, opens CLI grant review, and provides immediate cancellation and emergency stop.
+- **Per-user Windows installation.** The default PowerShell installer downloads the checksum-verified NSIS package, installs the CLI and optional tray under `~/.hermes/bin`, adds Start-menu shortcuts and user PATH, and can start the tray at sign-in. CLI-only installation remains available with `HERMES_RELAY_INSTALL_SURFACE=cli`.
+
+### Fixed
+
+- **Installed-binary diagnostics.** `hermes-relay doctor` reports the physical Bun-compiled executable instead of a virtual embedded-module path, so PATH and install-directory checks describe the binary that actually launched.
+- **Release guardrails.** CLI tag automation rejects version drift, tags not contained in `main`, oversized tray binaries, or a tray process that creates an application window.

 ## Install

-**Windows tray app (PowerShell):**
+**Windows CLI + optional systray (PowerShell):**
+
 ```powershell
 irm https://raw.githubusercontent.com/Codename-11/hermes-relay/main/desktop/scripts/install.ps1 | iex
 ```

 **Windows CLI only:**
+
 ```powershell
 $env:HERMES_RELAY_INSTALL_SURFACE='cli'; irm https://raw.githubusercontent.com/Codename-11/hermes-relay/main/desktop/scripts/install.ps1 | iex
 ```

 **macOS / Linux CLI:**
+
 ```bash
 curl -fsSL https://raw.githubusercontent.com/Codename-11/hermes-relay/main/desktop/scripts/install.sh | sh
 ```

-Pin this specific release with `HERMES_RELAY_VERSION=__TAG__`.
+Pin this release with `HERMES_RELAY_VERSION=__TAG__`.

 ## Verify

 ```text
 hermes-relay --version
-hermes-relay pair --remote ws://<host>:8767
-hermes-relay shell
+hermes-relay pair --remote ws://<host>:8767 --grant-tools
+hermes-relay daemon start
+hermes-relay daemon status
 ```

-Open **Hermes Relay Desktop** from the Windows Start menu for tray pairing, devices, task log, settings, pause, and emergency stop.
+On Windows, open **Hermes Relay Systray** from the Start menu and right-click its notification-area icon. No separate desktop window is installed.

-See [Desktop docs](https://codename-11.github.io/hermes-relay/desktop/) for full usage.
+See the [CLI and systray guide](https://codename-11.github.io/hermes-relay/desktop/) for installation, commands, desktop-use safety, and troubleshooting.
@@ -94,7 +94,57 @@ We follow [Conventional Commits](https://www.conventionalcommits.org/): `feat:`,

 **Branching model (as of 2026-04-19): `main` + `dev`.** Feature branches — `feature/<name>`, `fix/<name>`, `docs/<name>`, `chore/<name>` — branch off `dev` and merge back into `dev` via `--no-ff` PRs. `main` is released state only; it receives release merges from `dev` and nothing else. There is no straight-to-main exemption — even single-file typos go through `dev`.

-Release-prep commits (version bump, changelog promotion) land on `dev` first, then a surface-specific release PR merges `dev` → `main` with `--no-ff`. Tags are cut from `main` after the merge: `android-vX.Y.Z`, `server-vX.Y.Z`, or `desktop-vX.Y.Z`. See [RELEASE.md](RELEASE.md) for the full release process.
+Release-prep commits (version bump, changelog promotion) land on `dev` first, then a surface-specific release PR merges `dev` → `main` with `--no-ff`. Tags are cut from `main` after the merge: `android-vX.Y.Z`, `plugin-vX.Y.Z`, or `cli-vX.Y.Z`. See [RELEASE.md](RELEASE.md) for the full release process.
+
+## Stale PR salvage and contributor credit
+
+A valuable pull request can become unsafe to merge when `dev` has materially
+changed around it. Maintainers may create a replacement **salvage PR** from the
+current `dev` instead of resolving a stale branch by choosing whole conflict
+sides.
+
+A salvage PR must:
+
+- Link the original PR and contributor in its title or opening summary.
+- Recover only the intended feature; unrelated fork, release, signing, and
+  generated migration changes stay out.
+- Preserve the original commit author when a substantive commit can be safely
+  cherry-picked.
+- Use a verified `Co-authored-by: Name <email>` trailer when the implementation
+  must be reconstructed or substantially rewritten.
+- Include a `Lineage` section listing source and superseded PRs, plus a concise
+  explanation of integration changes made for current `dev`.
+- Run current verification rather than relying on checks from the stale branch.
+- Leave a comment linking the replacement before the source PR is closed.
+
+The maintainer remains the committer for integration commits. The original
+contributor remains the author or co-author of the recovered work. Do not guess
+an email address: use the source commit's verified address or ask the
+contributor.
+
+## Localization contributions
+
+English resources are canonical and Android locale catalogs must retain exact
+resource and format-argument parity. Read [docs/localization.md](docs/localization.md)
+before changing user-facing strings or adding a language.
+
+Translation PRs should cover one locale or one clear catalog refresh. They must
+not include custom APK publishing, signing configuration, version bumps, or
+fork-specific branding. Run:
+
+```bash
+python scripts/check-android-locales.py
+./gradlew lint
+```
+
+Update `docs/localization-status.json` with the actual review level. AI-assisted
+translations may ship as `ai-translated`; do not claim fluent review unless a
+review reference is recorded. Focused correction PRs from fluent contributors
+are the canonical way to improve wording and can advance a locale to
+`community-reviewed` or `verified` under `docs/translation-playbook.md`.
+Translated READMEs use separate `README.<locale>.md` files; `README.md` remains
+the canonical project description. User docs may be added incrementally under
+`user-docs/<locale>/`, with links back to canonical English reference material.

 ## Changelog & writing conventions

@@ -1,29 +1,36 @@
 # Hermes-Relay-Plugin v__VERSION__

-**Release Date:** June 22, 2026
-**Since the previous plugin release:** Reliability fixes for the Realtime Agent voice path — brokered Hermes turns no longer drop with `session_not_found`, and long-running Hermes work no longer times out a live voice session.
+**Release Date:** July 15, 2026

-This is a focused patch for the relay's Realtime Agent. When a spoken turn reached back into Hermes for context or tool work, a session-namespace mismatch could make the API Server reject the turn, and long background tasks could let the voice session lapse mid-run. Both paths are now resilient. Provider-native voice turns and vanilla upstream (no plugin) are unaffected.
+This patch aligns Server default with Hermes' sticky active profile and lets paired clients import conventional profile avatar files without exposing host paths.
+
+Pairs with Hermes-Relay-Android v1.4.6 for profile image import. Standard chat and Vanilla Hermes voice remain upstream-owned and do not require this plugin.

 ## What's changed

+### Added
+
+- **Paired clients can import profile avatars.** Relay discovers conventional direct-child images such as `avatar.png` and `profile.jpg`, validates their media type, size, and profile boundary, and serves the bytes through an authenticated route.
+
 ### Fixed
- **Brokered Hermes turns no longer fail with `session_not_found`.** When the Realtime Agent reached back to Hermes for context or tool work, it could hand the API Server a session id from a different session namespace (the gateway/client store), which the API Server rejected. The broker now mints a valid API Server session and retries the turn once when that happens, reuses an existing API Server session when the id is already valid, and reads the API Server's current nested `{"session": {"id": …}}` create-session response (previously only the legacy flat shape) so session creation no longer errors with "created a session without an id."
- **Realtime voice survives long Hermes runs.** A heartbeat now keeps the realtime voice session alive while a long-running Hermes task is in flight, so the turn no longer times out before the work finishes.

-## Install
+- **Server default follows Hermes' active profile.** Advertised identity, model, SOUL, profile metadata, and avatar resolve through the sticky `active_profile` marker instead of always using the root profile.

-```bash
-pip install hermes-relay==__VERSION__
-```
+## Install / update
+
+    # Native upstream plugin path:
+    hermes plugins install Codename-11/hermes-relay/plugin --enable
+
+    # Classic install / update on a systemd host:
+    curl -fsSL https://raw.githubusercontent.com/Codename-11/hermes-relay/main/install.sh | bash
+    # or, if already installed:
+    hermes-relay-update

 ## Verify

-```bash
-python -m relay_server --help
-```
+    hermes relay doctor
+    python scripts/check-plugin-version-sync.py --expect __VERSION__

 ---

-Tag prefixes: Android releases use `android-v*`, CLI releases use `cli-v*`. Historical
-relay/plugin releases used `relay-v*` tags.
+Tag prefixes: Android releases use android-v*, plugin releases use plugin-v*, and CLI releases use cli-v*.
@@ -21,6 +21,7 @@
 </p>

 <p align="center">
+  <strong>English</strong> · <a href="README.zh-CN.md">简体中文</a><br>
  <a href="https://codename-11.github.io/hermes-relay/">Documentation</a> ·
  <a href="https://github.com/Codename-11/hermes-relay/releases">Releases</a> ·
  <a href="CHANGELOG.md">Changelog</a> ·
@@ -151,6 +152,21 @@ Full server setup, TLS, and systemd details: [docs/relay-server.md](docs/relay-s
  </tr>
 </table>

+### Simplified Chinese
+
+<table>
+  <tr>
+    <td align="center" width="33%"><img src="assets/screenshots/Zh01.jpg" alt="中文设置界面" width="100%"><br><sub><b>设置 — 全面汉化</b></sub></td>
+    <td align="center" width="33%"><img src="assets/screenshots/Zh02.jpg" alt="中文管理界面" width="100%"><br><sub><b>管理 — 仪表盘汉化</b></sub></td>
+    <td align="center" width="33%"><img src="assets/screenshots/Zh03.jpg" alt="中文导航界面" width="100%"><br><sub><b>导航菜单 — 简体中文</b></sub></td>
+  </tr>
+</table>
+
+The Android app also ships a complete AI-assisted Spanish catalog. Choose
+**Español** from **Settings → Appearance → Language**; translation status and
+fluent review are tracked independently so community corrections remain easy
+to contribute.
+
 <p align="center"><sub>▶ <a href="https://codename-11.github.io/hermes-relay/guide/getting-started.html#see-it-working">Watch the demo</a> on the docs site</sub></p>

 ## Features
@@ -171,7 +187,7 @@ Full server setup, TLS, and systemd details: [docs/relay-server.md](docs/relay-s

 ## Hands on any machine — the Hermes-Relay CLI&nbsp;<sub>(alpha)</sub>

-> **Alpha · Windows today** (macOS / Linux coming soon). A single self-contained binary — no Node required. Binaries are unsigned during the experimental phase, so SmartScreen / Gatekeeper warnings are expected.
+> **Alpha.** Self-contained CLI binaries ship for Windows x64, Linux x64, and macOS x64/arm64 — no Node required. Windows also has an optional native, menu-only systray. Assets are unsigned during the experimental phase, so SmartScreen / Gatekeeper warnings are expected.

 The agent's brain stays on the host; the CLI lets it call tools **on your machine** over the same WSS relay — `read_file`, `write_file`, `terminal`, `search_files`, `screenshot`, `clipboard`, `open_in_editor`, and more — behind a one-time consent gate, interactive diff approval for patches, and a `--no-tools` kill-switch.

@@ -181,12 +197,14 @@ irm https://raw.githubusercontent.com/Codename-11/hermes-relay/main/desktop/scri

 ```bash
 hermes-relay pair --remote ws://<host>:8767   # once
-hermes-relay daemon                            # headless tool router — agent reaches you anytime
+hermes-relay daemon start                      # background tool router — agent reaches you anytime
 hermes-relay update                            # self-update via GitHub Releases
 ```

 It pairs against the **same relay and credential store** as the Android app — pair once from either, both work. Tagged on a separate `cli-v*` [release track](https://github.com/Codename-11/hermes-relay/releases?q=cli), with old alpha prereleases still visible under `desktop-v*`.

+On Windows, the default installer adds the optional right-click-only systray: no dashboard or app window, just TUI launch, User/Administrator-aware daemon controls, pairing, local grant review, audit, diagnostics, logs, desktop-use status/cancellation, sign-in startup, and emergency stop.
+
 - **Docs:** [CLI guide](https://codename-11.github.io/hermes-relay/desktop/) · [`desktop/README.md`](desktop/README.md)
 - **AI-agent setup recipe:** `/hermes-relay-desktop-setup`

@@ -311,7 +329,7 @@ docker build -t hermes-relay relay_server/ && docker run -d --network host --nam
 ln -s "$PWD/plugin" ~/.hermes/plugins/hermes-relay
 ```

-Then restart hermes and run `hermes pair` to verify. The 18 `android_*` and 9 `desktop_*` tools register regardless of hermes-agent version. See [docs/relay-server.md](docs/relay-server.md) for TLS, systemd, and full setup.
+Then restart hermes and run `hermes pair` to verify. The 35 `android_*` and 25 `desktop_*` tools register regardless of hermes-agent version. See [docs/relay-server.md](docs/relay-server.md) for TLS, systemd, and full setup.

 </details>

@@ -327,9 +345,9 @@ This is an indie project and every report helps shape where it goes next. If som

 <a href="https://www.star-history.com/?repos=Codename-11%2Fhermes-relay&type=date&legend=top-left">
 <picture>
-   <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/chart?repos=Codename-11/hermes-relay&type=date&theme=dark&legend=top-left" />
-   <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/chart?repos=Codename-11/hermes-relay&type=date&legend=top-left" />
-   <img alt="Star History Chart" src="https://api.star-history.com/chart?repos=Codename-11/hermes-relay&type=date&legend=top-left" />
+   <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/chart?repos=Codename-11/hermes-relay&type=date&theme=dark&legend=top-left&sealed_token=LpoTO7nnGWAwvnRyEeMuKowbf1fe6tQP9n6EbjX-9HTG0uGPrSD_OaNkloMDIM5ugTCg_14LB3XpQTx7v4fBn7PAtMZhO87iIlK5lo42Z31x8myptmcmnQ" />
+   <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/chart?repos=Codename-11/hermes-relay&type=date&legend=top-left&sealed_token=LpoTO7nnGWAwvnRyEeMuKowbf1fe6tQP9n6EbjX-9HTG0uGPrSD_OaNkloMDIM5ugTCg_14LB3XpQTx7v4fBn7PAtMZhO87iIlK5lo42Z31x8myptmcmnQ" />
+   <img alt="Star History Chart" src="https://api.star-history.com/chart?repos=Codename-11/hermes-relay&type=date&legend=top-left&sealed_token=LpoTO7nnGWAwvnRyEeMuKowbf1fe6tQP9n6EbjX-9HTG0uGPrSD_OaNkloMDIM5ugTCg_14LB3XpQTx7v4fBn7PAtMZhO87iIlK5lo42Z31x8myptmcmnQ" />
 </picture>
 </a>

@@ -0,0 +1,104 @@
+<p align="center">
+  <img src="assets/play-store-feature-1024x500.png" alt="Hermes-Relay — 随身携带您的 Hermes 代理" width="800">
+</p>
+
+<p align="center">
+  <strong>运行在您的电脑上，连接到您的设备。</strong><br>
+  Hermes-Relay 是 <a href="https://github.com/NousResearch/hermes-agent">Hermes Agent</a> 的原生 Android 客户端，提供流式聊天、免手动语音和代理管理；另有单文件 CLI，让代理在已配对的电脑上安全使用终端、文件和截图工具。
+</p>
+
+<p align="center">
+  <strong>简体中文</strong> · <a href="README.md">English</a><br>
+  <a href="https://codename-11.github.io/hermes-relay/zh-CN/">中文文档</a> ·
+  <a href="https://github.com/Codename-11/hermes-relay/releases">版本下载</a> ·
+  <a href="CHANGELOG.md">更新日志</a>
+</p>
+
+> 英文 [README.md](README.md) 是最新、完整的项目说明。本页维护中文安装入口和核心功能摘要；协议、架构和维护者文档以英文版本为准。
+
+## 功能简介
+
+- **Android 应用**：流式聊天、会话历史、文件附件、Hermes 管理、语音模式、多连接和配置文件。
+- **无需插件的标准路径**：聊天、管理和标准语音可直接连接未修改的上游 Hermes Agent。
+- **可选 Relay 插件**：增加终端、手机控制、媒体传输、通知助手、Relay 语音和电脑工具。
+- **安全连接**：二维码配对、Android Keystore、证书固定、按通道授权和可配置会话有效期。
+- **远程使用**：可配置 Tailscale 或 HTTPS 地址，在家庭局域网和远程路由之间自动切换。
+- **两种 Android 发行渠道**：Google Play 版本适合日常使用；sideload 版本包含完整手机控制能力。
+
+## 快速开始
+
+### 1. 安装 Android 应用
+
+- [Google Play](https://play.google.com/store/apps/details?id=com.axiomlabs.hermesrelay)：自动更新，包含聊天、语音、管理、终端、媒体和通知功能。
+- [GitHub Releases](https://github.com/Codename-11/hermes-relay/releases)：下载最新 `android-v*` 版本中以 `-sideload-release.apk` 结尾的文件，获得完整手机控制功能。
+
+### 2. 启动 Hermes API 服务
+
+手机需要能够访问 Hermes API 服务，并使用 API 密钥进行身份验证：
+
+```bash
+hermes setup --portal
+
+mkdir -p ~/.hermes
+API_SERVER_KEY="$(openssl rand -hex 32)"
+cat >> ~/.hermes/.env <<EOF
+API_SERVER_ENABLED=true
+API_SERVER_HOST=0.0.0.0
+API_SERVER_PORT=8642
+API_SERVER_KEY=$API_SERVER_KEY
+EOF
+chmod 600 ~/.hermes/.env
+
+echo "Android API URL: http://<电脑IP>:8642   key: $API_SERVER_KEY"
+hermes gateway
+```
+
+`0.0.0.0` 会让同一网络中的设备访问 API。请保留强密钥；离开可信局域网时，应使用 Tailscale 或 HTTPS 反向代理，不要直接把端口暴露到互联网。
+
+### 3. 在手机上连接
+
+打开应用后，可以：
+
+- 扫描局域网中的 Hermes；
+- 手动输入 `http://<主机>:8642` 和 API 密钥；
+- 扫描包含 API、Dashboard 和可选 Relay 地址的设置二维码。
+
+如需在手机上管理模型、密钥、技能和配置文件，请运行 Hermes Dashboard，并在应用的 **管理** 页面登录一次。同一登录会话也会启用标准语音。
+
+### 4. 可选：安装 Relay
+
+仅在需要终端、手机控制、媒体路由、Relay 会话、实时语音或电脑工具时安装：
+
+```bash
+hermes plugins install Codename-11/hermes-relay/plugin --enable
+hermes relay doctor
+hermes relay start --no-ssl
+hermes pair
+```
+
+完整说明请阅读[中文快速开始](https://codename-11.github.io/hermes-relay/zh-CN/guide/quick-start)；远程访问、协议和高级配置暂时链接到英文参考文档。
+
+## 中文界面
+
+<table>
+  <tr>
+    <td align="center" width="33%"><img src="assets/screenshots/Zh01.jpg" alt="中文设置界面" width="100%"><br><sub><b>设置</b></sub></td>
+    <td align="center" width="33%"><img src="assets/screenshots/Zh02.jpg" alt="中文管理界面" width="100%"><br><sub><b>管理</b></sub></td>
+    <td align="center" width="33%"><img src="assets/screenshots/Zh03.jpg" alt="中文导航界面" width="100%"><br><sub><b>导航</b></sub></td>
+  </tr>
+</table>
+
+## 参与翻译
+
+Android 英文资源是规范来源。新增语言必须保持资源名称、类型和格式参数一致，并通过：
+
+```bash
+python scripts/check-android-locales.py
+./gradlew lint
+```
+
+翻译规范、目录命名、复数和占位符规则见 [docs/localization.md](docs/localization.md)。
+
+## 许可证
+
+[MIT](LICENSE) — Copyright (c) 2026 [Axiom-Labs](https://codename-11.dev)
@@ -22,7 +22,7 @@ for automation.
 |---|---|---|---|---|
 | Hermes-Relay-Android | `android-v*` | `gradle/libs.versions.toml` | `scripts/bump-android-version.sh` | `.github/workflows/release-android.yml` |
 | Hermes-Relay-Plugin | `plugin-v*` | `pyproject.toml` plus checked plugin/dashboard metadata | `scripts/bump-plugin-version.sh` | `.github/workflows/release-plugin.yml` |
-| Hermes-Relay-CLI | `cli-v*` | `desktop/package.json` | `npm version` or manual package bump | `.github/workflows/release-cli.yml` |
+| Hermes-Relay-CLI | `cli-v*` | `desktop/package.json` | `cd desktop && npm version --no-git-tag-version <version>` | `.github/workflows/release-cli.yml` |

 This split is intentional. The plugin carries relay features for both Android
 and CLI clients, so plugin fixes can ship without forcing an Android app
@@ -115,6 +115,40 @@ runs plugin tests, builds a wheel and sdist, generates checksums, and
 publishes a `Hermes-Relay-Plugin vX.Y.Z` GitHub Release with the package
 artifacts.

+### CLI / tray versioning
+
+`desktop/package.json` is the CLI release track's source of truth. Its version
+must match the generated CLI and native Windows systray metadata. The systray is
+a menu-only controller for the installed CLI; it has no application window,
+WebView, embedded terminal, or separate desktop product surface. The public
+release remains one `Hermes-Relay-CLI` track containing CLI binaries plus the
+optional Windows installer.
+
+| File | Purpose |
+|---|---|
+| `desktop/package.json` | canonical CLI version |
+| `desktop/package-lock.json` | npm root/workspace package metadata |
+| `desktop/src/version.ts` | compiled CLI runtime version |
+| `desktop/tray/Cargo.toml` | native systray package version |
+| `desktop/tray/Cargo.lock` | locked systray package version |
+
+Prepare a new CLI version on `dev` without creating a tag or npm-generated
+commit:
+
+```powershell
+cd desktop
+npm version --no-git-tag-version 0.4.0-alpha.2
+npm run check:version-sync
+npm run verify
+```
+
+The npm `version` lifecycle runs `sync:version`, which copies the canonical
+version into the generated CLI and tray metadata. If `package.json` was edited
+manually, run `npm run sync:version` before checking. `npm run verify` is the
+single Windows release-parity gate: version sync, type-check, tests, TypeScript
+build, compiled CLI smoke, and tray formatting, Clippy, check, and tests. CI runs
+the portable portions on every desktop change and the Windows tray gates separately.
+
 ## Branching policy

 > **Updated 2026-04-19:** moved from `main`-only to `main + dev`. See
@@ -403,12 +437,25 @@ the new app version and a higher `appVersionCode`.
 - `RELEASE_NOTES.md` — body of the GitHub Release for this version
  (rewritten each release; the workflow uses this as-is). This is the
  operator-facing summary, not the CHANGELOG mirror. Keep the
-  **Download** section near the top — it should spell out which file
-  to grab by its `-sideload-release.apk` / `-googlePlay-release.aab`
-  suffix (every artifact is version-tagged as
+  **Download** section near the top, in the required format (#144):
+  1. A lead callout naming the **one file most people want** —
+     "Installing on your phone? Download
+     `hermes-relay-<version>-sideload-release.apk` and tap it"
+     (full feature set), with the Play Store link for the
+     conservative build.
+  2. One explicit line that the `.aab` is a Play Console upload
+     bundle and **cannot** be installed by tapping it on a phone.
+  3. The `SHA256SUMS.txt` verify line + sideload-guide link.
+  No download table, no parity/testing artifacts: releases attach
+  exactly **two** app artifacts — the sideload APK and the googlePlay
+  AAB — plus `SHA256SUMS.txt` covering exactly those two (the 2-asset
+  policy in `.github/workflows/release-android.yml`; the parity twins
+  stay reproducible from the tag via CI but are not attached).
+  Every artifact is version-tagged as
  `hermes-relay-<version>-<flavor>-<buildType>` via `archivesName`
-  in `app/build.gradle.kts`) and link to the sideload guide.
-  The v0.3.0 body is a good template.
+  in `app/build.gradle.kts`. Never rename the sideload APK — the
+  in-app update checker matches assets by `.apk` + `sideload` in the
+  name, and user-docs verify steps cite the filename.
 - `app/src/main/assets/whats_new.txt` — in-app "What's New" content
  shown in the settings/about screen. Update with the version number
  and a brief feature summary. Gets stale silently if forgotten
@@ -472,11 +519,41 @@ prefixed `hermes-relay-<version>-` via `archivesName` in
 Optional device smoke test: `scripts\dev.bat release` then
 `adb install -r app\build\outputs\apk\sideload\release\hermes-relay-*-sideload-release.apk`.

-### 4. Commit on `dev`, merge to `main`, tag from `main`
+### 4. Run the private Play preflight from `dev`

-The release-prep commit lands on `dev` first. Then a release PR merges
-`dev` → `main` with `--no-ff`, and the `android-v<version>` tag is cut from the
-resulting merge commit on `main`:
+The release-prep commit lands on `dev` first. Before any public tag or GitHub
+Release exists, open **Actions → Play Preflight — Android**, choose **Run
+workflow**, select the final `dev` branch, and enter the prepared version.
+
+The preflight workflow:
+
+1. requires the workflow to run from `dev` or untagged `main` with matching
+   version metadata;
+2. runs the release metadata, locale, and Android collection-API checks;
+3. builds and release-signs the same APK/AAB variants used by the public release;
+4. scans the final minified APK DEX for unsupported collection calls;
+5. uploads the Google Play AAB as a private **Production draft**; and
+6. records a 30-day preflight proof keyed to the version and Git tree hash.
+
+No sideload APK or GitHub Release is published by preflight. A successful signed
+build, final DEX scan, and Production-draft upload is the automated Play release
+gate. Play Console pre-review and pre-launch reports are informational and
+non-blocking because their detailed results are not exposed through the release
+automation API. If the release source changes after preflight, rerun it—the
+approval workflow matches the complete Git tree, not just the version number.
+
+GitHub exposes manual workflows only after their workflow file exists on the
+default branch. For the first release that introduces this process, merge the
+release PR without creating a tag, run preflight from untagged `main`, and then
+use the approval workflow. This publishes no app artifacts before the automated
+Play upload gate.
+
+### 5. Merge to `main` and approve the public release
+
+After Play preflight passes, merge the release PR from `dev` to `main`
+with `--no-ff`. The merge commit may differ from the preflight commit, but its
+tree must be identical. If the merge changes the tree, rerun private preflight
+from untagged `main`:

 ```bash
 # From a clean dev checkout:
@@ -488,17 +565,22 @@ git add gradle/libs.versions.toml RELEASE_NOTES.md CHANGELOG.md \
 git commit -m "release(android): android-v0.6.2"
 git push origin dev

+# Run Play Preflight — Android from dev and require a successful workflow.
 # Open the release PR (dev -> main) and merge with --no-ff.
-# After merge, tag from the new main tip:
-git checkout main
-git pull --ff-only origin main
-git tag android-v0.6.2
-git push origin android-v0.6.2
 ```

-Pushing a tag matching `android-v*` triggers `.github/workflows/release-android.yml`,
-which builds, signs, checksums, and creates a GitHub Release. Watch the
-run under the **Actions** tab.
+Then open **Actions → Approve Android Release**, choose **Run workflow**, select
+`main`, and enter the version. Starting the workflow is the release approval. It
+verifies that `main` has the exact preflighted tree and creates the
+`android-v<version>` tag. Manual stable tags are still guarded by the same
+preflight proof in the tag workflow.
+
+The tag-triggered `.github/workflows/release-android.yml` rebuilds and scans the
+artifacts, changes the existing Play Production draft to `completed` (submitting
+it for review), and only after Play accepts that operation creates the public
+GitHub Release with the sideload APK. A missing preflight, changed release tree,
+missing Play credential, or Play submission failure prevents public GitHub
+publication.

 Plugin/Python version files are intentionally not part of an Android app
 release unless the plugin package itself is also being released.
@@ -540,21 +622,62 @@ touches more than one release surface. The workflow also runs plugin tests,
 builds a wheel and sdist, generates `SHA256SUMS.txt`, and creates a GitHub
 Release named `Hermes-Relay-Plugin v<version>` for the plugin package.

-### 5. Upload to Play Console
+### CLI / Windows systray release

-> **If `PLAY_SERVICE_ACCOUNT_JSON` is configured as a repo secret, this step is
-> automated for stable tags.** The release workflow runs
-> `publishGooglePlayReleaseBundle --track=production` and the build appears as a
-> Production **draft** — skip to the Play Console, confirm the draft, and click
-> **Start rollout**. The manual path below is the fallback when the secret is
-> unset (or for staging on a non-production track).
+Use this when the standalone CLI, daemon, desktop tools, or Windows tray changes.
+Android and plugin versions do not need to move with it.
+
+First rewrite `CLI_RELEASE_NOTES.md` for the new CLI release and promote only
+CLI/tray-relevant changelog bullets into the release block. Then:
+
+```powershell
+git switch dev
+git pull --ff-only origin dev
+
+cd desktop
+npm version --no-git-tag-version 0.4.0-alpha.2
+npm run verify
+cd ..
+
+git add desktop/package.json desktop/package-lock.json desktop/src/version.ts `
+  desktop/tray/Cargo.toml desktop/tray/Cargo.lock CHANGELOG.md CLI_RELEASE_NOTES.md
+git commit -m "release(cli): cli-v0.4.0-alpha.2"
+git push origin dev
+
+# Open the release PR (dev -> main) and merge with --no-ff.
+# After merge, tag from main:
+git switch main
+git pull --ff-only origin main
+cd desktop
+npm run check:version-sync -- --expect 0.4.0-alpha.2
+cd ..
+git tag cli-v0.4.0-alpha.2
+git push origin cli-v0.4.0-alpha.2
+```
+
+The tag workflow rejects version drift and tags whose commit is not in
+`origin/main`, reruns CLI tests, builds all four standalone binaries, tests and
+packages the Windows tray, generates checksums, and publishes the GitHub Release.
+
+### 6. Play review and publishing behavior
+
+> **Stable Android releases require `PLAY_SERVICE_ACCOUNT_JSON`.** Preflight
+> uploads the Production draft; approval promotes that same version code to
+> `completed`. Play Console-only reports are informational and non-blocking.
+> Stable releases do not fall back to publishing GitHub first when Play
+> credentials or submission are unavailable.
 >
-> This automated tag path is intentionally bundle-only. It uploads the
+> This automated path is intentionally bundle-only. It uploads the
 > `googlePlayRelease` AAB and release-scoped "What's new" notes, but it does
 > not republish static listing assets such as screenshots, title, description,
 > icon, or feature graphic. Use the Play Store Listing workflow when those
 > assets change.

+If Play Console **Managed publishing** is enabled, an approved submission remains
+under **Changes ready to publish** until a Play Console user publishes it. If it
+is disabled, the production submission may become available after Google review.
+Either behavior begins only after the public-release approval described above.
+
 **Pick the track first.** The AAB is track-agnostic — the same
 `-googlePlay-release.aab` goes to whichever track you publish on. Choose by intent,
 not habit:
@@ -601,7 +724,7 @@ To promote an existing release between tracks without rebuilding:
 gradlew promoteReleaseArtifact --from-track=internal --promote-track=alpha
 ```

-### 6. Tracks (a menu, not a mandatory ladder)
+### 7. Tracks (a menu, not a mandatory ladder)

 The org account is exempt from the 14-day / 12-tester closed-testing rule, so a
 stable GA publishes **straight to Production** — there is no required promotion
@@ -620,7 +743,7 @@ the Play Console UI or:
 gradlew promoteReleaseArtifact --from-track=internal --promote-track=production
 ```

-### 7. After release
+### 8. After release

 - Verify the GitHub Release has APK, AAB, and `SHA256SUMS.txt` attached.
 - Confirm the release body includes the **Download** section that tells
@@ -651,9 +774,10 @@ On every push of a tag matching `android-v*`, `.github/workflows/release-android
   regression slice with explicit timeouts.
 3. Decodes `HERMES_KEYSTORE_BASE64` into `$RUNNER_TEMP/release.keystore`
   and exports `HERMES_KEYSTORE_PATH` (skipped if the secret is unset).
-4. Builds both Android release artifacts:
-   `./gradlew bundleRelease assembleRelease`.
-5. Generates `SHA256SUMS.txt` covering both.
+4. Builds all four flavored release artifacts
+   (`./gradlew bundleRelease assembleRelease`); only the sideload APK and
+   googlePlay AAB are attached (see §Release assets).
+5. Generates `SHA256SUMS.txt` covering the two attached files.
 6. Creates a GitHub Release named `Hermes-Relay-Android v<version>` with `RELEASE_NOTES.md` as
   the body. Attaches the APK, AAB, and `SHA256SUMS.txt`. Tags any version
   containing a dash (e.g. `android-v0.2.0-beta.1`) as a prerelease automatically.
@@ -1,35 +1,30 @@
-# Hermes-Relay-Android v1.2.3
+# Hermes-Relay-Android v1.4.6

-**Release Date:** June 23, 2026
-**Since v1.2.2:** A connection-stability hotfix. Connecting to a server over an **encrypted link** (Tailscale Serve or public HTTPS) could hard-close the app the moment the connection came up; that crash is fixed, so securing your connection no longer force-closes Hermes-Relay.
-
-v1.2.3 is a focused fix for anyone connecting over Tailscale or public TLS. Plain-LAN connections were never affected.
-
---
+**Release Date:** July 15, 2026

 ## Download

-v1.2.3 ships in two Android build flavors. APK and AAB filenames are version-tagged:
+> Installing on your phone? Download `hermes-relay-1.4.6-sideload-release.apk` and tap it for the full feature set, or install the conservative build from [Google Play](https://play.google.com/store/apps/details?id=com.axiomlabs.hermesrelay).

-| Flavor | File | Who it's for |
-|---|---|---|
-| Google Play | `hermes-relay-1.2.3-googlePlay-release.aab` | Upload this Android App Bundle to Play Console. It has no AccessibilityService, screen reading, screenshots, gestures, SMS/calls, contacts/location, overlays, or unattended phone control. |
-| sideload | `hermes-relay-1.2.3-sideload-release.apk` | Direct-install APK for full Device Control. Installs as `com.axiomlabs.hermesrelay.sideload`. |
-| googlePlay APK | `hermes-relay-1.2.3-googlePlay-release.apk` | Parity/testing artifact. |
-| sideload AAB | `hermes-relay-1.2.3-sideload-release.aab` | Parity/testing artifact. |
+The `.aab` file is a Play Console upload bundle and cannot be installed by tapping it on a phone.

-Verify integrity with `SHA256SUMS.txt` from the same release. See the [Sideload guide](https://codename-11.github.io/hermes-relay/guide/getting-started.html#sideload-apk) for APK install steps.
+Verify the download against `SHA256SUMS.txt`. See the [sideload guide](https://codename-11.github.io/hermes-relay/guide/sideload) for installation help.

---
+## Summary

-## Highlights
+This patch keeps Server default aligned with Hermes' active profile, adds per-profile icon import and organization controls, and prevents the session drawer from mixing profile databases.

-### Fixed
- **No more crash on connect over TLS / Tailscale.** Connecting over an encrypted link (Tailscale Serve or public HTTPS) could force-close the app with a `NetworkOnMainThreadException` as the connection came up — a live SSL socket was being closed on the main thread during client teardown, and a TLS close performs a network write. Socket teardown now always runs off the main thread, so connecting over a secured link is stable. Plain-LAN connections were never affected.
+## Added

---
+- Reorder or hide profiles per connection without changing server configuration.
+- Choose a profile icon from the Android file picker or import `avatar.png`/`profile.jpg` from a paired Relay host.

-## Upgrade notes
- This is an app-side fix on **both** flavors — no Device Control or server changes needed.
- If you were crashing on connect over Tailscale or HTTPS, update and reconnect.
- `appVersionCode` is **17**.
+## Fixed
+
+- Server default resolves Hermes' sticky active profile before Gateway session create/resume and dashboard session operations, keeping the agent, drawer, transcript, and writes in one profile database.
+- Host image import distinguishes an outdated Relay from a genuinely missing avatar and presents **Choose file** as a reliable fallback.
+
+## Install / Verify
+
+- App version: **1.4.6** (versionCode **29**).
+- Standard Chat and Vanilla Hermes voice continue to work against unmodified upstream Hermes.
@@ -101,7 +101,7 @@ Small follow-ons to v0.4 deliberately deferred to keep the v0.4.0 release surfac

 **What the middleware can do (near-term, ships via install.sh).** New aiohttp middleware in `hermes_relay_bootstrap/_command_middleware.py`, installed at the same `_PatchedApplication.__setitem__` hook as the current route injection so it lands before `AppRunner.setup()` freezes the app. Filters by `request.path in ("/v1/runs", "/v1/chat/completions")` — zero-cost fast path for everything else. On chat paths: parses the body, lazy-imports `GATEWAY_KNOWN_COMMANDS` + `resolve_command()` + `gateway_help_lines()` from `hermes_cli.commands`, and splits on command type:
 - **Stateless commands** (`/help`, `/commands`, and any others the upstream Option B PR ends up supporting without router state) — actually dispatch, emit a synthetic SSE stream matching the runs handler's existing event shape so the Android client at `HermesApiClient.kt:655-715` renders it as a normal assistant turn.
- **Stateful commands** (`/model`, `/new`, `/retry`, `/undo`, `/compress`, `/title`, `/resume`, `/branch`, `/rollback`, `/yolo`, `/reasoning`, `/personality`, etc. — most of the registry) — emit a synthetic SSE stream whose content is a short, helpful notice: *"The `/model` command requires a persistent session and isn't available on the stateless `/v1/runs` endpoint. Use `/api/sessions/{id}/chat/stream` (post-PR-#8556) or a channel with session state. For commands that work here, type `/help`."* This replaces the LLM hallucination with a deterministic, accurate message that points the user at the real fix.
+- **Stateful commands** (`/model`, `/new`, `/retry`, `/undo`, `/compress`, `/title`, `/resume`, `/branch`, `/rollback`, `/yolo`, `/reasoning`, `/personality`, etc. — most of the registry) — emit a synthetic SSE stream whose content is a short, helpful notice: *"The `/model` command requires a persistent session and isn't available on the stateless `/v1/runs` endpoint. Use `/api/sessions/{id}/chat/stream` or a channel with session state. For commands that work here, type `/help`."* This replaces the LLM hallucination with a deterministic, accurate message that points the user at the real fix.

 **On no match** (unknown command, cli-only command, or plain text): falls through to `handler(request)` unchanged. Fork-detects the same way the existing injection does — if the upstream preprocessor PR lands first, the middleware no-ops.

@@ -109,7 +109,7 @@ Small follow-ons to v0.4 deliberately deferred to keep the v0.4.0 release surfac

 **Files.** New `hermes_relay_bootstrap/_command_middleware.py` (~150 LOC), one-line append in `_patch.py` inside `_maybe_register_routes`, stdlib `unittest` coverage in `plugin/tests/test_bootstrap_command_middleware.py` mirroring the existing `test_bootstrap_patch.py` harness. Mirrors the upstream Option B PR exactly so the two can be reviewed side-by-side.

-**Phase 2 — stateful dispatch on the session chat stream endpoint (post PR #8556).** Once PR #8556 merges and `/api/sessions/{id}/chat/stream` ships natively in upstream, a separate middleware (or a follow-up upstream PR) can add a preprocessor **scoped to that endpoint only**, leveraging the `session_id` in the URL as the persistence handle. At that point stateful commands become a dict write against session-scoped state — `session.model_override = new_model` — without needing to refactor `GatewayRouter` or plumb api_server into the router. Much smaller than a full router refactor, and it matches upstream's partition: `/v1/*` stays stateless, statefulness lives on `/api/sessions/*`. Blocked on #8556 landing.
+**Phase 2 — stateful dispatch on the session chat stream endpoint (unblocked by PR #33134).** Since `/api/sessions/{id}/chat/stream` now ships natively in upstream, a separate middleware (or a follow-up upstream PR) can add a preprocessor **scoped to that endpoint only**, leveraging the `session_id` in the URL as the persistence handle. At that point stateful commands become a dict write against session-scoped state — `session.model_override = new_model` — without needing to refactor `GatewayRouter` or plumb api_server into the router. Much smaller than a full router refactor, and it matches upstream's partition: `/v1/*` stays stateless and statefulness lives on `/api/sessions/*`.

 ## Future — v0.5+

@@ -182,7 +182,13 @@ android {
        // [POC] Roborazzi runs without its Gradle plugin (the plugin needs AGP's
        // removed TestedExtension). Force record mode via the test-JVM system
        // property the plugin would otherwise inject, so captureRoboImage writes.
-        unitTests.all { it.systemProperty("roborazzi.test.record", "true") }
+        // Heap: the Roborazzi store renders (1080×2160 native graphics) share a
+        // worker JVM with the Robolectric suites; Gradle's 512m default OOMs
+        // once both are in the same run.
+        unitTests.all {
+            it.systemProperty("roborazzi.test.record", "true")
+            it.maxHeapSize = "2g"
+        }
    }
 }

@@ -239,6 +245,7 @@ dependencies {

    // Activity
    implementation(libs.activity.compose)
+    implementation(libs.appcompat)

    // Core
    implementation(libs.core.ktx)
@@ -290,6 +297,9 @@ dependencies {

    // Security
    implementation(libs.security.crypto)
+    // Force a Tink newer than security-crypto's transitive one — older Tink's
+    // HybridConfig removeFirst()/removeLast() trips the Android-15 crash lint.
+    implementation(libs.tink.android)

    // DataStore
    implementation(libs.datastore.preferences)
@@ -316,8 +326,8 @@ dependencies {
    // [POC] Roborazzi host-side screenshot rendering (src/test, Robolectric).
    // Renders real composables on the JVM at an exact canvas — no device, no
    // status bar, no clipping. See StoreScreenshotTest.
-    testImplementation("io.github.takahirom.roborazzi:roborazzi:1.43.1")
-    testImplementation("io.github.takahirom.roborazzi:roborazzi-compose:1.43.1")
+    testImplementation("io.github.takahirom.roborazzi:roborazzi:1.68.0")
+    testImplementation("io.github.takahirom.roborazzi:roborazzi-compose:1.68.0")
    testImplementation(libs.compose.ui.test.junit4)
    testImplementation(libs.compose.ui.test.manifest)
    testImplementation("androidx.test.ext:junit:1.3.0")
@@ -0,0 +1 @@
+info@axiom-labs.dev
@@ -1,3 +1 @@
-v1.2.3 — Connection crash fix.
-
-• Fixed a crash that could close the app right after connecting over an encrypted link (Tailscale or HTTPS). Connecting over a secured connection is now stable. Plain local-network connections were never affected.
+Server default now keeps its agent, chats, drawer, and transcript in the active Hermes profile. Reorder or hide profiles per connection, choose an icon from your phone, or import avatar.png/profile.jpg from an updated paired Relay. Image import now clearly distinguishes an outdated Relay from a missing avatar.
@@ -0,0 +1 @@
+“服务器默认”现在会让代理、聊天、会话抽屉和记录保持在 Hermes 当前活动配置文件中。可按连接重新排序或隐藏配置文件，从手机选择图标，或从已更新且配对的 Relay 导入 avatar.png/profile.jpg。图像导入也会明确区分 Relay 版本过旧与头像文件缺失。
@@ -29,6 +29,7 @@
        android:enableOnBackInvokedCallback="true"
        android:icon="@mipmap/ic_launcher"
        android:label="@string/app_name"
+        android:localeConfig="@xml/locales_config"
        android:networkSecurityConfig="@xml/network_security_config"
        android:supportsRtl="true"
        android:theme="@style/Theme.HermesRelay">
@@ -39,7 +40,7 @@
            android:launchMode="singleTask"
            android:screenOrientation="portrait"
            tools:ignore="LockedOrientationActivity"
-            android:configChanges="uiMode|fontScale|locale|density|orientation|screenSize|screenLayout|keyboardHidden"
+            android:configChanges="uiMode|fontScale|density|orientation|screenSize|screenLayout|keyboardHidden"
            android:windowSoftInputMode="adjustResize"
            android:theme="@style/Theme.HermesRelay.Splash">
            <intent-filter>
@@ -48,6 +49,17 @@
            </intent-filter>
        </activity>

+        <!-- AppCompat persists in-app language choices on Android 12 and lower.
+             Android 13+ stores the same selection in the platform LocaleManager. -->
+        <service
+            android:name="androidx.appcompat.app.AppLocalesMetadataHolderService"
+            android:enabled="false"
+            android:exported="false">
+            <meta-data
+                android:name="autoStoreLocales"
+                android:value="true" />
+        </service>
+
        <provider
            android:name="androidx.core.content.FileProvider"
            android:authorities="${applicationId}.fileprovider"
@@ -70,8 +82,18 @@
        </service>
        <!-- === END PHASE3-notif-listener === -->

-        <!-- Opt-in "Keep connected in background" — holds the gateway chat
-             socket open while backgrounded. In main so BOTH flavors ship it
+        <!-- Inline-reply receiver for proactive-message notifications
+             (Phase 2c — two-way phone messaging). Not exported: it is only
+             ever triggered by the app's own mutable RemoteInput PendingIntent
+             delivered by the system, never by a third party. -->
+        <receiver
+            android:name=".notifications.ProactiveReplyReceiver"
+            android:exported="false" />
+
+        <!-- Opt-in "Persistent connection" — holds the user's connection to
+             Hermes open while backgrounded so messages and live features stay
+             responsive (relay-paired setups also keep device control +
+             notification mirroring reachable). In main so BOTH flavors ship it
             (Home-Assistant-class persistent connection). Off by default; only
             runs while the user has explicitly enabled the toggle. specialUse
             needs a Play Console foreground-service declaration at submission. -->
@@ -81,7 +103,7 @@
            android:foregroundServiceType="specialUse">
            <property
                android:name="android.app.PROPERTY_SPECIAL_USE_FGS_SUBTYPE"
-                android:value="Keeps the user's chat connection to their Hermes agent open while the app is backgrounded, only when the user has explicitly enabled 'Keep connected in background'." />
+                android:value="Keeps the user's connection to their Hermes agent open in the background so messages and live features stay responsive, only when the user has explicitly enabled 'Persistent connection'." />
        </service>

    </application>
@@ -1,181 +1,439 @@
 {
-  "versions": [
+ "versions": [
+  {
+   "version": "1.4.6",
+   "title": "Profiles stay together",
+   "date": "2026-07-15",
+   "sections": [
    {
-      "version": "1.2.3",
-      "title": "Connection crash fix",
-      "date": "2026-06-23",
-      "sections": [
-        {
-          "header": "Stability",
-          "bullets": [
-            "Fixed a crash that could close the app right after connecting over an encrypted link (Tailscale or HTTPS) — a live secure connection was being torn down on the main thread as it came up. Securing your connection no longer force-closes the app; plain-LAN connections were never affected."
-          ]
-        }
-      ]
+     "header": "One Server-default profile",
+     "bullets": [
+      "Server default now keeps the selected agent, session drawer, transcript, and new messages in Hermes' sticky active profile.",
+      "Reorder or hide profiles per connection without changing server configuration."
+     ]
    },
    {
-      "version": "1.2.2",
-      "title": "Multi-profile polish",
-      "date": "2026-06-22",
-      "sections": [
-        {
-          "header": "Profiles that behave",
-          "bullets": [
-            "Deleting a session while a non-default agent profile is active now sticks — it no longer reappears after the list refreshes.",
-            "On a cold start with a non-default profile selected, the session drawer opens on that profile's chats directly instead of briefly showing the default profile's."
-          ]
-        },
-        {
-          "header": "Clearer diagnostics",
-          "bullets": [
-            "Diagnostics is now a full screen led by a top-to-bottom list of subsystem health checks — network, API server, chat transport, pairing, relay, and voice — each with a pass / warning / fail state and the reason when something's wrong; tap a failing check for full detail. The recent-activity log stays below."
-          ]
-        },
-        {
-          "header": "Small touches",
-          "bullets": [
-            "The default connection is now simply \"Hermes\" (and the optional power features are labelled \"Relay\"), across setup, the switcher, voice, and permissions.",
-            "Distraction-free chat mode gives its text a taller, scrollable area."
-          ]
-        }
-      ]
-    },
-    {
-      "version": "1.2.1",
-      "title": "Polish & control",
-      "date": "2026-06-21",
-      "sections": [
-        {
-          "header": "Yours to control",
-          "bullets": [
-            "Lock the app to a single agent profile (Settings → Profile lock) and hide the rest from the pickers."
-          ]
-        },
-        {
-          "header": "Find your way back",
-          "bullets": [
-            "A new \"What's New\" entry in Settings shows current and past release notes any time — not just after an update."
-          ]
-        },
-        {
-          "header": "When something breaks",
-          "bullets": [
-            "Diagnostics show clean error titles — tap any entry for a detail view with Copy, Share, and a one-tap GitHub issue.",
-            "A tasteful in-app banner tells you when a newer version is live (Play or sideload) — dismissable, and it never nags."
-          ]
-        },
-        {
-          "header": "Voice fixes",
-          "bullets": [
-            "Stop now halts realtime speech instantly, hold-to-talk is steadier, the voice overlay is easier to read, and a chosen voice applies in Auto mode.",
-            "Realtime turns that reach back to Hermes no longer drop with a session error."
-          ]
-        }
-      ]
-    },
-    {
-      "version": "1.2.0",
-      "title": "Make it yours",
-      "date": "2026-06-20",
-      "sections": [
-        {
-          "header": "Personalize",
-          "bullets": [
-            "Eight app themes in Settings → Appearance — the Hermes Relay brand plus ports of the Nous Hermes looks (Teal, Nous Blue, Midnight, Ember, Mono, Cyberpunk, Rosé), with light/dark.",
-            "Swap the agent orb for an animated pet that reacts to what the agent is doing — add, preview, and tune pets right in the app, or generate one from sprite art with the AI authoring kit.",
-            "Reskin the sphere, and give each agent profile its own icon."
-          ]
-        },
-        {
-          "header": "See what's happening",
-          "bullets": [
-            "The chat status strip names the actual streaming path (Gateway, Sessions, Completions, Runs), with a basic→best tier ladder in Chat Settings.",
-            "Tap the context meter for a \"What the agent sees\" sheet — the exact extra context prepended to your next turn.",
-            "Voice and Realtime turns are badged in the scrollback."
-          ]
-        },
-        {
-          "header": "Privacy",
-          "bullets": [
-            "When paired to the relay, the agent can mark private media and the phone blurs it per your setting — sensitivity stays model-emitted."
-          ]
-        },
-        {
-          "header": "Faster & more reliable",
-          "bullets": [
-            "Cold start is about 3× faster, and model/personality/approvals load honestly instead of showing a maybe-wrong value.",
-            "In-app crash reporting offers a one-tap, pre-filled bug report.",
-            "QR pairing no longer force-closes on unusual cameras (foldables); fixed crashes opening server images and PDFs; in-chat model picks now apply."
-          ]
-        },
-        {
-          "header": "Voice & terminal",
-          "bullets": [
-            "Enhanced voice control for Gemini and xAI providers.",
-            "Leaner terminal with TUI-correct input and an isolated, tuned tmux."
-          ]
-        }
-      ]
-    },
-    {
-      "version": "1.1.0",
-      "title": "Release plumbing & polish",
-      "date": "2026-06-16",
-      "sections": [
-        {
-          "header": "New",
-          "bullets": [
-            "Automated Play Console upload when a release tag ships (a human still starts the rollout).",
-            "/relay slash commands — status, devices, and pair from any platform — plus a relay-status badge in the dashboard header.",
-            "The relay plugin prompts for its optional voice-provider keys on install, and a tools-only native install path."
-          ]
-        },
-        {
-          "header": "Improved",
-          "bullets": [
-            "Settings overhaul: status pills are now exception-only, Power tools shows a single Plugin active/required/offline badge, and Connections moved to the top.",
-            "Release names and notes are now split per surface (Android, plugin, CLI)."
-          ]
-        },
-        {
-          "header": "Fixed",
-          "bullets": [
-            "No more force-close on connect when the stored credential keyset was corrupt — it now heals in place.",
-            "The installer works on uv-managed Hermes hosts, and the dashboard relay panel buttons are readable again."
-          ]
-        }
-      ]
-    },
-    {
-      "version": "1.0.0",
-      "title": "Stable launch",
-      "date": "2026-06-14",
-      "sections": [
-        {
-          "header": "Gateway chat with live thinking",
-          "bullets": [
-            "Chat can ride the upstream dashboard gateway — the only vanilla-upstream path that streams reasoning live, so the Thinking block and sphere light up during generation. \"Auto\" prefers it and falls back to the SSE endpoints per turn.",
-            "Desktop parity: native image/PDF/file attachments, mid-turn steering, edit & resend, approval/clarify/sudo/secret cards, live subagent lanes, a context-window meter, server slash commands, and turn-complete notifications.",
-            "Warm-start and an opt-in Keep connected in background toggle so long-backgrounded conversations resume instantly."
-          ]
-        },
-        {
-          "header": "Agents, Manage & media",
-          "bullets": [
-            "Switch agent profiles per conversation — model, SOUL, personality, and skills — with the selection bound to the session, never changing the server default for other clients.",
-            "Manage parity with the desktop dashboard: change models, manage provider keys, edit profiles and SOUL.md, and browse/install skills.",
-            "Open and save chat images and attachments — full-screen viewer with pinch-zoom, plus an Open/Share/Save menu."
-          ]
-        },
-        {
-          "header": "Standard path is first-class",
-          "bullets": [
-            "Chat, Manage, and voice all work against an unmodified upstream Hermes agent; the relay plugin is now purely additive.",
-            "Seamless connection UX — LAN↔Tailscale handoffs and reconnects no longer reload the chat, and status shows as in-theme slide-down toasts.",
-            "Persistent Realtime Agent voice that keeps one session across turns, with long runs promoted to tracked background tasks."
-          ]
-        }
-      ]
+     "header": "Profile icons",
+     "bullets": [
+      "Choose an image through Android's file picker or import avatar.png/profile.jpg from an updated paired Relay.",
+      "Host import now distinguishes an outdated Relay from a genuinely missing profile image."
+     ]
    }
-  ]
+   ]
+  },
+  {
+   "version": "1.4.5",
+   "title": "Chats that keep running",
+   "date": "2026-07-15",
+   "sections": [
+    {
+     "header": "Keep moving between chats",
+     "bullets": [
+      "Switch to another chat, profile, draft, or Thread without stopping a running Gateway reply.",
+      "Return to the session and reattach to its live checkpoint and progress."
+     ]
+    },
+    {
+     "header": "Cleaner live state",
+     "bullets": [
+      "Expired secret and sudo prompts collapse when Hermes reports their expiry, so stale actions no longer look usable.",
+      "Provider wait, reconnect, and continuation notices stay in Chat's live status line instead of cluttering the conversation."
+     ]
+    }
+   ]
+  },
+  {
+   "version": "1.4.4",
+   "title": "Spanish and clearer diagnostics",
+   "date": "2026-07-12",
+   "sections": [
+    {
+     "header": "Language that is ready to grow",
+     "bullets": [
+      "Use Spanish throughout the app from Settings → Appearance.",
+      "Translation freshness checks flag catalogs whenever the English source changes, while fluent verification remains tracked separately."
+     ]
+    },
+    {
+     "header": "Know what is connected",
+     "bullets": [
+      "Refresh Diagnostics to see the Relay plugin version, protocol, capability count, profile status, and last-check time.",
+      "Open the complete release history directly from the cleaner What’s New modal."
+     ]
+    }
+   ]
+  },
+  {
+   "version": "1.4.3",
+   "title": "Language switching inside the app",
+   "date": "2026-07-11",
+   "sections": [
+    {
+     "header": "Language at your fingertips",
+     "bullets": [
+      "Choose System default, English, or Simplified Chinese from Settings → Appearance without leaving Hermes-Relay.",
+      "The picker stays synchronized with Android's per-app language setting and persists the choice on Android 12 and lower.",
+      "Release builds reject collection APIs that can crash on Android versions before API 35."
+     ]
+    }
+   ]
+  },
+  {
+   "version": "1.4.2",
+   "title": "Simplified Chinese and scalable localization",
+   "date": "2026-07-11",
+   "sections": [
+    {
+     "header": "Simplified Chinese throughout the app",
+     "bullets": [
+      "Use onboarding, connection setup, Chat, Manage, Voice, settings, diagnostics, notifications, and accessibility labels in Simplified Chinese across both product flavors.",
+      "Switch between English and Simplified Chinese through Android's per-app language settings on supported versions, or follow the device language elsewhere."
+     ]
+    },
+    {
+     "header": "Localization built to grow",
+     "bullets": [
+      "Automated catalog checks protect resource, plural, and format-argument parity, while contributor docs and translated entry points make another language easier to add safely.",
+      "Connection scan and queued-message counts now use locale-aware Android plurals."
+     ]
+    }
+   ]
+  },
+  {
+   "version": "1.4.1",
+   "title": "Chat that keeps up",
+   "date": "2026-07-11",
+   "sections": [
+    {
+     "header": "Chat that stays with you",
+     "bullets": [
+      "Follow background terminal work from a compact process strip and expandable sheet. Its completed answer appears in the same conversation automatically.",
+      "Close and reopen while a reply runs: partial text, thinking, tool progress, background-task state, and pending approvals return in the same chat without repeating your prompt."
+     ]
+    },
+    {
+     "header": "Voice you can direct",
+     "bullets": [
+      "Use spoken commands to pause or resume listening, stop speech, cancel background work, repeat a finished result, or start Standard voice chat.",
+      "Hands-free, Low latency, Careful tools, and Quiet presets tune existing voice behavior without changing your selected voice or route."
+     ]
+    },
+    {
+     "header": "Clearer conversations",
+     "bullets": [
+      "Browse adjacent images as a gallery, read smoother streaming Markdown and wide tables, and see background-process completion as a compact process notice."
+     ]
+    }
+   ]
+  },
+  {
+   "version": "1.4.0",
+   "title": "Realtime voice that finishes the job",
+   "date": "2026-07-09",
+   "sections": [
+    {
+     "header": "Voice that keeps going",
+     "bullets": [
+      "Quick follow-ups can be answered while a long Hermes task runs, another long request can wait in a bounded queue, and the finished answer can stay in the selected realtime voice.",
+      "Voice route recovery now waits for relay confirmation, replays unacknowledged input without starting a second Hermes run, and rejects stale sockets or sessions before they can overwrite a healthy connection.",
+      "Listening, thinking, reconnecting, and cancellation states now settle cleanly after Stop, exit, route loss, or terminal retry failure."
+     ]
+    },
+    {
+     "header": "Models and phone automation",
+     "bullets": [
+      "Realtime Agent model and voice choices apply to the next session, persist per connection/profile, and survive restart.",
+      "Chat and Manage can refresh dynamic provider model catalogs on demand.",
+      "Opt-in notification rules can offer a local Ask Hermes action, and Bridge tools can target a specific paired Android device."
+     ]
+    },
+    {
+     "header": "Reliability and safety",
+     "bullets": [
+      "Long chat turns avoid premature transport fallback, and supported voice, card, and attachment context now reaches upstream Hermes through channels it consumes.",
+      "Malformed server addresses fail through normal connection errors, older Android versions avoid newer collection APIs, and relay media blocks credential and token paths.",
+      "Model management keeps unconfigured providers visible with key-setup guidance, and session cleanup gains export, prune preview/apply, archive, and restore plumbing."
+     ]
+    }
+   ]
+  },
+  {
+   "version": "1.3.0",
+   "title": "Voice that multitasks & sturdier chats",
+   "date": "2026-07-06",
+   "sections": [
+    {
+     "header": "Voice, hands-free",
+     "bullets": [
+      "Ask for something big and keep talking — long tasks hand off to the background with a live chip showing the current step, steps done, and a running timer, with a tap-to-cancel. The answer is spoken when it's ready, even after a brief disconnect — and if the voice session is gone, it arrives as a notification (the full answer is always in the chat).",
+      "Leaving voice mode (or tapping stop to interrupt speech) no longer cancels a running background task — the chip's ✕ is the one deliberate kill switch, and a delivered answer keeps its text instead of flipping to \"Cancelled.\"",
+      "Quieter and quicker: the agent speaks at milestones instead of narrating every step, clearly long tasks hand off to the background right away, and the first turn starts faster — the session warms up when you open voice mode."
+     ]
+    },
+    {
+     "header": "Chats that keep their answers",
+     "bullets": [
+      "An answer is no longer lost when the connection drops mid-reply on a long turn (slow local models, delegating skills) — the app quietly re-checks the conversation and completes the turn when the server finishes, with the usual done-notification if you've switched away.",
+      "Markdown reads like chat: headings are proportionate instead of billboard-sized, lists and paragraphs share one size, links are clearly styled, and timestamps show once per message group."
+     ]
+    },
+    {
+     "header": "Your agent can reach out",
+     "bullets": [
+      "Proactive messages: your Hermes agent can message your phone first (off by default, opt-in on both server and phone), and you can reply straight from the notification or the new Hermes inbox — the conversation continues like any other chat."
+     ]
+    },
+    {
+     "header": "Make it yours",
+     "bullets": [
+      "Pick your app font — Inter (new default), Nunito, or your system font — applied instantly, everywhere.",
+      "The in-bubble working indicator can be a small animated dot-matrix (Wave, Pulse, Bounce, Sparkle) with a color of your choice.",
+      "Quick Controls at the top of Settings puts Persistent connection and Turn-complete alerts one tap away."
+     ]
+    },
+    {
+     "header": "Setup & housekeeping",
+     "bullets": [
+      "Onboarding slides now scroll on small screens and large font sizes, so no setup guidance is cut off.",
+      "Reporting a diagnostic files the right kind of issue: informational entries ask what you expected and file as a question, and every report carries your actual connection mode.",
+      "Connections is a scannable list with a tabbed detail screen (Overview, Routes, Advanced, Security), and voice settings can now read and edit your server's voice engine (provider, voice, model) over the dashboard."
+     ]
+    }
+   ]
+  },
+  {
+   "version": "1.2.6",
+   "title": "Tidier chats & calmer status",
+   "date": "2026-06-27",
+   "sections": [
+    {
+     "header": "Tidier chats",
+     "bullets": [
+      "Chats no longer get stuck showing \"Untitled\" — your first message stands in as the title until the chat is named, titles refresh once a turn settles, and a new refresh button in the session drawer pulls the latest on demand. Renaming a chat now sticks when you're on a non-default agent profile."
+     ]
+    },
+    {
+     "header": "Calmer status",
+     "bullets": [
+      "Connection status — reconnecting, checking, network handoffs — now shows as a thin banner at the top that gently slides the screen down, instead of a card floating over your chat; the floating alert is kept for persistent errors. Quick confirmations (copied, profiles updated, profile/personality switches) land in the same calm banner instead of a pop-up at the bottom."
+     ]
+    }
+   ]
+  },
+  {
+   "version": "1.2.5",
+   "title": "Stability + Try the demo",
+   "date": "2026-06-27",
+   "sections": [
+    {
+     "header": "Stability",
+     "bullets": [
+      "Fixed a crash that could close the app when a non-URL value — a UI label, or a line copied from the docs — was entered in the API server or Dashboard URL field. The setup fields now reject anything that isn't a valid host or http(s) URL with an inline error, and the dashboard and voice request paths treat a bad address as unreachable instead of crashing."
+     ]
+    },
+    {
+     "header": "Try the demo",
+     "bullets": [
+      "A new \"Try the demo\" option on the setup screen — and on the empty chat screen if you skip setup — opens an offline preview of the real chat experience: a sample conversation with Markdown, a tool-progress card, and a rich card, with no server, account, or network. A banner shows it's a demo, with a one-tap Connect to set up for real."
+     ]
+    }
+   ]
+  },
+  {
+   "version": "1.2.4",
+   "title": "Stability + connection security",
+   "date": "2026-06-25",
+   "sections": [
+    {
+     "header": "Stability",
+     "bullets": [
+      "Fixed a crash that could close the app when the dashboard connection check hit a transient network failure — a pooled connection aborting or timing out over Tailscale. The check now reports the failure cleanly and the connection probe degrades gracefully instead of force-closing."
+     ]
+    },
+    {
+     "header": "See if you're secure",
+     "bullets": [
+      "The chat status chip, connection card, and route picker now show at a glance whether your connection is encrypted — Encrypted · TLS, Encrypted · Tailscale (both secure), Mixed routes, or Not encrypted — and tapping it opens a per-transport breakdown (chat, API, relay tools). A Tailscale or WireGuard route is now correctly shown as encrypted rather than implied insecure."
+     ]
+    }
+   ]
+  },
+  {
+   "version": "1.2.3",
+   "title": "Connection crash fix",
+   "date": "2026-06-23",
+   "sections": [
+    {
+     "header": "Stability",
+     "bullets": [
+      "Fixed a crash that could close the app right after connecting over an encrypted link (Tailscale or HTTPS) — a live secure connection was being torn down on the main thread as it came up. Securing your connection no longer force-closes the app; plain-LAN connections were never affected."
+     ]
+    }
+   ]
+  },
+  {
+   "version": "1.2.2",
+   "title": "Multi-profile polish",
+   "date": "2026-06-22",
+   "sections": [
+    {
+     "header": "Profiles that behave",
+     "bullets": [
+      "Deleting a session while a non-default agent profile is active now sticks — it no longer reappears after the list refreshes.",
+      "On a cold start with a non-default profile selected, the session drawer opens on that profile's chats directly instead of briefly showing the default profile's."
+     ]
+    },
+    {
+     "header": "Clearer diagnostics",
+     "bullets": [
+      "Diagnostics is now a full screen led by a top-to-bottom list of subsystem health checks — network, API server, chat transport, pairing, relay, and voice — each with a pass / warning / fail state and the reason when something's wrong; tap a failing check for full detail. The recent-activity log stays below."
+     ]
+    },
+    {
+     "header": "Small touches",
+     "bullets": [
+      "The default connection is now simply \"Hermes\" (and the optional power features are labelled \"Relay\"), across setup, the switcher, voice, and permissions.",
+      "Distraction-free chat mode gives its text a taller, scrollable area."
+     ]
+    }
+   ]
+  },
+  {
+   "version": "1.2.1",
+   "title": "Polish & control",
+   "date": "2026-06-21",
+   "sections": [
+    {
+     "header": "Yours to control",
+     "bullets": [
+      "Lock the app to a single agent profile (Settings → Profile lock) and hide the rest from the pickers."
+     ]
+    },
+    {
+     "header": "Find your way back",
+     "bullets": [
+      "A new \"What's New\" entry in Settings shows current and past release notes any time — not just after an update."
+     ]
+    },
+    {
+     "header": "When something breaks",
+     "bullets": [
+      "Diagnostics show clean error titles — tap any entry for a detail view with Copy, Share, and a one-tap GitHub issue.",
+      "A tasteful in-app banner tells you when a newer version is live (Play or sideload) — dismissable, and it never nags."
+     ]
+    },
+    {
+     "header": "Voice fixes",
+     "bullets": [
+      "Stop now halts realtime speech instantly, hold-to-talk is steadier, the voice overlay is easier to read, and a chosen voice applies in Auto mode.",
+      "Realtime turns that reach back to Hermes no longer drop with a session error."
+     ]
+    }
+   ]
+  },
+  {
+   "version": "1.2.0",
+   "title": "Make it yours",
+   "date": "2026-06-20",
+   "sections": [
+    {
+     "header": "Personalize",
+     "bullets": [
+      "Eight app themes in Settings → Appearance — the Hermes Relay brand plus ports of the Nous Hermes looks (Teal, Nous Blue, Midnight, Ember, Mono, Cyberpunk, Rosé), with light/dark.",
+      "Swap the agent orb for an animated pet that reacts to what the agent is doing — add, preview, and tune pets right in the app, or generate one from sprite art with the AI authoring kit.",
+      "Reskin the sphere, and give each agent profile its own icon."
+     ]
+    },
+    {
+     "header": "See what's happening",
+     "bullets": [
+      "The chat status strip names the actual streaming path (Gateway, Sessions, Completions, Runs), with a basic→best tier ladder in Chat Settings.",
+      "Tap the context meter for a \"What the agent sees\" sheet — the exact extra context prepended to your next turn.",
+      "Voice and Realtime turns are badged in the scrollback."
+     ]
+    },
+    {
+     "header": "Privacy",
+     "bullets": [
+      "When paired to the relay, the agent can mark private media and the phone blurs it per your setting — sensitivity stays model-emitted."
+     ]
+    },
+    {
+     "header": "Faster & more reliable",
+     "bullets": [
+      "Cold start is about 3× faster, and model/personality/approvals load honestly instead of showing a maybe-wrong value.",
+      "In-app crash reporting offers a one-tap, pre-filled bug report.",
+      "QR pairing no longer force-closes on unusual cameras (foldables); fixed crashes opening server images and PDFs; in-chat model picks now apply."
+     ]
+    },
+    {
+     "header": "Voice & terminal",
+     "bullets": [
+      "Enhanced voice control for Gemini and xAI providers.",
+      "Leaner terminal with TUI-correct input and an isolated, tuned tmux."
+     ]
+    }
+   ]
+  },
+  {
+   "version": "1.1.0",
+   "title": "Release plumbing & polish",
+   "date": "2026-06-16",
+   "sections": [
+    {
+     "header": "New",
+     "bullets": [
+      "Automated Play Console upload when a release tag ships (a human still starts the rollout).",
+      "/relay slash commands — status, devices, and pair from any platform — plus a relay-status badge in the dashboard header.",
+      "The relay plugin prompts for its optional voice-provider keys on install, and a tools-only native install path."
+     ]
+    },
+    {
+     "header": "Improved",
+     "bullets": [
+      "Settings overhaul: status pills are now exception-only, Power tools shows a single Plugin active/required/offline badge, and Connections moved to the top.",
+      "Release names and notes are now split per surface (Android, plugin, CLI)."
+     ]
+    },
+    {
+     "header": "Fixed",
+     "bullets": [
+      "No more force-close on connect when the stored credential keyset was corrupt — it now heals in place.",
+      "The installer works on uv-managed Hermes hosts, and the dashboard relay panel buttons are readable again."
+     ]
+    }
+   ]
+  },
+  {
+   "version": "1.0.0",
+   "title": "Stable launch",
+   "date": "2026-06-14",
+   "sections": [
+    {
+     "header": "Gateway chat with live thinking",
+     "bullets": [
+      "Chat can ride the upstream dashboard gateway — the only vanilla-upstream path that streams reasoning live, so the Thinking block and sphere light up during generation. \"Auto\" prefers it and falls back to the SSE endpoints per turn.",
+      "Desktop parity: native image/PDF/file attachments, mid-turn steering, edit & resend, approval/clarify/sudo/secret cards, live subagent lanes, a context-window meter, server slash commands, and turn-complete notifications.",
+      "Warm-start and an opt-in Keep connected in background toggle so long-backgrounded conversations resume instantly."
+     ]
+    },
+    {
+     "header": "Agents, Manage & media",
+     "bullets": [
+      "Switch agent profiles per conversation — model, SOUL, personality, and skills — with the selection bound to the session, never changing the server default for other clients.",
+      "Manage parity with the desktop dashboard: change models, manage provider keys, edit profiles and SOUL.md, and browse/install skills.",
+      "Open and save chat images and attachments — full-screen viewer with pinch-zoom, plus an Open/Share/Save menu."
+     ]
+    },
+    {
+     "header": "Standard path is first-class",
+     "bullets": [
+      "Chat, Manage, and voice all work against an unmodified upstream Hermes agent; the relay plugin is now purely additive.",
+      "Seamless connection UX — LAN↔Tailscale handoffs and reconnects no longer reload the chat, and status shows as in-theme slide-down toasts.",
+      "Persistent Realtime Agent voice that keeps one session across turns, with long runs promoted to tracked background tasks."
+     ]
+    }
+   ]
+  }
+ ]
 }
@@ -1,6 +1,8 @@
-v1.2.3 - Connection crash fix
+v1.4.6 - Profiles stay together

-Stability
-* Fixed a crash that could close the app right after connecting over an
-  encrypted link (Tailscale or HTTPS). Securing your connection no longer
-  force-closes the app. Plain-LAN connections were never affected.
+Profile continuity
+* Server default now keeps its agent, chats, drawer, and transcript in the active Hermes profile.
+* Reorder or hide profiles per connection without changing the server.
+
+Profile icons
+* Choose an image file on your phone or import avatar.png/profile.jpg from an updated paired Relay.
@@ -8,13 +8,13 @@ import android.os.Bundle
 import android.util.Log
 import android.view.View
 import android.view.animation.DecelerateInterpolator
-import androidx.activity.ComponentActivity
 import androidx.activity.compose.setContent
 import androidx.activity.enableEdgeToEdge
 import androidx.activity.result.contract.ActivityResultContracts
 import androidx.activity.viewModels
 import androidx.core.animation.doOnEnd
 import androidx.core.splashscreen.SplashScreen.Companion.installSplashScreen
+import androidx.appcompat.app.AppCompatActivity
 import com.hermesandroid.relay.accessibility.ScreenCaptureRequester
 import com.hermesandroid.relay.bridge.BridgeForegroundService
 import com.hermesandroid.relay.bridge.UnattendedAccessManager
@@ -24,7 +24,7 @@ import com.hermesandroid.relay.ui.RelayApp
 import com.hermesandroid.relay.util.NavRouteRequest
 import com.hermesandroid.relay.viewmodel.ConnectionViewModel

-class MainActivity : ComponentActivity() {
+class MainActivity : AppCompatActivity() {

    private val connectionViewModel: ConnectionViewModel by viewModels()

@@ -15,6 +15,7 @@ import android.os.HandlerThread
 import android.util.DisplayMetrics
 import android.util.Log
 import android.view.WindowManager
+import kotlinx.coroutines.delay
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.sync.withLock
 import kotlinx.coroutines.withContext
@@ -114,8 +115,27 @@ class ScreenCapture(
         */
        private const val MAX_IMAGES = 2

-        /** Capture timeout — if no frame arrives in this window, fail loudly. */
-        private const val CAPTURE_TIMEOUT_MS = 2_500L
+        /**
+         * Capture timeout — if no frame arrives in this window, fail loudly.
+         *
+         * BOOX / e-ink devices can take several seconds before a
+         * VirtualDisplay-backed ImageReader emits its first frame, especially
+         * after a fresh MediaProjection grant or when the display is idle. Keep
+         * the default generous enough for those devices while still bounded so
+         * a dead capture pipeline reports a clear error.
+         */
+        private const val DEFAULT_CAPTURE_TIMEOUT_MS = 10_000L
+
+        /** Optional JVM/system-property override for local QA and OEM tuning. */
+        private const val CAPTURE_TIMEOUT_PROPERTY =
+            "hermes.relay.screen_capture_timeout_ms"
+
+        private const val MIN_CAPTURE_TIMEOUT_MS = 2_500L
+        private const val MAX_CAPTURE_TIMEOUT_MS = 30_000L
+
+        /** One retry covers stale VirtualDisplay/ImageReader pipelines. */
+        private const val MAX_CAPTURE_ATTEMPTS = 2
+        private const val CAPTURE_RETRY_DELAY_MS = 350L
    }

    // === PHASE3-bridge-ui-followup: MediaProjection reuse fix ===
@@ -211,7 +231,27 @@ class ScreenCapture(
        // mutex keeps us honest if anything ever parallelizes.
        val pngBytes = try {
            captureMutex.withLock {
-                captureFrame(projection)
+                var lastTimeout: CaptureTimeoutException? = null
+                for (attempt in 1..MAX_CAPTURE_ATTEMPTS) {
+                    try {
+                        return@withLock captureFrame(projection)
+                    } catch (e: CaptureTimeoutException) {
+                        lastTimeout = e
+                        Log.w(
+                            TAG,
+                            "screen capture timed out on attempt " +
+                                "$attempt/$MAX_CAPTURE_ATTEMPTS: ${e.message}"
+                        )
+                        if (attempt < MAX_CAPTURE_ATTEMPTS) {
+                            // A timeout can leave an OEM VirtualDisplay path
+                            // wedged without invalidating the MediaProjection
+                            // grant. Rebuild our pipeline once before giving up.
+                            releaseCache()
+                            delay(CAPTURE_RETRY_DELAY_MS)
+                        }
+                    }
+                }
+                throw lastTimeout ?: IOException("screen capture timed out")
            }
        } catch (e: Exception) {
            Log.w(TAG, "captureFrame failed: ${e.message}")
@@ -286,16 +326,28 @@ class ScreenCapture(
        }

        return try {
-            kotlinx.coroutines.withTimeout(CAPTURE_TIMEOUT_MS) { deferred.await() }
+            val timeoutMs = captureTimeoutMs()
+            kotlinx.coroutines.withTimeout(timeoutMs) { deferred.await() }
        } catch (e: kotlinx.coroutines.TimeoutCancellationException) {
            pendingCaptureRef.compareAndSet(deferred, null)
-            throw IOException("screen capture timed out")
+            throw CaptureTimeoutException(
+                "screen capture timed out after ${captureTimeoutMs()}ms"
+            )
        } catch (t: Throwable) {
            pendingCaptureRef.compareAndSet(deferred, null)
            throw t
        }
    }

+    private fun captureTimeoutMs(): Long {
+        val configured = System.getProperty(CAPTURE_TIMEOUT_PROPERTY)
+            ?.toLongOrNull()
+            ?.coerceIn(MIN_CAPTURE_TIMEOUT_MS, MAX_CAPTURE_TIMEOUT_MS)
+        return configured ?: DEFAULT_CAPTURE_TIMEOUT_MS
+    }
+
+    private class CaptureTimeoutException(message: String) : IOException(message)
+
    /**
     * Build (or reuse) the cached VirtualDisplay + ImageReader + HandlerThread
     * for this projection. Rebuilds when:
@@ -489,7 +541,7 @@ class ScreenCapture(
            fastClient.newCall(request).execute().use { response ->
                when (response.code) {
                    200 -> {
-                        val raw = response.body?.string().orEmpty()
+                        val raw = response.body.string()
                        val token = extractToken(raw)
                        if (token.isNullOrBlank()) {
                            Result.failure(
@@ -9,6 +9,7 @@ import android.media.AudioTrack
 import android.os.Build
 import android.os.SystemClock
 import android.util.Log
+import com.hermesandroid.relay.R
 import com.hermesandroid.relay.diagnostics.DiagnosticCategory
 import com.hermesandroid.relay.diagnostics.DiagnosticSeverity
 import com.hermesandroid.relay.diagnostics.DiagnosticsLog
@@ -25,7 +26,7 @@ import kotlin.math.sqrt
 * writes them directly to an AudioTrack so the Android Studio dev build can
 * hear provider output without waiting for an encoded file.
 */
-class RealtimePcmPlayer(context: Context? = null) {
+class RealtimePcmPlayer(private val context: Context? = null) {
    private val trackLock = Any()
    private val writeLock = Any()
    private val audioManager =
@@ -225,7 +226,7 @@ class RealtimePcmPlayer(context: Context? = null) {
        // is the chunk's end frame. The cursor reaches this amplitude once
        // playbackHeadPosition passes the previous end frame.
        playbackAmpQueue.addLast(FrameAmp(endFrame = totalFramesWritten, rms = rms))
-        while (playbackAmpQueue.size > MAX_AMP_QUEUE) playbackAmpQueue.removeFirst()
+        while (playbackAmpQueue.size > MAX_AMP_QUEUE) playbackAmpQueue.removeAt(0)
    }

    /**
@@ -240,7 +241,7 @@ class RealtimePcmPlayer(context: Context? = null) {
        val head = readHeadFrames(track).toLong()
        // Drop fully-played chunks so the head of the queue is the one playing now.
        while (playbackAmpQueue.size > 1 && playbackAmpQueue.first().endFrame <= head) {
-            playbackAmpQueue.removeFirst()
+            playbackAmpQueue.removeAt(0)
        }
        amplitudeAtHead(playbackAmpQueue, head)
    }
@@ -449,7 +450,7 @@ class RealtimePcmPlayer(context: Context? = null) {
            DiagnosticsLog.record(
                category = DiagnosticCategory.Voice,
                severity = DiagnosticSeverity.Info,
-                title = "Realtime audio started",
+                title = context?.getString(R.string.audio_diag_started) ?: "Realtime audio started",
                detail = "First sample reached the speaker after ${ttfaMs}ms.",
            )
        }
@@ -489,7 +490,7 @@ class RealtimePcmPlayer(context: Context? = null) {
        DiagnosticsLog.record(
            category = DiagnosticCategory.Voice,
            severity = DiagnosticSeverity.Warning,
-            title = "Realtime audio not starting",
+            title = context?.getString(R.string.audio_diag_not_starting) ?: "Realtime audio not starting",
            detail = "Playback running ${stuckMs}ms but no audio reached the speaker " +
                "(${mediaVolumeSummaryLocked()}).",
        )
@@ -587,7 +588,7 @@ class RealtimePcmPlayer(context: Context? = null) {
        DiagnosticsLog.record(
            category = DiagnosticCategory.Voice,
            severity = DiagnosticSeverity.Warning,
-            title = "Realtime audio stream gap",
+            title = context?.getString(R.string.audio_diag_stream_gap) ?: "Realtime audio stream gap",
            detail = reason,
        )
    }
@@ -603,7 +604,7 @@ class RealtimePcmPlayer(context: Context? = null) {
            DiagnosticsLog.record(
                category = DiagnosticCategory.Voice,
                severity = DiagnosticSeverity.Warning,
-                title = "Realtime voice volume muted",
+                title = context?.getString(R.string.audio_diag_volume_muted) ?: "Realtime voice volume muted",
                detail = "Media volume is 0/${maxVolume ?: "?"}.",
            )
        }
@@ -5,6 +5,8 @@ import android.media.audiofx.Visualizer
 import android.util.Log
 import androidx.annotation.OptIn
 import androidx.core.net.toUri
+import androidx.media3.common.AudioAttributes
+import androidx.media3.common.C
 import androidx.media3.common.MediaItem
 import androidx.media3.common.Player
 import androidx.media3.common.util.UnstableApi
@@ -425,9 +427,25 @@ class VoicePlayer(
 * Production ExoPlayer factory — used as the default for [VoicePlayer].
 * Split out as a top-level function so unit tests can swap it for a
 * MockK mock without touching Media3's `Builder` class loader.
+ *
+ * Audio attributes (USAGE_MEDIA + CONTENT_TYPE_SPEECH) with
+ * `handleAudioFocus = true` are set so ExoPlayer requests audio focus when
+ * the first TTS clip starts, which warms the audio HAL output path before
+ * playback begins. Without them the very first turn of a cold voice session
+ * could lose its opening syllables to the AudioTrack/HAL allocation window —
+ * the standard-path twin of the deep-buffer cold-start the relay PCM player
+ * already mitigates. SPEECH also lets the system duck other audio
+ * appropriately for a spoken assistant reply.
 */
@OptIn(UnstableApi::class)
 private fun defaultExoPlayer(context: Context): ExoPlayer =
    ExoPlayer.Builder(context)
+        .setAudioAttributes(
+            AudioAttributes.Builder()
+                .setUsage(C.USAGE_MEDIA)
+                .setContentType(C.AUDIO_CONTENT_TYPE_SPEECH)
+                .build(),
+            /* handleAudioFocus = */ true,
+        )
        .setHandleAudioBecomingNoisy(true)
        .build()
@@ -5,6 +5,8 @@ import android.content.Context
 import android.media.AudioFormat
 import android.media.AudioRecord
 import android.media.MediaRecorder
+import android.media.audiofx.AcousticEchoCanceler
+import android.media.audiofx.NoiseSuppressor
 import android.util.Log
 import kotlinx.coroutines.flow.MutableStateFlow
 import kotlinx.coroutines.flow.StateFlow
@@ -55,6 +57,8 @@ class VoiceRecorder(
    private val bufferLock = Any()
    private val stopRequested = AtomicBoolean(false)
    private var audioRecord: AudioRecord? = null
+    private var echoCanceler: AcousticEchoCanceler? = null
+    private var noiseSuppressor: NoiseSuppressor? = null
    private var currentOutputFile: File? = null
    private var readThread: Thread? = null
    private var readDone: CountDownLatch? = null
@@ -117,6 +121,7 @@ class VoiceRecorder(
            throw e
        }

+        attachVoiceEffects(recorder.audioSessionId)
        audioRecord = recorder
        val done = CountDownLatch(1)
        readDone = done
@@ -136,6 +141,9 @@ class VoiceRecorder(
    fun stopRecording(): File {
        val file = currentOutputFile
            ?: throw IllegalStateException("stopRecording called with no active recording")
+        // Claim the capture exactly once. A stale UI stop must not repackage
+        // the previous PCM as a second voice turn.
+        currentOutputFile = null

        val record = audioRecord
        stopRequested.set(true)
@@ -202,8 +210,15 @@ class VoiceRecorder(
                    }
                }
                updateAmplitude(buffer, read)
+            } else if (read < 0) {
+                Log.w(TAG, "AudioRecord.read ended with error code $read")
+                break
            }
        }
+        // Android can terminate capture while the app is backgrounded without
+        // stopRecording() running. Reflect that loss in isRecording() so the
+        // foreground UI can recover instead of remaining stuck on Listening.
+        stopRequested.set(true)
    }

    private fun updateAmplitude(buffer: ByteArray, read: Int) {
@@ -224,7 +239,44 @@ class VoiceRecorder(
        _amplitude.value = sqrt(floored)
    }

+    /**
+     * Engage the platform's hardware echo-cancellation and noise-suppression
+     * on the [AudioRecord] capture session when the device exposes them —
+     * parity with hermes-desktop's `getUserMedia({echoCancellation,
+     * noiseSuppression})`. Both are best-effort: many mid-range and older
+     * devices report [AcousticEchoCanceler.isAvailable] / [NoiseSuppressor.isAvailable]
+     * false, in which case capture proceeds raw (the same behaviour as before
+     * this change). AEC in particular keeps the device's own TTS playback from
+     * bleeding into the next captured utterance during back-to-back voice turns.
+     */
+    private fun attachVoiceEffects(sessionId: Int) {
+        if (AcousticEchoCanceler.isAvailable()) {
+            echoCanceler = try {
+                AcousticEchoCanceler.create(sessionId)?.apply { enabled = true }
+            } catch (e: Exception) {
+                Log.w(TAG, "AcousticEchoCanceler unavailable: ${e.message}")
+                null
+            }
+        }
+        if (NoiseSuppressor.isAvailable()) {
+            noiseSuppressor = try {
+                NoiseSuppressor.create(sessionId)?.apply { enabled = true }
+            } catch (e: Exception) {
+                Log.w(TAG, "NoiseSuppressor unavailable: ${e.message}")
+                null
+            }
+        }
+    }
+
    private fun releaseRecorder() {
+        echoCanceler?.let { fx ->
+            try { fx.release() } catch (_: Exception) { }
+        }
+        echoCanceler = null
+        noiseSuppressor?.let { fx ->
+            try { fx.release() } catch (_: Exception) { }
+        }
+        noiseSuppressor = null
        audioRecord?.let { record ->
            try { record.release() } catch (_: Exception) { }
        }
@@ -898,6 +898,18 @@ class AuthManager(
    val profilesUpdatedEvents: kotlinx.coroutines.flow.SharedFlow<Unit> =
        _profilesUpdatedEvents.asSharedFlow()

+    /**
+     * Emits once per successful `auth.ok` — i.e. on every (re)connect, not
+     * just the first pair. Lets connection-scoped consumers re-establish
+     * per-socket state. The proactive subscription is tracked per-WebSocket
+     * on the relay, so [com.hermesandroid.relay.viewmodel.ConnectionViewModel]
+     * collects this to re-send `proactive.subscribe` after each reconnect.
+     */
+    private val _authOkEvents =
+        kotlinx.coroutines.flow.MutableSharedFlow<Unit>(extraBufferCapacity = 4)
+    val authOkEvents: kotlinx.coroutines.flow.SharedFlow<Unit> =
+        _authOkEvents.asSharedFlow()
+
    fun regeneratePairingCode() {
        _pairingCode.value = generatePairingCode()
    }
@@ -965,6 +977,9 @@ class AuthManager(
                    }
                    _authState.value = AuthState.Paired(token)
                    Log.i(TAG, "handleAuthOk: Paired(token=${token.take(8)}…)")
+                    // Per-connection signal for socket-scoped consumers (e.g.
+                    // re-sending proactive.subscribe). Fires on every auth.ok.
+                    _authOkEvents.tryEmit(Unit)
                    // Server-issued code is one-shot — drop it once the
                    // upgrade to a long-lived session token has landed.
                    serverIssuedCode = null
@@ -89,8 +89,8 @@ class AutoDisableWorker(private val context: Context) {

        val builder = NotificationCompat.Builder(context, CHANNEL_ID)
            .setSmallIcon(R.mipmap.ic_launcher)
-            .setContentTitle("Bridge auto-disabled")
-            .setContentText("Paused after idle — tap to re-enable in the Bridge tab.")
+            .setContentTitle(context.getString(R.string.bridge_notification_auto_disabled_title))
+            .setContentText(context.getString(R.string.bridge_notification_auto_disabled_body))
            .setStyle(NotificationCompat.BigTextStyle().bigText(
                "Hermes bridge was idle for too long, so device control has been turned off " +
                    "automatically. Open the Bridge tab to turn it back on if you still need it."
@@ -373,8 +373,8 @@ class BridgeForegroundService : Service() {

        return NotificationCompat.Builder(this, CHANNEL_ID)
            .setSmallIcon(R.mipmap.ic_launcher)
-            .setContentTitle("Hermes agent has device control")
-            .setContentText("Bridge is active — tap Disable to stop at any time.")
+            .setContentTitle(getString(R.string.bridge_notification_control_title))
+            .setContentText(getString(R.string.bridge_notification_control_body))
            .setStyle(NotificationCompat.BigTextStyle().bigText(
                "The Hermes agent can currently read the screen and perform " +
                    "actions on your behalf through the accessibility service. " +
@@ -137,6 +137,24 @@ object AgentDisplay {
            ?.trim()
            ?.takeIf { it.isNotEmpty() && !isServerDefaultAlias(it) }

+    /**
+     * The profile name that owns chat sessions for the current UI selection.
+     *
+     * [selectedProfileName] is null (or the synthetic `default` alias) for the
+     * "Server default" row. That UI sentinel must remain distinct from the
+     * server's sticky active profile: a dashboard launched under the root home
+     * may still report `active=victor`, in which case upstream Gateway and
+     * dashboard session calls must explicitly target `victor`. The resolved
+     * server value deliberately keeps the literal `default` name so a dashboard
+     * launched under another profile can still address the root profile.
+     */
+    fun effectiveSessionProfileName(
+        selectedProfileName: String?,
+        serverDefaultProfileName: String?,
+    ): String? =
+        profileRequestName(selectedProfileName)
+            ?: serverDefaultProfileName?.trim()?.takeIf { it.isNotEmpty() }
+
    fun profileSessionKey(profileName: String?): String =
        profileRequestName(profileName) ?: SERVER_DEFAULT_PROFILE_KEY

@@ -0,0 +1,43 @@
+package com.hermesandroid.relay.data
+
+import androidx.core.os.LocaleListCompat
+import java.util.Locale
+
+/** Languages exposed by the in-app picker and Android's per-app language UI. */
+enum class AppLanguage(val languageTag: String) {
+    SYSTEM_DEFAULT(""),
+    ENGLISH("en"),
+    SIMPLIFIED_CHINESE("zh-Hans"),
+    SPANISH("es"),
+    ;
+
+    fun toLocaleList(): LocaleListCompat = if (languageTag.isEmpty()) {
+        LocaleListCompat.getEmptyLocaleList()
+    } else {
+        LocaleListCompat.forLanguageTags(languageTag)
+    }
+
+    companion object {
+        fun fromLanguageTags(languageTags: String): AppLanguage {
+            val primaryTag = languageTags
+                .substringBefore(',')
+                .trim()
+                .takeIf { it.isNotEmpty() }
+                ?: return SYSTEM_DEFAULT
+            val locale = Locale.forLanguageTag(primaryTag)
+
+            return when (locale.language.lowercase(Locale.ROOT)) {
+                "en" -> ENGLISH
+                "es" -> SPANISH
+                "zh" -> {
+                    val simplified = locale.script.equals("Hans", ignoreCase = true) ||
+                        locale.script.isEmpty() ||
+                        locale.country.equals("CN", ignoreCase = true) ||
+                        locale.country.equals("SG", ignoreCase = true)
+                    if (simplified) SIMPLIFIED_CHINESE else SYSTEM_DEFAULT
+                }
+                else -> SYSTEM_DEFAULT
+            }
+        }
+    }
+}
@@ -82,9 +82,9 @@ class BargeInPreferencesRepository(
    constructor(context: Context) : this(context.relayDataStore)

    companion object {
-        private val KEY_ENABLED = booleanPreferencesKey("barge_in_enabled")
-        private val KEY_SENSITIVITY = stringPreferencesKey("barge_in_sensitivity")
-        private val KEY_RESUME_AFTER_INTERRUPTION =
+        internal val KEY_ENABLED = booleanPreferencesKey("barge_in_enabled")
+        internal val KEY_SENSITIVITY = stringPreferencesKey("barge_in_sensitivity")
+        internal val KEY_RESUME_AFTER_INTERRUPTION =
            booleanPreferencesKey("barge_in_resume_after_interruption")
    }

@@ -111,8 +111,51 @@ data class ChatMessage(
     * reconcile normally. Only [clientOnly] gates orphan preservation.
     */
    val clientOnly: Boolean = false,
+    /**
+     * Delivery state for a message the user sends into an agent **Thread** over
+     * the relay proactive channel ([com.hermesandroid.relay.viewmodel.ChatViewModel]
+     * routes `source=phone` sessions here instead of the normal chat send).
+     * `SENDING` until the relay acks (`proactive.reply.ack`) → `DELIVERED`;
+     * `FAILED` on a send error. Null for ordinary chat messages — those render
+     * no status affix.
+     */
+    val deliveryStatus: MessageDeliveryStatus? = null,
+    /**
+     * Client-side lifecycle for a promoted/durable Hermes run that belongs to
+     * this assistant turn. The same message owns the state from promotion
+     * through delivery so Chat never needs a separate system notice and final
+     * reply for one task. On the normal post-turn history reconcile this field
+     * is carried forward with the rest of the client-only enrichment whenever
+     * the live message can be matched to its server row.
+     */
+    val backgroundTask: BackgroundTaskState? = null,
 )

+/** One Chat-visible identity for a promoted/durable realtime Hermes run. */
+data class BackgroundTaskState(
+    /** Relay run id when supplied; otherwise a stable id derived from the message. */
+    val id: String,
+    /** Short objective derived from the associated user turn. */
+    val title: String,
+    /** ADR 33 tier: `promoted` or `durable`. */
+    val tier: String = "promoted",
+    val phase: BackgroundTaskPhase = BackgroundTaskPhase.RUNNING,
+    /** Latest meaningful progress line, deliberately not a raw event trace. */
+    val statusLine: String? = null,
+    val completedToolCount: Int = 0,
+    val queuedCount: Int = 0,
+    val startedAt: Long = System.currentTimeMillis(),
+)
+
+enum class BackgroundTaskPhase {
+    RUNNING,
+    WAITING,
+    DELIVERING,
+    COMPLETE,
+    FAILED,
+    CANCELLED,
+}
+
 /**
 * Structured details about a phone-local voice intent that was dispatched
 * in-process via [com.hermesandroid.relay.network.relay.BridgeCommandHandler.handleLocalCommand].
@@ -295,7 +338,13 @@ data class ToolCall(
     * goal truncated to 60 chars. Carried on each child call so the lane
     * header can render without a separate lane registry.
     */
-    val taskLabel: String? = null
+    val taskLabel: String? = null,
+    /** Deterministic non-low output risk reported by upstream for this call. */
+    val outputRisk: String? = null,
+    /** Human-readable deterministic findings; rendered as untrusted metadata. */
+    val outputRiskFindings: List<String> = emptyList(),
+    /** Upstream removed sensitive spans before emitting the findings. */
+    val outputRiskRedacted: Boolean = false,
 )

 enum class MessageRole {
@@ -304,6 +353,17 @@ enum class MessageRole {
    SYSTEM
 }

+/**
+ * Delivery state of a user reply sent into an agent Thread over the relay
+ * proactive channel. Only set on Thread replies; ordinary chat messages leave
+ * it null and show no status affix.
+ *
+ * - [SENDING]   handed to the relay; awaiting the per-reply ack.
+ * - [DELIVERED] the relay acked (`proactive.reply.ack`) — buffered for the agent.
+ * - [FAILED]    the send errored (e.g. relay disconnected).
+ */
+enum class MessageDeliveryStatus { SENDING, DELIVERED, FAILED }
+
 data class ChatSession(
    val sessionId: String,
    val title: String?,
@@ -311,7 +371,14 @@ data class ChatSession(
    val messageCount: Int = 0,
    val updatedAt: Long = 0L,
    val startedAt: Long = 0L,
-    val lastActivityAt: Long = 0L
+    val lastActivityAt: Long = 0L,
+    /**
+     * Originating gateway platform/source for this session (upstream `sessions.source`):
+     * `tui`/`api_server` for ordinary app chats, `phone` for an agent **Thread**, and
+     * `discord`/`slack`/… for other platforms. Null when the server didn't supply it or
+     * for locally-created optimistic rows. Drives the drawer's Thread tag (see ADR 12).
+     */
+    val source: String? = null,
 ) {
    val activityTimestamp: Long
        get() = firstPositive(lastActivityAt, updatedAt, startedAt)
@@ -0,0 +1,275 @@
+package com.hermesandroid.relay.data
+
+import android.content.Context
+import androidx.datastore.core.DataStore
+import androidx.datastore.preferences.core.Preferences
+import androidx.datastore.preferences.core.edit
+import androidx.datastore.preferences.core.stringPreferencesKey
+import kotlinx.coroutines.flow.first
+import kotlinx.serialization.Serializable
+import kotlinx.serialization.encodeToString
+import kotlinx.serialization.json.Json
+
+/**
+ * Durable, client-owned snapshot of one in-flight chat turn.
+ *
+ * Hermes history is authoritative once a turn finishes, but it cannot recreate
+ * transient UI that existed before persistence (live reasoning, a running tool,
+ * an interactive ask, or the latest lifecycle line). This checkpoint bridges
+ * that gap across Activity recreation and process death. It deliberately stores
+ * no entered secret/approval response; only the server-issued ask is retained.
+ */
+@Serializable
+data class ChatTurnCheckpoint(
+    val schemaVersion: Int = CURRENT_SCHEMA,
+    val contextKey: String,
+    val sessionId: String,
+    val liveSessionId: String? = null,
+    val transport: String,
+    val user: ChatTurnUserCheckpoint,
+    val assistant: ChatTurnAssistantCheckpoint,
+    val turnStatus: String? = null,
+    val priorUserMessageCount: Int,
+    val baselineAssistantCount: Int,
+    val pendingAsk: ChatTurnAskCheckpoint? = null,
+    val startedAt: Long,
+    val updatedAt: Long,
+) {
+    companion object {
+        const val CURRENT_SCHEMA = 1
+        const val MAX_AGE_MS = 24L * 60L * 60L * 1_000L
+    }
+}
+
+@Serializable
+data class ChatTurnUserCheckpoint(
+    val id: String,
+    val content: String,
+    val timestamp: Long,
+)
+
+@Serializable
+data class ChatTurnAssistantCheckpoint(
+    val id: String,
+    val content: String = "",
+    val timestamp: Long,
+    val isStreaming: Boolean = true,
+    val thinkingContent: String = "",
+    val isThinkingStreaming: Boolean = false,
+    val inputTokens: Int? = null,
+    val outputTokens: Int? = null,
+    val totalTokens: Int? = null,
+    val estimatedCost: Double? = null,
+    val agentName: String? = null,
+    val badges: List<String> = emptyList(),
+    val cards: List<HermesCard> = emptyList(),
+    val cardDispatches: List<HermesCardDispatch> = emptyList(),
+    val toolCalls: List<ChatTurnToolCheckpoint> = emptyList(),
+    val backgroundTask: ChatTurnBackgroundTaskCheckpoint? = null,
+)
+
+@Serializable
+data class ChatTurnToolCheckpoint(
+    val id: String? = null,
+    val name: String,
+    val result: String? = null,
+    val success: Boolean? = null,
+    val isComplete: Boolean = false,
+    val error: String? = null,
+    val runId: String? = null,
+    val provenance: String? = null,
+    val startedAt: Long,
+    val completedAt: Long? = null,
+    val isGenerating: Boolean = false,
+    val taskIndex: Int? = null,
+    val taskLabel: String? = null,
+    val outputRisk: String? = null,
+    val outputRiskFindings: List<String> = emptyList(),
+    val outputRiskRedacted: Boolean = false,
+)
+
+@Serializable
+data class ChatTurnBackgroundTaskCheckpoint(
+    val id: String,
+    val title: String,
+    val tier: String,
+    val phase: String,
+    val statusLine: String? = null,
+    val completedToolCount: Int = 0,
+    val queuedCount: Int = 0,
+    val startedAt: Long,
+)
+
+@Serializable
+data class ChatTurnAskCheckpoint(
+    val kind: String,
+    val requestId: String? = null,
+    val text: String,
+    val choices: List<String>? = null,
+    val smartDenied: Boolean = false,
+    val envVar: String? = null,
+    val timeoutSeconds: Int,
+    val messageId: String,
+    val cardKey: String,
+    /** Original receive time, used to preserve an ask's expiry after reopen. */
+    val receivedAt: Long,
+)
+
+interface ChatTurnCheckpointStore {
+    suspend fun read(): ChatTurnCheckpoint?
+    suspend fun readAll(): List<ChatTurnCheckpoint> = listOfNotNull(read())
+    suspend fun read(contextKey: String, sessionId: String): ChatTurnCheckpoint? =
+        readAll()
+            .filter { it.contextKey == contextKey && it.sessionId == sessionId }
+            .maxByOrNull(ChatTurnCheckpoint::updatedAt)
+    suspend fun write(checkpoint: ChatTurnCheckpoint)
+    suspend fun remove(contextKey: String, sessionId: String) {
+        if (read()?.let { it.contextKey == contextKey && it.sessionId == sessionId } == true) {
+            clear()
+        }
+    }
+    suspend fun clear()
+}
+
+class DataStoreChatTurnCheckpointStore(
+    private val dataStore: DataStore<Preferences>,
+    private val now: () -> Long = System::currentTimeMillis,
+) : ChatTurnCheckpointStore {
+    constructor(context: Context) : this(context.applicationContext.relayDataStore)
+
+    private val json = Json {
+        ignoreUnknownKeys = true
+        encodeDefaults = true
+        isLenient = true
+    }
+
+    override suspend fun read(): ChatTurnCheckpoint? =
+        readAll().maxByOrNull(ChatTurnCheckpoint::updatedAt)
+
+    override suspend fun readAll(): List<ChatTurnCheckpoint> {
+        val preferences = runCatching { dataStore.data.first() }.getOrNull() ?: return emptyList()
+        val decoded = decode(preferences)
+        val valid = decoded.filter(::isValid)
+            .distinctBy { it.contextKey to it.sessionId }
+        if (valid.size != decoded.size ||
+            (preferences[KEY_CHECKPOINT_SET] == null && preferences[KEY_CHECKPOINT] != null)
+        ) {
+            // Cleanup/migration is best-effort. A read must still return the
+            // valid subset if DataStore's atomic rewrite is briefly unavailable.
+            runCatching { replaceAll(valid) }
+        }
+        return valid
+    }
+
+    override suspend fun read(contextKey: String, sessionId: String): ChatTurnCheckpoint? =
+        readAll().firstOrNull { it.contextKey == contextKey && it.sessionId == sessionId }
+
+    override suspend fun write(checkpoint: ChatTurnCheckpoint) {
+        dataStore.edit { preferences ->
+            val merged = mergeChatTurnCheckpoints(
+                existing = decode(preferences),
+                checkpoint = checkpoint,
+                now = now(),
+                limit = MAX_CHECKPOINTS,
+            )
+            preferences[KEY_CHECKPOINT_SET] = json.encodeToString(
+                ChatTurnCheckpointSet(checkpoints = merged),
+            )
+            preferences.remove(KEY_CHECKPOINT)
+        }
+    }
+
+    override suspend fun remove(contextKey: String, sessionId: String) {
+        dataStore.edit { preferences ->
+            val remaining = removeChatTurnCheckpoint(
+                decode(preferences),
+                contextKey,
+                sessionId,
+            )
+            if (remaining.isEmpty()) {
+                preferences.remove(KEY_CHECKPOINT_SET)
+            } else {
+                preferences[KEY_CHECKPOINT_SET] = json.encodeToString(
+                    ChatTurnCheckpointSet(checkpoints = remaining),
+                )
+            }
+            preferences.remove(KEY_CHECKPOINT)
+        }
+    }
+
+    override suspend fun clear() {
+        dataStore.edit { preferences ->
+            preferences.remove(KEY_CHECKPOINT)
+            preferences.remove(KEY_CHECKPOINT_SET)
+        }
+    }
+
+    private fun decode(preferences: Preferences): List<ChatTurnCheckpoint> {
+        val current = preferences[KEY_CHECKPOINT_SET]?.let { raw ->
+            runCatching { json.decodeFromString<ChatTurnCheckpointSet>(raw) }.getOrNull()
+        }
+        if (current?.schemaVersion == ChatTurnCheckpointSet.CURRENT_SCHEMA) {
+            return current.checkpoints
+        }
+        return preferences[KEY_CHECKPOINT]?.let { raw ->
+            listOfNotNull(runCatching { json.decodeFromString<ChatTurnCheckpoint>(raw) }.getOrNull())
+        }.orEmpty()
+    }
+
+    private fun isValid(checkpoint: ChatTurnCheckpoint): Boolean =
+        checkpoint.schemaVersion == ChatTurnCheckpoint.CURRENT_SCHEMA &&
+            now() - checkpoint.updatedAt <= ChatTurnCheckpoint.MAX_AGE_MS
+
+    private suspend fun replaceAll(checkpoints: List<ChatTurnCheckpoint>) {
+        dataStore.edit { preferences ->
+            if (checkpoints.isEmpty()) {
+                preferences.remove(KEY_CHECKPOINT_SET)
+            } else {
+                preferences[KEY_CHECKPOINT_SET] = json.encodeToString(
+                    ChatTurnCheckpointSet(checkpoints = checkpoints),
+                )
+            }
+            preferences.remove(KEY_CHECKPOINT)
+        }
+    }
+
+    private companion object {
+        const val MAX_CHECKPOINTS = 16
+        val KEY_CHECKPOINT = stringPreferencesKey("chat_inflight_turn_checkpoint_v1")
+        val KEY_CHECKPOINT_SET = stringPreferencesKey("chat_inflight_turn_checkpoints_v2")
+    }
+}
+
+internal fun mergeChatTurnCheckpoints(
+    existing: List<ChatTurnCheckpoint>,
+    checkpoint: ChatTurnCheckpoint,
+    now: Long,
+    limit: Int = 16,
+): List<ChatTurnCheckpoint> =
+    (existing.filterNot {
+        it.contextKey == checkpoint.contextKey && it.sessionId == checkpoint.sessionId
+    } + checkpoint)
+        .filter {
+            it.schemaVersion == ChatTurnCheckpoint.CURRENT_SCHEMA &&
+                now - it.updatedAt <= ChatTurnCheckpoint.MAX_AGE_MS
+        }
+        .sortedByDescending(ChatTurnCheckpoint::updatedAt)
+        .take(limit)
+
+internal fun removeChatTurnCheckpoint(
+    existing: List<ChatTurnCheckpoint>,
+    contextKey: String,
+    sessionId: String,
+): List<ChatTurnCheckpoint> = existing.filterNot {
+    it.contextKey == contextKey && it.sessionId == sessionId
+}
+
+@Serializable
+private data class ChatTurnCheckpointSet(
+    val schemaVersion: Int = CURRENT_SCHEMA,
+    val checkpoints: List<ChatTurnCheckpoint>,
+) {
+    companion object {
+        const val CURRENT_SCHEMA = 1
+    }
+}
@@ -0,0 +1,156 @@
+package com.hermesandroid.relay.data
+
+/**
+ * Single source of truth for "is this connection encrypted, and by what?"
+ *
+ * Security is **per-surface**: a single paired connection fans out to several
+ * transports (chat/gateway + Manage over the dashboard, API/sessions, relay
+ * tools) and each can independently be TLS, overlay-encrypted, or plain (see
+ * [computeConnectionSecurity]). Every UI surface — the chat status chip, the
+ * connection header, the route picker, the detail sheet — renders the same
+ * derived [ConnectionSecurity] so no two places disagree about what "secure"
+ * means.
+ *
+ * Crucially, **"encrypted" includes overlay transports** (Tailscale/WireGuard,
+ * the plugin secure proxy), not just TLS. A `ws://` link over a tailnet is
+ * WireGuard-encrypted end-to-end — genuinely secure, just not TLS — so it is
+ * never labelled "insecure". Only a plain scheme with no overlay warns.
+ */
+enum class SurfaceSecurityKind { Tls, Overlay, Plain }
+
+/** Connection-level rollup across the surfaces actually in use. */
+enum class ConnectionSecurityLevel { Tls, Overlay, Mixed, Plain, Unknown }
+
+/** Security verdict for one transport surface of a connection. */
+data class SurfaceSecurity(
+    val label: String,
+    val kind: SurfaceSecurityKind,
+    /** Human mechanism: "TLS", "Tailscale", "WireGuard", "Proxy", "Plain". */
+    val mechanism: String,
+    val url: String,
+)
+
+data class ConnectionSecurity(
+    val level: ConnectionSecurityLevel,
+    /** Dominant mechanism for the at-a-glance label. */
+    val mechanism: String,
+    val surfaces: List<SurfaceSecurity>,
+) {
+    /** True when every in-use surface is encrypted (TLS or overlay). */
+    val isEncrypted: Boolean
+        get() = level == ConnectionSecurityLevel.Tls || level == ConnectionSecurityLevel.Overlay
+
+    companion object {
+        val UNKNOWN = ConnectionSecurity(ConnectionSecurityLevel.Unknown, "", emptyList())
+    }
+}
+
+/** True when the URL scheme is TLS (`wss://` / `https://`). */
+fun isTlsUrl(url: String?): Boolean {
+    if (url.isNullOrBlank()) return false
+    val lower = url.trim().lowercase()
+    return lower.startsWith("wss://") || lower.startsWith("https://")
+}
+
+/**
+ * True when the active route is encrypted by an overlay network (Tailscale /
+ * WireGuard) or the plugin secure proxy, even if its scheme is plain. Mirrors
+ * the logic that previously lived privately in `ActiveConnectionSections`.
+ */
+fun EndpointCandidate?.isEncryptedOverlayRoute(isTailscaleDetected: Boolean): Boolean {
+    if (this == null) return false
+    val r = role.lowercase()
+    val hint = security.orEmpty().lowercase()
+    return r == "tailscale" ||
+        (isTailscaleDetected && hint.contains("tailscale")) ||
+        r == "plugin_proxy" ||
+        r == "plugin-proxy" ||
+        hasSecureProxy() ||
+        hint.contains("wireguard") ||
+        hint.contains("https") ||
+        hint.contains("tls")
+}
+
+/** Human label for the overlay mechanism encrypting a route. */
+fun EndpointCandidate?.overlayMechanism(isTailscaleDetected: Boolean): String {
+    if (this == null) return "Encrypted"
+    val r = role.lowercase()
+    val hint = security.orEmpty().lowercase()
+    return when {
+        r == "tailscale" || (isTailscaleDetected && hint.contains("tailscale")) -> "Tailscale"
+        r == "plugin_proxy" || r == "plugin-proxy" || hasSecureProxy() -> "Proxy"
+        hint.contains("wireguard") -> "WireGuard"
+        hint.contains("https") || hint.contains("tls") -> "TLS"
+        else -> "Encrypted"
+    }
+}
+
+/** Classify a single surface URL against the active route. */
+fun classifySurfaceSecurity(
+    label: String,
+    url: String,
+    activeEndpoint: EndpointCandidate?,
+    isTailscaleDetected: Boolean,
+): SurfaceSecurity {
+    val (kind, mechanism) = when {
+        isTlsUrl(url) -> SurfaceSecurityKind.Tls to "TLS"
+        activeEndpoint.isEncryptedOverlayRoute(isTailscaleDetected) ->
+            SurfaceSecurityKind.Overlay to activeEndpoint.overlayMechanism(isTailscaleDetected)
+        else -> SurfaceSecurityKind.Plain to "Plain"
+    }
+    return SurfaceSecurity(label = label, kind = kind, mechanism = mechanism, url = url)
+}
+
+/**
+ * Roll up the per-surface verdicts into one connection-level [ConnectionSecurity].
+ * Pure + side-effect free so it is unit-testable without Android.
+ */
+fun computeConnectionSecurity(
+    apiUrl: String,
+    dashboardUrl: String,
+    relayUrl: String,
+    relayConfigured: Boolean,
+    activeEndpoint: EndpointCandidate?,
+    isTailscaleDetected: Boolean,
+): ConnectionSecurity {
+    val surfaces = buildList {
+        dashboardUrl.trim().takeIf { it.isNotBlank() }?.let {
+            add(classifySurfaceSecurity("Chat & Manage", it, activeEndpoint, isTailscaleDetected))
+        }
+        apiUrl.trim().takeIf { it.isNotBlank() }?.let {
+            add(classifySurfaceSecurity("API / sessions", it, activeEndpoint, isTailscaleDetected))
+        }
+        if (relayConfigured) {
+            relayUrl.trim().takeIf { it.isNotBlank() }?.let {
+                add(classifySurfaceSecurity("Relay tools", it, activeEndpoint, isTailscaleDetected))
+            }
+        }
+    }
+    if (surfaces.isEmpty()) return ConnectionSecurity.UNKNOWN
+
+    val kinds = surfaces.map { it.kind }.toSet()
+    val hasPlain = SurfaceSecurityKind.Plain in kinds
+    val hasSecure = kinds.any { it != SurfaceSecurityKind.Plain }
+
+    val level = when {
+        !hasSecure -> ConnectionSecurityLevel.Plain
+        hasPlain -> ConnectionSecurityLevel.Mixed
+        kinds == setOf(SurfaceSecurityKind.Tls) -> ConnectionSecurityLevel.Tls
+        else -> ConnectionSecurityLevel.Overlay
+    }
+
+    val mechanism = when (level) {
+        ConnectionSecurityLevel.Tls -> "TLS"
+        ConnectionSecurityLevel.Overlay ->
+            surfaces.firstOrNull { it.kind == SurfaceSecurityKind.Overlay }?.mechanism ?: "Encrypted"
+        ConnectionSecurityLevel.Mixed -> "Mixed"
+        ConnectionSecurityLevel.Plain -> when (activeEndpoint?.role?.lowercase()) {
+            "lan" -> "LAN"
+            "public" -> "Public"
+            null, "" -> "Plain"
+            else -> activeEndpoint.role
+        }
+        ConnectionSecurityLevel.Unknown -> ""
+    }
+    return ConnectionSecurity(level = level, mechanism = mechanism, surfaces = surfaces)
+}
@@ -0,0 +1,164 @@
+package com.hermesandroid.relay.data
+
+/**
+ * Curated, offline sample conversation for **Demo mode** — the zero-setup,
+ * zero-network "Try the demo" path surfaced on the Connect screen.
+ *
+ * Why this exists: Hermes-Relay is a client for a *user-run* Hermes server, so
+ * a fresh install with no connection has nothing to show. Google Play review
+ * (and any curious first-run user) hits an empty Connect wall. Demo mode feeds
+ * this canned transcript through the **real** chat pipeline
+ * ([com.hermesandroid.relay.network.upstream.ChatHandler] →
+ * [com.hermesandroid.relay.viewmodel.ChatViewModel] → `ChatScreen`), so the app
+ * showcases streaming chat, Markdown, a tool-progress card, and a rich
+ * [HermesCard] without a single network call. See [DemoMode] for the state
+ * holder and `docs/play-store-listing.md` (App access) for the reviewer note.
+ *
+ * Content contract (keep it this way):
+ *  - **Obviously fictional, English, no real personal/server data** — public
+ *    repo hygiene. "Aurora Bay" is a made-up city; "Hermes" is the agent.
+ *  - **Fully self-contained / renders with zero network** — every message is
+ *    terminal (not streaming), every attachment is [AttachmentState.LOADED]
+ *    with no `relayToken` (which would trigger a relay fetch), and no inline
+ *    `http(s)` image needs to be fetched. The unit test asserts this.
+ *  - **Deterministic timestamps** ([DEMO_BASE_TIME] + offsets) so the demo
+ *    looks the same every launch and the content is unit-testable.
+ */
+object DemoContent {
+
+    /**
+     * Fixed base wall-clock for demo timestamps (≈ mid-2025). Constant rather
+     * than `System.currentTimeMillis()` so the transcript is deterministic and
+     * the unit tests don't flake on timing.
+     */
+    const val DEMO_BASE_TIME: Long = 1_750_000_000_000L
+
+    /** Stable session id for the demo conversation. */
+    const val DEMO_SESSION_ID: String = "demo-session"
+
+    /** Display name used on the assistant bubbles in the demo. */
+    const val DEMO_AGENT_NAME: String = "Hermes"
+
+    /**
+     * The canned conversation, oldest-first (the order `ChatScreen` renders).
+     * Two short exchanges: a capability tour that runs a tool and emits a rich
+     * card, then a quick "can you code?" follow-up showing a Markdown code
+     * block. 1–2 exchanges is enough to convey what the app does.
+     */
+    fun transcript(): List<ChatMessage> = listOf(
+        ChatMessage(
+            id = "demo-user-1",
+            role = MessageRole.USER,
+            content = "Hey Hermes — what can this app do? And what's the weather in Aurora Bay?",
+            timestamp = DEMO_BASE_TIME,
+            clientOnly = true,
+        ),
+        ChatMessage(
+            id = "demo-assistant-1",
+            role = MessageRole.ASSISTANT,
+            content = ASSISTANT_TOUR,
+            timestamp = DEMO_BASE_TIME + 3_000L,
+            agentName = DEMO_AGENT_NAME,
+            badges = listOf("Demo"),
+            toolCalls = listOf(
+                ToolCall(
+                    id = "demo-tool-1",
+                    name = "web_search",
+                    args = "{\"query\":\"weather in Aurora Bay today\"}",
+                    result = "Aurora Bay — 18°C, partly cloudy, wind 12 km/h NW.",
+                    success = true,
+                    isComplete = true,
+                    provenance = "demo",
+                    startedAt = DEMO_BASE_TIME + 800L,
+                    completedAt = DEMO_BASE_TIME + 2_300L,
+                ),
+            ),
+            cards = listOf(
+                HermesCard(
+                    type = HermesCard.BuiltInTypes.WEATHER,
+                    title = "Aurora Bay",
+                    subtitle = "Partly cloudy",
+                    accent = HermesCard.Accents.INFO,
+                    fields = listOf(
+                        HermesCardField("Now", "18°C · feels like 17°C"),
+                        HermesCardField("Wind", "12 km/h NW"),
+                        HermesCardField("Sunset", "8:42 PM"),
+                    ),
+                    footer = "Sample data — demo mode",
+                    id = "demo-weather",
+                ),
+            ),
+            clientOnly = true,
+        ),
+        ChatMessage(
+            id = "demo-user-2",
+            role = MessageRole.USER,
+            content = "Nice! Can you write code too?",
+            timestamp = DEMO_BASE_TIME + 9_000L,
+            clientOnly = true,
+        ),
+        ChatMessage(
+            id = "demo-assistant-2",
+            role = MessageRole.ASSISTANT,
+            content = ASSISTANT_CODE,
+            timestamp = DEMO_BASE_TIME + 12_000L,
+            agentName = DEMO_AGENT_NAME,
+            badges = listOf("Demo"),
+            clientOnly = true,
+        ),
+    )
+
+    /**
+     * Assistant reply appended when the user sends a message INSIDE demo
+     * mode. The composer must not be a silent no-op (it reads as broken —
+     * see the demo-polish TODO), but there is no server to answer, so the
+     * "reply" is an honest notice pointing at the exit path. Same content
+     * contract as the transcript: clientOnly, terminal, zero network.
+     *
+     * @param id unique message id supplied by the caller (UUID-based; two
+     *   rapid sends must not collide on LazyColumn keys).
+     * @param nowMs wall-clock timestamp for the bubble.
+     */
+    fun composerReply(id: String, nowMs: Long): ChatMessage = ChatMessage(
+        id = id,
+        role = MessageRole.ASSISTANT,
+        content = COMPOSER_REPLY,
+        timestamp = nowMs,
+        agentName = DEMO_AGENT_NAME,
+        badges = listOf("Demo"),
+        clientOnly = true,
+    )
+
+    // --- Message bodies (Markdown). Kept as constants so the content is easy
+    // to scan and the [transcript] builder stays readable. ---
+
+    private val COMPOSER_REPLY: String = """
+        This is the offline demo, so I can't answer for real — nothing here talks to a server.
+
+        Connect your own Hermes server to chat live: tap **Connect** in the demo banner above.
+    """.trimIndent()
+
+    private val ASSISTANT_TOUR: String = """
+        I'm **Hermes**, the agent running on *your* server. Here's a quick tour of what this app surfaces:
+
+        - **Live streaming chat** with Markdown, code blocks, and reasoning
+        - **Tool calls** rendered as progress cards — watch me work in real time
+        - **Rich cards** for structured results like the one below
+        - Optional **Terminal**, **Bridge**, and **Voice** once you connect a server
+
+        I just looked up the forecast for you:
+    """.trimIndent()
+
+    private val ASSISTANT_CODE: String = """
+        Absolutely — code blocks render with syntax-aware styling. For example:
+
+        ```kotlin
+        fun greet(name: String): String = "Hello, ${'$'}name!"
+
+        println(greet("Aurora Bay"))
+        // -> Hello, Aurora Bay!
+        ```
+
+        Connect your Hermes server to chat for real, run tools, and pick up where this demo leaves off.
+    """.trimIndent()
+}
@@ -0,0 +1,48 @@
+package com.hermesandroid.relay.data
+
+import kotlinx.coroutines.flow.MutableStateFlow
+import kotlinx.coroutines.flow.StateFlow
+import kotlinx.coroutines.flow.asStateFlow
+
+/**
+ * Offline **Demo / Explore mode** state holder.
+ *
+ * Plain Kotlin (no Android, no network, no coroutines side-effects) so it can
+ * be unit-tested on the pure JVM and owned by the Activity-scoped
+ * [com.hermesandroid.relay.viewmodel.ConnectionViewModel] without dragging
+ * framework dependencies into the demo path. The ViewModel delegates
+ * `isDemoMode` to [active] and pushes [transcript] into the real `ChatHandler`
+ * so the canned conversation renders through the production chat UI.
+ *
+ * Lifecycle: [enter] flips [active] true and loads the canned [DemoContent]
+ * transcript; [exit] flips it false and clears the transcript. Entering demo
+ * must **never** mark onboarding complete or start a connection — the
+ * ViewModel's network entry points early-return while [active] is true (see
+ * `reconnectIfStale` / `revalidate` / `connectRelay`).
+ *
+ * @param transcriptFactory source of the demo transcript. Defaults to
+ *   [DemoContent.transcript]; overridable in tests.
+ */
+class DemoMode(
+    private val transcriptFactory: () -> List<ChatMessage> = DemoContent::transcript,
+) {
+    private val _active = MutableStateFlow(false)
+    /** True while the offline demo is active. Drives the banner + network gates. */
+    val active: StateFlow<Boolean> = _active.asStateFlow()
+
+    private val _transcript = MutableStateFlow<List<ChatMessage>>(emptyList())
+    /** The canned conversation while [active]; empty otherwise. */
+    val transcript: StateFlow<List<ChatMessage>> = _transcript.asStateFlow()
+
+    /** Enter demo: load the canned transcript, then mark active. Idempotent. */
+    fun enter() {
+        _transcript.value = transcriptFactory()
+        _active.value = true
+    }
+
+    /** Exit demo: clear active, then drop the transcript. Idempotent. */
+    fun exit() {
+        _active.value = false
+        _transcript.value = emptyList()
+    }
+}
@@ -5,7 +5,7 @@ import androidx.datastore.preferences.core.booleanPreferencesKey
 import androidx.datastore.preferences.core.edit

 /**
- * Single source of truth for the opt-in "keep the gateway chat connection
+ * Single source of truth for the opt-in "keep the app's connection to Hermes
 * alive in the background" preference. Off by default.
 *
 * Shared by [com.hermesandroid.relay.viewmodel.ConnectionViewModel] (the
@@ -246,4 +246,9 @@ data class HermesCardDispatch(
     * passes.
     */
    val syncedToServer: Boolean = false,
-)
+) {
+    companion object {
+        /** Local-only stamp used when Hermes expires an interactive ask. */
+        const val EXPIRED_STAMP = "expired"
+    }
+}
@@ -0,0 +1,69 @@
+package com.hermesandroid.relay.data
+
+/**
+ * A process event that upstream Hermes injected into transcript history as a
+ * synthetic user message.
+ *
+ * Hermes intentionally persists these events with role=user so the agent can
+ * react to them without breaking message-role alternation. UI code should use
+ * [ChatMessage.hermesProcessNotificationOrNull] to present them as process
+ * notices without changing their canonical role or content.
+ */
+data class HermesProcessNotification(
+    val processId: String,
+    val headline: String,
+    val detail: String?,
+)
+
+/**
+ * Recognizes the exact envelope emitted by upstream
+ * `tools.process_registry.format_process_notification` for background-process
+ * completion and watch events.
+ *
+ * The parser deliberately excludes other `[IMPORTANT: ...]` messages. Those
+ * can carry unrelated agent instructions and must continue through the normal
+ * transcript renderer.
+ */
+object HermesProcessNotificationParser {
+    private const val ENVELOPE_PREFIX = "[IMPORTANT: Background process "
+    private const val HEADLINE_PREFIX = "Background process "
+
+    fun parse(content: String): HermesProcessNotification? {
+        val normalized = content.trim()
+        if (!normalized.startsWith(ENVELOPE_PREFIX) || !normalized.endsWith(']')) {
+            return null
+        }
+
+        val body = normalized
+            .removePrefix("[IMPORTANT: ")
+            .dropLast(1)
+        val headline = body.substringBefore('\n').trim()
+        if (!headline.startsWith(HEADLINE_PREFIX)) return null
+
+        val identityAndStatus = headline.removePrefix(HEADLINE_PREFIX)
+        val processId = identityAndStatus.substringBefore(' ')
+        val status = identityAndStatus.substringAfter(' ', missingDelimiterValue = "")
+        if (processId.isBlank() || status.isBlank()) return null
+
+        val detail = body
+            .substringAfter('\n', missingDelimiterValue = "")
+            .trim()
+            .ifBlank { null }
+
+        return HermesProcessNotification(
+            processId = processId,
+            headline = headline,
+            detail = detail,
+        )
+    }
+}
+
+/**
+ * Returns the upstream process-notification presentation model only for the
+ * canonical synthetic user-row shape. The original [ChatMessage.role] remains
+ * [MessageRole.USER].
+ */
+fun ChatMessage.hermesProcessNotificationOrNull(): HermesProcessNotification? =
+    takeIf { it.role == MessageRole.USER }
+        ?.content
+        ?.let(HermesProcessNotificationParser::parse)
@@ -0,0 +1,84 @@
+package com.hermesandroid.relay.data
+
+import android.content.Context
+import androidx.datastore.core.DataStore
+import androidx.datastore.preferences.core.Preferences
+import androidx.datastore.preferences.core.edit
+import androidx.datastore.preferences.core.stringPreferencesKey
+import androidx.datastore.preferences.preferencesDataStore
+import kotlinx.coroutines.flow.Flow
+import kotlinx.coroutines.flow.map
+import kotlinx.serialization.Serializable
+import kotlinx.serialization.decodeFromString
+import kotlinx.serialization.encodeToString
+import kotlinx.serialization.json.Json
+
+/**
+ * One agent-initiated message as persisted in the Hermes inbox.
+ *
+ * Deliberately separate from the wire model
+ * ([com.hermesandroid.relay.network.relay.ProactiveMessage]) so the on-disk
+ * shape doesn't track protocol changes — only the user-facing fields persist.
+ */
+@Serializable
+data class ProactiveInboxEntry(
+    val id: String,
+    val title: String,
+    val text: String,
+    /** Epoch millis the message was received (server `sent_at` when present). */
+    val receivedAt: Long,
+    /**
+     * Conversation the message belongs to (server `chat_id`). Carried so an
+     * inbox reply (Phase 2c) continues the same thread. Nullable + defaulted
+     * so blobs persisted before 2c still decode (kotlinx tolerates the absent
+     * field).
+     */
+    val chatId: String? = null,
+)
+
+private val Context.proactiveInboxStore: DataStore<Preferences> by
+    preferencesDataStore(name = "proactive_inbox")
+
+private val INBOX_JSON = stringPreferencesKey("entries_json")
+
+/** Bound the inbox so a chatty agent can't grow the on-disk blob without limit. */
+private const val MAX_ENTRIES = 100
+
+/**
+ * DataStore-backed durable log of agent-initiated messages. Entries are kept
+ * newest-first, deduped by id (so a re-delivered message doesn't double up), and
+ * capped at [MAX_ENTRIES]. Survives app restart.
+ *
+ * Demoted (2026-06-29): the agent conversation now lives as a Thread in Chat (the
+ * gateway session is the durable history), so the in-app inbox view is retired.
+ * This store is only fed for messages NOT shown in an open Thread; it currently
+ * has no viewer and is fully retireable — see TODO.
+ */
+class ProactiveInboxRepository(private val context: Context) {
+
+    private val json = Json { ignoreUnknownKeys = true }
+
+    val entries: Flow<List<ProactiveInboxEntry>> =
+        context.proactiveInboxStore.data.map { prefs -> decode(prefs[INBOX_JSON]) }
+
+    suspend fun add(entry: ProactiveInboxEntry) {
+        context.proactiveInboxStore.edit { prefs ->
+            val current = decode(prefs[INBOX_JSON]).toMutableList()
+            current.removeAll { it.id == entry.id }
+            current.add(0, entry)
+            while (current.size > MAX_ENTRIES) current.removeAt(current.lastIndex)
+            prefs[INBOX_JSON] = json.encodeToString(current.toList())
+        }
+    }
+
+    suspend fun clear() {
+        context.proactiveInboxStore.edit { it.remove(INBOX_JSON) }
+    }
+
+    private fun decode(raw: String?): List<ProactiveInboxEntry> {
+        if (raw.isNullOrBlank()) return emptyList()
+        return runCatching {
+            json.decodeFromString<List<ProactiveInboxEntry>>(raw)
+        }.getOrDefault(emptyList())
+    }
+}
@@ -0,0 +1,33 @@
+package com.hermesandroid.relay.data
+
+import android.content.Context
+import androidx.datastore.preferences.core.booleanPreferencesKey
+import androidx.datastore.preferences.core.edit
+import kotlinx.coroutines.flow.Flow
+import kotlinx.coroutines.flow.map
+
+/**
+ * "Let Hermes message me" — the off-by-default opt-in that lets the agent
+ * proactively push messages to this phone (the `phone` Hermes platform).
+ *
+ * This is the app half of a two-sided gate: the server-side adapter is gated
+ * on `PHONE_ENABLED`, and the relay can only push when the app has sent
+ * `proactive.subscribe` — which the app only does when this flag is on. So
+ * nothing is delivered unless BOTH sides opt in.
+ *
+ * Shared by [com.hermesandroid.relay.viewmodel.ConnectionViewModel] (the
+ * StateFlow + subscribe/unsubscribe wiring) and the Settings switch that
+ * flips it. Phase 3 expands this into a fuller `ProactivePreferences`
+ * (quiet hours, per-profile scope, rate limiting); the enablement flag is
+ * the foundational gate and lives here next to the other shared pref keys.
+ */
+val KEY_PROACTIVE_ENABLED = booleanPreferencesKey("proactive_messages_enabled")
+
+/** Persist the "Let Hermes message me" preference. */
+suspend fun Context.setProactiveEnabled(enabled: Boolean) {
+    relayDataStore.edit { it[KEY_PROACTIVE_ENABLED] = enabled }
+}
+
+/** Reactive read of the enablement flag — defaults to false (off). */
+fun Context.proactiveEnabledFlow(): Flow<Boolean> =
+    relayDataStore.data.map { it[KEY_PROACTIVE_ENABLED] ?: false }
@@ -0,0 +1,21 @@
+package com.hermesandroid.relay.data
+
+/** User-facing availability of one Hermes profile from this connection. */
+enum class ProfilePresence {
+    /** Its dedicated gateway is running, so channels and proactive work can stay reachable. */
+    ONLINE,
+
+    /** The host can create/resume profile-bound sessions on demand, but no profile gateway is running. */
+    AVAILABLE,
+
+    /** The host/profile cannot currently be reached from this connection. */
+    OFFLINE,
+}
+
+object ProfilePresenceResolver {
+    fun resolve(profile: Profile, hostReachable: Boolean = true): ProfilePresence = when {
+        !hostReachable -> ProfilePresence.OFFLINE
+        profile.gatewayRunning -> ProfilePresence.ONLINE
+        else -> ProfilePresence.AVAILABLE
+    }
+}
@@ -0,0 +1,99 @@
+package com.hermesandroid.relay.data
+
+import android.content.Context
+import androidx.datastore.core.DataStore
+import androidx.datastore.preferences.core.Preferences
+import androidx.datastore.preferences.core.edit
+import androidx.datastore.preferences.core.stringPreferencesKey
+import androidx.datastore.preferences.preferencesDataStore
+import kotlinx.coroutines.flow.Flow
+import kotlinx.coroutines.flow.map
+import kotlinx.serialization.builtins.ListSerializer
+import kotlinx.serialization.builtins.serializer
+import kotlinx.serialization.json.Json
+
+/** Per-connection local display preferences for the profile picker. */
+data class ProfilePresentation(
+    val order: List<String> = emptyList(),
+    val hidden: Set<String> = emptySet(),
+)
+
+/**
+ * Applies saved presentation preferences without changing the server profile catalog.
+ * Unknown saved names are dropped and newly-discovered profiles append in server order.
+ */
+object ProfilePresentationPolicy {
+    fun availableKeys(profiles: List<Profile>): List<String> = buildList {
+        add(AgentDisplay.SERVER_DEFAULT_PROFILE_KEY)
+        profiles.asSequence()
+            .filterNot { AgentDisplay.isServerDefaultAlias(it.name) }
+            .map(Profile::name)
+            .distinct()
+            .forEach(::add)
+    }
+
+    fun orderedKeys(
+        profiles: List<Profile>,
+        presentation: ProfilePresentation,
+    ): List<String> {
+        val available = availableKeys(profiles)
+        val availableSet = available.toSet()
+        return presentation.order.filter { it in availableSet }.distinct() +
+            available.filterNot(presentation.order.toSet()::contains)
+    }
+
+    fun visibleKeys(
+        profiles: List<Profile>,
+        presentation: ProfilePresentation,
+        selectedKey: String,
+    ): List<String> = orderedKeys(profiles, presentation).filter { key ->
+        key == selectedKey || key !in presentation.hidden
+    }
+}
+
+class ProfilePresentationStore(
+    private val dataStore: DataStore<Preferences>,
+) {
+    constructor(context: Context) : this(context.profilePresentationDataStore)
+
+    private val json = Json { ignoreUnknownKeys = true }
+    private val listSerializer = ListSerializer(String.serializer())
+
+    private fun orderKey(connectionId: String) = stringPreferencesKey("order_$connectionId")
+    private fun hiddenKey(connectionId: String) = stringPreferencesKey("hidden_$connectionId")
+
+    fun presentationFlow(connectionId: String): Flow<ProfilePresentation> = dataStore.data.map { prefs ->
+        ProfilePresentation(
+            order = decode(prefs[orderKey(connectionId)]),
+            hidden = decode(prefs[hiddenKey(connectionId)]).toSet(),
+        )
+    }
+
+    suspend fun setOrder(connectionId: String, order: List<String>) {
+        dataStore.edit { it[orderKey(connectionId)] = json.encodeToString(listSerializer, order.distinct()) }
+    }
+
+    suspend fun setHidden(connectionId: String, hidden: Set<String>) {
+        dataStore.edit { it[hiddenKey(connectionId)] = json.encodeToString(listSerializer, hidden.sorted()) }
+    }
+
+    suspend fun clear(connectionId: String) {
+        dataStore.edit {
+            it.remove(orderKey(connectionId))
+            it.remove(hiddenKey(connectionId))
+        }
+    }
+
+    suspend fun clearAll() {
+        dataStore.edit { it.clear() }
+    }
+
+    private fun decode(raw: String?): List<String> = if (raw == null) {
+        emptyList()
+    } else {
+        runCatching { json.decodeFromString(listSerializer, raw) }.getOrDefault(emptyList())
+    }
+}
+
+internal val Context.profilePresentationDataStore: DataStore<Preferences>
+        by preferencesDataStore(name = "profile_presentation")
@@ -0,0 +1,36 @@
+package com.hermesandroid.relay.data
+
+import android.content.Context
+import androidx.datastore.preferences.core.edit
+import androidx.datastore.preferences.core.stringSetPreferencesKey
+import androidx.datastore.preferences.preferencesDataStore
+import kotlinx.coroutines.flow.Flow
+import kotlinx.coroutines.flow.map
+
+private val Context.sessionSourceDataStore by preferencesDataStore(name = "session_sources")
+private val KEY_HIDDEN = stringSetPreferencesKey("hidden_sources")
+
+/**
+ * Session `source`s hidden from the drawer by default — the agent's noisiest
+ * automation lanes. Everything else (your chats, Threads, discord, telegram, …)
+ * shows. The user can hide/reveal more from the drawer source filter or Chat
+ * settings; both edit the same persisted set.
+ */
+val DEFAULT_HIDDEN_SOURCES = setOf("cron", "webhook")
+
+/** DataStore for which gateway sources the drawer hides. */
+class SessionSourcePrefs(private val context: Context) {
+
+    val hiddenSources: Flow<Set<String>> = context.sessionSourceDataStore.data.map { prefs ->
+        prefs[KEY_HIDDEN] ?: DEFAULT_HIDDEN_SOURCES
+    }
+
+    suspend fun setHidden(source: String, hidden: Boolean) {
+        val key = source.trim().lowercase()
+        if (key.isBlank()) return
+        context.sessionSourceDataStore.edit { prefs ->
+            val cur = prefs[KEY_HIDDEN] ?: DEFAULT_HIDDEN_SOURCES
+            prefs[KEY_HIDDEN] = if (hidden) cur + key else cur - key
+        }
+    }
+}
@@ -0,0 +1,43 @@
+package com.hermesandroid.relay.data
+
+import android.content.Context
+import androidx.datastore.preferences.core.edit
+import androidx.datastore.preferences.core.stringPreferencesKey
+import androidx.datastore.preferences.preferencesDataStore
+import kotlinx.coroutines.flow.Flow
+import kotlinx.coroutines.flow.map
+import kotlinx.serialization.builtins.MapSerializer
+import kotlinx.serialization.builtins.serializer
+import kotlinx.serialization.json.Json
+
+private val Context.threadNameDataStore by preferencesDataStore(name = "thread_names")
+private val KEY_NAMES = stringPreferencesKey("names_json")
+
+/**
+ * Persists user-chosen agent **Thread** names (`sessionId` → name) so a named
+ * Thread keeps its name across app restarts — the user's name is authoritative
+ * (Discord-style), overriding the gateway's async auto-title which would
+ * otherwise clobber it. Applied to the drawer via
+ * [com.hermesandroid.relay.network.upstream.ChatHandler.setUserThreadNames].
+ */
+class ThreadNameStore(private val context: Context) {
+
+    private val json = Json { ignoreUnknownKeys = true }
+    private val ser = MapSerializer(String.serializer(), String.serializer())
+
+    private fun decode(raw: String?): Map<String, String> =
+        raw?.let { runCatching { json.decodeFromString(ser, it) }.getOrNull() } ?: emptyMap()
+
+    val names: Flow<Map<String, String>> = context.threadNameDataStore.data.map { prefs ->
+        decode(prefs[KEY_NAMES])
+    }
+
+    suspend fun setName(sessionId: String, name: String) {
+        val id = sessionId.trim()
+        val value = name.trim()
+        if (id.isBlank() || value.isBlank()) return
+        context.threadNameDataStore.edit { prefs ->
+            prefs[KEY_NAMES] = json.encodeToString(ser, decode(prefs[KEY_NAMES]) + (id to value))
+        }
+    }
+}
@@ -0,0 +1,191 @@
+package com.hermesandroid.relay.data
+
+/**
+ * One-tap bundles over voice settings that already exist in the app and relay.
+ *
+ * Presets intentionally do not own voice identity or routing: engine, audio
+ * route, provider, model, voice, enhanced-voice overrides, and background-run
+ * concurrency all remain exactly as the user configured them. A preset only
+ * coordinates interaction ergonomics, barge-in, Realtime trace/session
+ * behavior, and the existing ADR 33 background-delivery controls.
+ */
+enum class VoiceModePreset(
+    val displayName: String,
+    val shortLabel: String,
+    val description: String,
+    internal val localSettings: VoicePresetLocalSettings,
+    internal val bargeInUpdate: VoicePresetBargeInUpdate,
+    val promotionUpdate: VoicePresetPromotionUpdate,
+) {
+    HandsFree(
+        displayName = "Hands-free",
+        shortLabel = "Hands-free",
+        description =
+            "Continuous listening, exact answers, detailed trace, and low-noise " +
+                "spoken progress after 15 seconds. Your barge-in choice is preserved.",
+        localSettings = VoicePresetLocalSettings(
+            interactionMode = "continuous",
+            silenceThresholdMs = 1250L,
+            realtimeTraceDetails = true,
+            realtimePersistentSession = true,
+        ),
+        // Barge-in remains an explicit experimental opt-in until echo and
+        // self-recording hardening is complete. Never enable it via a preset.
+        bargeInUpdate = VoicePresetBargeInUpdate(),
+        promotionUpdate = VoicePresetPromotionUpdate(
+            enabled = true,
+            promoteAfterMs = 6000,
+            backgroundDefaultMode = "promote",
+            spokenHandoff = true,
+            progressSpokenAfterMs = 15000,
+            progressRepeatMs = 90000,
+            resultDelivery = "speak_verbatim",
+        ),
+    ),
+    LowLatency(
+        displayName = "Low latency",
+        shortLabel = "Fast",
+        description =
+            "Tap capture, the shortest supported silence window, a persistent " +
+                "session, and a fast visual handoff for long work.",
+        localSettings = VoicePresetLocalSettings(
+            interactionMode = "tap",
+            silenceThresholdMs = 750L,
+            realtimeTraceDetails = false,
+            realtimePersistentSession = true,
+        ),
+        bargeInUpdate = VoicePresetBargeInUpdate(enabled = false),
+        promotionUpdate = VoicePresetPromotionUpdate(
+            enabled = true,
+            promoteAfterMs = 2500,
+            backgroundDefaultMode = "promote",
+            spokenHandoff = false,
+            progressSpokenAfterMs = 0,
+            resultDelivery = "speak_when_idle",
+        ),
+    ),
+    CarefulTools(
+        displayName = "Careful tools",
+        shortLabel = "Careful",
+        description =
+            "Hold-to-talk, uninterrupted foreground tool runs, a detailed trace, and exact result delivery.",
+        localSettings = VoicePresetLocalSettings(
+            interactionMode = "hold",
+            silenceThresholdMs = 1750L,
+            realtimeTraceDetails = true,
+            realtimePersistentSession = true,
+        ),
+        bargeInUpdate = VoicePresetBargeInUpdate(enabled = false),
+        promotionUpdate = VoicePresetPromotionUpdate(
+            enabled = false,
+            backgroundDefaultMode = "foreground",
+            spokenHandoff = false,
+            progressSpokenAfterMs = 0,
+            resultDelivery = "speak_verbatim",
+        ),
+    ),
+    QuietVisualOnly(
+        displayName = "Quiet / visual-only",
+        shortLabel = "Quiet",
+        description =
+            "Manual capture with visual long-task handoffs and results. Normal short voice replies still speak.",
+        localSettings = VoicePresetLocalSettings(
+            interactionMode = "tap",
+            silenceThresholdMs = 1250L,
+            realtimeTraceDetails = true,
+            realtimePersistentSession = true,
+        ),
+        bargeInUpdate = VoicePresetBargeInUpdate(enabled = false),
+        promotionUpdate = VoicePresetPromotionUpdate(
+            enabled = true,
+            promoteAfterMs = 6000,
+            backgroundDefaultMode = "promote",
+            spokenHandoff = false,
+            progressSpokenAfterMs = 0,
+            resultDelivery = "visual_only",
+        ),
+    );
+
+    /** Apply only fields owned by this preset; every other value is preserved. */
+    fun applyTo(current: VoiceModePresetState): VoiceModePresetState =
+        current.copy(
+            voiceSettings = current.voiceSettings.copy(
+                interactionMode = localSettings.interactionMode,
+                silenceThresholdMs = localSettings.silenceThresholdMs,
+                realtimeTraceDetails = localSettings.realtimeTraceDetails,
+                realtimePersistentSession = localSettings.realtimePersistentSession,
+            ),
+            bargeInPreferences = current.bargeInPreferences.copy(
+                enabled = bargeInUpdate.enabled ?: current.bargeInPreferences.enabled,
+                sensitivity =
+                    bargeInUpdate.sensitivity ?: current.bargeInPreferences.sensitivity,
+                resumeAfterInterruption = bargeInUpdate.resumeAfterInterruption
+                    ?: current.bargeInPreferences.resumeAfterInterruption,
+            ),
+            promotion = current.promotion?.let(promotionUpdate::applyTo),
+        )
+
+    /** A preset is active only when every field it owns still matches. */
+    fun matches(current: VoiceModePresetState): Boolean =
+        current.promotion != null && applyTo(current) == current
+}
+
+/** Snapshot used by the pure preset reducer and active-preset detector. */
+data class VoiceModePresetState(
+    val voiceSettings: VoiceSettings,
+    val bargeInPreferences: BargeInPreferences,
+    val promotion: VoicePresetPromotionSettings?,
+)
+
+/** Relay promotion values mirrored without introducing a data -> network dependency. */
+data class VoicePresetPromotionSettings(
+    val enabled: Boolean = true,
+    val promoteAfterMs: Int = 6000,
+    val backgroundDefaultMode: String = "promote",
+    val spokenHandoff: Boolean = true,
+    val progressSpokenAfterMs: Int = 0,
+    val progressRepeatMs: Int = 90000,
+    val resultDelivery: String = "speak_verbatim",
+    val maxBackgroundRuns: Int = 1,
+)
+
+/** Nullable fields map directly to RelayVoiceClient's partial PATCH contract. */
+data class VoicePresetPromotionUpdate(
+    val enabled: Boolean? = null,
+    val promoteAfterMs: Int? = null,
+    val backgroundDefaultMode: String? = null,
+    val spokenHandoff: Boolean? = null,
+    val progressSpokenAfterMs: Int? = null,
+    val progressRepeatMs: Int? = null,
+    val resultDelivery: String? = null,
+    val maxBackgroundRuns: Int? = null,
+) {
+    internal fun applyTo(current: VoicePresetPromotionSettings): VoicePresetPromotionSettings =
+        current.copy(
+            enabled = enabled ?: current.enabled,
+            promoteAfterMs = promoteAfterMs ?: current.promoteAfterMs,
+            backgroundDefaultMode = backgroundDefaultMode ?: current.backgroundDefaultMode,
+            spokenHandoff = spokenHandoff ?: current.spokenHandoff,
+            progressSpokenAfterMs = progressSpokenAfterMs ?: current.progressSpokenAfterMs,
+            progressRepeatMs = progressRepeatMs ?: current.progressRepeatMs,
+            resultDelivery = resultDelivery ?: current.resultDelivery,
+            maxBackgroundRuns = maxBackgroundRuns ?: current.maxBackgroundRuns,
+        )
+}
+
+internal data class VoicePresetLocalSettings(
+    val interactionMode: String,
+    val silenceThresholdMs: Long,
+    val realtimeTraceDetails: Boolean,
+    val realtimePersistentSession: Boolean,
+)
+
+internal data class VoicePresetBargeInUpdate(
+    val enabled: Boolean? = null,
+    val sensitivity: BargeInSensitivity? = null,
+    val resumeAfterInterruption: Boolean? = null,
+)
+
+/** Null means the current manual values are Custom. */
+fun detectVoiceModePreset(current: VoiceModePresetState): VoiceModePreset? =
+    VoiceModePreset.entries.firstOrNull { it.matches(current) }
@@ -19,19 +19,23 @@ import kotlinx.coroutines.flow.distinctUntilChanged
 *
 * - [interactionMode] how the mic button behaves: "tap" | "hold" | "continuous".
 *   Drives the VoiceViewModel's InteractionMode enum at startup.
- * - [silenceThresholdMs] auto-stop threshold for listening: after this many
- *   ms of amplitude below the silence floor, stopListening() is called.
- * - [autoTts] future — read TTS on every non-voice assistant message.
- * - [language] STT language hint. Stored; not yet wired to /voice/transcribe
- *   (V1 doesn't accept a language param).
+ * - [silenceThresholdMs] end-of-speech threshold for listening: after this many
+ *   ms of amplitude below the silence floor (once speech has been heard),
+ *   stopListening() is called. Default 1250 ms matches hermes-desktop
+ *   voice_mode `silenceMs`. (Idle/no-speech 12 s and a 60 s hard turn cap are
+ *   fixed in VoiceViewModel, not user-tunable — see startSilenceWatchdog.)
+ *
+ * Note: the standard path has no client-side auto-TTS or STT-language pref.
+ * hermes-desktop only speaks responses during an active voice conversation
+ * (no "read every typed message"), and STT language is a server-side
+ * `stt.*.language` config edited via the Server voice config card, not a
+ * client param — so neither is faked here.
 */
 data class VoiceSettings(
    val engineMode: String = VoiceEngineMode.HermesVoiceOutput.storageValue,
    val audioRoute: String = VoiceAudioRoute.Auto.storageValue,
    val interactionMode: String = "tap",
-    val silenceThresholdMs: Long = 3000L,
-    val autoTts: Boolean = false,
-    val language: String = "",
+    val silenceThresholdMs: Long = 1250L,
    val realtimeTraceDetails: Boolean = false,
    /**
     * When true (default), Realtime Agent keeps one provider session/socket open
@@ -40,6 +44,9 @@ data class VoiceSettings(
     * docs/plans/2026-05-24-realtime-persistent-session.md.
     */
    val realtimePersistentSession: Boolean = true,
+    /** Per-profile Realtime Agent session overrides; blank uses relay config. */
+    val realtimeModel: String = "",
+    val realtimeVoice: String = "",
    /**
     * Enhanced-voice overrides for the relay TTS path, mapped onto the active
     * provider (Gemini / xAI). Empty string / false means "use the server's
@@ -150,9 +157,9 @@ class VoicePreferencesRepository(private val dataStore: DataStore<Preferences>)
        // over the hard default — see [scopedName] / [resolveString].
        //
        // Why these are per-profile: engine mode, audio route, and the
-        // enhanced-voice overrides describe *which voice the agent speaks
-        // with*, which is a property of the profile (the relay already
-        // persists `voice_output:`/`realtime_voice:` per profile and
+        // enhanced-voice and realtime-session overrides describe *which voice
+        // the agent speaks with*, which is a property of the profile (the relay
+        // already persists `voice_output:`/`realtime_voice:` per profile and
        // `RelayVoiceClient` already sends `?profile=`). Keeping them global
        // leaked one profile's voice onto every other profile.
        private const val KEY_ENGINE_MODE = "voice_engine_mode"
@@ -162,20 +169,19 @@ class VoicePreferencesRepository(private val dataStore: DataStore<Preferences>)
        private const val KEY_ENH_AUDIO_TAGS = "voice_enh_audio_tags"
        private const val KEY_ENH_PERSONA = "voice_enh_persona"
        private const val KEY_ENH_LANGUAGE = "voice_enh_language"
+        private const val KEY_REALTIME_MODEL = "voice_realtime_model"
+        private const val KEY_REALTIME_VOICE = "voice_realtime_voice"

        // --- Global keys (shared across profiles; never namespaced) ----------
        // Why these stay global: interaction-mode and silence-threshold are
        // ergonomic input preferences about *how the user drives the mic*, not
        // about the agent's voice — a user wants the same tap/hold/continuous
-        // habit regardless of which profile is active. auto-tts and the STT
-        // language hint are dead/experimental controls today, and the two
-        // realtime diagnostic toggles (trace details, persistent session) are
+        // habit regardless of which profile is active. The two realtime
+        // diagnostic toggles (trace details, persistent session) are
        // engine-behaviour switches that aren't profile-specific. Keeping them
        // un-namespaced means switching profiles never churns these.
        private val KEY_INTERACTION_MODE = stringPreferencesKey("voice_interaction_mode")
        private val KEY_SILENCE_THRESHOLD_MS = longPreferencesKey("voice_silence_threshold_ms")
-        private val KEY_AUTO_TTS = booleanPreferencesKey("voice_auto_tts")
-        private val KEY_LANGUAGE = stringPreferencesKey("voice_language")
        private val KEY_REALTIME_TRACE_DETAILS = booleanPreferencesKey("voice_realtime_trace_details")
        private val KEY_REALTIME_PERSISTENT_SESSION =
            booleanPreferencesKey("voice_realtime_persistent_session")
@@ -183,9 +189,8 @@ class VoicePreferencesRepository(private val dataStore: DataStore<Preferences>)
        const val DEFAULT_ENGINE_MODE = "hermes_voice_output"
        const val DEFAULT_AUDIO_ROUTE = "auto"
        const val DEFAULT_INTERACTION_MODE = "tap"
-        const val DEFAULT_SILENCE_THRESHOLD_MS = 3000L
-        const val DEFAULT_AUTO_TTS = false
-        const val DEFAULT_LANGUAGE = ""
+        // 1250 ms matches hermes-desktop voice_mode `silenceMs` end-of-speech.
+        const val DEFAULT_SILENCE_THRESHOLD_MS = 1250L
        const val DEFAULT_REALTIME_TRACE_DETAILS = false
        const val DEFAULT_REALTIME_PERSISTENT_SESSION = true

@@ -214,8 +219,8 @@ class VoicePreferencesRepository(private val dataStore: DataStore<Preferences>)

    /**
     * Point the repository at a (connection, profile) scope. Per-profile reads
-     * and writes (engine/route/enhanced) re-target the namespaced keys for that
-     * profile; global prefs are unaffected. Passing a null/blank profile name
+     * and writes (engine/route/enhanced/realtime) re-target the namespaced keys
+     * for that profile; global prefs are unaffected. Passing a null/blank profile name
     * reverts per-profile reads/writes to the global base layer (the default
     * profile). Idempotent — a no-op when the normalized scope is unchanged.
     */
@@ -248,11 +253,11 @@ class VoicePreferencesRepository(private val dataStore: DataStore<Preferences>)
            enhancedAudioTags = resolveBoolean(prefs, KEY_ENH_AUDIO_TAGS, scope, false),
            enhancedPersona = resolveString(prefs, KEY_ENH_PERSONA, scope, ""),
            enhancedLanguage = resolveString(prefs, KEY_ENH_LANGUAGE, scope, ""),
+            realtimeModel = resolveString(prefs, KEY_REALTIME_MODEL, scope, ""),
+            realtimeVoice = resolveString(prefs, KEY_REALTIME_VOICE, scope, ""),
            // --- global (shared across profiles) ---
            interactionMode = prefs[KEY_INTERACTION_MODE] ?: DEFAULT_INTERACTION_MODE,
            silenceThresholdMs = prefs[KEY_SILENCE_THRESHOLD_MS] ?: DEFAULT_SILENCE_THRESHOLD_MS,
-            autoTts = prefs[KEY_AUTO_TTS] ?: DEFAULT_AUTO_TTS,
-            language = prefs[KEY_LANGUAGE] ?: DEFAULT_LANGUAGE,
            realtimeTraceDetails = prefs[KEY_REALTIME_TRACE_DETAILS]
                ?: DEFAULT_REALTIME_TRACE_DETAILS,
            realtimePersistentSession = prefs[KEY_REALTIME_PERSISTENT_SESSION]
@@ -329,6 +334,29 @@ class VoicePreferencesRepository(private val dataStore: DataStore<Preferences>)
        dataStore.edit { it[key] = language.trim() }
    }

+    /** "" clears the override so new sessions use the relay's saved model. */
+    suspend fun setRealtimeModel(model: String) {
+        val key = stringPreferencesKey(scopedName(KEY_REALTIME_MODEL, _scope.value))
+        dataStore.edit { it[key] = model.trim() }
+    }
+
+    /** "" clears the override so new sessions use the relay's saved voice. */
+    suspend fun setRealtimeVoice(voice: String) {
+        val key = stringPreferencesKey(scopedName(KEY_REALTIME_VOICE, _scope.value))
+        dataStore.edit { it[key] = voice.trim() }
+    }
+
+    /** Persist a compatible model/voice pair without exposing a half-updated snapshot. */
+    suspend fun setRealtimeSelection(model: String, voice: String) {
+        val scope = _scope.value
+        val modelKey = stringPreferencesKey(scopedName(KEY_REALTIME_MODEL, scope))
+        val voiceKey = stringPreferencesKey(scopedName(KEY_REALTIME_VOICE, scope))
+        dataStore.edit {
+            it[modelKey] = model.trim()
+            it[voiceKey] = voice.trim()
+        }
+    }
+
    // --- global setters (always the un-namespaced key) -----------------------

    suspend fun setInteractionMode(mode: String) {
@@ -339,14 +367,6 @@ class VoicePreferencesRepository(private val dataStore: DataStore<Preferences>)
        dataStore.edit { it[KEY_SILENCE_THRESHOLD_MS] = ms.coerceAtLeast(500L) }
    }

-    suspend fun setAutoTts(enabled: Boolean) {
-        dataStore.edit { it[KEY_AUTO_TTS] = enabled }
-    }
-
-    suspend fun setLanguage(language: String) {
-        dataStore.edit { it[KEY_LANGUAGE] = language }
-    }
-
    suspend fun setRealtimeTraceDetails(enabled: Boolean) {
        dataStore.edit { it[KEY_REALTIME_TRACE_DETAILS] = enabled }
    }
@@ -354,4 +374,31 @@ class VoicePreferencesRepository(private val dataStore: DataStore<Preferences>)
    suspend fun setRealtimePersistentSession(enabled: Boolean) {
        dataStore.edit { it[KEY_REALTIME_PERSISTENT_SESSION] = enabled }
    }
+
+    /**
+     * Atomically apply the phone-side portion of [preset]. Only fields owned by
+     * the preset are written, so route/provider/model/voice overrides and other
+     * preferences remain untouched. Barge-in shares this DataStore and is
+     * updated in the same transaction so observers never see a half-applied
+     * local preset.
+     */
+    suspend fun applyModePreset(preset: VoiceModePreset) {
+        val local = preset.localSettings
+        val bargeIn = preset.bargeInUpdate
+        dataStore.edit { prefs ->
+            prefs[KEY_INTERACTION_MODE] = local.interactionMode
+            prefs[KEY_SILENCE_THRESHOLD_MS] = local.silenceThresholdMs.coerceAtLeast(500L)
+            prefs[KEY_REALTIME_TRACE_DETAILS] = local.realtimeTraceDetails
+            prefs[KEY_REALTIME_PERSISTENT_SESSION] = local.realtimePersistentSession
+            bargeIn.enabled?.let {
+                prefs[BargeInPreferencesRepository.KEY_ENABLED] = it
+            }
+            bargeIn.sensitivity?.let {
+                prefs[BargeInPreferencesRepository.KEY_SENSITIVITY] = it.name
+            }
+            bargeIn.resumeAfterInterruption?.let {
+                prefs[BargeInPreferencesRepository.KEY_RESUME_AFTER_INTERRUPTION] = it
+            }
+        }
+    }
 }
@@ -177,6 +177,14 @@ object DiagnosticsLog {
        return noUserInfo.take(MAX_TEXT_LENGTH)
    }

+    /**
+     * Public secret redaction for user-composed report text (e.g. the "what
+     * were you expecting?" answer embedded in a GitHub issue body). Same
+     * redaction + cap as the stored stacktraces — entry fields are already
+     * sanitized at record time; this covers text added after the fact.
+     */
+    fun redactReportText(value: String?): String? = redactTrace(value)
+
    private fun clean(value: String?): String? {
        val trimmed = value?.trim()?.takeIf { it.isNotBlank() } ?: return null
        return redact(trimmed).take(MAX_TEXT_LENGTH)
@@ -169,7 +169,7 @@ object EventStore {
            )

            if (buffer.size >= MAX_ENTRIES) {
-                buffer.removeFirst()
+                buffer.removeAt(0)
            }
            buffer.addLast(entry)
        }
@@ -82,6 +82,13 @@ class ChannelMultiplexer {
            // flavor or by the master enable toggle in the UI).
            "bridge" -> handlers["bridge"]?.onMessage(envelope)
            // === END PHASE3-accessibility ===
+            // Proactive channel — agent-initiated messages pushed FROM the
+            // server (`send_message target=phone`). Routed to a
+            // [ProactiveMessageHandler] (registered by [ConnectionViewModel])
+            // which raises a system notification. The phone→server subscribe
+            // lifecycle is sent directly via [send]; this branch only handles
+            // inbound `phone.message` / `proactive.subscribed`.
+            "proactive" -> handlers["proactive"]?.onMessage(envelope)
            // Pairing channel — host-originated pushes that concern the
            // paired session itself (e.g. `profiles.updated` when the
            // server rescans its ~/.hermes/profiles tree). Routed to
@@ -6,6 +6,7 @@ import android.net.Network
 import android.net.NetworkCapabilities
 import android.net.NetworkRequest
 import android.util.Log
+import com.hermesandroid.relay.R
 import com.hermesandroid.relay.auth.CertPinStore
 import com.hermesandroid.relay.data.EndpointCandidate
 import com.hermesandroid.relay.data.PairingPreferences
@@ -42,6 +43,20 @@ enum class ConnectionState {
    Reconnecting
 }

+/**
+ * Build an OkHttp request for a relay socket URL, or `null` if the URL is
+ * malformed. OkHttp's [Request.Builder.url] throws [IllegalArgumentException]
+ * on an invalid host; the relay connect runs on a background coroutine, so an
+ * uncaught throw crashes the app (the #131 "Invalid URL host" class). Callers
+ * treat `null` as a connection failure instead of letting it propagate.
+ */
+internal fun buildRelayRequestOrNull(url: String): Request? =
+    try {
+        Request.Builder().url(url).build()
+    } catch (e: IllegalArgumentException) {
+        null
+    }
+
 class ConnectionManager(
    private val multiplexer: ChannelMultiplexer,
    /**
@@ -116,6 +131,11 @@ class ConnectionManager(

    private fun buildClient(): OkHttpClient {
        val builder = OkHttpClient.Builder()
+            // OkHttp's 10s default connectTimeout is LAN-tuned; a Tailscale
+            // DERP-relayed cold-start handshake can exceed it, and a failed
+            // connect feeds the onFailure → markUnreachable → route-flap loop.
+            // Give the remote first-handshake room to complete.
+            .connectTimeout(20, TimeUnit.SECONDS)
            .pingInterval(30, TimeUnit.SECONDS)
            .readTimeout(0, TimeUnit.MILLISECONDS)
        // Swap in the current pin snapshot on every connect. We DON'T hold a
@@ -149,6 +169,23 @@ class ConnectionManager(
    @Volatile
    private var lastUpgradeResponseCode: Int? = null

+    // Consecutive relay socket failures (response == null) since the last
+    // successful onOpen. One slow Tailscale/DERP cold-start handshake must not
+    // immediately evict the active route from the SHARED resolver cache (chat +
+    // dashboard ride the same resolver), so we only poison the route after a
+    // couple of consecutive transport-level failures.
+    @Volatile
+    private var consecutiveSocketFailures = 0
+
+    // The relay requires the FIRST frame on a socket to be `system/auth` and
+    // rejects the whole connection otherwise ("expected system/auth, got
+    // <channel>/<type>"). `authenticated` gates [send] so nothing (notably the
+    // periodic bridge.status reporter) can race the auth handshake on a fresh
+    // or reconnecting socket. False from the start of every connect until the
+    // server confirms `auth.ok`; reset on close/failure/disconnect.
+    @Volatile
+    private var authenticated = false
+
    private val _connectionState = MutableStateFlow(ConnectionState.Disconnected)
    val connectionState: StateFlow<ConnectionState> = _connectionState.asStateFlow()

@@ -224,6 +261,10 @@ class ConnectionManager(
        private const val TAG = "ConnectionManager"
        private const val MAX_BACKOFF_MS = 30_000L
        private const val BASE_BACKOFF_MS = 1_000L
+        // How many consecutive relay socket failures before we mark the active
+        // endpoint unreachable in the shared resolver cache. Tolerates a single
+        // cold-start blip on a slow remote (Tailscale DERP) link.
+        private const val MARK_UNREACHABLE_AFTER_FAILURES = 2
        // Settle window before re-resolving after a network event. Long
        // enough to coalesce the onAvailable burst of a handoff, short
        // enough that a route swap still feels immediate.
@@ -243,6 +284,17 @@ class ConnectionManager(
        // banned forever. Waiting at least as long as the server's block
        // duration lets the ban expire naturally.
        private const val RATE_LIMIT_BACKOFF_MS = 300_000L
+
+        // Slow-poll tier. Against a paired-but-genuinely-dead server the
+        // exponential backoff otherwise caps at ~16s and retries forever, which
+        // is steady battery + log noise for no benefit. After this many
+        // consecutive failed attempts (~5 min of continuous failure at the cap)
+        // we drop to a 5-min poll until the server recovers. A network change
+        // re-resolves + reconnects immediately regardless of this delay (see the
+        // onAvailable callback), and reconnectAttempt resets to 0 on a
+        // successful onOpen, so recovery is never gated on the slow interval.
+        private const val SLOW_POLL_AFTER_ATTEMPTS = 20
+        private const val SLOW_POLL_BACKOFF_MS = 300_000L
    }

    fun setInsecureMode(enabled: Boolean) {
@@ -255,7 +307,7 @@ class ConnectionManager(
            DiagnosticsLog.record(
                category = DiagnosticCategory.Relay,
                severity = DiagnosticSeverity.Warning,
-                title = "Insecure relay mode enabled",
+                title = context?.getString(R.string.conn_diag_insecure_mode) ?: "Insecure relay mode enabled",
                detail = "ws:// connections are allowed",
            )
        }
@@ -281,7 +333,7 @@ class ConnectionManager(
                DiagnosticsLog.record(
                    category = DiagnosticCategory.Relay,
                    severity = DiagnosticSeverity.Info,
-                    title = "Relay route selected",
+                    title = context?.getString(R.string.conn_diag_route_selected) ?: "Relay route selected",
                    endpointRole = resolved.role,
                    url = resolved.relay.url,
                )
@@ -291,7 +343,7 @@ class ConnectionManager(
                DiagnosticsLog.record(
                    category = DiagnosticCategory.Relay,
                    severity = DiagnosticSeverity.Warning,
-                    title = "Using configured relay URL",
+                    title = context?.getString(R.string.conn_diag_using_configured_url) ?: "Using configured relay URL",
                    detail = "No resolver winner",
                    url = url,
                )
@@ -317,7 +369,7 @@ class ConnectionManager(
            DiagnosticsLog.record(
                category = DiagnosticCategory.Relay,
                severity = DiagnosticSeverity.Error,
-                title = "Relay socket blocked",
+                title = context?.getString(R.string.conn_diag_socket_blocked) ?: "Relay socket blocked",
                detail = "ws:// is disabled",
                url = url,
            )
@@ -328,7 +380,7 @@ class ConnectionManager(
            DiagnosticsLog.record(
                category = DiagnosticCategory.Relay,
                severity = DiagnosticSeverity.Error,
-                title = "Relay socket URL invalid",
+                title = context?.getString(R.string.conn_diag_url_invalid) ?: "Relay socket URL invalid",
                detail = "URL must start with ws:// or wss://",
                url = url,
            )
@@ -357,14 +409,14 @@ class ConnectionManager(
            DiagnosticsLog.record(
                category = DiagnosticCategory.Relay,
                severity = DiagnosticSeverity.Warning,
-                title = "Opening insecure relay socket",
+                title = context?.getString(R.string.conn_diag_opening_insecure) ?: "Opening insecure relay socket",
                url = normalized,
            )
        } else {
            DiagnosticsLog.record(
                category = DiagnosticCategory.Relay,
                severity = DiagnosticSeverity.Info,
-                title = "Opening relay socket",
+                title = context?.getString(R.string.conn_diag_opening_socket) ?: "Opening relay socket",
                url = normalized,
            )
        }
@@ -547,19 +599,34 @@ class ConnectionManager(
     * reconnects a disconnected socket on the same winner — preserving the
     * pre-refactor relay-path behavior.
     */
-    private fun scheduleNetworkReResolve(closeReason: String) {
+    private fun scheduleNetworkReResolve(closeReason: String, wipeCache: Boolean) {
        if (endpointResolver == null) return
        networkResolveJob?.cancel()
        networkResolveJob = scope.launch {
            delay(NETWORK_RESOLVE_DEBOUNCE_MS)
+            // Wipe the probe cache INSIDE the debounced job (not synchronously in
+            // onAvailable) so a burst of network/VPN-interface callbacks —
+            // Tailscale's tun churns onAvailable repeatedly — coalesces into a
+            // single cache wipe + re-probe instead of one per event. onLost
+            // manages its own cache (clear + markUnreachable) and passes false.
+            if (wipeCache) endpointResolver?.clearCache()
            val current = serverUrl
            val resolved = resolveBestEndpointSafe()
            if (resolved == null) {
-                // Don't clear a live socket's endpoint on a transient probe
-                // miss — only drop the published route when nothing is
-                // actually connected.
-                if (_connectionState.value != ConnectionState.Connected) {
+                // Hysteresis for the AUTOMATIC (network-callback) path. A
+                // transient cold-route probe miss must NOT null the published
+                // endpoint: effectiveApiServerUrl/effectiveDashboardUrl then fall
+                // back to the saved (home-LAN) host — dead for a remote device —
+                // and rebuild the chat client against it. That is the Tailscale
+                // reconnect loop. The old guard keyed on the relay socket being
+                // Connected, which the standard (no-relay) chat path never
+                // reaches, so it protected nobody there. Keep the last-known
+                // route unless a sustained loss was actually declared (onLost
+                // grace elapsed) or there was never a route to keep.
+                if (sustainedLossDeclared || _activeEndpoint.value == null) {
                    _activeEndpoint.value = null
+                } else {
+                    Log.i(TAG, "re-resolve miss but ${_activeEndpoint.value?.role} was live and loss not sustained — keeping route")
                }
                return@launch
            }
@@ -615,8 +682,9 @@ class ConnectionManager(
                // route (usually the same one); the rebuild only fires if the
                // URL actually moved.
                networkLossJob?.cancel()
-                endpointResolver?.clearCache()
-                scheduleNetworkReResolve("Network change — switching endpoint")
+                // Cache wipe happens inside the debounced re-resolve so a burst
+                // of onAvailable (VPN tun churn) coalesces into one wipe+probe.
+                scheduleNetworkReResolve("Network change — switching endpoint", wipeCache = true)
            }

            override fun onLost(network: Network) {
@@ -634,7 +702,10 @@ class ConnectionManager(
                    sustainedLossDeclared = true
                    endpointResolver?.clearCache()
                    markActiveEndpointUnreachable("network lost (sustained)")
-                    scheduleNetworkReResolve("Network lost — switching endpoint")
+                    // wipeCache=false: we just cleared + poisoned the dead route
+                    // above; re-wiping inside the job would drop that negative
+                    // entry and let the dead route win the resolve again.
+                    scheduleNetworkReResolve("Network lost — switching endpoint", wipeCache = false)
                }
            }
        }
@@ -687,11 +758,12 @@ class ConnectionManager(
        DiagnosticsLog.record(
            category = DiagnosticCategory.Relay,
            severity = DiagnosticSeverity.Info,
-            title = "Relay socket disconnect requested",
+            title = context?.getString(R.string.conn_diag_disconnect_requested) ?: "Relay socket disconnect requested",
            url = serverUrl,
        )
        webSocket?.close(1000, "Client disconnect")
        webSocket = null
+        authenticated = false
        _connectionState.value = ConnectionState.Disconnected
        _isInsecureConnection.value = false
        // ADR 24: clear manual override on explicit disconnect — a "Use
@@ -715,6 +787,17 @@ class ConnectionManager(
    }

    fun send(envelope: Envelope) {
+        // Hold every non-auth frame until the server has accepted our
+        // `system/auth` envelope. Otherwise a sender that fires on its own
+        // cadence — e.g. BridgeStatusReporter's 30s/immediate tick — can beat
+        // the auth handshake on a fresh socket, and the relay rejects the
+        // whole connection (forcing a reconnect). Dropping a periodic frame is
+        // harmless: the next tick re-sends once authenticated.
+        val isAuthFrame = envelope.channel == "system" && envelope.type == "auth"
+        if (!authenticated && !isAuthFrame) {
+            Log.d(TAG, "send: holding ${envelope.channel}/${envelope.type} until auth.ok")
+            return
+        }
        val text = json.encodeToString(envelope)
        webSocket?.send(text)
    }
@@ -755,11 +838,35 @@ class ConnectionManager(
        // pin store snapshot — crucial right after applyServerIssuedCodeAndReset
        // wipes a pin for re-pair. buildClient() does a tiny DataStore read
        // via runBlocking, so it runs on the IO dispatcher inside [scope].
+        // Every new socket starts unauthenticated — the send-gate stays closed
+        // (auth frame excepted) until this socket's own auth.ok arrives.
+        authenticated = false
        client = buildClient()

-        val request = Request.Builder()
-            .url(url)
-            .build()
+        val request = buildRelayRequestOrNull(url)
+        if (request == null) {
+            // A malformed relay URL (an invalid/empty host from a corrupt or
+            // hand-edited pairing payload) can't be built into a request. This
+            // runs on a background coroutine, so letting OkHttp's url() throw
+            // would crash the app — the #131 "Invalid URL host" class, relay-
+            // socket half. Route it through the same path onFailure uses.
+            Log.e(TAG, "doConnect: malformed relay URL '$url' — not connecting")
+            DiagnosticsLog.record(
+                category = DiagnosticCategory.Relay,
+                severity = DiagnosticSeverity.Error,
+                title = "Invalid relay URL",
+                detail = "The relay address could not be parsed; re-pair to refresh it.",
+                url = url,
+            )
+            authenticated = false
+            _connectionState.value = ConnectionState.Disconnected
+            previousSocketToClose?.let { stale ->
+                runCatching { stale.close(1000, replaceReason) }
+                stale.cancel()
+            }
+            scheduleReconnect()
+            return
+        }

        Log.i(TAG, "doConnect: opening WSS to $url")
        val newSocket = client.newWebSocket(request, object : WebSocketListener() {
@@ -772,12 +879,13 @@ class ConnectionManager(
                }
                reconnectAttempt = 0
                lastUpgradeResponseCode = null
+                consecutiveSocketFailures = 0
                _connectionState.value = ConnectionState.Connected
                Log.i(TAG, "onOpen: WSS handshake complete ($url)")
                DiagnosticsLog.record(
                    category = DiagnosticCategory.Relay,
                    severity = DiagnosticSeverity.Info,
-                    title = "Relay socket connected",
+                    title = context?.getString(R.string.conn_diag_connected) ?: "Relay socket connected",
                    url = url,
                )

@@ -808,6 +916,15 @@ class ConnectionManager(
                }
                try {
                    val envelope = json.decodeFromString<Envelope>(text)
+                    // Open the send-gate the instant the server confirms auth,
+                    // BEFORE routing — so anything handleAuthOk triggers
+                    // (e.g. proactive.subscribe) is allowed through.
+                    if (envelope.channel == "system") {
+                        when (envelope.type) {
+                            "auth.ok" -> authenticated = true
+                            "auth.fail" -> authenticated = false
+                        }
+                    }
                    multiplexer.route(envelope)
                } catch (e: Exception) {
                    Log.w(TAG, "Malformed relay envelope: ${e.message}")
@@ -828,10 +945,11 @@ class ConnectionManager(
                DiagnosticsLog.record(
                    category = DiagnosticCategory.Relay,
                    severity = DiagnosticSeverity.Warning,
-                    title = "Relay socket closed",
+                    title = context?.getString(R.string.conn_diag_closed) ?: "Relay socket closed",
                    detail = "code=$code reason=$reason",
                    url = url,
                )
+                authenticated = false
                _connectionState.value = ConnectionState.Disconnected
                scheduleReconnect()
            }
@@ -846,7 +964,7 @@ class ConnectionManager(
                DiagnosticsLog.record(
                    category = DiagnosticCategory.Relay,
                    severity = DiagnosticSeverity.Error,
-                    title = "Relay socket failed",
+                    title = context?.getString(R.string.conn_diag_failed) ?: "Relay socket failed",
                    detail = listOfNotNull(
                        t.javaClass.simpleName,
                        t.message,
@@ -856,8 +974,19 @@ class ConnectionManager(
                )
                lastUpgradeResponseCode = code
                if (response == null) {
-                    markActiveEndpointUnreachable("socket failure")
+                    // Transport-level failure (no HTTP upgrade response): on a
+                    // remote (Tailscale) link the first handshake can fail cold.
+                    // Don't evict the only working route from the shared resolver
+                    // on a single blip — wait for it to repeat. A genuinely
+                    // sustained network loss is handled separately by onLost.
+                    consecutiveSocketFailures++
+                    if (consecutiveSocketFailures >= MARK_UNREACHABLE_AFTER_FAILURES) {
+                        markActiveEndpointUnreachable("socket failure x$consecutiveSocketFailures")
+                    } else {
+                        Log.i(TAG, "relay socket failure $consecutiveSocketFailures/$MARK_UNREACHABLE_AFTER_FAILURES — not yet poisoning route")
+                    }
                }
+                authenticated = false
                _connectionState.value = ConnectionState.Disconnected
                scheduleReconnect()
            }
@@ -884,7 +1013,7 @@ class ConnectionManager(
            DiagnosticsLog.record(
                category = DiagnosticCategory.Session,
                severity = DiagnosticSeverity.Warning,
-                title = "Relay reconnect skipped",
+                title = context?.getString(R.string.conn_diag_reconnect_skipped) ?: "Relay reconnect skipped",
                detail = "No paired session or pending pair code",
                url = serverUrl,
            )
@@ -899,28 +1028,46 @@ class ConnectionManager(
        // normal exponential cadence and we'll re-fill the ban bucket on
        // every attempt, extending the ban indefinitely. Wait out the
        // server's full block window instead.
-        val backoffMs = if (lastUpgradeResponseCode == 429) {
-            Log.i(TAG, "scheduleReconnect: rate-limited (429) — backing off ${RATE_LIMIT_BACKOFF_MS}ms")
-            DiagnosticsLog.record(
-                category = DiagnosticCategory.Relay,
-                severity = DiagnosticSeverity.Warning,
-                title = "Relay reconnect delayed",
-                detail = "Rate limited; retrying in ${RATE_LIMIT_BACKOFF_MS / 1000}s",
-                url = url,
-            )
-            RATE_LIMIT_BACKOFF_MS
-        } else {
-            (BASE_BACKOFF_MS * (1L shl minOf(reconnectAttempt - 1, 4)))
-                .coerceAtMost(MAX_BACKOFF_MS)
-        }
-        if (lastUpgradeResponseCode != 429) {
-            DiagnosticsLog.record(
-                category = DiagnosticCategory.Relay,
-                severity = DiagnosticSeverity.Info,
-                title = "Relay reconnect scheduled",
-                detail = "Retrying in ${backoffMs / 1000}s",
-                url = url,
-            )
+        val backoffMs = when {
+            // Server-issued 429 means we're IP-banned — wait out the full
+            // block window instead of re-filling the ban bucket at our normal
+            // cadence.
+            lastUpgradeResponseCode == 429 -> {
+                Log.i(TAG, "scheduleReconnect: rate-limited (429) — backing off ${RATE_LIMIT_BACKOFF_MS}ms")
+                DiagnosticsLog.record(
+                    category = DiagnosticCategory.Relay,
+                    severity = DiagnosticSeverity.Warning,
+                    title = context?.getString(R.string.conn_diag_reconnect_delayed) ?: "Relay reconnect delayed",
+                    detail = "Rate limited; retrying in ${RATE_LIMIT_BACKOFF_MS / 1000}s",
+                    url = url,
+                )
+                RATE_LIMIT_BACKOFF_MS
+            }
+            // Sustained failure against a paired-but-dead server: stop hammering
+            // every ~16s forever; drop to a slow poll until it recovers.
+            reconnectAttempt >= SLOW_POLL_AFTER_ATTEMPTS -> {
+                Log.i(TAG, "scheduleReconnect: sustained failure (attempt $reconnectAttempt) — slow-polling every ${SLOW_POLL_BACKOFF_MS / 1000}s")
+                DiagnosticsLog.record(
+                    category = DiagnosticCategory.Relay,
+                    severity = DiagnosticSeverity.Warning,
+                    title = context?.getString(R.string.conn_diag_reconnect_slow_poll) ?: "Relay reconnect slow-polling",
+                    detail = "Server unreachable for a while; retrying every ${SLOW_POLL_BACKOFF_MS / 1000}s until it recovers (a network change reconnects immediately)",
+                    url = url,
+                )
+                SLOW_POLL_BACKOFF_MS
+            }
+            else -> {
+                val ms = (BASE_BACKOFF_MS * (1L shl minOf(reconnectAttempt - 1, 4)))
+                    .coerceAtMost(MAX_BACKOFF_MS)
+                DiagnosticsLog.record(
+                    category = DiagnosticCategory.Relay,
+                    severity = DiagnosticSeverity.Info,
+                    title = context?.getString(R.string.conn_diag_reconnect_scheduled) ?: "Relay reconnect scheduled",
+                    detail = "Retrying in ${ms / 1000}s",
+                    url = url,
+                )
+                ms
+            }
        }

        scope.launch {
@@ -932,8 +1079,18 @@ class ConnectionManager(
                val resolved = resolveBestEndpointSafe()
                val targetUrl = resolved?.relay?.url
                if (resolved != null) {
+                    // Mirror scheduleNetworkReResolve: clear the sustained-loss
+                    // latch on a successful resolve so a later transient miss
+                    // doesn't null a route we just reconnected. (The latch is set
+                    // in onLost's grace job but can be cleared on EITHER success
+                    // edge — network-callback or relay-timer.)
+                    sustainedLossDeclared = false
                    _activeEndpoint.value = resolved
-                } else {
+                } else if (sustainedLossDeclared || _activeEndpoint.value == null) {
+                    // Same hysteresis as scheduleNetworkReResolve: a transient
+                    // miss during a relay reconnect must not flip every effective
+                    // URL back to the dead saved host. Keep the last-known route;
+                    // we fall through to doConnect(url) and retry it with backoff.
                    _activeEndpoint.value = null
                }
                if (targetUrl != null && normalizeRelayUrl(targetUrl) != url) {
@@ -0,0 +1,160 @@
+package com.hermesandroid.relay.network.relay
+
+import android.content.Context
+import android.util.Log
+import com.hermesandroid.relay.network.relay.models.Envelope
+import com.hermesandroid.relay.notifications.ProactiveMessageNotifier
+import kotlinx.serialization.json.JsonObject
+import kotlinx.serialization.json.contentOrNull
+import kotlinx.serialization.json.jsonPrimitive
+
+/**
+ * Handles inbound `proactive` channel envelopes — agent-initiated messages
+ * the relay pushes over the existing phone WSS (the server→app counterpart of
+ * the bridge channel). Sibling of [BridgeCommandHandler].
+ *
+ * Wire protocol (server → app):
+ * ```json
+ * {
+ *   "channel": "proactive",
+ *   "type": "phone.message",
+ *   "id": "<uuid>",
+ *   "payload": {
+ *     "message_id": "...",
+ *     "chat_id": "phone",
+ *     "text": "build is green",
+ *     "title": "Hermes",
+ *     "surfacing": null,          // "notification" | "inbox" | "session" | null(default)
+ *     "reply_to": null,
+ *     "metadata": { ... },
+ *     "sent_at": 1719600000000
+ *   }
+ * }
+ * ```
+ *
+ * The inbox is the **always-present** durable log — every received message is
+ * recorded there. The `surfacing` hint then selects the *additional* surface:
+ *  - `null` / `"default"` / `"notification"` → also raise a system notification
+ *  - `"inbox"`                               → inbox only (silent)
+ *  - `"session"`                             → also inject into the active chat
+ *      session ([toSession]); falls back to a notification when no session sink
+ *      is wired
+ *
+ * The [toInbox] / [toSession] sinks are injected by [ConnectionViewModel] so
+ * the handler stays free of ViewModel/DataStore dependencies and unit-testable.
+ * [toSession] is a `var` so it can be wired after construction (the ChatViewModel
+ * isn't available when the handler is built).
+ */
+class ProactiveMessageHandler(
+    private val context: Context,
+    /** Sink for the dedicated Hermes inbox (Phase 2a) — the always-present log. */
+    private val toInbox: ((ProactiveMessage) -> Unit)? = null,
+    /** Sink for injecting into the active chat session (Phase 2b). */
+    var toSession: ((ProactiveMessage) -> Unit)? = null,
+    /**
+     * Sink for the relay's per-reply ack (`proactive.reply.ack`) — lets the
+     * chat layer settle a Thread reply bubble from SENDING → DELIVERED. Wired
+     * after construction (the ChatViewModel isn't available at build time).
+     * `(clientMsgId, status)`.
+     */
+    var onReplyAck: ((String, String) -> Unit)? = null,
+    /**
+     * Show an inbound message inline in the Chat **Thread** it belongs to, when
+     * that Thread is currently open. Returns true if it was shown there — in
+     * which case the message is NOT also notified or added to the inbox (you're
+     * already looking at the conversation). The unified-Threads counterpart of
+     * [toSession]; wired after construction.
+     */
+    var injectIntoThread: ((ProactiveMessage) -> Boolean)? = null,
+) {
+
+    fun onMessage(envelope: Envelope) {
+        when (envelope.type) {
+            "phone.message" -> {
+                val msg = parse(envelope.payload)
+                if (msg == null) {
+                    Log.w(TAG, "dropping malformed phone.message")
+                    return
+                }
+                dispatch(msg)
+            }
+            // Subscribe ack — informational; nothing to do client-side.
+            "proactive.subscribed" -> Log.d(TAG, "proactive subscribe acked")
+            // Per-reply ack — settle the matching Thread reply bubble (the
+            // `client_msg_id` is the id the app stamped on its own reply).
+            "proactive.reply.ack" -> {
+                val clientMsgId = envelope.payload["client_msg_id"]?.jsonPrimitive?.contentOrNull
+                val status = envelope.payload["status"]?.jsonPrimitive?.contentOrNull ?: "received"
+                if (!clientMsgId.isNullOrBlank()) onReplyAck?.invoke(clientMsgId, status)
+            }
+            else -> Log.d(TAG, "ignoring proactive type ${envelope.type}")
+        }
+    }
+
+    /** Route a parsed message: into the open Thread if it belongs there, else
+     *  the durable inbox log + the surface its hint selects. */
+    private fun dispatch(msg: ProactiveMessage) {
+        // Unified Threads: if this message belongs to the Thread currently open
+        // in Chat, render it inline there and STOP — no notification, no inbox
+        // entry (you're already looking at the conversation).
+        if (injectIntoThread?.invoke(msg) == true) return
+        // Otherwise the inbox is the durable log of agent-initiated messages and
+        // the surfacing hint selects the additional surface.
+        toInbox?.invoke(msg)
+        when (msg.surfacing?.lowercase()) {
+            "inbox" -> { /* inbox only — already recorded above */ }
+            "session" -> {
+                val sink = toSession
+                // Legacy explicit "inject into active session" path; if no sink
+                // (or no active chat) fall back to a notification so it isn't
+                // silently missed (the inbox copy already exists either way).
+                if (sink != null) sink.invoke(msg) else notify(msg)
+            }
+            // null / "default" / "notification" / anything unrecognized.
+            else -> notify(msg)
+        }
+    }
+
+    private fun notify(msg: ProactiveMessage) {
+        ProactiveMessageNotifier.notify(
+            context = context,
+            title = msg.title,
+            text = msg.text,
+            messageId = msg.messageId,
+            chatId = msg.chatId,
+        )
+    }
+
+    private fun parse(payload: JsonObject): ProactiveMessage? {
+        val text = payload["text"]?.jsonPrimitive?.contentOrNull
+        if (text.isNullOrBlank()) return null
+        return ProactiveMessage(
+            messageId = payload["message_id"]?.jsonPrimitive?.contentOrNull,
+            chatId = payload["chat_id"]?.jsonPrimitive?.contentOrNull,
+            text = text,
+            title = payload["title"]?.jsonPrimitive?.contentOrNull,
+            surfacing = payload["surfacing"]?.jsonPrimitive?.contentOrNull,
+            sentAt = payload["sent_at"]?.jsonPrimitive?.contentOrNull?.toLongOrNull(),
+            replyTo = payload["reply_to"]?.jsonPrimitive?.contentOrNull,
+        )
+    }
+
+    companion object {
+        private const val TAG = "ProactiveMsgHandler"
+    }
+}
+
+/**
+ * A parsed agent-initiated message. `surfacing` is the optional route hint
+ * (null = app default); Phase 2 keys inbox/session delivery off it.
+ */
+data class ProactiveMessage(
+    val messageId: String?,
+    val chatId: String?,
+    val text: String,
+    val title: String?,
+    val surfacing: String?,
+    val sentAt: Long?,
+    /** Id of the message this one answers, if any (server threading hint). */
+    val replyTo: String? = null,
+)
@@ -1,17 +1,23 @@
 package com.hermesandroid.relay.network.relay

+import android.content.Context
 import android.util.Log
+import com.hermesandroid.relay.R
 import com.hermesandroid.relay.auth.PairedDeviceInfo
 import com.hermesandroid.relay.diagnostics.DiagnosticCategory
 import com.hermesandroid.relay.diagnostics.DiagnosticSeverity
 import com.hermesandroid.relay.diagnostics.DiagnosticsLog
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.withContext
+import kotlinx.serialization.SerialName
 import kotlinx.serialization.Serializable
 import kotlinx.serialization.builtins.ListSerializer
 import kotlinx.serialization.json.Json
+import kotlinx.serialization.json.contentOrNull
 import kotlinx.serialization.json.jsonObject
+import kotlinx.serialization.json.jsonPrimitive
 import okhttp3.HttpUrl.Companion.toHttpUrl
+import okhttp3.HttpUrl.Companion.toHttpUrlOrNull
 import okhttp3.MediaType.Companion.toMediaType
 import okhttp3.OkHttpClient
 import okhttp3.Request
@@ -46,6 +52,9 @@ class RelayHttpClient(
     *  paired). Lets [mediaUrlConfigured] check fetch-readiness without
     *  suspending; mirrors what [sessionTokenProvider] resolves. */
    private val pairedTokenSnapshot: () -> String? = { null },
+    /** Application context for localized string resources. Nullable for
+     *  backwards-compat with call sites that don't need localization. */
+    private val context: Context? = null,
 ) {

    companion object {
@@ -61,12 +70,12 @@ class RelayHttpClient(
    /**
     * True when relay media is actually FETCHABLE right now: a non-blank relay
     * URL AND a current paired session token. Synchronous. The token check
-     * matters because the relay's SessionManager is in-memory and wiped on
-     * restart, so a configured relay URL can outlive the pairing — gating on URL
-     * alone made the media-capability badge read "available" while every
+     * matters because a configured relay URL can outlive a usable pairing — the
+     * session can expire, be revoked, or never have been established — so gating
+     * on URL alone made the media-capability badge read "available" while every
     * `/media/by-path` fetch failed for a missing token. Now the badge (and the
-     * SSE media hint) agree with what the fetch can do, and self-correct on
-     * re-pair.
+     * SSE media hint) agree with what the fetch can do, and self-correct once a
+     * valid paired token is present.
     */
    fun mediaUrlConfigured(): Boolean =
        !relayUrlProvider().isNullOrBlank() && !pairedTokenSnapshot().isNullOrBlank()
@@ -152,7 +161,10 @@ class RelayHttpClient(
            .replace(Regex("^ws://", RegexOption.IGNORE_CASE), "http://")
            .trimEnd('/')

-        val url = "$httpBase/media/$token"
+        val url = "$httpBase/media/$token".toHttpUrlOrNull()
+            ?: return@withContext Result.failure(
+                IllegalArgumentException("Invalid relay URL: $httpBase")
+            )

        val request = Request.Builder()
            .url(url)
@@ -315,6 +327,111 @@ class RelayHttpClient(
        }
    }

+    /**
+     * Fetch the conventional avatar image stored in a Hermes profile home.
+     *
+     * The optional Relay endpoint searches the selected profile directory for
+     * names such as `avatar.png` and `profile.jpg`. The bytes are returned to
+     * the caller so Android can copy them into its existing local per-profile
+     * icon store; the host path is never persisted on the phone.
+     */
+    suspend fun fetchProfileAvatar(profileName: String?): Result<FetchedMedia> =
+        withContext(Dispatchers.IO) {
+            val relayUrl = relayUrlProvider()?.trim().orEmpty()
+            if (relayUrl.isEmpty()) {
+                return@withContext Result.failure(
+                    IllegalStateException("Relay URL not configured")
+                )
+            }
+
+            val sessionToken = sessionTokenProvider()
+            if (sessionToken.isNullOrBlank()) {
+                return@withContext Result.failure(
+                    IllegalStateException("Relay not paired — session token missing")
+                )
+            }
+
+            val httpBase = relayUrl
+                .replace(Regex("^wss://", RegexOption.IGNORE_CASE), "https://")
+                .replace(Regex("^ws://", RegexOption.IGNORE_CASE), "http://")
+                .trimEnd('/')
+            val profile = profileName?.trim()?.ifBlank { null } ?: "default"
+            val url = try {
+                "$httpBase/api/profiles".toHttpUrl().newBuilder()
+                    .addPathSegment(profile)
+                    .addPathSegment("avatar")
+                    .build()
+            } catch (e: IllegalArgumentException) {
+                return@withContext Result.failure(IOException("Invalid relay URL: ${e.message}"))
+            }
+
+            val request = Request.Builder()
+                .url(url)
+                .get()
+                .header("Authorization", "Bearer $sessionToken")
+                .header("Accept", "image/*")
+                .build()
+
+            try {
+                okHttpClient.newCall(request).execute().use { response ->
+                    if (!response.isSuccessful) {
+                        val errorCode = runCatching {
+                            sessionsJson.parseToJsonElement(response.body.string())
+                                .jsonObject["error"]
+                                ?.jsonPrimitive
+                                ?.contentOrNull
+                        }.getOrNull()
+                        val reason = when (response.code) {
+                            401 -> "Unauthorized — re-pair with the relay"
+                            403 -> "The host profile image is blocked by Relay file policy"
+                            404 -> when (errorCode) {
+                                "profile_avatar_not_found" ->
+                                    "No host profile image found — add avatar.png or profile.jpg to the profile directory"
+                                "profile_not_found" ->
+                                    "The selected profile directory was not found on the Relay host"
+                                else ->
+                                    "This Relay host does not support profile image import yet — update Relay or choose a file"
+                            }
+                            415 -> "The host profile image format is not supported"
+                            in 500..599 -> "Relay error (HTTP ${response.code})"
+                            else -> "HTTP ${response.code}: ${response.message.ifBlank { "request failed" }}"
+                        }
+                        return@withContext Result.failure(IOException(reason))
+                    }
+
+                    val contentType = response.header("Content-Type")
+                        ?.substringBefore(';')
+                        ?.trim()
+                        ?.ifBlank { null }
+                        ?: "application/octet-stream"
+                    if (!contentType.startsWith("image/")) {
+                        return@withContext Result.failure(
+                            IOException("Relay returned a non-image profile file")
+                        )
+                    }
+                    val bytes = response.body.bytes()
+                    if (bytes.isEmpty()) {
+                        return@withContext Result.failure(IOException("Host profile image is empty"))
+                    }
+                    Result.success(
+                        FetchedMedia(
+                            contentType = contentType,
+                            bytes = bytes,
+                            fileName = parseContentDispositionFilename(
+                                response.header("Content-Disposition")
+                            ),
+                        )
+                    )
+                }
+            } catch (e: IOException) {
+                Log.w(TAG, "fetchProfileAvatar failed for $profile: ${e.message}")
+                Result.failure(e)
+            } catch (e: Exception) {
+                Log.w(TAG, "fetchProfileAvatar unexpected error for $profile: ${e.message}")
+                Result.failure(e)
+            }
+        }
+
    /**
     * Fetch the relay's server-side injected-context audit. This endpoint is
     * optional and fail-open: old/plugin-absent relays return an empty disabled
@@ -394,6 +511,215 @@ class RelayHttpClient(
        }
    }

+    /** One phone Thread's identity from the relay's `/phone/threads`. */
+    @Serializable
+    data class PhoneThreadInfo(
+        @SerialName("session_id") val sessionId: String = "",
+        @SerialName("chat_id") val chatId: String = "",
+        val title: String? = null,
+    )
+
+    @Serializable
+    private data class PhoneThreadsResponse(
+        val threads: List<PhoneThreadInfo> = emptyList(),
+    )
+
+    /**
+     * Fetch the phone-Thread `session_id → chat_id` map the upstream
+     * `/api/sessions` omits (the relay reads it from the gateway store). The app
+     * seeds its reply-routing map from this so a Thread it didn't create — or any
+     * Thread after a restart — routes replies to the right conversation.
+     *
+     * Optional + fail-soft: an older relay without the route returns 404 → an
+     * empty list, and the client falls back to its learned map.
+     */
+    suspend fun fetchPhoneThreads(): Result<List<PhoneThreadInfo>> = withContext(Dispatchers.IO) {
+        val relayUrl = relayUrlProvider()?.trim().orEmpty()
+        if (relayUrl.isEmpty()) {
+            return@withContext Result.failure(IllegalStateException("Relay URL not configured"))
+        }
+        val sessionToken = sessionTokenProvider()
+        if (sessionToken.isNullOrBlank()) {
+            return@withContext Result.failure(
+                IllegalStateException("Relay not paired — session token missing")
+            )
+        }
+        val httpBase = relayUrl
+            .replace(Regex("^wss://", RegexOption.IGNORE_CASE), "https://")
+            .replace(Regex("^ws://", RegexOption.IGNORE_CASE), "http://")
+            .trimEnd('/')
+        val url = try {
+            "$httpBase/phone/threads".toHttpUrl()
+        } catch (e: IllegalArgumentException) {
+            return@withContext Result.failure(IOException("Invalid relay URL: ${e.message}"))
+        }
+        val request = Request.Builder()
+            .url(url)
+            .get()
+            .header("Authorization", "Bearer $sessionToken")
+            .header("Accept", "application/json")
+            .build()
+        val client = okHttpClient.newBuilder()
+            .callTimeout(3, java.util.concurrent.TimeUnit.SECONDS)
+            .build()
+        try {
+            client.newCall(request).execute().use { response ->
+                if (response.code == 404) {
+                    return@withContext Result.success(emptyList())
+                }
+                if (!response.isSuccessful) {
+                    val reason = when (response.code) {
+                        401, 403 -> "Unauthorized — re-pair with the relay"
+                        in 500..599 -> "Relay error (HTTP ${response.code})"
+                        else -> "HTTP ${response.code}: ${response.message.ifBlank { "request failed" }}"
+                    }
+                    return@withContext Result.failure(IOException(reason))
+                }
+                val body = response.body?.string().orEmpty()
+                if (body.isBlank()) {
+                    return@withContext Result.success(emptyList())
+                }
+                Result.success(
+                    sessionsJson.decodeFromString(PhoneThreadsResponse.serializer(), body).threads
+                )
+            }
+        } catch (e: IOException) {
+            Log.w(TAG, "fetchPhoneThreads failed: ${e.message}")
+            Result.failure(e)
+        } catch (e: Exception) {
+            Log.w(TAG, "fetchPhoneThreads parse error: ${e.message}")
+            Result.failure(e)
+        }
+    }
+
+    /** The relay's update-check result from `/relay/update-check`. */
+    @Serializable
+    data class RelayUpdateInfo(
+        val current: String = "",
+        val latest: String? = null,
+        @SerialName("update_available") val updateAvailable: Boolean = false,
+        @SerialName("update_command") val updateCommand: String? = null,
+        val error: String? = null,
+    )
+
+    @Serializable
+    data class RelayProfileInfo(
+        val name: String,
+        @SerialName("relay_state") val relayState: String,
+    )
+
+    @Serializable
+    data class RelayInfo(
+        @SerialName("plugin_version") val pluginVersion: String = "",
+        @SerialName("protocol_version") val protocolVersion: Int = 0,
+        val capabilities: List<String> = emptyList(),
+        val profiles: List<RelayProfileInfo> = emptyList(),
+        val health: String = "unknown",
+    )
+
+    /** Fetch the installed plugin/protocol/profile capability contract. */
+    suspend fun fetchRelayInfo(): Result<RelayInfo?> = withContext(Dispatchers.IO) {
+        val relayUrl = relayUrlProvider()?.trim().orEmpty()
+        val token = sessionTokenProvider()
+        if (relayUrl.isEmpty() || token.isNullOrBlank()) {
+            return@withContext Result.failure(IllegalStateException("Relay is not configured and paired"))
+        }
+        val base = relayUrl
+            .replace(Regex("^wss://", RegexOption.IGNORE_CASE), "https://")
+            .replace(Regex("^ws://", RegexOption.IGNORE_CASE), "http://")
+            .trimEnd('/')
+        val url = try { "$base/relay/info".toHttpUrl() } catch (e: IllegalArgumentException) {
+            return@withContext Result.failure(IOException("Invalid relay URL: ${e.message}"))
+        }
+        val request = Request.Builder().url(url).get()
+            .header("Authorization", "Bearer $token")
+            .header("Accept", "application/json").build()
+        try {
+            okHttpClient.newBuilder().callTimeout(4, java.util.concurrent.TimeUnit.SECONDS).build()
+                .newCall(request).execute().use { response ->
+                    if (response.code == 404) return@withContext Result.success(null)
+                    if (!response.isSuccessful) return@withContext Result.failure(IOException("HTTP ${response.code}"))
+                    val body = response.body?.string().orEmpty()
+                    Result.success(body.takeIf { it.isNotBlank() }?.let {
+                        sessionsJson.decodeFromString(RelayInfo.serializer(), it)
+                    })
+                }
+        } catch (e: Exception) {
+            Log.w(TAG, "fetchRelayInfo failed: ${e.message}")
+            Result.failure(e)
+        }
+    }
+
+    /**
+     * Ask the relay whether a newer plugin release is available — it compares its
+     * installed version against the latest `plugin-v*` GitHub release (cached an
+     * hour server-side, so the app polling this is cheap). Surfaced as a soft,
+     * dismissible "your relay is behind" nudge plus a version readout.
+     *
+     * Optional + fail-soft: an older relay without the route returns 404 → null,
+     * and the app simply shows no update hint.
+     */
+    suspend fun fetchUpdateCheck(): Result<RelayUpdateInfo?> = withContext(Dispatchers.IO) {
+        val relayUrl = relayUrlProvider()?.trim().orEmpty()
+        if (relayUrl.isEmpty()) {
+            return@withContext Result.failure(IllegalStateException("Relay URL not configured"))
+        }
+        val sessionToken = sessionTokenProvider()
+        if (sessionToken.isNullOrBlank()) {
+            return@withContext Result.failure(
+                IllegalStateException("Relay not paired — session token missing")
+            )
+        }
+        val httpBase = relayUrl
+            .replace(Regex("^wss://", RegexOption.IGNORE_CASE), "https://")
+            .replace(Regex("^ws://", RegexOption.IGNORE_CASE), "http://")
+            .trimEnd('/')
+        val url = try {
+            "$httpBase/relay/update-check".toHttpUrl()
+        } catch (e: IllegalArgumentException) {
+            return@withContext Result.failure(IOException("Invalid relay URL: ${e.message}"))
+        }
+        val request = Request.Builder()
+            .url(url)
+            .get()
+            .header("Authorization", "Bearer $sessionToken")
+            .header("Accept", "application/json")
+            .build()
+        // Slightly longer than the other reads — a cache-miss on the relay does a
+        // GitHub round-trip in an executor before responding.
+        val client = okHttpClient.newBuilder()
+            .callTimeout(8, java.util.concurrent.TimeUnit.SECONDS)
+            .build()
+        try {
+            client.newCall(request).execute().use { response ->
+                if (response.code == 404) {
+                    return@withContext Result.success(null)
+                }
+                if (!response.isSuccessful) {
+                    val reason = when (response.code) {
+                        401, 403 -> "Unauthorized — re-pair with the relay"
+                        in 500..599 -> "Relay error (HTTP ${response.code})"
+                        else -> "HTTP ${response.code}: ${response.message.ifBlank { "request failed" }}"
+                    }
+                    return@withContext Result.failure(IOException(reason))
+                }
+                val body = response.body?.string().orEmpty()
+                if (body.isBlank()) {
+                    return@withContext Result.success(null)
+                }
+                Result.success(
+                    sessionsJson.decodeFromString(RelayUpdateInfo.serializer(), body)
+                )
+            }
+        } catch (e: IOException) {
+            Log.w(TAG, "fetchUpdateCheck failed: ${e.message}")
+            Result.failure(e)
+        } catch (e: Exception) {
+            Log.w(TAG, "fetchUpdateCheck parse error: ${e.message}")
+            Result.failure(e)
+        }
+    }
+
    // ------------------------------------------------------------------
    // Paired-device management (2026-04-11 security overhaul)
    // ------------------------------------------------------------------
@@ -435,7 +761,10 @@ class RelayHttpClient(
            .replace(Regex("^ws://", RegexOption.IGNORE_CASE), "http://")
            .trimEnd('/')

-        val url = "$httpBase/sessions"
+        val url = "$httpBase/sessions".toHttpUrlOrNull()
+            ?: return@withContext Result.failure(
+                IllegalArgumentException("Invalid relay URL: $httpBase")
+            )
        val request = Request.Builder()
            .url(url)
            .get()
@@ -735,7 +1064,7 @@ class RelayHttpClient(
            DiagnosticsLog.record(
                category = DiagnosticCategory.Relay,
                severity = DiagnosticSeverity.Error,
-                title = "Relay URL invalid",
+                title = context?.getString(R.string.http_diag_url_invalid) ?: "Relay URL invalid",
                detail = e.message,
                url = relayUrl,
            )
@@ -765,7 +1094,7 @@ class RelayHttpClient(
                    DiagnosticsLog.record(
                        category = DiagnosticCategory.Relay,
                        severity = DiagnosticSeverity.Warning,
-                        title = "Relay health failed",
+                        title = context?.getString(R.string.http_diag_health_failed) ?: "Relay health failed",
                        detail = "HTTP ${response.code}",
                        url = httpBase,
                        elapsedMs = System.currentTimeMillis() - startedAtMs,
@@ -779,7 +1108,7 @@ class RelayHttpClient(
                    DiagnosticsLog.record(
                        category = DiagnosticCategory.Relay,
                        severity = DiagnosticSeverity.Warning,
-                        title = "Relay health failed",
+                        title = context?.getString(R.string.http_diag_health_failed) ?: "Relay health failed",
                        detail = "Empty response",
                        url = httpBase,
                        elapsedMs = System.currentTimeMillis() - startedAtMs,
@@ -796,7 +1125,7 @@ class RelayHttpClient(
                    DiagnosticsLog.record(
                        category = DiagnosticCategory.Relay,
                        severity = DiagnosticSeverity.Warning,
-                        title = "Relay health failed",
+                        title = context?.getString(R.string.http_diag_health_failed) ?: "Relay health failed",
                        detail = "Non-JSON response",
                        url = httpBase,
                        elapsedMs = System.currentTimeMillis() - startedAtMs,
@@ -810,7 +1139,7 @@ class RelayHttpClient(
                    DiagnosticsLog.record(
                        category = DiagnosticCategory.Relay,
                        severity = DiagnosticSeverity.Warning,
-                        title = "Relay health failed",
+                        title = context?.getString(R.string.http_diag_health_failed) ?: "Relay health failed",
                        detail = "status=${status ?: "missing"}",
                        url = httpBase,
                        elapsedMs = System.currentTimeMillis() - startedAtMs,
@@ -824,7 +1153,7 @@ class RelayHttpClient(
                    DiagnosticsLog.record(
                        category = DiagnosticCategory.Relay,
                        severity = DiagnosticSeverity.Warning,
-                        title = "Relay health failed",
+                        title = context?.getString(R.string.http_diag_health_failed) ?: "Relay health failed",
                        detail = "Missing version field",
                        url = httpBase,
                        elapsedMs = System.currentTimeMillis() - startedAtMs,
@@ -841,7 +1170,7 @@ class RelayHttpClient(
                    DiagnosticsLog.record(
                        category = DiagnosticCategory.Relay,
                        severity = DiagnosticSeverity.Info,
-                        title = "Relay health ok",
+                        title = context?.getString(R.string.http_diag_health_ok) ?: "Relay health ok",
                        detail = "version=$version clients=$clients sessions=$sessions",
                        url = httpBase,
                        elapsedMs = System.currentTimeMillis() - startedAtMs,
@@ -854,7 +1183,7 @@ class RelayHttpClient(
            DiagnosticsLog.record(
                category = DiagnosticCategory.Relay,
                severity = DiagnosticSeverity.Warning,
-                title = "Relay health timeout",
+                title = context?.getString(R.string.http_diag_health_timeout) ?: "Relay health timeout",
                detail = "No HTTP response in 3s",
                url = httpBase,
                elapsedMs = System.currentTimeMillis() - startedAtMs,
@@ -865,7 +1194,7 @@ class RelayHttpClient(
            DiagnosticsLog.record(
                category = DiagnosticCategory.Relay,
                severity = DiagnosticSeverity.Error,
-                title = "Relay connection refused",
+                title = context?.getString(R.string.http_diag_conn_refused) ?: "Relay connection refused",
                detail = e.message,
                url = httpBase,
                elapsedMs = System.currentTimeMillis() - startedAtMs,
@@ -876,7 +1205,7 @@ class RelayHttpClient(
            DiagnosticsLog.record(
                category = DiagnosticCategory.Relay,
                severity = DiagnosticSeverity.Warning,
-                title = "Relay health failed",
+                title = context?.getString(R.string.http_diag_health_failed) ?: "Relay health failed",
                detail = e.message ?: "Network error",
                url = httpBase,
                elapsedMs = System.currentTimeMillis() - startedAtMs,
@@ -887,7 +1216,7 @@ class RelayHttpClient(
            DiagnosticsLog.record(
                category = DiagnosticCategory.Relay,
                severity = DiagnosticSeverity.Error,
-                title = "Relay health failed",
+                title = context?.getString(R.string.http_diag_health_failed) ?: "Relay health failed",
                detail = e.message ?: e.javaClass.simpleName,
                url = httpBase,
                elapsedMs = System.currentTimeMillis() - startedAtMs,
@@ -1,6 +1,8 @@
 package com.hermesandroid.relay.network.shared

+import android.content.Context
 import android.util.Log
+import com.hermesandroid.relay.R
 import com.hermesandroid.relay.data.EndpointCandidate
 import com.hermesandroid.relay.diagnostics.DiagnosticCategory
 import com.hermesandroid.relay.diagnostics.DiagnosticSeverity
@@ -85,6 +87,12 @@ class EndpointResolver(
     * tests feed a mutable clock to exercise the 30-second TTL.
     */
    private val clock: () -> Long = { System.currentTimeMillis() },
+    /**
+     * Application context for localized string resources. When null the
+     * resolver falls back to hardcoded English strings — this is the
+     * expected path for plain JVM tests.
+     */
+    private val context: Context? = null,
 ) {

    /**
@@ -190,7 +198,7 @@ class EndpointResolver(
                DiagnosticsLog.record(
                    category = DiagnosticCategory.Endpoint,
                    severity = DiagnosticSeverity.Info,
-                    title = "Endpoint selected",
+                    title = context?.getString(R.string.endpoint_diag_selected) ?: "Endpoint selected",
                    detail = "priority=$priority",
                    endpointRole = winner.role,
                    url = winner.relay.url,
@@ -203,7 +211,7 @@ class EndpointResolver(
        DiagnosticsLog.record(
            category = DiagnosticCategory.Endpoint,
            severity = DiagnosticSeverity.Warning,
-            title = "No reachable endpoint",
+            title = context?.getString(R.string.endpoint_diag_no_reachable) ?: "No reachable endpoint",
            detail = "${candidates.size} configured route(s) failed health probes",
        )
        return null
@@ -288,7 +296,7 @@ class EndpointResolver(
                DiagnosticsLog.record(
                    category = DiagnosticCategory.Endpoint,
                    severity = DiagnosticSeverity.Error,
-                    title = "Endpoint probe invalid",
+                    title = context?.getString(R.string.endpoint_diag_probe_invalid) ?: "Endpoint probe invalid",
                    detail = "Invalid API URL",
                    endpointRole = candidate.role,
                    url = candidate.api.url,
@@ -312,10 +320,15 @@ class EndpointResolver(
                withTimeoutOrNull(PROBE_TIMEOUT_MS + 200L) {
                    fastClient.newCall(request).execute().use { resp ->
                        val ok = resp.isSuccessful
+                        val probeTitle = if (ok) {
+                            context?.getString(R.string.endpoint_diag_probe_ok) ?: "Endpoint probe ok"
+                        } else {
+                            context?.getString(R.string.endpoint_diag_probe_failed) ?: "Endpoint probe failed"
+                        }
                        DiagnosticsLog.record(
                            category = DiagnosticCategory.Endpoint,
                            severity = if (ok) DiagnosticSeverity.Info else DiagnosticSeverity.Warning,
-                            title = if (ok) "Endpoint probe ok" else "Endpoint probe failed",
+                            title = probeTitle,
                            detail = if (ok) null else "HTTP ${resp.code}",
                            endpointRole = candidate.role,
                            url = candidate.api.url,
@@ -332,7 +345,7 @@ class EndpointResolver(
                    DiagnosticsLog.record(
                        category = DiagnosticCategory.Endpoint,
                        severity = DiagnosticSeverity.Warning,
-                        title = "Endpoint probe timeout",
+                        title = context?.getString(R.string.endpoint_diag_probe_timeout) ?: "Endpoint probe timeout",
                        detail = "No /health response in ${PROBE_TIMEOUT_MS}ms",
                        endpointRole = candidate.role,
                        url = candidate.api.url,
@@ -345,7 +358,7 @@ class EndpointResolver(
                DiagnosticsLog.record(
                    category = DiagnosticCategory.Endpoint,
                    severity = DiagnosticSeverity.Warning,
-                    title = "Endpoint probe timeout",
+                    title = context?.getString(R.string.endpoint_diag_probe_timeout) ?: "Endpoint probe timeout",
                    detail = "No /health response in ${PROBE_TIMEOUT_MS}ms",
                    endpointRole = candidate.role,
                    url = candidate.api.url,
@@ -359,7 +372,7 @@ class EndpointResolver(
                DiagnosticsLog.record(
                    category = DiagnosticCategory.Endpoint,
                    severity = DiagnosticSeverity.Warning,
-                    title = "Endpoint probe failed",
+                    title = context?.getString(R.string.endpoint_diag_probe_failed) ?: "Endpoint probe failed",
                    detail = e.javaClass.simpleName,
                    endpointRole = candidate.role,
                    url = candidate.api.url,
@@ -2,9 +2,13 @@ package com.hermesandroid.relay.network.upstream

 import android.util.Log
 import com.hermesandroid.relay.data.Attachment
+import com.hermesandroid.relay.data.BackgroundTaskPhase
+import com.hermesandroid.relay.data.BackgroundTaskState
 import com.hermesandroid.relay.data.ChatMessage
 import com.hermesandroid.relay.data.ChatSession
+import com.hermesandroid.relay.data.ChatTurnCheckpoint
 import com.hermesandroid.relay.data.HermesCard
+import com.hermesandroid.relay.data.MessageDeliveryStatus
 import com.hermesandroid.relay.data.MessageRole
 import com.hermesandroid.relay.data.RealtimeTurnTrace
 import com.hermesandroid.relay.data.ToolCall
@@ -14,6 +18,7 @@ import com.hermesandroid.relay.network.upstream.GatewaySubagentEvent
 import com.hermesandroid.relay.network.upstream.models.MessageItem
 import com.hermesandroid.relay.network.upstream.models.RelayStreamEventEnvelope
 import com.hermesandroid.relay.network.upstream.models.SessionItem
+import com.hermesandroid.relay.voice.RealtimeTurnSyncBuilder
 import kotlinx.coroutines.flow.MutableStateFlow
 import kotlinx.coroutines.flow.StateFlow
 import kotlinx.coroutines.flow.asStateFlow
@@ -211,17 +216,68 @@ class ChatHandler {
     */
    private val _turnStatus = MutableStateFlow<String?>(null)
    val turnStatus: StateFlow<String?> = _turnStatus.asStateFlow()
+    private var turnStatusKind: String? = null

-    fun setTurnStatus(text: String) {
+    fun setTurnStatus(text: String, kind: String? = null) {
+        turnStatusKind = kind
        _turnStatus.value = text
    }

+    fun clearTurnStatus(kind: String? = null) {
+        if (kind != null && turnStatusKind != kind) return
+        turnStatusKind = null
+        _turnStatus.value = null
+    }
+
    private val _isStreaming = MutableStateFlow(false)
    val isStreaming: StateFlow<Boolean> = _isStreaming.asStateFlow()

+    /**
+     * Silently drop the global streaming flag + turn-status caption without
+     * touching the message list, error, or per-message `isStreaming` flags.
+     * For abandoning an in-flight answer recovery (issue #166) on a path that
+     * clears or reloads the transcript itself: there is no placeholder to
+     * finalize and nothing went wrong, so [onStreamComplete] (which reconciles
+     * a specific message) and [onStreamError] (which raises an error banner)
+     * are both the wrong tool. Leaves per-message streaming flags intact so a
+     * caller that still needs to find the placeholder afterwards (e.g.
+     * cancelStream's Stopped-badge pass) can.
+     */
+    fun clearStreamingStatus() {
+        _isStreaming.value = false
+        clearTurnStatus()
+    }
+
    private val _sessions = MutableStateFlow<List<ChatSession>>(emptyList())
    val sessions: StateFlow<List<ChatSession>> = _sessions.asStateFlow()

+    // User-chosen Thread names (sessionId → name), authoritative over the
+    // server's auto-title — applied in [updateSessions] so the gateway's async
+    // auto-titler can't clobber the name. ChatViewModel hydrates this map from
+    // ThreadNameStore, so names survive both list refreshes and app restarts.
+    private val userThreadNames = mutableMapOf<String, String>()
+
+    /** Record a user-chosen name for one Thread session + re-apply it now. */
+    fun setUserThreadName(sessionId: String, name: String) {
+        userThreadNames[sessionId] = name
+        reapplyThreadNames()
+    }
+
+    /** Merge persisted user-thread-names in (e.g. the initial DataStore load) —
+     *  merge, not replace, so a just-created name set this session isn't clobbered
+     *  by a slightly-stale persisted emission. */
+    fun setUserThreadNames(names: Map<String, String>) {
+        userThreadNames.putAll(names)
+        reapplyThreadNames()
+    }
+
+    private fun reapplyThreadNames() {
+        if (userThreadNames.isEmpty()) return
+        _sessions.update { list ->
+            list.map { s -> userThreadNames[s.sessionId]?.let { s.copy(title = it) } ?: s }
+        }
+    }
+
    private val _error = MutableStateFlow<String?>(null)
    val error: StateFlow<String?> = _error.asStateFlow()

@@ -308,6 +364,43 @@ class ChatHandler {
        }
    }

+    /**
+     * Update the [ChatMessage.deliveryStatus] of a sent message by id — used by
+     * the agent-Thread reply path (`source=phone`) to move a bubble through
+     * SENDING → DELIVERED (on the relay's `proactive.reply.ack`) / FAILED.
+     * No-op when the id isn't present (it may have aged out of the window).
+     */
+    fun updateDeliveryStatus(messageId: String, status: MessageDeliveryStatus) {
+        _messages.update { list ->
+            list.map { if (it.id == messageId) it.copy(deliveryStatus = status) else it }
+        }
+    }
+
+    /** Attach the first Chat-visible state for a promoted/durable Hermes run. */
+    fun setBackgroundTask(messageId: String, task: BackgroundTaskState) {
+        _messages.update { list ->
+            list.map { message ->
+                if (message.id == messageId) message.copy(backgroundTask = task) else message
+            }
+        }
+    }
+
+    /** Update an existing task in place; no-op when the message/task is absent. */
+    fun updateBackgroundTask(
+        messageId: String,
+        transform: (BackgroundTaskState) -> BackgroundTaskState,
+    ) {
+        _messages.update { list ->
+            list.map { message ->
+                if (message.id == messageId && message.backgroundTask != null) {
+                    message.copy(backgroundTask = transform(message.backgroundTask))
+                } else {
+                    message
+                }
+            }
+        }
+    }
+
    /**
     * Append a SYSTEM-role notice bubble (e.g. a gateway interactive ask the
     * phone can't answer). SYSTEM role keeps it out of the voice TTS observer
@@ -326,6 +419,50 @@ class ChatHandler {
        }
    }

+    /**
+     * Inject an agent-initiated ("proactive") message into the active session
+     * (the `phone` platform's `surfacing="session"` path). SYSTEM role — like
+     * [addSystemNotice] — keeps it out of the voice TTS stream observer (which
+     * only voices ASSISTANT messages) so injection can't trigger uncontrolled
+     * speech; Phase 3's TTS-on-voice will speak proactive messages explicitly.
+     * [ChatMessage.clientOnly] preserves it across the history reconcile.
+     */
+    fun addProactiveMessage(text: String) {
+        _messages.update { list ->
+            val msg = ChatMessage(
+                id = "proactive-msg-${java.util.UUID.randomUUID()}",
+                role = MessageRole.SYSTEM,
+                content = text,
+                timestamp = System.currentTimeMillis(),
+                clientOnly = true,
+            )
+            (list + msg).let { if (it.size > MAX_MESSAGES) it.drop(it.size - MAX_MESSAGES) else it }
+        }
+    }
+
+    /**
+     * Render an agent-initiated message inline in the open Thread as an
+     * ASSISTANT bubble (the unified-Threads live path — the agent's reply shows
+     * in the conversation, not just as a notification). [clientOnly] preserves it
+     * across the history reconcile; idempotent on the proactive [messageId] so a
+     * re-delivered push (e.g. an outbound-buffer flush) never double-posts.
+     */
+    fun addAgentThreadMessage(text: String, messageId: String?, agentName: String?) {
+        val id = messageId?.let { "proactive-$it" } ?: "proactive-${java.util.UUID.randomUUID()}"
+        _messages.update { list ->
+            if (messageId != null && list.any { it.id == id }) return@update list
+            val msg = ChatMessage(
+                id = id,
+                role = MessageRole.ASSISTANT,
+                content = text,
+                timestamp = System.currentTimeMillis(),
+                agentName = agentName,
+                clientOnly = true,
+            )
+            (list + msg).let { if (it.size > MAX_MESSAGES) it.drop(it.size - MAX_MESSAGES) else it }
+        }
+    }
+
    /**
     * Append an assistant message that carries ONLY a gateway ask card
     * (clarify / approval / sudo / secret). Local-only — the server never
@@ -375,6 +512,11 @@ class ChatHandler {
        }
    }

+    /** Remove a provisional client-side message that never became a real turn. */
+    fun removeMessage(messageId: String) {
+        _messages.update { messages -> messages.filterNot { it.id == messageId } }
+    }
+
    /**
     * Append a local-only voice-intent trace to the chat scroll. Used by
     * the sideload voice intent flow (`RealVoiceBridgeIntentHandler`) so
@@ -756,6 +898,140 @@ class ChatHandler {
        }
    }

+    /**
+     * Rehydrate the last client-owned state of an unfinished turn.
+     *
+     * The caller loads server history first. That means the user row may already
+     * be present while the assistant row is not yet durable; positional matching
+     * avoids duplicating short repeated prompts. Rich assistant-only state is
+     * then restored so thinking and tool cards do not reset to an empty spinner.
+     */
+    fun restoreInFlightTurn(
+        checkpoint: ChatTurnCheckpoint,
+        upstreamAssistantText: String? = null,
+    ) {
+        val user = checkpoint.user
+        val assistant = checkpoint.assistant
+        val upstreamText = upstreamAssistantText.orEmpty()
+        val currentAssistant = _messages.value.lastOrNull { it.id == assistant.id }
+        val restoredContent = listOf(
+            assistant.content,
+            upstreamText,
+            currentAssistant?.content.orEmpty(),
+        ).maxByOrNull { it.length }.orEmpty()
+        val checkpointTools = assistant.toolCalls.map { tool ->
+            ToolCall(
+                id = tool.id,
+                name = tool.name,
+                args = null,
+                result = tool.result,
+                success = tool.success,
+                isComplete = tool.isComplete,
+                error = tool.error,
+                runId = tool.runId,
+                provenance = tool.provenance,
+                startedAt = tool.startedAt,
+                completedAt = tool.completedAt,
+                isGenerating = tool.isGenerating,
+                taskIndex = tool.taskIndex,
+                taskLabel = tool.taskLabel,
+                outputRisk = tool.outputRisk,
+                outputRiskFindings = tool.outputRiskFindings,
+                outputRiskRedacted = tool.outputRiskRedacted,
+            )
+        }
+        val currentTools = currentAssistant?.toolCalls.orEmpty()
+        val restoredTools = buildList {
+            checkpointTools.forEach { checkpointTool ->
+                val live = currentTools.firstOrNull {
+                    (it.id != null && it.id == checkpointTool.id) ||
+                        (it.id == null && checkpointTool.id == null &&
+                            it.name == checkpointTool.name &&
+                            it.taskIndex == checkpointTool.taskIndex)
+                }
+                add(live ?: checkpointTool)
+            }
+            currentTools.filterTo(this) { live ->
+                checkpointTools.none { checkpointTool ->
+                    (live.id != null && live.id == checkpointTool.id) ||
+                        (live.id == null && checkpointTool.id == null &&
+                            live.name == checkpointTool.name &&
+                            live.taskIndex == checkpointTool.taskIndex)
+                }
+            }
+        }
+        val restoredBackgroundTask = assistant.backgroundTask?.let { task ->
+            BackgroundTaskState(
+                id = task.id,
+                title = task.title,
+                tier = task.tier,
+                phase = runCatching { BackgroundTaskPhase.valueOf(task.phase) }
+                    .getOrDefault(BackgroundTaskPhase.RUNNING),
+                statusLine = task.statusLine,
+                completedToolCount = task.completedToolCount,
+                queuedCount = task.queuedCount,
+                startedAt = task.startedAt,
+            )
+        }
+        val restoredAssistant = ChatMessage(
+            id = assistant.id,
+            role = MessageRole.ASSISTANT,
+            content = restoredContent,
+            timestamp = assistant.timestamp,
+            isStreaming = true,
+            toolCalls = restoredTools,
+            thinkingContent = listOf(
+                assistant.thinkingContent,
+                currentAssistant?.thinkingContent.orEmpty(),
+            ).maxByOrNull { it.length }.orEmpty(),
+            isThinkingStreaming = currentAssistant?.isThinkingStreaming
+                ?: assistant.isThinkingStreaming,
+            inputTokens = currentAssistant?.inputTokens ?: assistant.inputTokens,
+            outputTokens = currentAssistant?.outputTokens ?: assistant.outputTokens,
+            totalTokens = currentAssistant?.totalTokens ?: assistant.totalTokens,
+            estimatedCost = currentAssistant?.estimatedCost ?: assistant.estimatedCost,
+            agentName = currentAssistant?.agentName ?: assistant.agentName ?: activeAgentName,
+            badges = (assistant.badges + currentAssistant?.badges.orEmpty()).distinct(),
+            cards = currentAssistant?.cards?.takeIf { it.isNotEmpty() } ?: assistant.cards,
+            cardDispatches = currentAssistant?.cardDispatches?.takeIf { it.isNotEmpty() }
+                ?: assistant.cardDispatches,
+            backgroundTask = currentAssistant?.backgroundTask ?: restoredBackgroundTask,
+        )
+
+        activeAgentName = restoredAssistant.agentName ?: activeAgentName
+        _messages.update { current ->
+            val withoutOldAssistant = current.filterNot { it.id == assistant.id }
+            val users = withoutOldAssistant.filter { it.role == MessageRole.USER }
+            val positionalUser = users.getOrNull(checkpoint.priorUserMessageCount)
+            val hasUser = withoutOldAssistant.any { it.id == user.id } ||
+                positionalUser?.content?.trim() == user.content.trim()
+            val withUser = if (hasUser) {
+                withoutOldAssistant
+            } else {
+                withoutOldAssistant + ChatMessage(
+                    id = user.id,
+                    role = MessageRole.USER,
+                    content = user.content,
+                    timestamp = user.timestamp,
+                )
+            }
+            val insertBeforeAsk = withUser.indexOfFirst {
+                it.clientOnly && it.id.startsWith("ask-")
+            }
+            val restored = if (insertBeforeAsk >= 0) {
+                withUser.toMutableList().apply { add(insertBeforeAsk, restoredAssistant) }
+            } else {
+                withUser + restoredAssistant
+            }
+            restored.let { list ->
+                if (list.size > MAX_MESSAGES) list.drop(list.size - MAX_MESSAGES) else list
+            }
+        }
+        _isStreaming.value = true
+        turnStatusKind = null
+        _turnStatus.value = checkpoint.turnStatus ?: "Reconnecting to the active turn…"
+    }
+
    fun clearMessages() {
        _messages.value = emptyList()
        // Drop any pending line buffers / dedupe state so a fresh session
@@ -769,6 +1045,21 @@ class ChatHandler {
        subagentLabels.clear()
    }

+    /**
+     * Load a fully-static, offline transcript for Demo / Explore mode (see
+     * [com.hermesandroid.relay.data.DemoContent]). Clears any prior state and
+     * replaces the message list wholesale — these messages are terminal
+     * ([ChatMessage.isStreaming] = false), so no streaming/dedupe machinery
+     * runs against them. Drives the canned conversation through the same
+     * `_messages` flow the live chat surface renders, so demo reuses the real
+     * UI rather than a parallel one. No network is touched.
+     */
+    fun loadDemoTranscript(demoMessages: List<ChatMessage>) {
+        clearMessages()
+        _isStreaming.value = false
+        _messages.value = demoMessages
+    }
+
    /**
     * Repair assistant labels after late-arriving agent config. History can
     * load before GET /api/config returns, leaving default-profile messages
@@ -911,6 +1202,11 @@ class ChatHandler {
            }
        }

+        // Trimmed assistant texts of synced provider-answered realtime turns
+        // found in this reload — used below to drop their superseded local
+        // clientOnly bubbles (same exchange, pre-sync copy).
+        val syncedRealtimeTurnContents = mutableSetOf<String>()
+
        val loaded = items.mapNotNull { item ->
            val role = when (item.role) {
                "user" -> MessageRole.USER
@@ -960,7 +1256,7 @@ class ChatHandler {
            // straight onto the reconstructed ChatMessage and strip their
            // lines from the displayed content in the same pass. No
            // post-assignment dispatch needed.
-            val (cleanedContent, extractedCards) = if (
+            val (cardCleanedContent, extractedCards) = if (
                role == MessageRole.ASSISTANT && afterMedia.isNotEmpty()
            ) {
                extractCardsFromContent(afterMedia)
@@ -968,6 +1264,23 @@ class ChatHandler {
                afterMedia to emptyList()
            }

+            // A provider-answered realtime voice turn synced into the session
+            // (RealtimeTurnSyncBuilder) carries a trailing provenance marker —
+            // "[Realtime Agent provider-native voice turn: provider=…]" — in
+            // its assistant text. Render it as the quiet "Realtime Agent"
+            // badge (same chip live turns get) instead of raw bracket noise,
+            // and remember the stripped text so the superseded local
+            // clientOnly bubble can be dropped below instead of duplicating
+            // the exchange.
+            val strippedRealtimeContent = if (role == MessageRole.ASSISTANT) {
+                RealtimeTurnSyncBuilder.stripProvenanceMarker(cardCleanedContent)
+            } else {
+                null
+            }
+            val isSyncedRealtimeTurn = strippedRealtimeContent != null
+            val cleanedContent = strippedRealtimeContent ?: cardCleanedContent
+            if (isSyncedRealtimeTurn) syncedRealtimeTurnContents.add(cleanedContent.trim())
+
            val prior = priorById[messageId]
            // Outbound attachments: prefer an id-match (covers any future
            // user-message id reconciliation), else fall back to the
@@ -1019,6 +1332,11 @@ class ChatHandler {
                    } else {
                        ""
                    },
+                    badges = if (isSyncedRealtimeTurn && "Realtime Agent" !in prior.badges) {
+                        prior.badges + "Realtime Agent"
+                    } else {
+                        prior.badges
+                    },
                )
            } else {
                // INSERT — a server message with no local row yet. Built from
@@ -1037,6 +1355,7 @@ class ChatHandler {
                    // Server persists per-message reasoning — restore it so the
                    // Thought-process block survives returning to the chat.
                    thinkingContent = if (role == MessageRole.ASSISTANT) serverThinking ?: "" else "",
+                    badges = if (isSyncedRealtimeTurn) listOf("Realtime Agent") else emptyList(),
                )
            }
        }
@@ -1064,7 +1383,19 @@ class ChatHandler {
        // but IS in the transcript, so it reconciles normally; only clientOnly +
        // absent-from-transcript marks a preservable orphan.
        val loadedIds = loaded.mapTo(HashSet()) { it.id }
-        val preservedLocal = _messages.value.filter { it.clientOnly && it.id !in loadedIds }
+        val preservedLocal = _messages.value.filter { msg ->
+            if (!msg.clientOnly || msg.id in loadedIds) return@filter false
+            // Drop a provider-answered realtime bubble whose SYNCED copy just
+            // loaded from the server transcript (matched on the synced
+            // assistant text) — keeping both would render the exchange twice.
+            // Unsynced traces are always preserved: they are still the only
+            // record of the turn.
+            val trace = msg.realtimeTurn
+            !(
+                trace != null && trace.syncedToServer &&
+                    trace.assistantText.trim() in syncedRealtimeTurnContents
+                )
+        }
        val merged = if (preservedLocal.isEmpty()) {
            loaded
        } else {
@@ -1338,18 +1669,45 @@ class ChatHandler {
     * Update sessions list from API response.
     */
    fun updateSessions(items: List<SessionItem>) {
+        // Index the current rows so a server row that arrives without a title
+        // can inherit a title we already know locally. Auto-titling is a
+        // fire-and-forget background job on the server (upstream
+        // agent.title_generator.maybe_auto_title) — and on the api_server
+        // SSE/runs surfaces it never runs at all — so a freshly persisted
+        // session is routinely returned with title == null for a few seconds
+        // (or forever) even though we're already showing the optimistic
+        // first-message preview. Blindly copying that null is what surfaced
+        // sessions as "Untitled" in the drawer (issue #133). Preserve the known
+        // local title whenever the server hasn't supplied a non-blank one.
+        val existingById = _sessions.value.associateBy { it.sessionId }
        val mapped = items.map { item ->
            val startedAtMs = timestampToMillis(item.startedAt)
            val lastActivityAtMs = timestampToMillis(item.resolvedLastActivity)
            val activityAtMs = firstPositive(lastActivityAtMs, startedAtMs)
+            val serverTitle = item.title?.takeIf { it.isNotBlank() }
+            val serverPreview = item.preview?.takeIf { it.isNotBlank() }
+            // A user-chosen Thread name is authoritative (Discord-style): it
+            // overrides the server's auto-title so the gateway's async auto-titler
+            // can't clobber the name the user set. A known local preview remains
+            // ahead of the server's truncated first-message preview; the latter is
+            // the standard upstream/Desktop fallback for historical untitled rows.
+            val resolvedTitle = userThreadNames[item.id]
+                ?: serverTitle
+                ?: existingById[item.id]?.title?.takeIf { it.isNotBlank() }
+                ?: serverPreview
            ChatSession(
                sessionId = item.id,
-                title = item.title,
+                title = resolvedTitle,
                model = item.model,
                messageCount = item.messageCount ?: 0,
                updatedAt = activityAtMs,
                startedAt = startedAtMs,
                lastActivityAt = lastActivityAtMs,
+                // Carry the upstream platform/source so the drawer can tag agent
+                // Threads (source=phone) — this is the one list site fed by the wire
+                // SessionItem; the other ChatSession() call sites are local optimistic
+                // rows (default source). (ADR 12 — Threads surface, slice 1.)
+                source = item.source,
            )
        }.sortedByDescending { it.activityTimestamp }
        // Preserve the active session's optimistic row when the server list
@@ -2392,6 +2750,27 @@ class ChatHandler {
        }
    }

+    /** Attach untrusted output-risk metadata to the exact matching tool call. */
+    fun onToolOutputRisk(messageId: String, outputRisk: GatewayToolOutputRisk) {
+        _messages.update { messages ->
+            messages.map { msg ->
+                if (msg.id != messageId || msg.role != MessageRole.ASSISTANT) return@map msg
+                val updatedCalls = msg.toolCalls.map { call ->
+                    if (call.id == outputRisk.toolCallId) {
+                        call.copy(
+                            outputRisk = outputRisk.risk,
+                            outputRiskFindings = outputRisk.findings,
+                            outputRiskRedacted = outputRisk.redacted,
+                        )
+                    } else {
+                        call
+                    }
+                }
+                if (updatedCalls == msg.toolCalls) msg else msg.copy(toolCalls = updatedCalls)
+            }
+        }
+    }
+
    /**
     * A single assistant turn completed, but the agent run may continue
     * (e.g., tool calls pending → next assistant turn). Marks the current
@@ -2477,7 +2856,7 @@ class ChatHandler {
     */
    fun onStreamComplete(messageId: String) {
        _isStreaming.value = false
-        _turnStatus.value = null
+        clearTurnStatus()
        insideThinkingBlock = false

        // Flush any remaining annotation text that didn't end with a newline
@@ -2521,6 +2900,9 @@ class ChatHandler {

    fun onStreamError(message: String) {
        _isStreaming.value = false
+        // The turn is over — a stale lifecycle/recovery caption must not
+        // outlive it (onStreamComplete clears the same way).
+        clearTurnStatus()
        _error.value = message
        // Clear streaming flag on any actively streaming message
        _messages.update { messages ->
@@ -2627,6 +3009,10 @@ class ChatHandler {
    fun setLastSentMessage(text: String) {
        _lastSentMessage.value = text
    }
+
+    fun clearLastSentMessage() {
+        _lastSentMessage.value = null
+    }
 }

 /**
@@ -7,6 +7,9 @@ import com.hermesandroid.relay.network.upstream.models.MessageItem
 import com.hermesandroid.relay.network.upstream.models.MessageListResponse
 import com.hermesandroid.relay.network.upstream.models.SessionItem
 import com.hermesandroid.relay.network.upstream.models.SessionListResponse
+import com.hermesandroid.relay.network.upstream.models.SessionPruneFilters
+import com.hermesandroid.relay.network.upstream.models.SessionPrunePreview
+import com.hermesandroid.relay.network.upstream.models.SessionPruneResult
 import com.hermesandroid.relay.auth.SecureStoreCache
 import com.hermesandroid.relay.auth.SessionTokenStore
 import com.hermesandroid.relay.auth.buildRawTokenStore
@@ -24,6 +27,7 @@ import kotlinx.serialization.json.booleanOrNull
 import kotlinx.serialization.json.buildJsonObject
 import kotlinx.serialization.json.contentOrNull
 import kotlinx.serialization.json.jsonObject
+import kotlinx.serialization.json.jsonPrimitive
 import kotlinx.serialization.json.put
 import okhttp3.Cookie
 import okhttp3.CookieJar
@@ -77,11 +81,34 @@ data class DashboardWsTicket(
    val ttlSeconds: Int? = null,
 )

+/** Sticky server default and the profile that owns the running dashboard process. */
+data class DashboardProfileScope(
+    val active: String,
+    val current: String,
+)
+
 data class DashboardChatDisplaySettings(
    val showReasoning: Boolean? = null,
    val toolDisplay: String? = null,
 )

+/** One entry from `GET /api/audio/elevenlabs/voices` — non-secret voice metadata. */
+data class ElevenLabsVoice(
+    val voiceId: String,
+    val name: String,
+    val label: String,
+)
+
+/**
+ * Result of `GET /api/audio/elevenlabs/voices`. [available] is false when the
+ * server has no `ELEVENLABS_API_KEY` configured (the picker degrades to a free
+ * text field in that case); true with a populated [voices] list otherwise.
+ */
+data class ElevenLabsVoices(
+    val available: Boolean,
+    val voices: List<ElevenLabsVoice>,
+)
+
 /**
 * Native client for the Hermes dashboard/admin server (:9119).
 *
@@ -101,6 +128,23 @@ class DashboardApiClient(
 ) {
    private val baseUrl: String = baseUrl.trim().trimEnd('/')

+    /**
+     * Resolve a request URL without ever throwing. okhttp's
+     * [Request.Builder.url] (String overload) throws `IllegalArgumentException`
+     * (`Invalid URL host: "..."`) on a malformed host — e.g. a non-URL value
+     * such as a UI label / docs line reaching the dashboard-URL slot (#131). If
+     * that throw escapes one of this client's `withContext(IO)` suspend lambdas
+     * on a Main-dispatched caller, the app force-closes. Parsing via
+     * [toHttpUrlOrNull] lets every method short-circuit to [Result.failure]
+     * instead. Returns null when `baseUrl + pathAndQuery` is not a valid http(s)
+     * URL.
+     */
+    private fun resolveUrl(pathAndQuery: String): HttpUrl? =
+        "$baseUrl$pathAndQuery".toHttpUrlOrNull()
+
+    private fun invalidUrlException(): IOException =
+        IOException("Dashboard URL \"$baseUrl\" is not a valid http(s) address")
+
    suspend fun getStatus(): Result<DashboardStatus> = withContext(Dispatchers.IO) {
        getJson("/api/status").mapCatching { parseStatus(it) }
    }
@@ -118,8 +162,9 @@ class DashboardApiClient(

    suspend fun getJsonElement(path: String): Result<JsonElement> = withContext(Dispatchers.IO) {
        val normalized = if (path.startsWith("/")) path else "/$path"
+        val httpUrl = resolveUrl(normalized) ?: return@withContext Result.failure(invalidUrlException())
        val request = Request.Builder()
-            .url("$baseUrl$normalized")
+            .url(httpUrl)
            .get()
            .build()
        executeJsonElement(request, normalized)
@@ -130,8 +175,9 @@ class DashboardApiClient(
        payload: JsonObject = JsonObject(emptyMap()),
    ): Result<JsonObject> = withContext(Dispatchers.IO) {
        val normalized = if (path.startsWith("/")) path else "/$path"
+        val httpUrl = resolveUrl(normalized) ?: return@withContext Result.failure(invalidUrlException())
        val request = Request.Builder()
-            .url("$baseUrl$normalized")
+            .url(httpUrl)
            .post(json.encodeToString(JsonObject.serializer(), payload).toRequestBody(JSON_MEDIA))
            .build()
        executeJson(request, normalized)
@@ -142,17 +188,32 @@ class DashboardApiClient(
        payload: JsonObject,
    ): Result<JsonObject> = withContext(Dispatchers.IO) {
        val normalized = if (path.startsWith("/")) path else "/$path"
+        val httpUrl = resolveUrl(normalized) ?: return@withContext Result.failure(invalidUrlException())
        val request = Request.Builder()
-            .url("$baseUrl$normalized")
+            .url(httpUrl)
            .put(json.encodeToString(JsonObject.serializer(), payload).toRequestBody(JSON_MEDIA))
            .build()
        executeJson(request, normalized)
    }

+    suspend fun patchJsonObject(
+        path: String,
+        payload: JsonObject,
+    ): Result<JsonObject> = withContext(Dispatchers.IO) {
+        val normalized = if (path.startsWith("/")) path else "/$path"
+        val httpUrl = resolveUrl(normalized) ?: return@withContext Result.failure(invalidUrlException())
+        val request = Request.Builder()
+            .url(httpUrl)
+            .patch(json.encodeToString(JsonObject.serializer(), payload).toRequestBody(JSON_MEDIA))
+            .build()
+        executeJson(request, normalized)
+    }
+
    suspend fun deleteJsonObject(path: String): Result<JsonObject> = withContext(Dispatchers.IO) {
        val normalized = if (path.startsWith("/")) path else "/$path"
+        val httpUrl = resolveUrl(normalized) ?: return@withContext Result.failure(invalidUrlException())
        val request = Request.Builder()
-            .url("$baseUrl$normalized")
+            .url(httpUrl)
            .delete()
            .build()
        executeJson(request, normalized)
@@ -164,8 +225,9 @@ class DashboardApiClient(
        payload: JsonObject,
    ): Result<JsonObject> = withContext(Dispatchers.IO) {
        val normalized = if (path.startsWith("/")) path else "/$path"
+        val httpUrl = resolveUrl(normalized) ?: return@withContext Result.failure(invalidUrlException())
        val request = Request.Builder()
-            .url("$baseUrl$normalized")
+            .url(httpUrl)
            .delete(json.encodeToString(JsonObject.serializer(), payload).toRequestBody(JSON_MEDIA))
            .build()
        executeJson(request, normalized)
@@ -176,8 +238,69 @@ class DashboardApiClient(
    suspend fun getChatDisplaySettings(): Result<DashboardChatDisplaySettings> =
        getJsonObject("/api/config").mapCatching { root -> parseChatDisplaySettings(root) }

-    /** Full provider/model universe — REST twin of the TUI's `model.options` RPC. */
-    suspend fun getModelOptions(): Result<JsonObject> = getJsonObject("/api/model/options")
+    // --- Config tree (dashboard parity with hermes-desktop Settings → config.yaml) ---
+
+    /**
+     * The full runtime config VALUES as a nested tree (model/tts/stt/...).
+     * Upstream strips internal `_`-prefixed keys server-side, so the object is
+     * safe to mutate and round-trip back through [updateConfig].
+     */
+    suspend fun getConfig(): Result<JsonObject> = getJsonObject("/api/config")
+
+    /**
+     * The config SCHEMA: `{fields: {<dot.path>: {type, description, category,
+     * options?}}, category_order: [...]}`. Describes how to render each field;
+     * pair it with [getConfig] for current values. Note this is distinct from
+     * the values tree — `fields` keys are flat dot-paths, the values are nested.
+     */
+    suspend fun getConfigSchema(): Result<JsonObject> = getJsonObject("/api/config/schema")
+
+    /**
+     * Replace the runtime config (`PUT /api/config`). Upstream `save_config`
+     * writes the WHOLE document, so [config] MUST be the full values tree
+     * (read [getConfig], mutate, write back) — a partial object would drop
+     * every key it omits. [profile] null/blank targets the launch profile.
+     */
+    suspend fun updateConfig(config: JsonObject, profile: String? = null): Result<JsonObject> =
+        putJsonObject(
+            path = "/api/config",
+            payload = buildJsonObject {
+                put("config", config)
+                profile?.trim()?.takeIf { it.isNotBlank() }?.let { put("profile", it) }
+            },
+        )
+
+    /**
+     * ElevenLabs voice catalog for the `tts.elevenlabs.voice_id` picker
+     * (`GET /api/audio/elevenlabs/voices`, dashboard cookie auth). Returns
+     * `available=false` with an empty list when the server has no API key
+     * configured; the API key itself never leaves the server.
+     */
+    suspend fun getElevenLabsVoices(): Result<ElevenLabsVoices> = withContext(Dispatchers.IO) {
+        getJson("/api/audio/elevenlabs/voices").mapCatching { parseElevenLabsVoices(it) }
+    }
+
+    /**
+     * Full provider/model universe — REST twin of the TUI's `model.options` RPC.
+     *
+     * Always opts into `include_unconfigured=1`: newer upstream defaults this
+     * route to configured-providers-only, which would silently drop the
+     * unauthenticated skeleton rows Manage renders as its Keys-setup
+     * affordance. Older upstream returned the full universe by default and
+     * ignores the extra param, so both generations serve the same catalog.
+     *
+     * [refresh] maps to upstream's explicit `refresh=1` path, which refreshes
+     * dynamic/custom-provider catalogs on demand without probing every
+     * provider during normal picker opens.
+     */
+    suspend fun getModelOptions(refresh: Boolean = false): Result<JsonObject> =
+        getJsonObject(
+            if (refresh) {
+                "/api/model/options?refresh=1&include_unconfigured=1"
+            } else {
+                "/api/model/options?include_unconfigured=1"
+            },
+        )

    /**
     * Assign the main model in `~/.hermes/config.yaml` (new sessions only).
@@ -380,6 +503,21 @@ class DashboardApiClient(
            payload = buildJsonObject { put("name", name) },
        )

+    /**
+     * Read the upstream profile split used by app-global remote mode.
+     * `active` is the sticky default for new Hermes invocations; `current` is
+     * the already-running dashboard/gateway process scope. They can differ.
+     */
+    suspend fun getActiveProfileScope(): Result<DashboardProfileScope> =
+        getJsonObject("/api/profiles/active").mapCatching { root ->
+            DashboardProfileScope(
+                active = root["active"]?.jsonPrimitive?.contentOrNull
+                    ?.trim()?.takeIf { it.isNotEmpty() } ?: "default",
+                current = root["current"]?.jsonPrimitive?.contentOrNull
+                    ?.trim()?.takeIf { it.isNotEmpty() } ?: "default",
+            )
+        }
+
    suspend fun getProfileSoul(name: String): Result<JsonObject> =
        getJsonObject("/api/profiles/${pathSegment(name)}/soul")

@@ -414,7 +552,11 @@ class DashboardApiClient(
     * ordering where the host honors it. Android still sorts by decoded
     * `last_active` locally because older hosts return started-time order.
     */
-    suspend fun listSessions(profile: String? = null, limit: Int = 200): Result<List<SessionItem>> =
+    suspend fun listSessions(
+        profile: String? = null,
+        limit: Int = 200,
+        archived: String? = null,
+    ): Result<List<SessionItem>> =
        withContext(Dispatchers.IO) {
            val query = buildList {
                add("limit=${limit.coerceIn(1, 200)}")
@@ -422,6 +564,10 @@ class DashboardApiClient(
                add("min_messages=1")
                val name = profile?.trim().orEmpty()
                if (name.isNotBlank()) add("profile=${pathSegment(name)}")
+                // Upstream `archived` filter: exclude (default) | only | include.
+                // Omitted unless requested so older hosts see an unchanged request.
+                val archivedMode = archived?.trim().orEmpty()
+                if (archivedMode.isNotBlank()) add("archived=${pathSegment(archivedMode)}")
            }.joinToString(prefix = "?", separator = "&")
            getJson("/api/sessions$query").mapCatching { root ->
                val parsed = json.decodeFromJsonElement(SessionListResponse.serializer(), root)
@@ -461,6 +607,98 @@ class DashboardApiClient(
    suspend fun deleteSession(sessionId: String, profile: String? = null): Result<JsonObject> =
        deleteJsonObject("/api/sessions/${pathSegment(sessionId)}${profileQuery(profile)}")

+    /**
+     * Export one session as server-owned JSON metadata + messages. This is the
+     * safe "archive a copy before cleanup" primitive for clients that want to
+     * offer download/share before a destructive delete or prune. Profile scoping
+     * matches [deleteSession].
+     */
+    suspend fun exportSession(sessionId: String, profile: String? = null): Result<JsonObject> =
+        getJsonObject("/api/sessions/${pathSegment(sessionId)}/export${profileQuery(profile)}")
+
+    /**
+     * Rename a session scoped to a profile via the dashboard
+     * `PATCH /api/sessions/{id}` surface — the write twin of [deleteSession].
+     * A non-default profile's sessions live in that profile's own `state.db`,
+     * so the unscoped api_server rename would patch the wrong DB and the new
+     * title would never appear in the profile-scoped list. Current upstream
+     * reads `profile` from the PATCH body (`SessionRename`); the query param
+     * rides along for builds that scoped by query.
+     */
+    suspend fun renameSession(sessionId: String, title: String, profile: String? = null): Result<JsonObject> =
+        patchJsonObject(
+            "/api/sessions/${pathSegment(sessionId)}${profileQuery(profile)}",
+            buildJsonObject {
+                put("title", title)
+                profile?.trim()?.takeIf { it.isNotBlank() }?.let { put("profile", it) }
+            },
+        )
+
+    /**
+     * Soft-archive or restore a session via the same dashboard
+     * `PATCH /api/sessions/{id}` surface (`{archived: true|false}`). Archived
+     * sessions drop out of the default list and are excluded from a prune
+     * unless [SessionPruneFilters.includeArchived] is set; list them back with
+     * [listSessions] `archived = "only"`. Profile scoping matches
+     * [renameSession]: body for current upstream, query for older builds.
+     */
+    suspend fun setSessionArchived(
+        sessionId: String,
+        archived: Boolean,
+        profile: String? = null,
+    ): Result<JsonObject> =
+        patchJsonObject(
+            "/api/sessions/${pathSegment(sessionId)}${profileQuery(profile)}",
+            buildJsonObject {
+                put("archived", archived)
+                profile?.trim()?.takeIf { it.isNotBlank() }?.let { put("profile", it) }
+            },
+        )
+
+    /**
+     * Dry-run a server-backed bulk session cleanup via the dashboard
+     * `POST /api/sessions/prune` (`dry_run: true`). Returns what WOULD be
+     * deleted — matched count, started-at span, and the candidate rows —
+     * without deleting anything. This is the required first step of the
+     * prune flow: show the preview, then pass it to [pruneSessions].
+     */
+    suspend fun previewSessionPrune(filters: SessionPruneFilters): Result<SessionPrunePreview> =
+        postJsonObject("/api/sessions/prune", filters.toPrunePayload(dryRun = true))
+            .mapCatching { root ->
+                json.decodeFromJsonElement(SessionPrunePreview.serializer(), root)
+            }
+
+    /**
+     * Apply a server-backed bulk session cleanup (`POST /api/sessions/prune`,
+     * `dry_run: false`). Destructive — [confirmedPreview] is required so no
+     * caller can reach this without first running [previewSessionPrune] with
+     * the same [filters] and showing the user its count/span. A preview that
+     * matched nothing short-circuits without touching the server: sessions
+     * that aged into the filter after the preview are not covered by what the
+     * user confirmed.
+     */
+    suspend fun pruneSessions(
+        filters: SessionPruneFilters,
+        confirmedPreview: SessionPrunePreview,
+    ): Result<SessionPruneResult> {
+        if (confirmedPreview.matched <= 0) {
+            return Result.success(SessionPruneResult(ok = true, removed = 0))
+        }
+        return postJsonObject("/api/sessions/prune", filters.toPrunePayload(dryRun = false))
+            .mapCatching { root ->
+                json.decodeFromJsonElement(SessionPruneResult.serializer(), root)
+            }
+    }
+
+    private fun SessionPruneFilters.toPrunePayload(dryRun: Boolean): JsonObject =
+        buildJsonObject {
+            olderThanDays?.let { put("older_than_days", it) }
+            source?.trim()?.takeIf { it.isNotBlank() }?.let { put("source", it) }
+            profile?.trim()?.takeIf { it.isNotBlank() }?.let { put("profile", it) }
+            if (includeArchived) put("include_archived", true)
+            put("dry_run", dryRun)
+        }
+
    private fun parseProfiles(root: JsonObject): List<Profile> {
        fun decode(element: JsonElement, nameOverride: String?): Profile? = runCatching {
            val obj = element as? JsonObject ?: return null
@@ -494,8 +732,10 @@ class DashboardApiClient(
            put("password", password)
            put("next", next)
        }
+        val httpUrl = resolveUrl("/auth/password-login")
+            ?: return@withContext Result.failure(invalidUrlException())
        val request = Request.Builder()
-            .url("$baseUrl/auth/password-login")
+            .url(httpUrl)
            .post(json.encodeToString(JsonObject.serializer(), payload).toRequestBody(JSON_MEDIA))
            .build()

@@ -509,8 +749,10 @@ class DashboardApiClient(
    }

    suspend fun currentSession(): Result<DashboardAuthSession> = withContext(Dispatchers.IO) {
+        val httpUrl = resolveUrl("/api/auth/me")
+            ?: return@withContext Result.failure(invalidUrlException())
        val request = Request.Builder()
-            .url("$baseUrl/api/auth/me")
+            .url(httpUrl)
            .get()
            .build()

@@ -553,7 +795,8 @@ class DashboardApiClient(
        // audio routes and treat the surface as present if EITHER answers
        // non-404 (they ship together upstream, so one reachable implies both).
        fun probe(path: String): Boolean {
-            val request = Request.Builder().url("$baseUrl$path").head().build()
+            val httpUrl = resolveUrl(path) ?: return false
+            val request = Request.Builder().url(httpUrl).head().build()
            return try {
                okHttpClient.newCall(request).execute().use { it.code != 404 }
            } catch (_: Exception) {
@@ -564,8 +807,10 @@ class DashboardApiClient(
    }

    suspend fun requestWsTicket(): Result<DashboardWsTicket> = withContext(Dispatchers.IO) {
+        val httpUrl = resolveUrl("/api/auth/ws-ticket")
+            ?: return@withContext Result.failure(invalidUrlException())
        val request = Request.Builder()
-            .url("$baseUrl/api/auth/ws-ticket")
+            .url(httpUrl)
            .post(ByteArray(0).toRequestBody(null))
            .build()

@@ -592,8 +837,9 @@ class DashboardApiClient(
    }

    private suspend fun getJson(path: String): Result<JsonObject> = withContext(Dispatchers.IO) {
+        val httpUrl = resolveUrl(path) ?: return@withContext Result.failure(invalidUrlException())
        val request = Request.Builder()
-            .url("$baseUrl$path")
+            .url(httpUrl)
            .get()
            .build()
        executeJson(request, path)
@@ -788,6 +1034,20 @@ class DashboardApiClient(
            name.equals("basic", ignoreCase = true) ||
                name.equals("password", ignoreCase = true)

+        fun parseElevenLabsVoices(root: JsonObject): ElevenLabsVoices {
+            val available = root.booleanField("available") ?: false
+            val voices = (root["voices"] as? JsonArray).orEmpty().mapNotNull { element ->
+                val obj = element as? JsonObject ?: return@mapNotNull null
+                val voiceId = obj.stringField("voice_id") ?: return@mapNotNull null
+                ElevenLabsVoice(
+                    voiceId = voiceId,
+                    name = obj.stringField("name") ?: voiceId,
+                    label = obj.stringField("label") ?: obj.stringField("name") ?: voiceId,
+                )
+            }
+            return ElevenLabsVoices(available = available, voices = voices)
+        }
+
        fun parseChatDisplaySettings(root: JsonObject): DashboardChatDisplaySettings {
            val config = root["config"] as? JsonObject
            val display = (config?.get("display") as? JsonObject)
@@ -0,0 +1,135 @@
+package com.hermesandroid.relay.network.upstream
+
+import kotlinx.serialization.json.JsonArray
+import kotlinx.serialization.json.JsonElement
+import kotlinx.serialization.json.JsonObject
+import kotlinx.serialization.json.JsonPrimitive
+import kotlinx.serialization.json.contentOrNull
+
+/**
+ * Pure helpers for the dashboard config-editing surface (`GET /api/config`,
+ * `GET /api/config/schema`, `PUT /api/config`).
+ *
+ * These are deliberately free of Android / OkHttp dependencies so the
+ * GET → mutate → PUT-whole flow can be unit-tested without a server. The
+ * critical invariant they protect: upstream `save_config` writes the WHOLE
+ * config document, so a write must round-trip the entire values tree with the
+ * one changed leaf replaced — never a partial object. [withConfigValue] /
+ * [applyConfigEdits] build that full tree immutably.
+ *
+ * The schema (`fields`) keys are flat dot-paths (`tts.elevenlabs.voice_id`);
+ * the values tree (`GET /api/config`) is nested. [configValueAt] bridges the
+ * two by walking the dot-path into the nested tree.
+ */
+
+/** UI field kinds emitted by upstream `_infer_type` + `_SCHEMA_OVERRIDES`. */
+enum class ConfigFieldType {
+    String,
+    Number,
+    Boolean,
+    /** A `select` override — render as a dropdown over [ConfigSchemaField.options]. */
+    Select,
+    List,
+    Object,
+    Unknown;
+
+    companion object {
+        fun fromWire(value: kotlin.String?): ConfigFieldType = when (value?.trim()?.lowercase()) {
+            "string" -> String
+            "number", "integer", "float" -> Number
+            "boolean", "bool" -> Boolean
+            "select" -> Select
+            "list", "array" -> List
+            "object", "dict" -> Object
+            else -> Unknown
+        }
+    }
+}
+
+/** One editable field from `GET /api/config/schema` `fields`. */
+data class ConfigSchemaField(
+    /** Flat dot-path, e.g. `tts.elevenlabs.voice_id`. */
+    val key: String,
+    val type: ConfigFieldType,
+    val description: String?,
+    val category: String?,
+    /** Allowed values when [type] is [ConfigFieldType.Select]; empty otherwise. */
+    val options: List<String> = emptyList(),
+)
+
+/**
+ * Parse the `fields` map from `GET /api/config/schema` into ordered
+ * [ConfigSchemaField]s. Insertion order is preserved (the server orders
+ * fields meaningfully — e.g. `model` then `model_context_length`).
+ */
+fun parseConfigSchema(schemaRoot: JsonObject): List<ConfigSchemaField> {
+    val fields = schemaRoot["fields"] as? JsonObject ?: return emptyList()
+    return fields.mapNotNull { (key, value) ->
+        val obj = value as? JsonObject ?: return@mapNotNull null
+        ConfigSchemaField(
+            key = key,
+            type = ConfigFieldType.fromWire(obj.configString("type")),
+            description = obj.configString("description"),
+            category = obj.configString("category"),
+            options = (obj["options"] as? JsonArray)
+                ?.mapNotNull { (it as? JsonPrimitive)?.contentOrNull }
+                ?: emptyList(),
+        )
+    }
+}
+
+/**
+ * The subset of schema fields that configure standard-path voice — the
+ * `tts.*` and `stt.*` keys. Filtered by dot-path prefix rather than the
+ * `category` field so it is robust to upstream's category-merging.
+ */
+fun voiceConfigFields(fields: List<ConfigSchemaField>): List<ConfigSchemaField> =
+    fields.filter { it.key.startsWith("tts.") || it.key.startsWith("stt.") }
+
+/** Read the value at a dot-path from the nested config values tree, or null. */
+fun configValueAt(tree: JsonObject, dotPath: String): JsonElement? {
+    var current: JsonElement = tree
+    for (part in dotPath.split('.')) {
+        val obj = current as? JsonObject ?: return null
+        current = obj[part] ?: return null
+    }
+    return current
+}
+
+/**
+ * Return a copy of [tree] with [value] set at [dotPath], creating intermediate
+ * objects as needed. Immutable: the input tree is never mutated, and object
+ * key order is preserved so a round-trip leaves untouched sections byte-stable.
+ */
+fun withConfigValue(tree: JsonObject, dotPath: String, value: JsonElement): JsonObject =
+    setIn(tree, dotPath.split('.'), 0, value)
+
+/** Apply many dot-path edits onto [tree], returning the fully-merged tree. */
+fun applyConfigEdits(tree: JsonObject, edits: Map<String, JsonElement>): JsonObject {
+    var result = tree
+    for ((path, value) in edits) {
+        result = withConfigValue(result, path, value)
+    }
+    return result
+}
+
+private fun setIn(
+    obj: JsonObject,
+    parts: List<String>,
+    index: Int,
+    value: JsonElement,
+): JsonObject {
+    val key = parts[index]
+    // LinkedHashMap copy preserves existing key order; a new key appends.
+    val next = LinkedHashMap<String, JsonElement>(obj)
+    next[key] = if (index == parts.lastIndex) {
+        value
+    } else {
+        val child = obj[key] as? JsonObject ?: JsonObject(emptyMap())
+        setIn(child, parts, index + 1, value)
+    }
+    return JsonObject(next)
+}
+
+private fun JsonObject.configString(name: String): String? =
+    (this[name] as? JsonPrimitive)?.contentOrNull?.trim()?.takeIf { it.isNotEmpty() }
@@ -7,6 +7,7 @@ import kotlinx.serialization.json.JsonPrimitive
 import kotlinx.serialization.json.contentOrNull
 import kotlinx.serialization.json.doubleOrNull
 import kotlinx.serialization.json.intOrNull
+import kotlinx.serialization.json.booleanOrNull

 /**
 * Maps tui_gateway events for ONE chat turn onto [GatewayTurnCallbacks].
@@ -21,16 +22,22 @@ import kotlinx.serialization.json.intOrNull
 * why dispatch is a manual `when (type)` over [JsonObject] rather than a
 * sealed polymorphic hierarchy (which throws on unknown discriminators).
 */
-class GatewayEventMapper(private val callbacks: GatewayTurnCallbacks) {
+class GatewayEventMapper(
+    private val callbacks: GatewayTurnCallbacks,
+    private val dedupeAdjacentMessageStarts: Boolean = false,
+) {

    /** True once `message.complete` or `error` has been seen — the turn is over. */
    var turnEnded: Boolean = false
        private set

    private var sawMessageStart = false
+    private var previousEventType: String? = null
    private var sawTextDelta = false
    private var sawThinkingDelta = false
    private var syntheticToolCounter = 0
+    private var providerWaitStatusActive = false
+    private var compactionStatusActive = false

    /**
     * `tool.complete` events match their `tool.start` by `tool_id`; when a
@@ -50,41 +57,68 @@ class GatewayEventMapper(private val callbacks: GatewayTurnCallbacks) {
    fun onEvent(type: String, payload: JsonObject?) {
        if (turnEnded) return
        when (type) {
-            "reasoning.delta", "thinking.delta" -> {
+            "reasoning.delta" -> {
                val text = payload.string("text")
                if (!text.isNullOrEmpty()) {
+                    clearActivityStatuses()
                    sawThinkingDelta = true
                    callbacks.onThinkingDelta(text)
                }
            }

+            "thinking.delta" -> {
+                val text = payload.string("text")
+                if (!text.isNullOrEmpty()) {
+                    if (isProviderWaitNotice(text)) {
+                        providerWaitStatusActive = true
+                        callbacks.onStatusUpdate(PROVIDER_WAIT_STATUS_KIND, text)
+                    } else {
+                        clearActivityStatuses()
+                        sawThinkingDelta = true
+                        callbacks.onThinkingDelta(text)
+                    }
+                }
+            }
+
            // Post-hoc reasoning (providers that don't stream it) — only
            // useful when nothing streamed live.
            "reasoning.available" -> {
                val text = payload.string("text")
-                if (!text.isNullOrEmpty() && !sawThinkingDelta) {
-                    sawThinkingDelta = true
-                    callbacks.onThinkingDelta(text)
+                if (!text.isNullOrEmpty()) {
+                    clearActivityStatuses()
+                    if (!sawThinkingDelta) {
+                        sawThinkingDelta = true
+                        callbacks.onThinkingDelta(text)
+                    }
                }
            }

            "message.delta" -> {
                val text = payload.string("text")
                if (!text.isNullOrEmpty()) {
+                    clearActivityStatuses()
                    sawTextDelta = true
                    callbacks.onTextDelta(text)
                }
            }

            "message.start" -> {
+                // The upstream background-completion poller currently emits
+                // message.start immediately before _run_prompt_submit(), which
+                // emits the same start again. Treat an adjacent pair as one
+                // boundary; a later start after any other event still closes
+                // the previous assistant message as before.
+                if (dedupeAdjacentMessageStarts && previousEventType == "message.start") return
                // Gateway has no server-side message id (placeholder UUID
                // stays). A second start inside one turn means a new
                // assistant message began — close out the previous one.
                if (sawMessageStart) callbacks.onTurnComplete()
                sawMessageStart = true
+                callbacks.onStart()
            }

            "tool.generating" -> {
+                clearActivityStatuses()
                // `{name?}` with NO tool_id — the model is still streaming
                // this tool's arguments.
                val name = payload.string("name")
@@ -96,6 +130,7 @@ class GatewayEventMapper(private val callbacks: GatewayTurnCallbacks) {
            }

            "tool.start" -> {
+                clearActivityStatuses()
                val name = payload.string("name") ?: "unknown"
                // A pending generating placeholder for this name is adopted
                // (consumed FIFO) whether or not the server sent a real id.
@@ -112,6 +147,7 @@ class GatewayEventMapper(private val callbacks: GatewayTurnCallbacks) {
            }

            "tool.complete" -> {
+                clearActivityStatuses()
                val name = payload.string("name") ?: "unknown"
                val toolId = payload.string("tool_id")
                    ?: openSyntheticIdsByName[name]?.removeFirstOrNull()
@@ -148,6 +184,7 @@ class GatewayEventMapper(private val callbacks: GatewayTurnCallbacks) {
            "subagent.start", "subagent.thinking", "subagent.tool",
            "subagent.progress", "subagent.complete",
            -> {
+                clearActivityStatuses()
                val phase = when (type) {
                    "subagent.start" -> GatewaySubagentEvent.Phase.START
                    "subagent.thinking" -> GatewaySubagentEvent.Phase.THINKING
@@ -193,10 +230,39 @@ class GatewayEventMapper(private val callbacks: GatewayTurnCallbacks) {
                    text = listOfNotNull(payload.string("command"), payload.string("description"))
                        .joinToString(" — ")
                        .ifBlank { "a command approval" },
-                    timeoutSeconds = 0,
+                    choices = payload.approvalChoices(),
+                    smartDenied = payload.boolean("smart_denied") == true,
+                    // Current Hermes omits timeout metadata. Keep the legacy
+                    // no-countdown behavior unless a future contract exposes
+                    // the effective per-request timeout explicitly.
+                    timeoutSeconds = payload.int("timeout_seconds") ?: 0,
                ),
            )

+            "tool.output_risk" -> {
+                val toolId = payload.string("tool_id")
+                val risk = payload.string("risk")?.lowercase() ?: return
+                if (!toolId.isNullOrBlank() && risk in OUTPUT_RISK_LEVELS && risk != "low") {
+                    callbacks.onToolOutputRisk(
+                        GatewayToolOutputRisk(
+                            toolCallId = toolId,
+                            toolName = payload.string("name").orEmpty(),
+                            risk = risk,
+                            findings = (payload?.get("findings") as? JsonArray)
+                                ?.mapNotNull { (it as? JsonPrimitive)?.contentOrNull?.trim() }
+                                ?.filter { it.isNotEmpty() }
+                                ?.distinct()
+                                .orEmpty(),
+                            redacted = payload.boolean("redacted") == true,
+                        ),
+                    )
+                }
+            }
+
+            // MoA activity proves auto-compaction has resumed even though
+            // Android does not currently render these upstream events.
+            "moa.reference", "moa.aggregating", "tool.progress" -> clearActivityStatuses()
+
            "sudo.request" -> callbacks.onInteractionRequest(
                GatewayAsk(
                    kind = GatewayAsk.Kind.SUDO,
@@ -217,10 +283,36 @@ class GatewayEventMapper(private val callbacks: GatewayTurnCallbacks) {
                ),
            )

+            "sudo.expire" -> callbacks.onInteractionExpired(
+                GatewayAskExpiry(
+                    kind = GatewayAsk.Kind.SUDO,
+                    requestId = payload.string("request_id"),
+                ),
+            )
+
+            "secret.expire" -> callbacks.onInteractionExpired(
+                GatewayAskExpiry(
+                    kind = GatewayAsk.Kind.SECRET,
+                    requestId = payload.string("request_id"),
+                ),
+            )
+
+            // Forward-compatible consumer for the proposed upstream approval
+            // expiry event. Approvals correlate by session, never request id.
+            "approval.expire" -> callbacks.onInteractionExpired(
+                GatewayAskExpiry(
+                    kind = GatewayAsk.Kind.APPROVAL,
+                    requestId = null,
+                ),
+            )
+
            "status.update" -> {
                val text = payload.string("text")
                if (!text.isNullOrBlank()) {
-                    callbacks.onStatusUpdate(payload.string("kind"), text)
+                    providerWaitStatusActive = false
+                    val kind = payload.string("kind")
+                    compactionStatusActive = kind == COMPACTION_STATUS_KIND
+                    callbacks.onStatusUpdate(kind, text)
                }
            }

@@ -228,6 +320,7 @@ class GatewayEventMapper(private val callbacks: GatewayTurnCallbacks) {
            // alike: ignore.
            else -> Unit
        }
+        previousEventType = type
    }

    private fun syntheticToolId(name: String): String {
@@ -236,7 +329,49 @@ class GatewayEventMapper(private val callbacks: GatewayTurnCallbacks) {
        return id
    }

+    private fun clearProviderWaitStatus() {
+        if (!providerWaitStatusActive) return
+        providerWaitStatusActive = false
+        callbacks.onStatusClear(PROVIDER_WAIT_STATUS_KIND)
+    }
+
+    private fun clearActivityStatuses() {
+        clearProviderWaitStatus()
+        if (!compactionStatusActive) return
+        compactionStatusActive = false
+        callbacks.onStatusClear(COMPACTION_STATUS_KIND)
+    }
+
+    private fun JsonObject?.approvalChoices(): List<String>? =
+        (this?.get("choices") as? JsonArray)
+            ?.mapNotNull { (it as? JsonPrimitive)?.contentOrNull?.lowercase() }
+            ?.filter { it in APPROVAL_CHOICES }
+            ?.distinct()
+            ?.takeIf { it.isNotEmpty() }
+
+    private fun JsonObject?.boolean(key: String): Boolean? =
+        (this?.get(key) as? JsonPrimitive)?.booleanOrNull
+
    companion object {
+        const val PROVIDER_WAIT_STATUS_KIND = "provider_wait"
+        const val COMPACTION_STATUS_KIND = "compacting"
+        private val APPROVAL_CHOICES = setOf("once", "session", "always", "deny")
+        private val OUTPUT_RISK_LEVELS = setOf("low", "medium", "high", "critical")
+
+        /**
+         * Hermes 2026-07-15 emits these operational wait lines through the
+         * legacy `thinking.delta` display callback. Match the deliberately
+         * narrow canonical prefixes so genuine legacy model thinking still
+         * remains durable reasoning.
+         */
+        fun isProviderWaitNotice(text: String): Boolean {
+            val normalized = text.trimStart()
+            return normalized.startsWith("⏳ waiting on ") ||
+                normalized.startsWith("⚠ no response from provider in ") ||
+                normalized.startsWith("⚠ no output from provider for ") ||
+                normalized.startsWith("↻ model returned reasoning with no final answer — asking it to continue")
+        }
+
        /**
         * `message.complete.usage` uses tui_gateway's own key names
         * (`input`/`output`/`total`, with `prompt`/`completion` as the raw
@@ -22,10 +22,14 @@ import kotlinx.coroutines.cancel
 import kotlinx.coroutines.launch

 /**
- * Opt-in foreground service that keeps the app process alive so the gateway
- * chat WebSocket (held by [com.hermesandroid.relay.viewmodel.ConnectionViewModel]'s
- * [GatewayChatClient]) survives Android's background-freeze / Doze — i.e.
- * "keep connected in the background".
+ * Opt-in foreground service that holds the app process up so the app's
+ * connection to Hermes survives Android's background-freeze / Doze — i.e.
+ * "persistent connection". Concretely it keeps the gateway chat WebSocket
+ * (held by [com.hermesandroid.relay.viewmodel.ConnectionViewModel]'s
+ * [GatewayChatClient]) open; for relay-paired setups, holding the whole
+ * process up incidentally also keeps the relay WSS — device control and
+ * notification mirroring — reachable. It does NOT warm Manage (stateless
+ * HTTP) or voice (per-turn sockets).
 *
 * # Both flavors (Play declaration required)
 *
@@ -56,7 +60,7 @@ class GatewayKeepAliveService : Service() {
    companion object {
        private const val TAG = "GatewayKeepAliveSvc"
        const val CHANNEL_ID = "gateway_keepalive"
-        private const val CHANNEL_NAME = "Background connection"
+        private const val CHANNEL_NAME = "Persistent connection"
        const val NOTIFICATION_ID = 4713
        const val ACTION_STOP = "com.hermesandroid.relay.gateway.KEEPALIVE_STOP"

@@ -146,14 +150,14 @@ class GatewayKeepAliveService : Service() {

        return NotificationCompat.Builder(this, CHANNEL_ID)
            .setSmallIcon(R.mipmap.ic_launcher)
-            .setContentTitle("Hermes stays connected")
-            .setContentText("Keeping your chat connection warm in the background.")
+            .setContentTitle(getString(R.string.gateway_keepalive_title))
+            .setContentText(getString(R.string.gateway_keepalive_body))
            .setContentIntent(tapPending)
            .setOngoing(true)
            .setOnlyAlertOnce(true)
            .setPriority(NotificationCompat.PRIORITY_LOW)
            .setCategory(NotificationCompat.CATEGORY_SERVICE)
-            .addAction(0, "Disconnect", stopPending)
+            .addAction(0, "Turn off", stopPending)
            .build()
    }

@@ -164,7 +168,7 @@ class GatewayKeepAliveService : Service() {
        nm.createNotificationChannel(
            NotificationChannel(CHANNEL_ID, CHANNEL_NAME, NotificationManager.IMPORTANCE_LOW).apply {
                description =
-                    "Persistent indicator while Hermes keeps your chat connection open in the background."
+                    "Shows while Hermes keeps its connection open in the background so messages and live features stay responsive."
                setShowBadge(false)
            },
        )
@@ -81,8 +81,40 @@ fun resolveStreamingEndpointPreference(
 */
 fun interface ActiveTurnHandle {
    fun cancel()
+
+    /**
+     * Release this client's callbacks without interrupting server-side work.
+     * Gateway turns override this for process/UI teardown; transports that
+     * cannot be reattached retain their existing cancel behavior.
+     */
+    fun detach() = cancel()
 }

+/** Partial text checkpoint returned by current upstream Hermes on live resume. */
+data class GatewayInflightTurn(
+    val user: String,
+    val assistant: String,
+    val streaming: Boolean,
+)
+
+/** Result of reattaching Android to an existing durable Gateway session. */
+data class GatewaySessionRecovery(
+    val storedSessionId: String,
+    val liveSessionId: String,
+    val running: Boolean,
+    val status: String?,
+    val inflight: GatewayInflightTurn?,
+    /** Non-null only when subsequent turn events are bound to [GatewayTurnCallbacks]. */
+    val handle: ActiveTurnHandle?,
+)
+
+/** A detached sibling turn reached its terminal event on the shared Gateway socket. */
+data class GatewayBackgroundTurnCompletion(
+    val storedSessionId: String,
+    val profile: String?,
+    val expectedAssistantText: String?,
+)
+
 /**
 * One server-side interactive ask. The agent thread upstream is BLOCKED
 * until the matching respond RPC arrives, the ask times out (resolves to ""
@@ -101,8 +133,10 @@ data class GatewayAsk(
    val requestId: String?,
    /** Question / command / prompt — whatever the ask wants the user to read. */
    val text: String,
-    /** Clarify-only: server-suggested answers. */
+    /** Server-advertised answers for clarify and approval requests. */
    val choices: List<String>? = null,
+    /** Approval-only: the smart observer denied and the owner may override once. */
+    val smartDenied: Boolean = false,
    /** Secret-only: the env var the value will be stored under. */
    val envVar: String? = null,
    /**
@@ -114,6 +148,28 @@ data class GatewayAsk(
    enum class Kind { CLARIFY, APPROVAL, SUDO, SECRET }
 }

+/**
+ * Server-side expiry of one blocking gateway interaction. Sudo/secret asks
+ * correlate by [requestId]; approvals remain session-scoped and therefore
+ * carry no request id.
+ */
+data class GatewayAskExpiry(
+    val kind: GatewayAsk.Kind,
+    val requestId: String?,
+)
+
+/** Outcome returned by the gateway's `*.respond` RPCs. */
+enum class GatewayAskResponse { ACCEPTED, EXPIRED }
+
+/** Deterministic, non-low risk metadata emitted after a tool returns output. */
+data class GatewayToolOutputRisk(
+    val toolCallId: String,
+    val toolName: String,
+    val risk: String,
+    val findings: List<String>,
+    val redacted: Boolean,
+)
+
 /**
 * One `subagent.*` lifecycle event, emitted on the PARENT session. Lifecycle
 * per task: START → (THINKING | TOOL | PROGRESS)* → COMPLETE. Field
@@ -135,6 +191,67 @@ data class GatewaySubagentEvent(
    enum class Phase { START, THINKING, TOOL, PROGRESS, COMPLETE }
 }

+/**
+ * One session-owned background process returned by the upstream gateway's
+ * `process.list` RPC. The registry calls its process id `session_id`; Android
+ * exposes it as [id] so it cannot be confused with either the stored chat id or
+ * the gateway's live, per-connection session id.
+ *
+ * [outputPreview] is the registry's short preview, while [outputTail] is the
+ * gateway's larger (currently 4,000-character) snapshot used to recover output
+ * missed while the WebSocket was unavailable. Unknown/new fields are ignored
+ * by the parser so this remains compatible with older and newer gateways.
+ */
+data class GatewayProcess(
+    val id: String,
+    val command: String,
+    val cwd: String? = null,
+    val pid: Long? = null,
+    val startedAt: String? = null,
+    val uptimeSeconds: Long = 0L,
+    val status: String,
+    val outputPreview: String? = null,
+    val outputTail: String? = null,
+    val exitCode: Int? = null,
+    val detached: Boolean = false,
+    val notifyOnComplete: Boolean = false,
+    val sessionScoped: Boolean = false,
+    val watchPatterns: List<String> = emptyList(),
+    val watchHit: Boolean = false,
+) {
+    val isRunning: Boolean get() = status.equals("running", ignoreCase = true)
+}
+
+/** Whether this gateway socket supports the session-scoped process RPCs. */
+enum class GatewayProcessCapability {
+    /** Not probed on this socket yet (or no socket is currently connected). */
+    Unknown,
+
+    /** A `process.list` / `process.kill` call succeeded. */
+    Supported,
+
+    /** The gateway returned JSON-RPC method-not-found for the process surface. */
+    Unsupported,
+}
+
+/**
+ * Connection-level background-process events. These are deliberately separate
+ * from [GatewayTurnCallbacks]: output and completion notifications can arrive
+ * while no app-initiated turn is active.
+ */
+sealed interface GatewayProcessEvent {
+    enum class Trigger { TOOL_COMPLETE, STATUS_UPDATE, MESSAGE_COMPLETE }
+
+    /** The process snapshot may have changed and should be refreshed. */
+    data class Invalidated(val trigger: Trigger) : GatewayProcessEvent
+
+    /** Live output from `agent.terminal.output`. */
+    data class Output(val processId: String, val chunk: String) : GatewayProcessEvent
+
+    /** The agent requested that its read-only terminal view be closed. */
+    data class TerminalClosed(val processId: String) : GatewayProcessEvent
+}
+
 /**
 * One provider from the gateway `model.options` RPC — the curated, authenticated
 * provider/model list the upstream desktop + TUI model picker uses (NOT the
@@ -208,11 +325,15 @@ data class GatewayReasoningSettings(
 class GatewayTurnCallbacks(
    /** Stored (DB) session id — fired on session create/rotate so the drawer + persistence stay correct. */
    val onSessionId: (String) -> Unit,
+    /** A gateway `message.start` opened an assistant response for this turn. */
+    val onStart: () -> Unit,
    val onTextDelta: (String) -> Unit,
    val onThinkingDelta: (String) -> Unit,
    val onToolCallStart: (toolCallId: String, toolName: String) -> Unit,
    val onToolCallDone: (toolCallId: String, resultPreview: String?) -> Unit,
    val onToolCallFailed: (toolCallId: String, errorMsg: String?) -> Unit,
+    /** Attach deterministic output-risk metadata to the matching tool card. */
+    val onToolOutputRisk: (GatewayToolOutputRisk) -> Unit = { _ -> },
    val onTurnComplete: () -> Unit,
    val onComplete: () -> Unit,
    val onUsage: (UsageInfo?) -> Unit,
@@ -231,10 +352,29 @@ class GatewayTurnCallbacks(
     * cancelled.
     */
    val onInteractionRequest: (GatewayAsk) -> Unit,
+    /** Server declared a pending interaction expired; clear only the matching card. */
+    val onInteractionExpired: (GatewayAskExpiry) -> Unit,
    /**
     * Gateway `status.update` lifecycle line — model fallback, retries, and
     * errors (often emoji-prefixed: 🔄 fallback, ⏳ retry, ❌ error). Default
     * no-op so non-gateway/legacy constructors don't need to provide it.
     */
    val onStatusUpdate: (kind: String?, text: String) -> Unit = { _, _ -> },
+    /** Clear a transient status only when [kind] still owns the visible status slot. */
+    val onStatusClear: (kind: String) -> Unit = { _ -> },
+)
+
+/**
+ * UI registration for one server-initiated gateway turn.
+ *
+ * Background-process completion is converted upstream into a normal assistant
+ * turn on the originating session. It has no matching client [GatewayChatClient.sendTurn]
+ * call, so the client asks the active conversation for callbacks when the first
+ * `message.start` arrives. [onHandle] binds the resulting cancellable turn into
+ * the same Stop/steer lifecycle as a locally submitted turn.
+ */
+class GatewayInboundTurnRegistration(
+    val callbacks: GatewayTurnCallbacks,
+    /** Main-thread admission. False leaves the server turn unbound for history recovery. */
+    val onHandle: (ActiveTurnHandle) -> Boolean,
 )
@@ -28,6 +28,7 @@ import kotlinx.serialization.json.JsonPrimitive
 import kotlinx.serialization.json.booleanOrNull
 import kotlinx.serialization.json.contentOrNull
 import kotlinx.serialization.json.decodeFromJsonElement
+import okhttp3.HttpUrl.Companion.toHttpUrlOrNull
 import okhttp3.MediaType.Companion.toMediaType
 import okhttp3.OkHttpClient
 import okhttp3.Request
@@ -178,6 +179,32 @@ class HermesApiClient(
    companion object {
        private const val TAG = "HermesApiClient"
        private val JSON_MEDIA = "application/json".toMediaType()
+
+        /**
+         * Prefix stamped by [streamFailureMessage] on stream failures raised
+         * by the transport layer (the IOException family: socket reset/close,
+         * DNS, TLS, timeouts) as opposed to a server-reported error. The
+         * dropped-stream answer recovery (issue #166) keys on it via
+         * [isTransportStreamError].
+         */
+        const val TRANSPORT_ERROR_PREFIX = "Connection failed"
+
+        /**
+         * True when a stream `onError` message came from a transport-layer
+         * failure (see [TRANSPORT_ERROR_PREFIX]) — the class of error where
+         * the server may still be running (and persisting) the turn.
+         */
+        fun isTransportStreamError(errorMsg: String): Boolean =
+            errorMsg.startsWith(TRANSPORT_ERROR_PREFIX)
+
+        /** Shared human-readable message for an SSE [EventSourceListener.onFailure]. */
+        private fun streamFailureMessage(t: Throwable?, response: Response?): String = when {
+            response != null && !response.isSuccessful ->
+                "API error ${response.code}: ${response.message}"
+            t is IOException -> "$TRANSPORT_ERROR_PREFIX: ${t.message}"
+            t != null -> "Stream error: ${t.message}"
+            else -> "Unknown stream error"
+        }
    }

    private val mainHandler = Handler(Looper.getMainLooper())
@@ -522,6 +549,9 @@ class HermesApiClient(
     *   blank the `model` field is omitted entirely and the server falls
     *   back to its session default. Used by the agent-profile picker so
     *   an explicit user choice wins over implicit session/server defaults.
+     *   Best-effort hint: current native upstream does not parse `model`
+     *   on this route (legacy fork builds honor it) — see the contract
+     *   notes in `HermesChatPayloads.kt`.
     */
    fun sendChatStream(
        sessionId: String,
@@ -529,23 +559,25 @@ class HermesApiClient(
        systemMessage: String? = null,
        attachments: List<com.hermesandroid.relay.data.Attachment>? = null,
        /**
-         * Pre-built OpenAI-format synthetic messages to splice into the
-         * payload alongside the live `message`. Produced by
+         * Pre-built OpenAI-format synthetic messages carrying phone-local
+         * context (voice intents, card dispatches, realtime voice turns).
+         * Produced by
         * [com.hermesandroid.relay.voice.VoiceIntentSyncBuilder.buildSyntheticMessages]
-         * for the v0.4.1 voice-intent → server session sync feature.
+         * and its twin builders; the param name is historical — it accepts
+         * any synthetic-message array.
         *
-         * When non-empty, the request body grows a top-level `messages`
-         * array containing the synthetic `assistant` (with `tool_calls`)
-         * + `tool` (with `tool_call_id`) pairs. The server-side session
-         * absorbs them into its conversation history so the LLM sees
-         * prior phone-local voice actions in its session memory.
+         * Upstream's session-chat handler consumes only `message` and
+         * `system_message` — a top-level `messages` array is NOT parsed
+         * (verified in `gateway/platforms/api_server.py`,
+         * `_handle_session_chat_stream`), so these can't ride the request
+         * as real history entries. Instead [buildSessionChatStreamPayload]
+         * renders them as a plain-text digest folded into this turn's
+         * ephemeral `system_message`. The model sees the context for THIS
+         * turn only; it is not persisted server-side. See the mapping notes
+         * in `HermesChatPayloads.kt`.
         *
-         * Null / empty on every send that has no unsynced voice intents
-         * to communicate, which is the common case after the first sync.
-         * The Hermes API server treats unrecognised body fields
-         * permissively (matches OpenAI Chat Completions semantics), so
-         * this stays a safe additive change against any conformant
-         * upstream.
+         * Null / empty on every send that has no unsynced traces to
+         * communicate, which is the common case after the first sync.
         */
        voiceIntentMessages: JsonArray? = null,
        onSessionId: (String) -> Unit,
@@ -568,7 +600,7 @@ class HermesApiClient(
        AgentDisplay.profileRequestName(profileName)?.let {
            Log.d(TAG, "sendChatStream: profile=$it")
        }
-        val requestPayload = buildSessionChatStreamPayload(
+        val built = buildSessionChatStreamPayload(
            message = message,
            systemMessage = systemMessage,
            attachments = attachments,
@@ -576,12 +608,19 @@ class HermesApiClient(
            modelOverride = modelOverride,
            profileName = profileName,
        )
-        val requestBody = json.encodeToString(JsonObject.serializer(), requestPayload)
+        logDroppedAttachments("sessions chat/stream", built.droppedAttachments)
+        val requestBody = json.encodeToString(JsonObject.serializer(), built.payload)

-        val request = authRequest("$baseUrl/api/sessions/$sessionId/chat/stream")
-            .header("Accept", "text/event-stream")
-            .post(requestBody.toRequestBody(JSON_MEDIA))
-            .build()
+        val request = authRequestOrNull("$baseUrl/api/sessions/$sessionId/chat/stream")
+            ?.header("Accept", "text/event-stream")
+            ?.post(requestBody.toRequestBody(JSON_MEDIA))
+            ?.build()
+            ?: run {
+                // #131: malformed base URL — fail the turn through the normal
+                // error channel instead of throwing out of the ViewModel.
+                mainHandler.post { onError(invalidBaseUrlMessage()) }
+                return failedEventSource()
+            }

        val completeCalled = AtomicBoolean(false)
        // Comparable to the gateway's turn[gateway] line — see TurnLatencyTracer.
@@ -762,13 +801,7 @@ class HermesApiClient(
            ) {
                tracer.done("error")
                if (completeCalled.compareAndSet(false, true)) {
-                    val msg = when {
-                        response != null && !response.isSuccessful ->
-                            "API error ${response.code}: ${response.message}"
-                        t is IOException -> "Connection failed: ${t.message}"
-                        t != null -> "Stream error: ${t.message}"
-                        else -> "Unknown stream error"
-                    }
+                    val msg = streamFailureMessage(t, response)
                    mainHandler.post { onError(msg) }
                }
            }
@@ -819,7 +852,7 @@ class HermesApiClient(
        AgentDisplay.profileRequestName(profileName)?.let {
            Log.d(TAG, "sendChatCompletionsStream: profile=$it")
        }
-        val requestPayload = buildChatCompletionsStreamPayload(
+        val built = buildChatCompletionsStreamPayload(
            message = message,
            model = model,
            systemMessage = systemMessage,
@@ -828,12 +861,18 @@ class HermesApiClient(
            modelOverride = modelOverride,
            profileName = profileName,
        )
-        val requestBody = json.encodeToString(JsonObject.serializer(), requestPayload)
+        logDroppedAttachments("chat completions", built.droppedAttachments)
+        val requestBody = json.encodeToString(JsonObject.serializer(), built.payload)

-        val request = authRequest("$baseUrl/v1/chat/completions")
-            .header("Accept", "text/event-stream")
-            .post(requestBody.toRequestBody(JSON_MEDIA))
-            .build()
+        val request = authRequestOrNull("$baseUrl/v1/chat/completions")
+            ?.header("Accept", "text/event-stream")
+            ?.post(requestBody.toRequestBody(JSON_MEDIA))
+            ?.build()
+            ?: run {
+                // #131: malformed base URL — see sendChatStream.
+                mainHandler.post { onError(invalidBaseUrlMessage()) }
+                return failedEventSource()
+            }

        val completeCalled = AtomicBoolean(false)
        val messageStarted = AtomicBoolean(false)
@@ -904,13 +943,7 @@ class HermesApiClient(
            ) {
                tracer.done("error")
                if (completeCalled.compareAndSet(false, true)) {
-                    val msg = when {
-                        response != null && !response.isSuccessful ->
-                            "API error ${response.code}: ${response.message}"
-                        t is IOException -> "Connection failed: ${t.message}"
-                        t != null -> "Stream error: ${t.message}"
-                        else -> "Unknown stream error"
-                    }
+                    val msg = streamFailureMessage(t, response)
                    mainHandler.post { onError(msg) }
                }
            }
@@ -986,7 +1019,13 @@ class HermesApiClient(
        model: String? = null,
        systemMessage: String? = null,
        attachments: List<com.hermesandroid.relay.data.Attachment>? = null,
-        /** See [sendChatStream]'s `voiceIntentMessages` doc — same semantics. */
+        /**
+         * See [sendChatStream]'s `voiceIntentMessages` doc. On the runs
+         * path the mapping differs slightly: plain user/assistant text
+         * turns ride the upstream-parsed `conversation_history` field,
+         * while tool-call pairs fold into the `instructions` digest —
+         * see [buildRunStreamPayload].
+         */
        voiceIntentMessages: JsonArray? = null,
        onSessionId: (String) -> Unit,
        onMessageStarted: (String) -> Unit,
@@ -1008,7 +1047,7 @@ class HermesApiClient(
        AgentDisplay.profileRequestName(profileName)?.let {
            Log.d(TAG, "sendRunStream: profile=$it")
        }
-        val requestPayload = buildRunStreamPayload(
+        val built = buildRunStreamPayload(
            message = message,
            model = model,
            systemMessage = systemMessage,
@@ -1017,12 +1056,18 @@ class HermesApiClient(
            modelOverride = modelOverride,
            profileName = profileName,
        )
-        val requestBody = json.encodeToString(JsonObject.serializer(), requestPayload)
+        logDroppedAttachments("runs", built.droppedAttachments)
+        val requestBody = json.encodeToString(JsonObject.serializer(), built.payload)

-        val request = authRequest("$baseUrl/v1/runs")
-            .header("Accept", "text/event-stream")
-            .post(requestBody.toRequestBody(JSON_MEDIA))
-            .build()
+        val request = authRequestOrNull("$baseUrl/v1/runs")
+            ?.header("Accept", "text/event-stream")
+            ?.post(requestBody.toRequestBody(JSON_MEDIA))
+            ?.build()
+            ?: run {
+                // #131: malformed base URL — see sendChatStream.
+                mainHandler.post { onError(invalidBaseUrlMessage()) }
+                return failedEventSource()
+            }

        val completeCalled = AtomicBoolean(false)
        // Comparable to the gateway's turn[gateway] line — see TurnLatencyTracer.
@@ -1203,13 +1248,7 @@ class HermesApiClient(
            ) {
                tracer.done("error")
                if (completeCalled.compareAndSet(false, true)) {
-                    val msg = when {
-                        response != null && !response.isSuccessful ->
-                            "API error ${response.code}: ${response.message}"
-                        t is IOException -> "Connection failed: ${t.message}"
-                        t != null -> "Stream error: ${t.message}"
-                        else -> "Unknown stream error"
-                    }
+                    val msg = streamFailureMessage(t, response)
                    mainHandler.post { onError(msg) }
                }
            }
@@ -1364,6 +1403,65 @@ class HermesApiClient(
        return builder
    }

+    /**
+     * Non-throwing twin of [authRequest] for the streaming entry points
+     * (#131 crash class). The three send*Stream methods build their Request
+     * BEFORE any try/catch or EventSource listener exists, so a malformed
+     * [baseUrl] (hand-edited connection, corrupt settings import) made
+     * `Request.Builder.url(String)` throw `IllegalArgumentException`
+     * synchronously up through the ViewModel. Returns null on a bad URL so
+     * the caller can route the failure through its normal `onError` channel
+     * instead. Non-streaming methods keep [authRequest] — their existing
+     * try/catch already contains the throw.
+     */
+    private fun authRequestOrNull(url: String): Request.Builder? {
+        val builder = buildApiRequestOrNull(url) ?: return null
+        if (apiKey.isNotBlank()) {
+            builder.header("Authorization", "Bearer $apiKey")
+        }
+        return builder
+    }
+
+    /**
+     * Inert [EventSource] returned by the streaming methods when the request
+     * couldn't even be built (bad base URL). The turn already failed via
+     * `onError`; this just satisfies the return type so callers' cancel()
+     * handling stays uniform.
+     */
+    private fun failedEventSource(): EventSource = object : EventSource {
+        // Guaranteed-parseable placeholder; never dispatched.
+        private val placeholder = Request.Builder().url("http://invalid.invalid/").build()
+        override fun request(): Request = placeholder
+        override fun cancel() {}
+    }
+
+    /** Human message for a base URL that fails to parse (#131). */
+    private fun invalidBaseUrlMessage(): String =
+        "Invalid server address ($baseUrl) — edit the connection's API URL or re-pair."
+
+    /**
+     * Make attachment drops on the SSE fallback transports explicit
+     * (HRUI-001): the payload builders return attachments that have no
+     * upstream-supported channel on the target endpoint instead of
+     * silently omitting them. The user-visible notice lives in
+     * ChatViewModel (`warnIfAttachmentsDropped`) — this log line is the
+     * network-layer audit trail that the bytes never left the device.
+     */
+    private fun logDroppedAttachments(
+        endpoint: String,
+        dropped: List<com.hermesandroid.relay.data.Attachment>,
+    ) {
+        if (dropped.isEmpty()) return
+        val names = dropped.joinToString(", ") {
+            it.fileName ?: if (it.isImage) "image" else "file"
+        }
+        Log.w(
+            TAG,
+            "Dropped ${dropped.size} attachment(s) with no supported channel " +
+                "on the $endpoint endpoint (not sent): $names",
+        )
+    }
+
    private fun apiFailure(response: Response, operation: String): IOException {
        val detail = response.message.takeIf { it.isNotBlank() }?.let { ": $it" }.orEmpty()
        val message = when (response.code) {
@@ -1380,3 +1478,13 @@ class HermesApiClient(
    private fun firstNonBlank(vararg values: String?): String =
        values.firstOrNull { !it.isNullOrBlank() }.orEmpty()
 }
+
+/**
+ * #131 guard, api_server half: parse-or-null Request builder for a URL string.
+ * `Request.Builder.url(String)` throws `IllegalArgumentException` on a
+ * malformed host; the streaming send paths must fail through `onError`
+ * instead. Top-level (like `buildRelayRequestOrNull` in ConnectionManager)
+ * so the guard is unit-testable without instantiating the client.
+ */
+internal fun buildApiRequestOrNull(url: String): Request.Builder? =
+    url.toHttpUrlOrNull()?.let { Request.Builder().url(it) }
@@ -4,14 +4,233 @@ import com.hermesandroid.relay.data.AgentDisplay
 import com.hermesandroid.relay.data.Attachment
 import kotlinx.serialization.json.JsonArray
 import kotlinx.serialization.json.JsonObject
-import kotlinx.serialization.json.add
+import kotlinx.serialization.json.JsonPrimitive
 import kotlinx.serialization.json.addJsonObject
 import kotlinx.serialization.json.buildJsonArray
 import kotlinx.serialization.json.buildJsonObject
+import kotlinx.serialization.json.contentOrNull
 import kotlinx.serialization.json.put
 import kotlinx.serialization.json.putJsonArray
 import kotlinx.serialization.json.putJsonObject

+/*
+ * === Upstream request contract (HRUI-001) ===
+ *
+ * Verified against hermes-agent `gateway/platforms/api_server.py`. These
+ * builders send ONLY fields the target handler consumes (plus a small,
+ * documented set of legacy hint fields — see below). Fields upstream
+ * ignores are never emitted: a dead field on the wire misrepresents
+ * capability and masks data loss.
+ *
+ * Per-endpoint parsing truth (current upstream main):
+ *
+ *  - `POST /api/sessions/{id}/chat/stream` (`_handle_session_chat_stream`)
+ *    consumes `message` (or `input`) and `system_message` (or
+ *    `instructions`, string only). `message` accepts either a plain string
+ *    or OpenAI-style content parts (text + `image_url`) via
+ *    `_normalize_multimodal_content`. Top-level `messages`, `attachments`,
+ *    `model`, and `profile` are NOT parsed.
+ *
+ *  - `POST /v1/runs` (`_handle_runs`) consumes `input` (string or message
+ *    array), `instructions`, `conversation_history` (array of
+ *    `{role, content}` objects, string-coerced), `previous_response_id`,
+ *    `session_id`, and `model`. It does NOT parse `system_message`,
+ *    `stream`, `messages`, `attachments`, or `profile` — and always
+ *    answers `202 {"run_id": ...}` JSON (no SSE on POST).
+ *
+ *  - `POST /v1/chat/completions` (`_handle_chat_completions`) consumes
+ *    `messages`, `stream`, and `model`. Within `messages`: `system` roles
+ *    fold into the ephemeral system prompt; `user`/`assistant` entries are
+ *    kept as history with multimodal content normalization; `tool`-role
+ *    entries are silently skipped and `tool_calls` fields are stripped.
+ *    Top-level `attachments` and `profile` are NOT parsed.
+ *
+ * Legacy hint fields we deliberately keep sending although current native
+ * upstream ignores them: `model` + `profile` on the sessions path,
+ * `profile` on runs/completions, and `stream` on runs. They are
+ * configuration hints (never user content, so they cannot mask data
+ * loss) honored by legacy fork builds — the runs path in particular only
+ * activates against servers that explicitly advertise SSE-on-POST, which
+ * vanilla upstream never does. See `ServerCapabilities`.
+ *
+ * === Synthetic-history mapping ===
+ *
+ * Phone-local synthetic turns (voice-intent traces, card dispatches,
+ * provider-answered realtime voice turns — see `VoiceIntentSyncBuilder`,
+ * `CardDispatchSyncBuilder`, `RealtimeTurnSyncBuilder`) arrive here as one
+ * OpenAI-format array. Historically they were sent as a top-level
+ * `messages` field on sessions/runs, which upstream never consumed —
+ * silent data loss. They now map onto channels each endpoint actually
+ * supports:
+ *
+ *  - Tool-call pairs (`assistant` + `tool` with `tool_call_id`) have no
+ *    surviving wire shape on ANY fallback endpoint, so they render as a
+ *    plain-text digest ([renderSyntheticHistoryDigest]) folded into the
+ *    per-turn ephemeral system prompt: `system_message` on sessions,
+ *    `instructions` on runs, the `system` message on completions.
+ *  - Plain `user`/`assistant` text turns ride a real history channel
+ *    where one exists: spliced into `messages` on completions, sent as
+ *    `conversation_history` on runs. The sessions endpoint has no
+ *    client-provided history channel, so there they join the digest.
+ *
+ * This mapping is ephemeral where the digest is used: the model sees the
+ * context for THIS turn only; it is not persisted into the server-side
+ * session transcript. That is strictly better than the previous behavior
+ * (context arrived never) and matches the existing voice-turn pattern of
+ * per-turn non-persisted instructions.
+ *
+ * === Attachments ===
+ *
+ * Only the completions endpoint has an upstream-supported attachment
+ * channel on this surface: inline `image_url` content parts (images
+ * only). Sessions/runs payloads carry no attachments at all. Anything
+ * that cannot be delivered is returned in
+ * [ChatPayloadResult.droppedAttachments] so callers can surface the drop
+ * (HermesApiClient logs it; ChatViewModel shows a user-visible notice) —
+ * never a silent discard. Note: current upstream's sessions `message`
+ * field does accept inline `image_url` content parts, so image delivery
+ * on the sessions path is a possible future improvement; it is not wired
+ * yet because the caller's attachment warning and this builder must move
+ * together.
+ */
+
+/**
+ * Result of building a fallback-transport chat payload.
+ *
+ * @property payload The JSON request body — contains only fields the
+ *   target endpoint consumes (plus documented legacy hint fields).
+ * @property droppedAttachments Attachments that have NO supported channel
+ *   on the target endpoint and were therefore not encoded into [payload].
+ *   Callers must surface these (log + user notice), never ignore them.
+ */
+internal data class ChatPayloadResult(
+    val payload: JsonObject,
+    val droppedAttachments: List<Attachment>,
+)
+
+/**
+ * Header line for the synthetic phone-context digest. Tells the model the
+ * listed activity already happened on-device so it treats the lines as
+ * history, not instructions to act on.
+ */
+internal const val SYNTHETIC_DIGEST_HEADER =
+    "Phone-side activity since the previous server turn " +
+        "(already completed on-device; context only — do not re-execute):"
+
+private fun JsonObject.roleOrNull(): String? =
+    (this["role"] as? JsonPrimitive)?.contentOrNull
+
+private fun JsonObject.contentStringOrNull(): String? =
+    (this["content"] as? JsonPrimitive)?.contentOrNull
+
+/**
+ * True for a synthetic entry deliverable as a REAL conversation turn on
+ * endpoints with a client-history channel: plain `user`/`assistant` role,
+ * string content, no `tool_calls`. Matches the shape emitted by
+ * `RealtimeTurnSyncBuilder`; tool-call pairs from the voice-intent and
+ * card-dispatch builders fail this check and go through the digest.
+ */
+internal fun isPlainSyntheticTurn(entry: JsonObject): Boolean {
+    val role = entry.roleOrNull()
+    if (role != "user" && role != "assistant") return false
+    if (entry.containsKey("tool_calls")) return false
+    return !entry.contentStringOrNull().isNullOrBlank()
+}
+
+/**
+ * Render the synthetic sync stream as a compact plain-text digest for the
+ * per-turn ephemeral system prompt.
+ *
+ * Tool-call pairs (`assistant.tool_calls` + matching `tool` result keyed
+ * by `tool_call_id`) always render, one line per call:
+ * `- called <name> with <arguments> -> <result>`. Plain text turns render
+ * as `- user: ...` / `- assistant: ...` lines only when
+ * [includePlainTurns] is true (sessions path — no real history channel);
+ * endpoints that deliver plain turns natively pass false so the same turn
+ * is never delivered twice.
+ *
+ * @return null when nothing renders (no synthetic messages, or only plain
+ *   turns while [includePlainTurns] is false).
+ */
+internal fun renderSyntheticHistoryDigest(
+    syntheticMessages: JsonArray?,
+    includePlainTurns: Boolean,
+): String? {
+    if (syntheticMessages.isNullOrEmpty()) return null
+
+    // Pair tool results with their originating call.
+    val resultsByCallId = HashMap<String, String>()
+    for (element in syntheticMessages) {
+        val obj = element as? JsonObject ?: continue
+        if (obj.roleOrNull() != "tool") continue
+        val callId = (obj["tool_call_id"] as? JsonPrimitive)?.contentOrNull ?: continue
+        resultsByCallId[callId] = obj.contentStringOrNull().orEmpty()
+    }
+
+    val lines = mutableListOf<String>()
+    for (element in syntheticMessages) {
+        val obj = element as? JsonObject ?: continue
+        when (obj.roleOrNull()) {
+            "assistant" -> {
+                val toolCalls = obj["tool_calls"] as? JsonArray
+                if (toolCalls != null) {
+                    for (call in toolCalls) {
+                        val callObj = call as? JsonObject ?: continue
+                        val function = callObj["function"] as? JsonObject
+                        val name = (function?.get("name") as? JsonPrimitive)
+                            ?.contentOrNull ?: "unknown_tool"
+                        val args = (function?.get("arguments") as? JsonPrimitive)
+                            ?.contentOrNull ?: "{}"
+                        val callId = (callObj["id"] as? JsonPrimitive)?.contentOrNull
+                        val result = callId?.let(resultsByCallId::get)
+                        lines += if (result.isNullOrBlank()) {
+                            "- called $name with $args"
+                        } else {
+                            "- called $name with $args -> $result"
+                        }
+                    }
+                } else if (includePlainTurns) {
+                    obj.contentStringOrNull()?.takeIf { it.isNotBlank() }
+                        ?.let { lines += "- assistant: $it" }
+                }
+            }
+            "user" -> if (includePlainTurns) {
+                obj.contentStringOrNull()?.takeIf { it.isNotBlank() }
+                    ?.let { lines += "- user: $it" }
+            }
+            // "tool" entries fold into their assistant line via resultsByCallId.
+        }
+    }
+    if (lines.isEmpty()) return null
+    return SYNTHETIC_DIGEST_HEADER + "\n" + lines.joinToString("\n")
+}
+
+/**
+ * Merge the caller's per-turn system message with the synthetic-history
+ * digest into one ephemeral prompt string. Either side may be absent.
+ */
+internal fun mergeEphemeralContext(systemMessage: String?, digest: String?): String? = when {
+    digest.isNullOrBlank() -> systemMessage?.takeIf { it.isNotBlank() }
+    systemMessage.isNullOrBlank() -> digest
+    else -> systemMessage + "\n\n" + digest
+}
+
+/** Synthetic entries deliverable as real history turns (see [isPlainSyntheticTurn]). */
+private fun plainSyntheticTurns(syntheticMessages: JsonArray?): List<JsonObject> =
+    (syntheticMessages ?: emptyList())
+        .mapNotNull { it as? JsonObject }
+        .filter(::isPlainSyntheticTurn)
+
+/**
+ * Body for `POST /api/sessions/{id}/chat/stream`.
+ *
+ * Emits `message` + `system_message` (upstream-consumed) and `model` +
+ * `profile` (legacy hints — current native upstream ignores both on this
+ * route; legacy fork builds honor them; see the file header). ALL
+ * synthetic history folds into `system_message` via the digest: the
+ * endpoint has no client-provided history channel. Attachments have no
+ * supported channel here and are returned as dropped.
+ */
 internal fun buildSessionChatStreamPayload(
    message: String,
    systemMessage: String? = null,
@@ -19,30 +238,33 @@ internal fun buildSessionChatStreamPayload(
    voiceIntentMessages: JsonArray? = null,
    modelOverride: String? = null,
    profileName: String? = null,
-): JsonObject = buildJsonObject {
-    put("message", message)
-    if (!systemMessage.isNullOrBlank()) {
-        put("system_message", systemMessage)
-    }
-    if (!modelOverride.isNullOrBlank()) {
-        put("model", modelOverride)
-    }
-    AgentDisplay.profileRequestName(profileName)?.let { put("profile", it) }
-    if (!attachments.isNullOrEmpty()) {
-        putJsonArray("attachments") {
-            attachments.forEach { att ->
-                addJsonObject {
-                    put("contentType", att.contentType)
-                    put("content", att.content)
-                }
-            }
+): ChatPayloadResult {
+    val digest = renderSyntheticHistoryDigest(voiceIntentMessages, includePlainTurns = true)
+    val effectiveSystem = mergeEphemeralContext(systemMessage, digest)
+    val payload = buildJsonObject {
+        put("message", message)
+        if (!effectiveSystem.isNullOrBlank()) {
+            put("system_message", effectiveSystem)
        }
+        if (!modelOverride.isNullOrBlank()) {
+            put("model", modelOverride)
+        }
+        AgentDisplay.profileRequestName(profileName)?.let { put("profile", it) }
    }
-    if (voiceIntentMessages != null && voiceIntentMessages.isNotEmpty()) {
-        put("messages", voiceIntentMessages)
-    }
+    return ChatPayloadResult(payload, droppedAttachments = attachments.orEmpty())
 }

+/**
+ * Body for `POST /v1/runs`.
+ *
+ * Emits `input`, `model`, and `instructions` (upstream-consumed; note the
+ * runs handler reads `instructions`, NOT `system_message` — the latter was
+ * a silent drop before HRUI-001), plus `stream` + `profile` legacy hints.
+ * Synthetic history: plain text turns ride `conversation_history` (a real
+ * upstream channel — entries are `{role, content}` objects); tool-call
+ * pairs fold into the `instructions` digest. Attachments have no
+ * supported channel here and are returned as dropped.
+ */
 internal fun buildRunStreamPayload(
    message: String,
    model: String? = null,
@@ -51,36 +273,46 @@ internal fun buildRunStreamPayload(
    voiceIntentMessages: JsonArray? = null,
    modelOverride: String? = null,
    profileName: String? = null,
-): JsonObject {
+): ChatPayloadResult {
    val resolvedModel = when {
        !modelOverride.isNullOrBlank() -> modelOverride
        !model.isNullOrBlank() -> model
        else -> "default"
    }
-    return buildJsonObject {
+    val digest = renderSyntheticHistoryDigest(voiceIntentMessages, includePlainTurns = false)
+    val effectiveInstructions = mergeEphemeralContext(systemMessage, digest)
+    val plainTurns = plainSyntheticTurns(voiceIntentMessages)
+    val payload = buildJsonObject {
        put("model", resolvedModel)
        put("input", message)
        put("stream", true)
-        if (!systemMessage.isNullOrBlank()) {
-            put("system_message", systemMessage)
+        if (!effectiveInstructions.isNullOrBlank()) {
+            put("instructions", effectiveInstructions)
        }
-        AgentDisplay.profileRequestName(profileName)?.let { put("profile", it) }
-        if (!attachments.isNullOrEmpty()) {
-            putJsonArray("attachments") {
-                attachments.forEach { att ->
-                    addJsonObject {
-                        put("contentType", att.contentType)
-                        put("content", att.content)
-                    }
-                }
+        if (plainTurns.isNotEmpty()) {
+            putJsonArray("conversation_history") {
+                plainTurns.forEach { add(it) }
            }
        }
-        if (voiceIntentMessages != null && voiceIntentMessages.isNotEmpty()) {
-            put("messages", voiceIntentMessages)
-        }
+        AgentDisplay.profileRequestName(profileName)?.let { put("profile", it) }
    }
+    return ChatPayloadResult(payload, droppedAttachments = attachments.orEmpty())
 }

+/**
+ * Body for `POST /v1/chat/completions`.
+ *
+ * Emits `model`, `stream`, and `messages` (all upstream-consumed) plus
+ * the `profile` legacy hint. Synthetic history: plain text turns splice
+ * into `messages` before the live user message (upstream keeps
+ * `user`/`assistant` history entries verbatim); tool-call pairs fold into
+ * the system message digest, because upstream SKIPS `tool`-role messages
+ * and STRIPS `tool_calls` — splicing them produced junk empty-content
+ * assistant entries and lost the results entirely. Image attachments ride
+ * inline `image_url` content parts on the user message (upstream vision
+ * format); non-image attachments have no channel and are returned as
+ * dropped.
+ */
 internal fun buildChatCompletionsStreamPayload(
    message: String,
    model: String? = null,
@@ -89,35 +321,37 @@ internal fun buildChatCompletionsStreamPayload(
    voiceIntentMessages: JsonArray? = null,
    modelOverride: String? = null,
    profileName: String? = null,
-): JsonObject {
+): ChatPayloadResult {
    val resolvedModel = when {
        !modelOverride.isNullOrBlank() -> modelOverride
        !model.isNullOrBlank() -> model
        else -> "default"
    }
-    return buildJsonObject {
+    val digest = renderSyntheticHistoryDigest(voiceIntentMessages, includePlainTurns = false)
+    val effectiveSystem = mergeEphemeralContext(systemMessage, digest)
+    val plainTurns = plainSyntheticTurns(voiceIntentMessages)
+    val imageAttachments = attachments.orEmpty().filter { it.isImage }
+    val payload = buildJsonObject {
        put("model", resolvedModel)
        put("stream", true)
        AgentDisplay.profileRequestName(profileName)?.let { put("profile", it) }
        putJsonArray("messages") {
-            if (!systemMessage.isNullOrBlank()) {
+            if (!effectiveSystem.isNullOrBlank()) {
                addJsonObject {
                    put("role", "system")
-                    put("content", systemMessage)
+                    put("content", effectiveSystem)
                }
            }
-            if (voiceIntentMessages != null && voiceIntentMessages.isNotEmpty()) {
-                voiceIntentMessages.forEach { add(it) }
-            }
+            plainTurns.forEach { add(it) }
            addJsonObject {
                put("role", "user")
-                if (!attachments.isNullOrEmpty() && attachments.any { it.isImage }) {
+                if (imageAttachments.isNotEmpty()) {
                    put("content", buildJsonArray {
                        addJsonObject {
                            put("type", "text")
                            put("text", message)
                        }
-                        attachments.filter { it.isImage }.forEach { att ->
+                        imageAttachments.forEach { att ->
                            addJsonObject {
                                put("type", "image_url")
                                putJsonObject("image_url") {
@@ -131,15 +365,9 @@ internal fun buildChatCompletionsStreamPayload(
                }
            }
        }
-        if (!attachments.isNullOrEmpty() && attachments.any { !it.isImage }) {
-            putJsonArray("attachments") {
-                attachments.filter { !it.isImage }.forEach { att ->
-                    addJsonObject {
-                        put("contentType", att.contentType)
-                        put("content", att.content)
-                    }
-                }
-            }
-        }
    }
+    return ChatPayloadResult(
+        payload = payload,
+        droppedAttachments = attachments.orEmpty().filter { !it.isImage },
+    )
 }
@@ -11,6 +11,7 @@ import kotlinx.serialization.json.JsonPrimitive
 import kotlinx.serialization.json.buildJsonObject
 import kotlinx.serialization.json.contentOrNull
 import kotlinx.serialization.json.put
+import okhttp3.HttpUrl.Companion.toHttpUrlOrNull
 import okhttp3.MediaType.Companion.toMediaType
 import okhttp3.OkHttpClient
 import okhttp3.Request
@@ -75,13 +76,20 @@ class StandardHermesVoiceClient(
            )
        }

+        // Resolve via toHttpUrlOrNull() — okhttp's url(String) THROWS on a
+        // malformed dashboard URL (a non-address pasted into that field, #131),
+        // and this runs before executeJson()'s try/catch, so the throw would
+        // escape withContext(IO) onto the calling coroutine and crash the app.
+        val httpUrl = "$baseUrl/api/audio/transcribe".toHttpUrlOrNull()
+            ?: return@withContext Result.failure(IOException("Hermes dashboard URL is not a valid address: $baseUrl"))
+
        val dataUrl = buildAudioDataUrl(audioFile)
        val payload = buildJsonObject {
            put("data_url", dataUrl)
            put("mime_type", mediaTypeForAudioFile(audioFile))
        }
        val request = Request.Builder()
-            .url("$baseUrl/api/audio/transcribe")
+            .url(httpUrl)
            .post(json.encodeToString(JsonObject.serializer(), payload).toRequestBody(JSON_MEDIA))
            .header("Accept", "application/json")
            .build()
@@ -105,6 +113,11 @@ class StandardHermesVoiceClient(
            return@withContext Result.failure(IllegalArgumentException("Cannot synthesize blank text"))
        }

+        // See transcribe(): guard the throwing url(String) so a malformed
+        // dashboard URL is a clean Result.failure, never a Main-thread crash.
+        val httpUrl = "$baseUrl/api/audio/speak".toHttpUrlOrNull()
+            ?: return@withContext Result.failure(IOException("Hermes dashboard URL is not a valid address: $baseUrl"))
+
        val payload = buildJsonObject {
            put("text", cleanText)
            // Defensive only — upstream /api/audio/speak ignores it (text-only
@@ -112,7 +125,7 @@ class StandardHermesVoiceClient(
            profileProvider()?.trim()?.takeIf { it.isNotBlank() }?.let { put("profile", it) }
        }
        val request = Request.Builder()
-            .url("$baseUrl/api/audio/speak")
+            .url(httpUrl)
            .post(json.encodeToString(JsonObject.serializer(), payload).toRequestBody(JSON_MEDIA))
            .header("Accept", "application/json")
            .build()
@@ -138,6 +138,8 @@ data class SessionItem(
    @Serializable(with = FlexibleIdNonNullSerializer::class)
    val id: String = "",
    val title: String? = null,
+    /** Upstream's first-user-message label when no persisted title exists. */
+    val preview: String? = null,
    val model: String? = null,
    val source: String? = null,
    @SerialName("started_at")
@@ -179,6 +181,58 @@ data class RenameSessionRequest(
    val title: String
 )

+// --- Server-backed bulk cleanup (dashboard POST /api/sessions/prune) ---
+
+/**
+ * Client-side subset of upstream's `SessionPrune` body. Nulls are omitted from
+ * the request; a fully-bare filter set is a "bare prune", where upstream
+ * applies its own implicit ended-more-than-90-days-ago cutoff.
+ */
+data class SessionPruneFilters(
+    val olderThanDays: Double? = null,
+    val source: String? = null,
+    val profile: String? = null,
+    val includeArchived: Boolean = false,
+)
+
+/** One row of the dry-run preview (`sessions` in the prune response). */
+@Serializable
+data class SessionPruneCandidate(
+    @Serializable(with = FlexibleIdNonNullSerializer::class)
+    val id: String = "",
+    val source: String? = null,
+    val title: String? = null,
+    val model: String? = null,
+    @SerialName("started_at")
+    @Serializable(with = FlexibleTimestampSerializer::class)
+    val startedAt: Double? = null,
+    @SerialName("message_count") val messageCount: Int? = null,
+)
+
+/**
+ * Dry-run response: what a prune WOULD delete — count, started-at span, and
+ * the candidate rows — without deleting anything. Upstream orders candidates
+ * oldest-first.
+ */
+@Serializable
+data class SessionPrunePreview(
+    val matched: Int = 0,
+    @SerialName("oldest_started_at")
+    @Serializable(with = FlexibleTimestampSerializer::class)
+    val oldestStartedAt: Double? = null,
+    @SerialName("newest_started_at")
+    @Serializable(with = FlexibleTimestampSerializer::class)
+    val newestStartedAt: Double? = null,
+    val sessions: List<SessionPruneCandidate> = emptyList(),
+)
+
+/** Apply response — how many sessions the server actually removed. */
+@Serializable
+data class SessionPruneResult(
+    val ok: Boolean = true,
+    val removed: Int = 0,
+)
+
 // --- Messages ---

@Serializable
@@ -8,6 +8,11 @@ import android.service.notification.StatusBarNotification
 import android.util.Log
 import com.hermesandroid.relay.network.relay.ChannelMultiplexer
 import com.hermesandroid.relay.network.relay.models.Envelope
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.SupervisorJob
+import kotlinx.coroutines.cancel
+import kotlinx.coroutines.launch
 import kotlinx.serialization.json.Json
 import kotlinx.serialization.json.JsonObject
 import kotlinx.serialization.json.encodeToJsonElement
@@ -42,6 +47,11 @@ import java.util.concurrent.ConcurrentLinkedQueue
 */
 class HermesNotificationCompanion : NotificationListenerService() {

+    private val serviceScope = CoroutineScope(SupervisorJob() + Dispatchers.IO)
+    private val triggerStore by lazy {
+        NotificationTriggerStore(applicationContext.notificationTriggerDataStore)
+    }
+
    /**
     * Buffer for entries that arrive before [multiplexer] has been
     * wired up (e.g. notifications during app cold-start). Bounded so
@@ -68,6 +78,7 @@ class HermesNotificationCompanion : NotificationListenerService() {
        if (active === this) {
            active = null
        }
+        serviceScope.cancel()
        super.onDestroy()
    }

@@ -75,6 +86,13 @@ class HermesNotificationCompanion : NotificationListenerService() {
        if (sbn == null) return

        val entry = sbn.toEntry() ?: return
+        // The trigger MVP posts its own local prompt notifications. Never feed
+        // Hermes-Relay's notifications back into the rule engine, or a broad
+        // rule could prompt on its own prompt. Still forward them to the relay
+        // cache to preserve existing notification-companion semantics.
+        if (entry.packageName != packageName) {
+            evaluateNotificationTriggers(entry)
+        }
        val envelope = entry.toEnvelope()

        // Drain any backlog first so order is preserved.
@@ -141,6 +159,31 @@ class HermesNotificationCompanion : NotificationListenerService() {
        )
    }

+    private fun evaluateNotificationTriggers(entry: NotificationEntry) {
+        serviceScope.launch {
+            val match = triggerStore.firstMatchingRule(entry) ?: return@launch
+            val result = when (match.rule.action) {
+                NotificationTriggerAction.AskMe -> NotificationTriggerPromptNotifier.notifyAskMe(
+                    context = applicationContext,
+                    rule = match.rule,
+                    entry = entry,
+                )
+            }
+            triggerStore.appendActivity(
+                NotificationTriggerActivityEntry(
+                    ruleId = match.rule.id,
+                    ruleLabel = match.rule.label,
+                    action = match.rule.action,
+                    packageName = entry.packageName,
+                    title = entry.title,
+                    textPreview = entry.text?.take(160) ?: entry.subText?.take(160),
+                    matchedAt = System.currentTimeMillis(),
+                    result = result,
+                )
+            )
+        }
+    }
+
    private fun NotificationEntry.toEnvelope(): Envelope {
        val payload = JSON.encodeToJsonElement(NotificationEntry.serializer(), this) as JsonObject
        return Envelope(
@@ -0,0 +1,292 @@
+package com.hermesandroid.relay.notifications
+
+import android.Manifest
+import android.annotation.SuppressLint
+import android.app.NotificationChannel
+import android.app.NotificationManager
+import android.app.PendingIntent
+import android.content.Context
+import android.content.Intent
+import android.content.pm.PackageManager
+import android.os.Build
+import android.util.Log
+import androidx.core.app.NotificationCompat
+import androidx.core.app.NotificationManagerCompat
+import androidx.core.content.ContextCompat
+import androidx.datastore.core.DataStore
+import androidx.datastore.preferences.core.Preferences
+import androidx.datastore.preferences.core.booleanPreferencesKey
+import androidx.datastore.preferences.core.edit
+import androidx.datastore.preferences.core.stringPreferencesKey
+import androidx.datastore.preferences.preferencesDataStore
+import com.hermesandroid.relay.MainActivity
+import com.hermesandroid.relay.R
+import kotlinx.coroutines.flow.Flow
+import kotlinx.coroutines.flow.first
+import kotlinx.coroutines.flow.map
+import kotlinx.serialization.SerialName
+import kotlinx.serialization.Serializable
+import kotlinx.serialization.decodeFromString
+import kotlinx.serialization.encodeToString
+import kotlinx.serialization.json.Json
+import java.util.UUID
+
+/**
+ * Minimal notification-trigger MVP schema and persistence.
+ *
+ * Storage location: Android DataStore preferences file `notification_triggers`
+ * under the app-private data directory. Rules and the visible activity log are
+ * JSON strings so schema evolution remains additive and lenient.
+ */
+@Serializable
+data class NotificationTriggerRule(
+    val id: String = UUID.randomUUID().toString(),
+    val label: String = "Ask me about matching notifications",
+    val enabled: Boolean = true,
+    @SerialName("app_package")
+    val appPackage: String? = null,
+    @SerialName("title_contains")
+    val titleContains: String? = null,
+    @SerialName("text_contains")
+    val textContains: String? = null,
+    val action: NotificationTriggerAction = NotificationTriggerAction.AskMe,
+    @SerialName("require_confirmation")
+    val requireConfirmation: Boolean = false,
+)
+
+@Serializable
+enum class NotificationTriggerAction {
+    @SerialName("ask_me")
+    AskMe,
+}
+
+@Serializable
+data class NotificationTriggerActivityEntry(
+    val id: String = UUID.randomUUID().toString(),
+    @SerialName("rule_id")
+    val ruleId: String,
+    @SerialName("rule_label")
+    val ruleLabel: String,
+    val action: NotificationTriggerAction,
+    @SerialName("package_name")
+    val packageName: String,
+    val title: String? = null,
+    @SerialName("text_preview")
+    val textPreview: String? = null,
+    @SerialName("matched_at")
+    val matchedAt: Long,
+    val result: String,
+)
+
+@Serializable
+data class NotificationTriggerSettings(
+    @SerialName("master_enabled")
+    val masterEnabled: Boolean = false,
+    @SerialName("kill_switch")
+    val killSwitch: Boolean = false,
+    val rules: List<NotificationTriggerRule> = emptyList(),
+    @SerialName("activity_log")
+    val activityLog: List<NotificationTriggerActivityEntry> = emptyList(),
+)
+
+data class NotificationTriggerMatch(
+    val rule: NotificationTriggerRule,
+    val entry: NotificationEntry,
+)
+
+internal val Context.notificationTriggerDataStore: DataStore<Preferences> by
+    preferencesDataStore(name = "notification_triggers")
+
+class NotificationTriggerStore(
+    private val dataStore: DataStore<Preferences>,
+) {
+    private val json = Json {
+        ignoreUnknownKeys = true
+        encodeDefaults = true
+    }
+
+    val settings: Flow<NotificationTriggerSettings> = dataStore.data.map { prefs ->
+        NotificationTriggerSettings(
+            masterEnabled = prefs[KEY_MASTER_ENABLED] ?: false,
+            killSwitch = prefs[KEY_KILL_SWITCH] ?: false,
+            rules = decodeList<NotificationTriggerRule>(prefs[KEY_RULES_JSON]),
+            activityLog = decodeList<NotificationTriggerActivityEntry>(prefs[KEY_ACTIVITY_LOG_JSON]),
+        )
+    }
+
+    suspend fun setMasterEnabled(enabled: Boolean) {
+        dataStore.edit { prefs -> prefs[KEY_MASTER_ENABLED] = enabled }
+    }
+
+    suspend fun setKillSwitch(enabled: Boolean) {
+        dataStore.edit { prefs -> prefs[KEY_KILL_SWITCH] = enabled }
+    }
+
+    suspend fun saveSingleRule(rule: NotificationTriggerRule) {
+        dataStore.edit { prefs ->
+            prefs[KEY_RULES_JSON] = json.encodeToString(listOf(rule.normalized()))
+        }
+    }
+
+    suspend fun clearActivityLog() {
+        dataStore.edit { prefs -> prefs.remove(KEY_ACTIVITY_LOG_JSON) }
+    }
+
+    suspend fun firstMatchingRule(entry: NotificationEntry): NotificationTriggerMatch? {
+        val snapshot = settings.first()
+        if (!snapshot.masterEnabled || snapshot.killSwitch) return null
+        val rule = snapshot.rules.firstOrNull { it.matches(entry) } ?: return null
+        return NotificationTriggerMatch(rule = rule, entry = entry)
+    }
+
+    suspend fun appendActivity(entry: NotificationTriggerActivityEntry) {
+        dataStore.edit { prefs ->
+            val current = decodeList<NotificationTriggerActivityEntry>(prefs[KEY_ACTIVITY_LOG_JSON])
+            prefs[KEY_ACTIVITY_LOG_JSON] = json.encodeToString(
+                (listOf(entry) + current).take(MAX_ACTIVITY_LOG_ENTRIES),
+            )
+        }
+    }
+
+    private inline fun <reified T> decodeList(raw: String?): List<T> {
+        if (raw.isNullOrBlank()) return emptyList()
+        return runCatching { json.decodeFromString<List<T>>(raw) }.getOrDefault(emptyList())
+    }
+
+    private fun NotificationTriggerRule.normalized(): NotificationTriggerRule = copy(
+        label = label.trim().ifBlank { "Ask me about matching notifications" },
+        appPackage = appPackage.cleanBlank(),
+        titleContains = titleContains.cleanBlank(),
+        textContains = textContains.cleanBlank(),
+    )
+
+    companion object {
+        private val KEY_MASTER_ENABLED = booleanPreferencesKey("notification_triggers_enabled")
+        private val KEY_KILL_SWITCH = booleanPreferencesKey("notification_triggers_kill_switch")
+        private val KEY_RULES_JSON = stringPreferencesKey("notification_trigger_rules_json")
+        private val KEY_ACTIVITY_LOG_JSON = stringPreferencesKey("notification_trigger_activity_log_json")
+        const val MAX_ACTIVITY_LOG_ENTRIES = 25
+
+        fun defaultRule(): NotificationTriggerRule = NotificationTriggerRule()
+    }
+}
+
+fun NotificationTriggerRule.matches(entry: NotificationEntry): Boolean {
+    if (!enabled) return false
+    val app = appPackage.cleanBlank()
+    val titleNeedle = titleContains.cleanBlank()
+    val textNeedle = textContains.cleanBlank()
+
+    // Avoid accidental "match every notification on the phone" rules. The UI
+    // requires at least one filter too, but this keeps imported/future schema
+    // data safe.
+    if (app == null && titleNeedle == null && textNeedle == null) return false
+
+    if (app != null && !entry.packageName.equals(app, ignoreCase = true)) return false
+    if (titleNeedle != null && !entry.title.orEmpty().contains(titleNeedle, ignoreCase = true)) {
+        return false
+    }
+    if (textNeedle != null) {
+        val haystack = listOfNotNull(entry.text, entry.subText).joinToString("\n")
+        if (!haystack.contains(textNeedle, ignoreCase = true)) return false
+    }
+    return true
+}
+
+fun NotificationTriggerRule.summary(): String {
+    val parts = buildList {
+        appPackage.cleanBlank()?.let { add("app $it") }
+        titleContains.cleanBlank()?.let { add("title contains “$it”") }
+        textContains.cleanBlank()?.let { add("text contains “$it”") }
+    }
+    return if (parts.isEmpty()) "No filters set" else parts.joinToString(" · ")
+}
+
+private fun String?.cleanBlank(): String? = this?.trim()?.takeIf { it.isNotBlank() }
+
+object NotificationTriggerPromptNotifier {
+    private const val TAG = "NotifTriggerPrompt"
+    private const val CHANNEL_ID = "notification_triggers"
+    private const val CHANNEL_NAME = "Notification triggers"
+    private const val NOTIFICATION_ID_BASE = 4300
+    private const val CHAT_ROUTE = "chat"
+
+    /**
+     * Safe automatic action: post a local prompt that asks the user whether to
+     * involve Hermes. It does not send an LLM request, reply, tap, text, route,
+     * or otherwise act on another app without the user tapping first.
+     */
+    @SuppressLint("MissingPermission", "NotificationPermission")
+    fun notifyAskMe(
+        context: Context,
+        rule: NotificationTriggerRule,
+        entry: NotificationEntry,
+    ): String {
+        ensureChannel(context)
+        if (!hasPostNotificationsPermission(context)) {
+            Log.i(TAG, "POST_NOTIFICATIONS not granted — logging trigger without prompt")
+            return "skipped: post-notifications permission missing"
+        }
+
+        val tapIntent = Intent(context, MainActivity::class.java).apply {
+            flags = Intent.FLAG_ACTIVITY_NEW_TASK or Intent.FLAG_ACTIVITY_CLEAR_TOP
+            putExtra(MainActivity.EXTRA_NAV_ROUTE, CHAT_ROUTE)
+        }
+        val pendingFlags = PendingIntent.FLAG_UPDATE_CURRENT or PendingIntent.FLAG_IMMUTABLE
+        val tapPending = PendingIntent.getActivity(context, notificationId(entry), tapIntent, pendingFlags)
+
+        val title = context.getString(R.string.notification_trigger_prompt_title)
+        val source = entry.title?.takeIf { it.isNotBlank() } ?: entry.packageName
+        val body = entry.text?.takeIf { it.isNotBlank() }
+            ?: "Rule matched: ${rule.summary()}"
+        val expanded = "Matched ${rule.summary()}\n\n$source\n$body"
+
+        val notification = NotificationCompat.Builder(context, CHANNEL_ID)
+            .setSmallIcon(R.mipmap.ic_launcher)
+            .setContentTitle(title)
+            .setContentText("$source — ${body.take(96)}")
+            .setStyle(NotificationCompat.BigTextStyle().bigText(expanded.take(700)))
+            .setContentIntent(tapPending)
+            .setAutoCancel(true)
+            .setOnlyAlertOnce(false)
+            .setPriority(NotificationCompat.PRIORITY_DEFAULT)
+            .setCategory(NotificationCompat.CATEGORY_REMINDER)
+            .build()
+
+        return runCatching {
+            NotificationManagerCompat.from(context).notify(notificationId(entry), notification)
+            "prompt posted"
+        }.getOrElse { exc ->
+            Log.w(TAG, "notifyAskMe: notify failed", exc)
+            "skipped: prompt failed (${exc.javaClass.simpleName})"
+        }
+    }
+
+    private fun notificationId(entry: NotificationEntry): Int {
+        val suffix = (entry.key.hashCode() and 0x0fff)
+        return NOTIFICATION_ID_BASE + suffix
+    }
+
+    private fun ensureChannel(context: Context) {
+        if (Build.VERSION.SDK_INT < Build.VERSION_CODES.O) return
+        val nm = context.getSystemService(NotificationManager::class.java) ?: return
+        if (nm.getNotificationChannel(CHANNEL_ID) != null) return
+        val channel = NotificationChannel(
+            CHANNEL_ID,
+            CHANNEL_NAME,
+            NotificationManager.IMPORTANCE_DEFAULT,
+        ).apply {
+            description = "Prompts shown when an explicitly enabled notification trigger matches."
+            setShowBadge(true)
+        }
+        nm.createNotificationChannel(channel)
+    }
+
+    private fun hasPostNotificationsPermission(context: Context): Boolean {
+        if (Build.VERSION.SDK_INT < Build.VERSION_CODES.TIRAMISU) return true
+        return ContextCompat.checkSelfPermission(
+            context,
+            Manifest.permission.POST_NOTIFICATIONS,
+        ) == PackageManager.PERMISSION_GRANTED
+    }
+}
--- a/Show More
+++ b/Show More
				`@@ -0,0 +1 @@`
				`“服务器默认”现在会让代理、聊天、会话抽屉和记录保持在 Hermes 当前活动配置文件中。可按连接重新排序或隐藏配置文件，从手机选择图标，或从已更新且配对的 Relay 导入 avatar.png/profile.jpg。图像导入也会明确区分 Relay 版本过旧与头像文件缺失。`