Merge pull request #3663 from vitorpamplona/claude/sqlite-query-performance-bh2j27

SQLite query scaling: FTS contentless, tag-merge, pooled statements

.claude/CLAUDE.md

@@ -302,6 +302,21 @@ Do this before considering the task complete.
   `forEach`/`map`/`filter`/`any` — the `fast*` variants allocate no iterator,
   no intermediate list, and no lambda object. Don't "modernize" those into
   stdlib collection calls; match the surrounding hot-path style.
+- **Never put raw invisible/bidirectional Unicode characters in source files**
+  — write them as `\uXXXX` escapes instead (`'\u202E'`, `Regex("[\u200B-\u200D\uFEFF]")`).
+  This covers the bidi family Sonar's Trojan-Source rule (CVE-2021-42574)
+  flags — U+202A–U+202E, the isolates U+2066–U+2069, U+200E/U+200F, U+061C —
+  plus zero-width characters (U+200B–U+200D, U+FEFF, U+2060). The escape
+  compiles to the identical codepoint, so behaviour is unchanged; the point is
+  that the file on disk stays visually unambiguous. Applies even when the
+  character is *intentional* (sanitizer strip-lists, adversarial test
+  payloads) — that's data, and escapes express it just as well. Exceptions:
+  U+200D as part of a real emoji ZWJ sequence in test data (👩‍👧 — functional,
+  not a bidi control), and LRM/RLM inside Crowdin-managed `strings.xml`
+  translations (legitimate RTL typography; don't touch those files by hand
+  anyway). Note the tooling trap: the Edit tool may normalise a typed
+  `\uXXXX` back into the raw character — if that happens, do the replacement
+  at byte level (`perl -CSD -pe 's/\x{202E}/\\u202E/g'`).
 
 ### Navigation Shell
 - **Desktop**: Sidebar + main content area

.claude/hooks/pre-push-spotless.sh

@@ -63,15 +63,10 @@ before="$(git diff HEAD -- '*.kt' '*.kts' 2>/dev/null | sha1sum)"
 
 log="$(mktemp /tmp/spotless-gate.XXXXXX.log)"
 if ! ./gradlew spotlessApply >"$log" 2>&1; then
-  # Distinguish a formatting failure (block) from Gradle being unable to RUN —
-  # e.g. deps can't resolve in a restricted sandbox. An infra failure must not
-  # strand the agent; warn and let CI's spotlessCheck be the backstop.
-  if grep -qiE "could not resolve|could not (get|download)|handshake|connect timed out|no address|unable to (find|resolve) host|read timed out" "$log"; then
-    echo "WARN: could not run spotlessApply (Gradle infra/network failure), skipping the formatting gate." >&2
-    echo "      CI's spotlessCheck still enforces formatting on the PR." >&2
-    rm -f "$log"
-    exit 0
-  fi
+  # Any failure blocks. The web sandbox pre-seeds the Gradle distribution (see
+  # .claude/hooks/session-start.sh) and Gradle resolves deps through the proxy,
+  # so spotlessApply no longer fails for infra reasons — a failure here is a
+  # real formatting/compile error, not a restricted-sandbox hiccup.
   echo "BLOCKED: spotlessApply failed — fix the build/formatting error before pushing." >&2
   echo "----- gradle output (tail) -----" >&2
   tail -n 40 "$log" >&2

.claude/hooks/session-start.sh

@@ -211,6 +211,60 @@ install_konan_dep "llvm-19-x86_64-linux-essentials-109" \
 install_konan_dep "libffi-3.2.1-2-linux-x86-64" \
   "$KONAN_DEPS_URL/libffi-3.2.1-2-linux-x86-64.tar.gz"
 
+# --- Gradle distribution: pre-seed the wrapper distribution ---
+# The wrapper's distributionUrl (services.gradle.org) 307-redirects to
+# github.com release assets, which the web sandbox's git-only GitHub proxy
+# blocks (403) even at Full network access — so `./gradlew` can't bootstrap.
+# Download the pinned distribution from a mirror instead, but verify it against
+# Gradle's OFFICIAL sha256 (served from services.gradle.org, reachable here)
+# so a tampered/wrong mirror file is rejected and never executed. Idempotent:
+# skips entirely if the distribution is already installed.
+seed_gradle_distribution() {
+  local props="$CLAUDE_PROJECT_DIR/gradle/wrapper/gradle-wrapper.properties"
+  [ -f "$props" ] || return 0
+  local url zip name hash dir ver official mirror ok=""
+  url=$(sed -n 's/^distributionUrl=//p' "$props" | sed 's/\\//g')
+  [ -n "$url" ] || return 0
+  zip=${url##*/}; name=${zip%.zip}
+  # Gradle stores the dist under base36(md5(distributionUrl)) — derive it so this
+  # keeps working across version bumps instead of hardcoding the hash dir.
+  hash=$(python3 - "$url" <<'PY'
+import hashlib, sys
+n = int.from_bytes(hashlib.md5(sys.argv[1].encode()).digest(), 'big')
+d = "0123456789abcdefghijklmnopqrstuvwxyz"; s = ""
+while n:
+    s = d[n % 36] + s; n //= 36
+print(s or "0")
+PY
+)
+  dir="${GRADLE_USER_HOME:-$HOME/.gradle}/wrapper/dists/$name/$hash"
+  ver=${name%-bin}; ver=${ver%-all}
+  if [ -x "$dir/$ver/bin/gradle" ]; then return 0; fi   # already installed
+  echo "Seeding Gradle distribution $ver (github release blocked; using verified mirror)..." >&2
+  mkdir -p "$dir"
+  official=$(curl -fsSL "https://services.gradle.org/distributions/${zip}.sha256") || {
+    echo "Could not fetch official Gradle checksum; leaving gradlew to fail as before." >&2
+    return 0
+  }
+  for mirror in \
+      "https://mirrors.cloud.tencent.com/gradle" \
+      "https://mirrors.huaweicloud.com/gradle"; do
+    if curl -fsSL -o "$dir/$zip" "$mirror/$zip" \
+       && echo "${official}  $dir/$zip" | sha256sum -c - >/dev/null 2>&1; then
+      ok=1; break
+    fi
+    echo "Mirror $mirror failed download/verify; trying next." >&2
+    rm -f "$dir/$zip"
+  done
+  if [ -z "$ok" ]; then
+    echo "Gradle seed failed against all mirrors; leaving gradlew to fail as before." >&2
+    return 0
+  fi
+  unzip -q "$dir/$zip" -d "$dir" && touch "$dir/$zip.ok"
+  echo "Gradle $ver seeded and verified against official sha256." >&2
+}
+seed_gradle_distribution
+
 cd "$CLAUDE_PROJECT_DIR"
 ./gradlew --version > /dev/null 2>&1
 

.claude/skills/find-missing-translations/SKILL.md

@@ -7,7 +7,9 @@ description: Use when comparing Android strings.xml locale files to find untrans
 
 ## Overview
 
-Extract string resource keys from the default `values/strings.xml` that are absent in a target locale's `strings.xml`, excluding non-translatable entries. Outputs missing keys and offers to translate them.
+Extract string resource keys from a default `values/strings.xml` that are absent in a target locale's `strings.xml`, excluding non-translatable entries. Outputs missing keys and offers to translate them.
+
+The repo now has **two independent Crowdin-managed resource trees** — you must scan **both** (see "Resource trees" below).
 
 ## When to Use
 
@@ -15,6 +17,56 @@ Extract string resource keys from the default `values/strings.xml` that are abse
 - Preparing a batch of strings for a translator
 - Checking translation coverage after adding new features
 
+## Resource trees (scan BOTH)
+
+There are two separate `strings.xml` trees, each with its own default `values/` and per-locale `values-<locale>/` files, each wired into `crowdin.yml` independently:
+
+| Tree | Default file | Per-locale file |
+|------|--------------|-----------------|
+| **amethyst** (Android app) | `amethyst/src/main/res/values/strings.xml` | `amethyst/src/main/res/values-<locale>/strings.xml` |
+| **commons** (KMP Compose resources, shared by Android + Desktop) | `commons/src/commonMain/composeResources/values/strings.xml` | `commons/src/commonMain/composeResources/values-<locale>/strings.xml` |
+
+The `commons` tree appeared when shared event-renderer composables were extracted out of `amethyst/` into `commons/` (Compose Multiplatform `stringResource`). It is **not** a copy of the amethyst tree — the vast majority of its keys are commons-only; only a small handful overlap. Every diff/count/translate command below works on either tree by swapping the base path — **run the whole technique once per tree** and report them separately (each maps to its own Crowdin file, so the counts should reconcile against two different Crowdin UI numbers).
+
+**Locale-qualifier caveat:** `commons` uses the same region-qualified locale dirs as amethyst for our four targets (`values-cs`, `values-de-rDE`, `values-sv-rSE`, `values-pt-rBR`), but the *full* set of locale dirs differs between trees. Enumerate `values-*` under each tree's own base rather than assuming they match.
+
+**Overlap (copy — but only after checking the English matches):** a few `commons` keys share a *name* with a key in the amethyst tree. For such a key already translated in the amethyst locale file you may **copy the existing approved translation verbatim** — but **only if the two English source values are byte-identical.** A shared key name does **not** guarantee a shared meaning.
+
+> ⚠️ **Mistake we actually made (2026-07-18):** `napplet_card_permissions` exists in *both* trees with the *same key name* but *different English* — commons = `"What it can access"`, amethyst = `"Permissions:"`. Copying the amethyst translation by key name produced the wrong string in commons (it said "Permissions:" where the UI reads "What it can access"). **Always diff the English values, not just the key names.** When the English differs, translate the commons value fresh — or, better, find the amethyst key whose *value* matches (here `favorite_app_access_show` = "What it can access") and copy *that* approved translation.
+
+Detect name-overlap **and flag value mismatches** in one pass:
+
+```bash
+cdef=commons/src/commonMain/composeResources/values/strings.xml
+adef=amethyst/src/main/res/values/strings.xml
+comm -12 \
+  <(grep '<string name=' "$cdef" | sed 's/.*name="\([^"]*\)".*/\1/' | sort -u) \
+  <(grep '<string name=' "$adef" | grep -v 'translatable="false"' | sed 's/.*name="\([^"]*\)".*/\1/' | sort -u) \
+| while read -r k; do
+    cv=$(grep -m1 "name=\"$k\"" "$cdef" | sed 's/.*>\(.*\)<\/string>/\1/')
+    av=$(grep -m1 "name=\"$k\"" "$adef" | sed 's/.*>\(.*\)<\/string>/\1/')
+    [ "$cv" = "$av" ] && echo "SAFE-COPY   $k" || echo "VALUE-DIFFERS $k  commons=\"$cv\"  amethyst=\"$av\""
+  done
+```
+
+Only `SAFE-COPY` keys may be copied verbatim. For `VALUE-DIFFERS`, translate the commons English fresh (or copy from the amethyst key that has the *matching value*).
+
+**Whitespace-quote convention differs between trees.** Android string resources use surrounding double-quotes to preserve leading/trailing whitespace (`"replying to "`). The **commons Compose-resources tree does NOT use this convention** — it authors trailing/leading spaces raw and unquoted (`replying to `). So when copying/translating a commons string with edge whitespace, **match the commons source: raw spaces, no wrapping quotes.** (Mistake we made: we copied amethyst's quoted `"replying to "` into commons, where the quotes would render literally.) A quick check for stray quote-wrapping you introduced:
+
+```bash
+grep -nE '<string name="[^"]*">"' commons/src/commonMain/composeResources/values-*/strings.xml
+# The commons English tree has zero quote-wrapped values — any hit in a locale file is almost certainly a bad copy from amethyst.
+```
+
+**Why two catalogs exist — the duplication is NOT a bug to "fix" (don't ask again).** You will see the same English text (`Cancel`, `Save`, `Delete`, `Open`, …) defined *many* times across the amethyst tree under per-feature keys **and** once more in commons under generic keys (`action_cancel`, `action_save`, …). This is **required architecture, not an error:**
+
+- The two trees are **different resource systems**: amethyst uses Android `R.string`; commons uses Compose-Multiplatform `Res.string` (`com.vitorpamplona.amethyst.commons.resources.Res`).
+- **`commons` cannot depend on `amethyst`** (amethyst depends on commons — the reverse would be circular). So a composable extracted *into* commons physically cannot reference `R.string.cancel`; it needs its own string, hence the generic `action_*` keys. That is the only way an extracted shared composable can render "Cancel."
+- The scattered amethyst per-feature duplicates (`nip46_signer_cancel`, `nest_create_cancel`, …) are **pre-existing tech debt**; the commons keys did not create them.
+- Both catalogs are Crowdin-managed **independently**, and Crowdin's translation memory pre-fills repeats, so translating the same word in both trees is **not** wasted effort.
+
+**Do not** treat the value-overlap as something to deduplicate during a translation pass. Migrating amethyst's own screens onto the shared `action_*` strings is a *separate, optional* refactor and a maintainer call — out of scope for this skill. Just translate each tree correctly and independently.
+
 ## Background: Crowdin strip-identical behavior
 
 This repo syncs translations via Crowdin (branch `l10n_crowdin_translations`). Crowdin's default export behavior **omits any translation that exactly equals the source**, so a key that the translator deliberately kept as English (common for brand terms like `"Nowhere Drop"`, single-word loanwords like `"Apps"` / `"Feed"` / `"Issues"`, or version prefixes like `"v%1$s"`) will not appear in the locale's `strings.xml` even though the Crowdin UI shows it as 100% translated.
@@ -53,9 +105,25 @@ The default set of locales (unless the user specifies otherwise):
 
 ### 1. Identify files
 
+Do this for **each** resource tree (see "Resource trees" above). The examples below use the amethyst base path; repeat every step with the commons base path swapped in.
+
 ```
+# amethyst tree
 Default:  amethyst/src/main/res/values/strings.xml
 Target:   amethyst/src/main/res/values-<locale>/strings.xml
+
+# commons tree
+Default:  commons/src/commonMain/composeResources/values/strings.xml
+Target:   commons/src/commonMain/composeResources/values-<locale>/strings.xml
+```
+
+A convenient way to run the whole technique twice is to loop over the two base dirs:
+
+```bash
+for base in amethyst/src/main/res commons/src/commonMain/composeResources; do
+  echo "########## tree: $base ##########"
+  # ... run the diff/count/value-extraction commands with $base/values[...] ...
+done
 ```
 
 ### 2. Find missing keys using cs as reference
@@ -153,8 +221,10 @@ Flag and offer to fix:
 ```bash
 # Scan every locale's strings.xml for <item quantity="one"> entries that
 # hardcode "1" (or other literal digits) instead of using a placeholder.
-# Looks at default + all values-* locales.
-for f in amethyst/src/main/res/values/strings.xml amethyst/src/main/res/values-*/strings.xml; do
+# Looks at default + all values-* locales, in BOTH resource trees.
+for f in amethyst/src/main/res/values/strings.xml amethyst/src/main/res/values-*/strings.xml \
+         commons/src/commonMain/composeResources/values/strings.xml \
+         commons/src/commonMain/composeResources/values-*/strings.xml; do
   awk -v file="$f" '
     /<plurals/ { in_plurals = 1; name = $0; sub(/.*name="/, "", name); sub(/".*/, "", name) }
     in_plurals && /quantity="one"/ {
@@ -173,7 +243,9 @@ done
 Then scan for dead `quantity="zero"` entries. CLDR's `zero` category is integer-bearing only in **Arabic (`ar`)** and **Welsh (`cy`)**. In every other locale, count=0 falls through to `other`, so a `<item quantity="zero">` entry is dead and likely a translator/author bug (or it silently never fires):
 
 ```bash
-for f in amethyst/src/main/res/values/strings.xml amethyst/src/main/res/values-*/strings.xml; do
+for f in amethyst/src/main/res/values/strings.xml amethyst/src/main/res/values-*/strings.xml \
+         commons/src/commonMain/composeResources/values/strings.xml \
+         commons/src/commonMain/composeResources/values-*/strings.xml; do
   # Skip Arabic and Welsh — they natively use the zero category.
   case "$f" in
     *values-ar*|*values-cy*) continue ;;
@@ -260,14 +332,48 @@ When adding translated strings to locale files:
 
 - **Append new strings at the bottom** of the file, just before the closing `</resources>` tag.
 - Do NOT try to insert them in alphabetical or matching order — a separate process handles ordering.
+- **Insert into each locale ONLY the keys missing from *that* locale — never a shared "union" block.** Because Crowdin strips keys asymmetrically (Step 2), a key you translate may already exist in some target locales. If you compute one union set of missing keys, translate it, and paste the *same* block into every locale, you will create **duplicate keys** in whichever locales already had them. Drive the insertion off the **per-locale** diff, not the union:
+
+  ```bash
+  # For each locale, insert only the keys comm -23 reports missing FOR THAT LOCALE.
+  for l in cs de-rDE sv-rSE pt-rBR; do
+    missing=$(comm -23 \
+      <(grep '<string name=' $base/values/strings.xml | grep -v 'translatable="false"' \
+        | sed 's/.*name="\([^"]*\)".*/\1/' | sort) \
+      <(grep '<string name=' $base/values-$l/strings.xml \
+        | sed 's/.*name="\([^"]*\)".*/\1/' | sort))
+    # ... append ONLY the $missing keys' translations to values-$l/strings.xml ...
+  done
+  ```
+
+  (This bit us on 2026-07-21: `ps1_save_block`, `podcast_value_for_value`, and `chats_history_relays` were each missing in only *some* commons locales, but the same 3-key block was pasted into all four — producing duplicates in the locales that already had them.)
+
+- **After inserting, verify each edited file has no duplicate keys AND is well-formed XML — before you call the task done.** A duplicate key is not a warning: the `commons` tree's Compose-resources build task fails hard on it (`convertXmlValueResourcesForCommonMain: … Duplicated key '…'`), which breaks the build for everyone. Quick post-insertion gate over every file you touched:
+
+  ```bash
+  for f in <every edited strings.xml>; do
+    dups=$(grep -oE '<(string|plurals) name="[^"]*"' "$f" \
+      | sed 's/.*name="\([^"]*\)"/\1/' | sort | uniq -d)
+    [ -n "$dups" ] && echo "DUP in $f: $dups"
+    python3 -c "import xml.dom.minidom; xml.dom.minidom.parse('$f')" \
+      || echo "MALFORMED $f"
+  done
+  # For a commons change, also run the build task that enforces this:
+  #   ./gradlew :commons:convertXmlValueResourcesForCommonMain
+  ```
 
 ## Common Mistakes
 
+- **Scanning only the amethyst tree** — there are now **two** Crowdin-managed `strings.xml` trees (`amethyst/src/main/res` and `commons/src/commonMain/composeResources`). A key extracted into `commons/` will never show up in the amethyst diff. Run the whole technique once per tree (see "Resource trees") and report each separately.
+- **Copying an overlapping `commons` translation by key name alone** — a shared key name does NOT mean shared English. `napplet_card_permissions` is "What it can access" in commons but "Permissions:" in amethyst; copying by name produced the wrong string. Diff the English *values* first; copy verbatim only when they're byte-identical, else translate fresh (see "Overlap" in Resource trees).
+- **Applying amethyst's `"…"` whitespace-quote convention to a commons string** — the commons Compose-resources tree authors edge whitespace raw and unquoted; wrapping quotes copied from amethyst render literally there. Match the commons source format.
+- **Trying to "dedupe" the amethyst↔commons value-overlap** — it's required architecture (commons can't depend on amethyst, so shared composables need their own `Res.string` catalog), not an error. Don't fold consolidation into a translation pass.
 - **Forgetting `translatable="false"`** — these should never appear in locale files
 - **Diffing only `<string name=`** — `<plurals>` is a separate resource type; a source `<plurals>` missing from a locale will never show up in a `<string>` diff. Always run the diff twice (once per resource type) as shown in Step 2. The same goes for `<string-array>` if the project uses it.
 - **Trusting a git "sync-timestamp" heuristic to pre-filter the list** — this skill used to skip keys added before the last `New Crowdin translations` commit, on the theory that Crowdin had already "decided" them. It was dropped: a key added shortly before an export that translators hadn't reached yet is genuinely missing, so the heuristic silently dropped real work. Use the raw on-disk diff and reconcile against the Crowdin web UI's untranslated count instead.
 - **Adding source-identical fallbacks locally** — they get overwritten on the next Crowdin sync. Android falls back to `values/strings.xml` at runtime anyway, so a key intentionally kept as English already renders correctly. Skip these by inspection (brand terms, loanwords, `v%1$s`-style strings); don't translate them to an identical value.
 - **Skipping per-locale diffs when only diffing cs** — Crowdin can strip different keys in different locales (each translator's choice), so cs is not a reliable upper bound. Diff each target locale and union the results.
+- **Pasting the union set of missing keys into every locale → duplicate keys** — the union is the right set to *translate*, but the wrong set to *insert*. A key missing in only some locales, inserted into all of them, duplicates in the ones that already had it. Drive each file's insertion off its own per-locale diff (see Step 6). In `commons`, a duplicate key is build-breaking: `convertXmlValueResourcesForCommonMain` fails with `Duplicated key '…'`. **Always run the post-insertion duplicate + XML-wellformedness gate in Step 6 before declaring done.** (Happened 2026-07-21 with `ps1_save_block` / `podcast_value_for_value` / `chats_history_relays`.)
 - **Inserting strings in a specific position** — always append at the bottom; ordering is handled separately
 - **Hardcoding `"1"` in a `<plurals>` `quantity="one"` item** — always use the count placeholder; otherwise non-English `one` categories produce wrong text
 - **Copying English's `one`/`other` set into every locale** — each language must include all CLDR plural categories it uses (e.g. Czech needs `one`, `few`, `many`, `other`)

.github/workflows/crowdin.yml

@@ -41,6 +41,15 @@ jobs:
           CROWDIN_PROJECT_ID: ${{ secrets.CROWDIN_PROJECT_ID }}
           CROWDIN_PERSONAL_TOKEN: ${{ secrets.CROWDIN_PERSONAL_TOKEN }}
 
+      # crowdin/github-action runs in a Docker container as root, so any file or
+      # directory it downloads (especially a brand-new locale folder like
+      # values-en-rGB/) ends up owned by root. The unprivileged runner user in
+      # the create-pull-request step below then can't unlink those files, which
+      # aborts its branch checkout with "unable to unlink ... Permission denied".
+      # Reclaim ownership of the whole working tree before touching git.
+      - name: Fix ownership after Crowdin Docker action
+        run: sudo chown -R "$(id -u):$(id -g)" "$GITHUB_WORKSPACE"
+
       # Keep docs/changelog/translators.json seeded with everyone who has translated
       # recently, so the per-release `## Translations` credits (scripts/translators.sh)
       # can resolve them to npubs. Only adds rows when a genuinely new contributor
@@ -61,6 +70,7 @@ jobs:
           branch: l10n_crowdin_translations
           add-paths: |
             amethyst/src/main/res/**/strings.xml
+            commons/src/commonMain/composeResources/**/strings.xml
             docs/changelog/translators.json
           commit-message: 'chore: sync Crowdin translations and seed translator npub placeholders'
           title: 'New Crowdin Translations'

README.md

@@ -17,7 +17,7 @@ Join the social network you control.
 [![Maven Central](https://img.shields.io/maven-central/v/com.vitorpamplona.quartz/quartz?label=Quartz%20%28Maven%20Central%29&labelColor=27303D&color=0877d2)](https://central.sonatype.com/artifact/com.vitorpamplona.quartz/quartz)
 [![JitPack snapshots](https://img.shields.io/badge/Quartz%20snapshots-JitPack-27303D?labelColor=27303D&color=0877d2)](https://jitpack.io/#vitorpamplona/amethyst)
 [![CI](https://img.shields.io/github/actions/workflow/status/vitorpamplona/amethyst/build.yml?labelColor=27303D)](https://github.com/vitorpamplona/amethyst/actions/workflows/build.yml)
-[![License: Apache-2.0](https://img.shields.io/github/license/vitorpamplona/amethyst?labelColor=27303D&color=0877d2)](/LICENSE)
+[![License: MIT](https://img.shields.io/github/license/vitorpamplona/amethyst?labelColor=27303D&color=0877d2)](/LICENSE)
 [![Ask DeepWiki](https://deepwiki.com/badge.svg)](https://deepwiki.com/vitorpamplona/amethyst)
 
 ## Download and Install

SKILL.md

@@ -24,7 +24,9 @@ Build customized Amethyst Nostr clients for Android. Fork, rebrand, customize, a
 
 2. **Android SDK**
    - Command-line tools from https://developer.android.com/studio#command-line-tools-only
-   - Required components: build-tools, platform-tools, platforms;android-35
+   - Required components: build-tools, platform-tools, platforms;android-37
+   - The exact SDK level is `android-compileSdk` in `gradle/libs.versions.toml` —
+     check there if this number has drifted.
 
 3. **Git** for cloning the repository
 
@@ -66,48 +68,54 @@ keyPassword=your-password
 
 ### 3. Configure Signing
 
-Add to `amethyst/build.gradle` inside the `android {}` block:
+Add to `amethyst/build.gradle.kts` inside the `android {}` block:
 
-```gradle
-def keystorePropertiesFile = rootProject.file("keystore.properties")
-def keystoreProperties = new Properties()
+```kotlin
+val keystorePropertiesFile = rootProject.file("keystore.properties")
+val keystoreProperties = Properties()
 if (keystorePropertiesFile.exists()) {
-    keystoreProperties.load(new FileInputStream(keystorePropertiesFile))
+    keystorePropertiesFile.inputStream().use { keystoreProperties.load(it) }
 }
 
 signingConfigs {
-    release {
+    create("release") {
         if (keystorePropertiesFile.exists()) {
-            storeFile rootProject.file(keystoreProperties['storeFile'])
-            storePassword keystoreProperties['storePassword']
-            keyAlias keystoreProperties['keyAlias']
-            keyPassword keystoreProperties['keyPassword']
+            storeFile = rootProject.file(keystoreProperties["storeFile"] as String)
+            storePassword = keystoreProperties["storePassword"] as String
+            keyAlias = keystoreProperties["keyAlias"] as String
+            keyPassword = keystoreProperties["keyPassword"] as String
         }
     }
 }
 ```
 
+This needs `import java.util.Properties` at the top of the file.
+
 Update the release buildType to use the signing config:
-```gradle
+```kotlin
 buildTypes {
-    release {
-        signingConfig signingConfigs.release
+    getByName("release") {
+        signingConfig = signingConfigs.getByName("release")
         // ... existing config
     }
 }
 ```
 
+Verify with `./gradlew :amethyst:signingReport` — the release variants should
+report your keystore rather than `~/.android/debug.keystore`.
+
 ### 4. Disable Google Services (Required for F-Droid)
 
 **⚠️ CRITICAL:** The Google Services plugin fails when you change the package name. For F-Droid builds, disable it.
 
-Edit `amethyst/build.gradle`, comment out the plugin:
-```gradle
+Edit `amethyst/build.gradle.kts`, comment out the plugin:
+```kotlin
 plugins {
     alias(libs.plugins.androidApplication)
-    alias(libs.plugins.jetbrainsKotlinAndroid)
     // alias(libs.plugins.googleServices)  // DISABLED for F-Droid
     alias(libs.plugins.jetbrainsComposeCompiler)
+    alias(libs.plugins.serialization)
+    alias(libs.plugins.googleKsp)
 }
 ```
 
@@ -141,8 +149,8 @@ Edit `amethyst/src/main/res/values/strings.xml`:
 
 ### Change Package ID
 
-Edit `amethyst/build.gradle`:
-```gradle
+Edit `amethyst/build.gradle.kts`:
+```kotlin
 android {
     defaultConfig {
         applicationId = "com.yourcompany.yourapp"
@@ -152,8 +160,8 @@ android {
 
 ### Change Project Name
 
-Edit `settings.gradle`:
-```gradle
+Edit `settings.gradle.kts`:
+```kotlin
 rootProject.name = "YourAppName"
 ```
 
@@ -167,36 +175,28 @@ Replace icon files in:
 
 Make your app identify itself on posts with `["client", "YourAppName"]`.
 
-**1. Create tag builder extension:**
+You do **not** need to add the tag per event type. The client tag is applied
+centrally by `NostrSignerWithClientTag`, a signer decorator that appends the tag
+to everything it signs (and respects the user's "add client tag" privacy
+setting). Changing the name is a one-constant edit:
 
-Create `quartz/src/commonMain/kotlin/com/vitorpamplona/quartz/nip01Core/tags/clientTag/TagArrayBuilderExt.kt`:
+Edit `amethyst/src/main/java/com/vitorpamplona/amethyst/model/accountsCache/AccountCacheState.kt`:
 ```kotlin
-package com.vitorpamplona.quartz.nip01Core.tags.clientTag
-
-import com.vitorpamplona.quartz.nip01Core.core.Event
-import com.vitorpamplona.quartz.nip01Core.core.TagArrayBuilder
-
-fun <T : Event> TagArrayBuilder<T>.client(clientName: String) = 
-    addUnique(arrayOf(ClientTag.TAG_NAME, clientName))
+const val CLIENT_TAG_NAME = "YourAppName"
 ```
 
-**2. Add to TextNoteEvent:**
+That constant is passed to `NostrSignerWithClientTag` when the account's signer
+is built, so every signed event carries your name.
 
-Edit `quartz/src/commonMain/kotlin/com/vitorpamplona/quartz/nip10Notes/TextNoteEvent.kt`:
-
-Add import:
-```kotlin
-import com.vitorpamplona.quartz.nip01Core.tags.clientTag.client
-```
-
-In both `build()` functions, add after `alt(...)`:
-```kotlin
-client("YourAppName")
-```
+The tag itself lives in
+`quartz/src/commonMain/kotlin/com/vitorpamplona/quartz/nip89AppHandlers/clientTag/`
+(`ClientTag`, `TagArrayBuilderExt`, `NostrSignerWithClientTag`) — you only need to
+touch it if you want the optional NIP-89 handler address / relay hint variants.
 
 ### Modify Default Relays
 
-Edit relay configuration in `quartz/src/main/java/com/vitorpamplona/quartz/nip01Core/relay/` or the UI settings files.
+Edit `commons/src/commonMain/kotlin/com/vitorpamplona/amethyst/commons/defaults/Constants.kt`
+(see also `AmethystDefaults.kt` and `DefaultDmIndexerRelays.kt` in the same folder).
 
 ## Troubleshooting
 

amethyst/build.gradle.kts

@@ -391,6 +391,10 @@ dependencies {
     implementation(project(":commons"))
     implementation(project(":nestsClient"))
     implementation(project(":nappletHost"))
+    // Compose Multiplatform resources runtime, so app-side screens that share a
+    // string with a commons renderer can read commons' generated `Res` directly
+    // instead of duplicating the key in the Android res tree.
+    implementation(libs.jetbrains.compose.components.resources)
     implementation(libs.androidx.core.ktx)
     implementation(libs.androidx.activity.compose)
 
@@ -563,6 +567,7 @@ dependencies {
     testImplementation(libs.junit)
     testImplementation(libs.mockk)
     testImplementation(libs.kotlinx.coroutines.test)
+    testImplementation(libs.secp256k1.kmp.jni.jvm)
 
     androidTestImplementation(platform(libs.androidx.compose.bom))
     androidTestImplementation(libs.androidx.junit)

amethyst/plans/2026-07-10-concord-mobile-integration.md

@@ -0,0 +1,208 @@
+# Concord — Mobile Integration Plan (mirroring NIP-29 Relay Groups)
+
+## Context
+
+The Concord protocol engine is complete in `quartz/…/concord/` (CORD-01…07,
+~65 tests) and driven end-to-end by the `amy concord` CLI over a commons
+`ConcordActions` layer. This plan covers the **Android app integration**, and it
+deliberately **mirrors the just-merged NIP-29 relay-groups feature** — that work
+used Soapbox's Armada as a study base and established the exact Amethyst touch
+points a group-chat protocol should plug into. Wherever possible we clone the
+NIP-29 file structure with Concord equivalents rather than inventing parallels.
+
+Naming: user-facing = **"Concord Channels"** (Amethyst reserves "community" for
+NIP-72). Protocol-internal code keeps the spec term `community`.
+
+## The one structural difference from NIP-29
+
+NIP-29 group metadata (kind 39000) is **relay-signed and public**, so groups are
+browsable. Concord communities are **end-to-end encrypted**: the only public
+artifact is the addressable kind-33301 invite **bundle**, whose content is
+token-gated. Consequences for the mirror:
+
+- **Addressing** is by *derived stream pubkey* (`group_key.pk` per plane/epoch),
+  not `(hostRelay, groupId)`. A Concord channel lives at its plane address and
+  may be mirrored on several relays (the community's relay set), not pinned to
+  one host. So `ConcordChannel.relays()` = the community relay set.
+- **Discovery** cannot preview E2EE content. The discovery feed surfaces **public
+  invite links** (kind-33301 bundles + links shared in notes), filtered by
+  author/hashtag — the entry action is *redeem a link*, not *browse contents*.
+  This is a genuinely thinner surface than NIP-29; documented, not a bug.
+- **Membership = key possession**, verified locally from the folded Control Plane
+  + banlist (already implemented), not from relay-signed 39001/39002.
+
+## Per-account persistence & subscription model (Concord is between NIP-17 and NIP-28/29)
+
+Separate **addressing** from **encryption/membership** and Concord's place is clear:
+
+| Concern | NIP-28 | NIP-29 | NIP-17 | **Concord** |
+|---|---|---|---|---|
+| Find messages by | channel id | `(relay, h)` | `#p = me` | **`authors=[derived plane pk]`** |
+| Content | public | public | E2EE to you | **E2EE to a shared key** |
+| Decrypt with | — | — | your key | **per-channel derived conv key** |
+| Membership | open | relay roster | key possession | **key possession** |
+| "My rooms" home | follow list | kind-10009 | chatroom set | **kind-13302 (carries secrets)** |
+
+The decisive point: a Concord wrap's `p` tag is **ephemeral**, so you can never
+find messages with `#p = me` (the NIP-17 model). You subscribe **by author = the
+derived plane pubkey** (NIP-28/29 addressing), a query only a secret-holder can
+form, and decrypt with the shared plane key (NIP-17 E2EE).
+
+**Home base = kind-13302 `ConcordCommunityList`** (built in quartz): NIP-44
+self-encrypted, replaceable, relay-synced. Unlike NIP-17 (only secret is your
+identity key) or NIP-29 (public group tags), **each entry carries the community
+secrets** (`community_root`, salt, epoch, private-channel keys). Same trust model
+as NIP-17's recoverable giftwrapped history: a leaked nsec exposes them, nothing
+worse. `ConcordChannelListState` wraps 13302 exactly like `RelayGroupListState`
+wraps 10009 / `EphemeralChatListState` wraps its list — **same wiring, entries
+hold keys.**
+
+**In-memory projection (LocalCache):** `ConcordChannel` keyed by
+`(communityId, channelId)`, holding the folded Control-Plane state + decrypted
+messages — recomputed from events, never persisted as identity (the NIP-28/29
+half).
+
+**Subscription = per-plane author REQ, fanned out from the joined list** — not a
+single `#p=me` catch-all. `ConcordMyChannelsFilterAssembler` (mirrors NIP-29's
+`RelayGroupMyJoinedGroupsFilterAssembler`) walks `account.concordChannelList`,
+derives each community's control-plane + channel-plane addresses, and issues
+`{kinds:[1059], authors:[planePk]}` per plane across the community's relays.
+
+**Secrets at rest:** relay copy is self-NIP-44-encrypted (13302); the on-device
+mirror can be wrapped with `commons/keystorage`.
+
+## Layering (same as NIP-29)
+
+- `quartz/…/concord/` — protocol (done)
+- `commons/…/model/concord/` — `ConcordChannel`, `ConcordChannelListState`,
+  membership/view-mode enums, discovery constraint (platform-agnostic)
+- `amethyst/…/chats/publicChannels/concord/` — screens, feed filters, datasource
+  subassemblers, navigation
+- `commons/…/actions/ConcordActions.kt` — builders/filters/folding (done)
+- `cli/…/commands/Concord*Commands.kt` — verbs (done; already matches the
+  `RelayGroupCommands` route+verb-map pattern)
+
+## Mirror map (NIP-29 file → Concord equivalent)
+
+### commons state
+- `model/nip29RelayGroups/RelayGroupChannel.kt` → **`model/concord/ConcordChannel.kt`**
+  — a `Channel` subclass keyed by a `ConcordChannelId(communityId, channelId)`,
+  holding the folded `ConcordCommunityState` + this channel's messages StateFlow,
+  `relays()` = community relay set, `membershipOf()` from the authority resolver,
+  `placeholderNote()`.
+- `RelayGroupListState.kt` → **`model/concord/ConcordChannelListState.kt`** —
+  backed by the **kind-13302** joined-communities list (already in quartz:
+  `ConcordCommunityList`). Exposes `liveCommunities: StateFlow<List<Entry>>` and
+  `liveServers: StateFlow<Set<communityId>>`. `join(community)`/`leave` do
+  read-modify-write of the 13302 event. Mirrors `EphemeralChatListState`.
+- `RelayGroupMembership.kt` → **`ConcordMembership.kt`** (OWNER/ADMIN/MEMBER/BANNED/
+  NONE) derived from `AuthorityResolver` (rank + banlist).
+- `RelayGroupViewMode.kt` → **`ConcordViewMode.kt`** (INLINE/GROUPED).
+- `model/nip29RelayGroups/GroupDiscoveryConstraint.kt` → **`ConcordDiscoveryConstraint.kt`**
+  (AllPublic / ByPeople / ByHashtags) matching against a public invite bundle.
+
+### Account wiring (`amethyst/…/model/Account.kt`)
+Add right after the `relayGroupList` lines (~382): a
+`ConcordChannelListState(signer, cache, decryptionCache, scope, settings)` field
++ its decryption cache. Action methods next to `joinRelayGroup` (~1472):
+`createConcordCommunity`, `joinConcordFromLink`, `postConcordMessage`,
+`createConcordInvite`, `banConcordMember`, `follow/unfollow(ConcordChannel)` →
+delegate to `ConcordChannelListState`. Writes go through the community relay set.
+Add `concordViewMode` to `AccountSettings.kt`.
+
+### LocalCache (`amethyst/…/model/LocalCache.kt`)
+Add a `LargeCache<ConcordChannelId, ConcordChannel>` index + `getOrCreateConcordChannel`,
+and route inbound kind-1059 wraps on known plane addresses into the fold (decrypt
+→ edition/message). Mirrors `getOrCreateRelayGroupChannel`.
+
+### Messages inbox integration (THE key mirror)
+- `chats/rooms/dal/ChatroomListKnownFeedFilter.kt` + `ChatroomListNewFeedFilter.kt`
+  — extend the 5-way `feed()` concatenation to **6-way**: add a `concordChannels`
+  block reading `account.concordChannelList.liveCommunities`, branching on
+  `concordViewMode` (INLINE = one row per channel via
+  `LocalCache.getOrCreateConcordChannel(...).newestChatNote() ?: placeholderNote()`;
+  GROUPED = one synthetic `ConcordServerRoomNote(communityId, newest)` per
+  community). Update `applyFilter`/`updateListWith` with a
+  `filterRelevantConcordMessages(...)` keyed by `concordRowKey()`.
+- `chats/rooms/dal/RelayGroupServerRoomNote.kt` → **`ConcordServerRoomNote.kt`** —
+  synthetic event-less Note collapsing a community's channels into one inbox row.
+- `chats/rooms/ChatroomHeaderCompose.kt` — add `rendersWithoutEvent` branches for
+  `ConcordServerRoomNote` and channel placeholders; `ConcordServerRoomCompose` →
+  `Route.ConcordServer(communityId)`; `ConcordRoomCompose` (chip = community name)
+  → `routeFor(channel)`. **This is where the "chip opens the Concord Channel"
+  requirement lands.**
+
+### Screens (`amethyst/…/chats/publicChannels/concord/`, mirror `relayGroup/`)
+- `ConcordServerList.kt` (community rows) · `ConcordChannelListScreen.kt(communityId)`
+  (a community's channels, from the folded Control Plane) ·
+  `ConcordChatScreen.kt(communityId, channelId, …)` (top-level route target) ·
+  `ConcordChannelView.kt` (reuse the NIP-28 `ChannelFeedViewModel`/`ChannelView`
+  stack via the `ConcordChannel: Channel` subclass) · `ConcordMembersScreen.kt` ·
+  `ConcordMetadataScreen.kt`/`ViewModel.kt` (create/edit) · `ConcordTopBar.kt`
+  (name + role badge + Members/Edit/Invite/Ban/Leave menu) · `LoadConcordChannel.kt`.
+- Compose composer gated on `membershipOf(me).isMember()`; else a "redeem an
+  invite to post" notice.
+
+### Discovery feed (GitRepositories-style triad; thinner than NIP-29)
+- `concord/dal/ConcordDiscoveryFeedFilter.kt` (`AdditiveFeedFilter<Note>` over
+  public kind-33301 bundles; "My Communities" branch = the 13302 list) +
+  `concord/dal/ConcordDiscoveryConstraint.kt` bridge +
+  `concord/datasource/subassemblies/FilterConcordBundlesBy{Authors,Follows,Hashtag}.kt`.
+  `ConcordDiscoveryScreen.kt` = `DisappearingScaffold` + `FeedFilterSpinner` +
+  `RenderFeedContentState` with `ConcordDiscoveryCard` (name + Join button). FAB →
+  `ConcordBrowse`/redeem-link.
+
+### Navigation (`ui/navigation/routes/Routes.kt` + `AppNavigation.kt`)
+`@Serializable` routes: `Concord`(communityId, channelId, +draftId?/inviteToken?),
+`ConcordServer`(communityId), `ConcordMembers`, `ConcordCreate`, `ConcordEdit`,
+`Concords`(object, bottom-nav → discovery), `ConcordBrowse`. `RouteMaker.routeFor(ConcordChannel)`
++ deep-link: an invite URL/`nostr:`-embedded link → `Route.Concord(..., inviteToken=…)`,
+auto-redeeming on open (mirror NIP-29's inviteCode auto-join). Wire through
+`BouncingIntentNav.kt`.
+
+### Invite/redeem UI + linkification
+- `InviteConcordDialog.kt` (moderator: mint + share link via `ConcordActions.mintInviteLink`)
+  · `JoinConcordDialog.kt` (paste a link → redeem) · `ui/components/ConcordInviteCard.kt`
+  (render a link as a preview card; tap → `Route.Concord(inviteToken)`) ·
+  `ui/components/ClickableConcordInviteLink.kt` (inline linkify shared invite URLs).
+
+### Notifications (your explicit ask)
+Route a Concord message notification click to the **channel chat**, not the feed:
+in the notification builder + `BouncingIntentNav`, map a Concord message
+notification to `Route.Concord(communityId, channelId)`. Mirror how NIP-29
+group notifications resolve via `routeFor`.
+
+### Zaps & likes
+Because `ConcordChannel` extends `Channel` and messages render through the shared
+`ChannelView`, reactions (kind 7) and zaps attach through the existing chat
+reaction/zap path — but they must be **wrapped on the channel plane** (kind-7/9735
+rumors sealed like messages, bound to channel+epoch), not published in the clear.
+Add `ConcordActions.buildReaction`/`buildZapRequest` that wrap on the plane, and
+point the shared reaction/zap affordances at them for Concord notes.
+
+## Build order (each a tested, shippable slice)
+1. **commons foundation** — `ConcordChannel`, `ConcordChannelListState` (13302),
+   membership/view-mode enums; unit tests. Wire into `Account.kt` + `AccountSettings`.
+2. **LocalCache index** + inbound wrap folding.
+3. **Messages inbox** 6-way concat + `ConcordServerRoomNote` + header render/nav
+   (delivers the chip-opens-channel behavior).
+4. **Chat screens** (reuse NIP-28 `ChannelView`) + nav routes + create/invite/join.
+5. **Discovery feed** triad (public invite bundles).
+6. **Notifications routing + zaps/likes on-plane.**
+
+## Verification
+- commons: `:commons:jvmTest` unit tests for `ConcordChannelListState` (13302
+  round-trip/merge) and `ConcordChannel` folding, mirroring
+  `RelayGroupListDecryptionTest`/`RelayGroupChannelTest`.
+- Android: `:amethyst:installDebug`; create a community, see it in Messages with a
+  chip, tap → channel opens, send/receive between two emulators, redeem an invite
+  link deep-link, verify a notification click opens the chat. Cross-check against
+  `amy concord` (same relay) for wire interop, and against Armada for protocol
+  interop (`Nip29ArmadaInteropTest` is the precedent).
+
+## Gotchas carried from the NIP-29 study
+- Membership has two independent layers (Concord authority vs NIP-43 relay
+  membership); we only implement Concord authority.
+- Cache-as-floor + optimistic local signing for snappy UX.
+- E2EE means no server-side moderation and no metadata preview — surface state
+  from the local fold only.

amethyst/plans/2026-07-12-dual-reply-minichat.md

@@ -0,0 +1,113 @@
+# Dual-mode replies: inline + "minichat" threads across all chats
+
+## Goal
+
+Give every Amethyst chat two ways to reply, chosen at send time:
+
+- **Inline reply** — a normal chat message that references its parent and stays in
+  the main timeline (today's behavior). On the wire this is the chat protocol's
+  native reply: NIP-C7 kind-9 with a `q` quote (Concord), kind-42 reply (NIP-28),
+  kind-9 `+h` reply (NIP-29), kind-14 reply (NIP-17 DM).
+- **Minichat reply** — a **kind-1111 NIP-22 `CommentEvent`** rooted at the parent
+  message. It is pulled *out* of the main timeline and shown in a separate
+  **minichat** ("chat within a chat") opened from the parent. This matches Soapbox
+  Armada exactly (kind-9 `q` = inline quote, kind-1111 = thread).
+
+The rule is uniform and protocol-agnostic: **any kind-1111 whose root is a chat
+message opens as that message's minichat.** So the same treatment automatically
+covers Concord kind-9, NIP-28 kind-42, NIP-29 kind-9, and (later) NIP-17 kind-14 —
+wherever a 1111 lands on a chat message.
+
+## Reuse survey (what already exists — do NOT rebuild)
+
+| Need | Reuse |
+|---|---|
+| kind-1111 reply builder (NIP-22 `K/E/P`+`k/e/p`) | `quartz/.../nip22Comments/CommentEvent.replyBuilder`; Concord's `ChannelChat.reply` already uses it |
+| 1111 → parent wiring | `LocalCache.computeReplyTo` (CommentEvent branch) → `parentNote.replies`; minichat content = `note.replies.filter { it.event is CommentEvent }` |
+| "N replies" chip | `observeNoteReplyCount(note, avm)` (EventObservers.kt) — already used by `RelayGroupThreadsScreen` |
+| Shared per-row action strip | `ChatMessageCompose.NormalChatNote` `detailRow` `Row` — one place, every chat type |
+| Thread rendering | `threadview/ThreadFeedView` + `ThreadAssembler.findThreadFor`; NIP-29 `RelayGroupThreadsScreen` as the chat-adjacent precedent |
+| Per-message 1111 REQ (public chats) | `FilterRepliesAndReactionsToNotes` (kinds incl 1111, `#e`) via `EventFinder`; `RelayGroupThreadFeedFilterAssembler` (compose-scoped `#h`+1111 sub) |
+| Composer reply state + "replying-to" preview | `*NewMessageViewModel.replyTo` + `chats/utils/DisplayReplyingToNote` |
+| NIP-22 comment composer | `note/nip22Comments/CommentPostViewModel` (full-featured) |
+
+Concord already delivers kind-1111 replies through the existing channel-plane
+subscription (they're wrapped like every other rumor), so **no new subscription is
+needed for Concord** — only the timeline split, the chip, the minichat screen, and
+the composer picker.
+
+## Design
+
+### 1. Wire model (settled — matches Armada)
+- Inline reply → native chat reply event, native reply tags, stays in timeline.
+- Minichat reply → kind-1111 `CommentEvent`: uppercase `K/E/P` at the immutable
+  thread root (the chat message), lowercase `k/e/p` at the immediate parent, plus
+  whatever binding the plane requires (Concord: `channel`/`epoch`). One level:
+  replying inside a minichat roots the new 1111 at the **same** root message
+  (parent = the message being answered, root = the minichat root), rendered flat —
+  so minichat messages don't spawn sub-threads. (The wire still permits nesting;
+  we render flat.)
+
+### 2. Timeline vs minichat split (rendering)
+- **Main feed** excludes kind-1111 comments whose root is a chat message — they
+  live in the minichat, not as flat siblings. Implemented in the shared
+  `ChannelFeedFilter` / `ChatroomFeedFilter` by dropping `CommentEvent`s that root
+  onto a message already in the feed (keep everything else).
+- Each root message row shows an **"N replies" chip** (from `observeNoteReplyCount`
+  restricted to CommentEvent replies) in the `detailRow` strip; tap → minichat route.
+
+### 3. Minichat screen
+- A thread screen keyed by the **root message id** (+ the channel/room key needed to
+  re-derive the plane / re-subscribe). Renders the root message pinned at top, then
+  its kind-1111 replies as a flat mini-timeline (reuse `ChatroomMessageCompose`), with
+  its own composer that always sends kind-1111 rooted at this message.
+- Back it with `ThreadFeedView`/`ThreadAssembler` where possible; for Concord, feed
+  it from `rootNote.replies` (already populated) + a lifecycle sub that keeps the
+  plane live.
+
+### 4. Composer mode picker
+- Add `replyMode: ReplyMode {INLINE, MINICHAT}` next to `replyTo` in each
+  `*NewMessageViewModel` (Concord `ConcordNewMessageViewModel`, DM
+  `ChatNewMessageViewModel`, channels `ChannelNewMessageViewModel`).
+- Render a small toggle beside `DisplayReplyingToNote` ("Reply in chat" ⇄ "Reply in
+  thread"). Default = INLINE (least surprise; user opts into pulling it aside).
+- Send branch: `MINICHAT` routes to the kind-1111 builder
+  (`CommentEvent.replyBuilder` / Concord `buildChannelReply`), `INLINE` keeps the
+  native reply builder.
+
+### 5. Subscriptions
+- **Concord**: none new (1111 arrives via the channel plane). Just ensure the
+  timeline filter and minichat read `rootNote.replies`.
+- **NIP-28 / NIP-29 (phase 2)**: add a compose-scoped assembler (clone
+  `RelayGroupThreadFeedFilterAssembler`) that REQs `{kinds:[1111], "#e":[<visible
+  message ids>]}` (and `#E`) off the feed's current message-id set (from
+  `FeedContentState`). Reuse the same minichat screen/row.
+- **NIP-17 DM (phase 3, later)**: kind-1111 replies must be gift-wrapped like the
+  kind-14s; deferred — needs an encrypted-comment path, more design.
+
+## Phasing
+
+1. **Phase 1 — Concord, full UX + all shared pieces.** ReplyMode enum + composer
+   toggle; timeline split (drop chat-rooted 1111s); "N replies" chip in the shared
+   `detailRow`; minichat route + screen; Concord send branch. Delivers the complete
+   dual-mode experience for Concord and builds every shared component.
+2. **Phase 2 — public chats.** Per-message 1111 subscription for NIP-28 + NIP-29;
+   reuse the Phase-1 chip/screen/composer. NIP-29 already has a thread screen to
+   reconcile with.
+3. **Phase 3 — DMs.** Gift-wrapped kind-1111 minichat for NIP-17. Deferred.
+
+## Decisions (settled)
+- **Default mode** when tapping reply: **INLINE**. User opts into MINICHAT via the toggle.
+- **Minichat depth**: **flat, one level**. Replying inside a minichat roots at the
+  same message; no sub-threads.
+- **Scope now**: **Phase 1 + 2 together** — Concord AND public chats (NIP-28/NIP-29).
+  DMs (phase 3) still deferred.
+- **Screen styling**: **chat-styled bubbles** (reuse `ChatroomMessageCompose`) so the
+  minichat reads as "a chat within a chat".
+
+## Verification
+- quartz/commons unit tests for the reply-mode builders + the timeline-filter split
+  (a chat-rooted 1111 is excluded from the feed but present in `rootNote.replies`).
+- On-device: in Concord, reply inline (stays in timeline) and reply-in-thread (opens
+  minichat); confirm Armada shows our minichat replies as a thread and its threads
+  open as our minichat; confirm the "N replies" chip count.

amethyst/plans/2026-07-13-chat-scroll-performance.md

@@ -0,0 +1,124 @@
+# Chat feed scroll performance — fast fling through thousands of messages
+
+Status: plan. Owner: chat feed (`amethyst/.../ui/screen/loggedIn/chats/feed/`).
+
+## Problem
+
+A fling through a long chat history composes hundreds of `ChatroomMessageCompose`
+rows per second. Each newly composed row currently pays for work that is either
+(a) derivable off the composition path, (b) only needed for *recent* messages, or
+(c) side-effectful (coroutines, relay-filter updates) and therefore multiplies
+into churn under velocity. The redesign added per-row observers (group position,
+reaction chips, delivery ticks) that are individually cheap but sum up at 1000+
+rows.
+
+## What is already fine (verified, don't re-litigate)
+
+- **Rich text parse is cached**: `TranslatableRichTextViewer` →
+  `CachedRichTextParser.parseText` behind `remember(content, tags)`; re-scrolling
+  past a message doesn't re-parse.
+- **Engagement flows are sampled**: `observeNoteReactions/Zaps/Replies` sample at
+  200–500ms, and the EventFinder assembler folds all subscribed note ids into a
+  small number of shared REQs (`SingleSubEoseManager`), not one REQ per note.
+- **LazyColumn hygiene**: stable `key = idHex`, `contentType = kind`,
+  `animateItem()` gated by performance mode.
+- **Tracker fan-out fixed**: delivery state is one small StateFlow per message.
+
+## Per-row cost inventory (composition of ONE new row during fling)
+
+| # | Cost | Where | Class |
+|---|------|-------|-------|
+| 1 | 4× `dateFormatter` (ThreadLocal `SimpleDateFormat` for >24h-old messages) for group break checks, + 2 more in `NewDateOrSubjectDivisor` | `ChatGroupPosition.groupsWith`, `NewDateOrSubjectDivisor` | CPU, per row |
+| 2 | 3× `collectAsStateWithLifecycle` on metadata flows | `watchChatGroupPosition` | collector churn |
+| 3 | `LaunchedEffect` → `loadAndMarkAsRead(route, createdAt)` coroutine | `NormalChatNote` | 1 coroutine/row; read-marker lock churn |
+| 4 | `LaunchedEffect` → `accountViewModel.decrypt(note)` for the jumbo flag | `NormalChatNote` | 1 coroutine/row, even for plaintext kinds |
+| 5 | Reaction observer + zap observer subscriptions (ids added to shared relay filters; filter update per batch) | `ChatReactionChips`, `ObserveZapAmountText` | relay REQ re-issue churn under velocity |
+| 6 | 2× flow collectors for delivery ticks on own messages, forever, even for long-settled history | `ChatDeliveryTicks` | collector churn |
+| 7 | Per-row animation/gesture state: `animateColorAsState`, press `InteractionSource`, swipe `pointerInput`, highlight `LaunchedEffect` | `ChatBubbleLayout` | allocation, mostly unavoidable |
+| 8 | Media/link previews kick Coil requests immediately | `TranslatableRichTextViewer` children | IO churn during fling |
+
+Feed-level:
+
+| # | Cost | Where |
+|---|------|-------|
+| 9 | `shouldHighlight = highlightedNoteId.value == item.idHex` reads one state in every item lambda → all visible items recompose when it changes (rare; low) | `ChatFeedLoaded` |
+| 10 | `onScrollToNote` recreated when `ChatFeedLoaded` recomposes → unstable param defeats item skipping | `ChatFeedLoaded` |
+| 11 | Feed invalidation rebuilds the sorted list; every reaction arriving during scroll can reorder/emit | `FeedContentState` (existing infra, sampled) |
+
+## Plan
+
+### Phase 0 — Measure first (do not skip)
+
+1. **Macrobenchmark**: add a `benchmark` scenario that seeds `LocalCache` with
+   5–10k synthetic `ChannelMessageEvent`s (mixed: text, links, emoji-only, a few
+   with reactions/zaps) and flings the public-chat screen. Metrics:
+   `frameDurationCpuMs` P50/P90/P99, jank %, `frameOverrunMs`.
+2. **Composition tracing / recomposition counts** on a seeded room; compose
+   compiler reports (`composables.txt`) for `ChatroomMessageCompose`,
+   `NormalChatNote`, `InnerChatBubble`, `ChatReactionChips` — verify skippability
+   and find unstable params (expect #10).
+3. Record baseline numbers in this file before changing anything.
+
+### Phase 1 — Kill per-row CPU and coroutines (expected biggest wins)
+
+4. **Day-stamp grouping (#1)**: replace `dateFormatter` equality in `groupsWith`
+   with an epoch-local-day integer comparison (`(createdAt + zoneOffsetSeconds) / 86400`),
+   and give `NewDateOrSubjectDivisor` the same predicate so the break condition
+   stays mirrored (only its *display* string needs formatting, and only when a
+   divider actually renders). Zero `SimpleDateFormat` on the scroll path.
+5. **Hoist read-marking (#3)**: replace the per-row `LaunchedEffect` with one
+   feed-level `snapshotFlow { listState.firstVisibleItem createdAt }`-driven
+   marker update (only the newest visible timestamp matters; the marker is
+   monotonic). One coroutine per scroll session instead of one per row.
+6. **Jumbo without a coroutine (#4)**: only launch the decrypt effect for
+   encrypted kinds (`PrivateDmEvent`, sealed rumors not yet in the decrypt
+   cache). Plaintext kinds (public chats, NIP-17 rumors already unwrapped —
+   the vast majority) take the synchronous path only.
+7. **Retire settled delivery ticks (#6)**: once a message is fully accepted (or
+   untracked and older than the tracker window), render the tick from a
+   `remember`ed terminal value and drop both collectors. Only in-flight sends
+   keep live flows.
+8. **Group position with fewer collectors (#2)**: collect the three metadata
+   flows only while any of the three notes is missing `event`/`author`
+   (the common case for history is all-loaded → pure `remember`, no collectors).
+
+### Phase 2 — Tame side-effect churn under velocity
+
+9. **Defer new relay-filter membership while flinging (#5)**: gate
+   `EventFinderFilterAssemblerSubscription` enrollment on
+   `!listState.isScrollInProgress` (or debounce enrollment ~300ms): rows that
+   fly past never join the reaction/zap filters; rows you settle on subscribe
+   as today. Needs a small `LocalScrollSettled` composition local (provided by
+   `ChatFeedLoaded`) so `ChatReactionChips`/`ChatDeliveryTicks` can wait without
+   threading params. Verify with #1 measurements that filter re-issues drop.
+10. **Defer media loads (#8)**: same settled-gate for the image/video preview
+    composables inside chat bubbles (placeholder immediately, Coil request on
+    settle). Coil cancels in-flight requests on dispose already, but not
+    starting them is cheaper than cancel.
+11. **Stabilize item lambdas (#10)**: `remember(items.list, listState)` around
+    `onScrollToNote`; pass `shouldHighlight` via `derivedStateOf` keyed per item
+    (#9) so only the highlighted row recomposes.
+
+### Phase 3 — Structural (only if Phase 1/2 measurements demand more)
+
+12. **Precomputed row model**: build a lightweight `ChatFeedRow(note, groupPos,
+    dayStamp, isJumbo, isSystem)` list inside `FeedContentState` (background
+    thread, once per feed update) so item composition becomes pure rendering.
+    This subsumes #4/#8 above but is a bigger refactor of shared feed infra —
+    justify with numbers first.
+13. **Finer contentType**: distinguish `bubble / jumbo / system / zap-card`
+    contentTypes so Lazy slot reuse doesn't rebuild structurally different rows.
+14. **Prefetch tuning**: evaluate `LazyListPrefetchStrategy(nestedPrefetchItemCount)`
+    for the fling case on Compose ≥1.7.
+
+### Phase 4 — Regression guardrails
+
+15. Wire the Phase-0 macrobenchmark into CI (or at least a documented manual
+    run before releases touching the chat feed), and re-record numbers here.
+
+## Non-goals
+
+- Virtualizing bubble internals (Compose already skips off-screen work).
+- Caching parsed rich text more aggressively (already LRU-cached).
+- Changing feed sorting/invalidation infra (shared with all feeds; separate plan
+  if measurements point there).

amethyst/plans/2026-07-13-cord06-refounding.md

@@ -0,0 +1,83 @@
+# CORD-06 Refounding — real member removal for Concord
+
+## Problem
+
+Concord membership is key possession: a banned member (CORD-04 banlist) still
+holds the community's `community_root`, so every client just *declines to show*
+their posts — they can still decrypt everything. That is a soft removal. CORD-06
+adds the hard removal: rotate the key so a removed member's key stops working for
+anything sent afterwards.
+
+The quartz crypto for the kind-3303 rekey blob (`ConcordRekey`, `RekeyBlob`)
+already existed and was tested, but nothing in the app called it. This wires the
+whole path — build, publish, receive, persist, UI — around a **Refounding**
+(whole-community rotation), the removal that matters while Amethyst supports only
+public channels (a per-channel rekey needs private channels, not built yet).
+
+## What a Refounding does (CORD-06 §3)
+
+1. Ban the removed members on the current Control Plane (so the compacted snapshot
+   carries the ban).
+2. Roll `community_root` to a fresh random 32 bytes at `rootEpoch + 1`. Public
+   channels + the Control/Guestbook planes all derive from the root, so rolling it
+   rotates every plane at once.
+3. Republish the **compacted** Control Plane under the new root — keep only each
+   entity's head edition and re-wrap its *original plaintext seal*, so the original
+   authors' signatures survive re-encryption (a fresh joiner verifies the slim
+   state exactly as it verified the full chain).
+4. Mint per-recipient kind-3303 rekey blobs delivering the new root to every
+   retained member, sealed + addressed under the **prior** root on the
+   `base-rekey-pseudonym(prior_root, community_id, new_epoch)` address — which every
+   current member precomputes, so they receive it live. A removed member gets no
+   blob and can never derive the new root.
+
+## Layers
+
+- **quartz** `concord/cord06Rekey/`
+  - `ConcordKeyDerivation`: `baseRekeyAddress` / `channelRekeyAddress` (the rekey
+    stream addresses), `epochKeyCommitment` (`prevcommit`, CORD-02 §A.5).
+  - `ConcordRekey`: signer-based `blobForSigner` / `findNewKeyWithSigner` (bunker
+    accounts open a blob with one `nip44Decrypt`, no raw key).
+  - `ConcordRefounding`: `compactControlPlane`, `buildBaseRekeyWraps`, `build`
+    (whole refounding), `findNewRoot` (receive: verify scope/epoch/continuity, find
+    my blob). `OpenedStreamEvent` now also carries the inner `seal` so compaction
+    can re-wrap it. Tests in `ConcordRefoundingTest`.
+- **commons**
+  - `ConcordActions`: `guestbookPlane` / `nextBaseRekeyPlane`, `buildGuestbookJoin`
+    / `guestbookMembers`, `buildRefounding`, `openBaseRekey`.
+  - `ConcordCommunitySession`: folds the Guestbook plane into `members`
+    (the recipient set), buffers inbound base-rekey wraps (`pendingBaseRekeyWraps`),
+    exposes `controlPlaneWraps` for compaction, and AUTHs to + subscribes the
+    Guestbook and next-epoch base-rekey planes (`streamKeys`, `subscribeAddresses`).
+  - `ConcordSessionRegistry.sync`: rebuilds a session when its entry's root/epoch
+    changed — the session is a pure function of its entry, so adopting a new root is
+    just a persisted entry swap.
+  - `ConcordSubscriptionPlanner.auxiliaryPlaneSubs`: REQs the Guestbook + next
+    base-rekey planes for every joined community.
+- **amethyst**
+  - `Account`: announces a Guestbook JOIN on create/join (`announceConcordGuestbookJoin`)
+    so members are visible to a future rotator; `refoundConcordCommunity` (owner /
+    BAN-holder) bans + rolls + publishes + persists; `drainConcordRekeys` (revision
+    tick) adopts an inbound rotation from an authorized rotator; `adoptConcordRoot`
+    persists the new root (prior root kept as a `HeldRoot`) and re-seeds the new
+    epoch's Guestbook, guarded against double-adopt.
+  - `AccountViewModel.removeConcordMember`; `ConcordMembersScreen` "Remove from
+    community" action + confirm dialog, gated exactly like Ban.
+
+## Recipient set
+
+The rotator re-keys **Guestbook membership ∪ the privileged roster ∪ self**, minus
+the removed and the already-banned. The Guestbook is best-effort/off-consensus, so
+a member who joined but whose Guestbook JOIN hasn't propagated to the rotator would
+be missed and locked out — the accepted trade for a serverless, key-possession
+membership model. Adopting a new root re-announces the Guestbook JOIN at the new
+epoch so cascading removals keep a live membership.
+
+## Known limitations / follow-ups
+
+- No explicit "you were removed" detection: a removed member simply stops receiving
+  new content (their old-epoch keys still read history). CORD-06's "held all n
+  chunks, none is mine ⇒ removed" self-eviction is not implemented.
+- Per-channel rekey (single private channel) is not wired — needs private channels.
+- Race convergence (two rotators, same epoch, lexicographically-lowest-key wins) is
+  not implemented; single-rotator (owner/admin) refounding is the supported path.

amethyst/plans/2026-07-15-bitchat-geohash-interop.md

@@ -0,0 +1,71 @@
+# Bitchat geohash chat interop
+
+Status: **Phase 1 (public geohash channels) shipped.** Phase 2 (encrypted DMs)
+is designed but not implemented.
+
+## What Bitchat does (verified against `permissionlesstech/bitchat`
+iOS + `bitchat-android`)
+
+Bitchat's Nostr side has two chat features. Amethyst is a pure-Nostr client
+(no BLE mesh / Noise identity), so only the Nostr halves are in scope.
+
+### Public geohash channels ("location channels") — SHIPPED
+- Message = **kind 20000** (ephemeral), content = plain UTF-8 text.
+  Tags: `["g", geohash]` (required), `["n", nickname]` (optional),
+  `["t","teleport"]` (optional). Optional NIP-13 `["nonce", …]` PoW, default 8
+  bits, used to relax per-sender relay rate limits.
+- Presence = **kind 20001**, only the `g` tag, empty content.
+- Subscribe: `kinds:[20000,20001]`, `#g:[geohash]` (exact cell).
+- Precision levels (geohash chars): building 8, block 7, neighborhood 6,
+  city 5, province 4, region 2.
+- Identity = a per-geohash throwaway key `HMAC-SHA256(deviceSeed, geohash)`,
+  deterministic per (device, cell), unlinkable to the user's npub.
+- **Relay routing is geographic and load-bearing:** a cell's traffic goes to the
+  5 relays nearest the cell center, chosen from the public MIT-licensed
+  `permissionlesstech/georelays` CSV both clients load. If Amethyst used any
+  other relay set its messages would not rendezvous with Bitchat clients.
+
+### Private DMs — NOT YET IMPLEMENTED (Phase 2)
+- Standard NIP-17/59: rumor kind 14, seal kind 13, gift wrap kind 1059, wrap
+  under a throwaway key, NIP-44 v2.
+- **The kind-14 rumor content is NOT plain text.** It is
+  `"bitchat1:" + base64url(<binary bitchat packet>)` — a `BitchatPacket`
+  (TLV + a `NoisePayloadType` byte) carrying the private message, delivery ACKs,
+  and read receipts. Full DM interop therefore requires porting that binary
+  framing (`NostrEmbeddedBitChat.swift` / `NostrEmbeddedBitChat.kt`).
+- Two DM flavors: geohash DMs (gift-wrapped to a participant's per-geohash
+  pubkey) and stable-identity DMs (to an npub learned via Bitchat's mesh
+  `[FAVORITED]:<npub>` handshake — mesh-specific, mostly N/A for a Nostr client).
+
+## What shipped (Phase 1)
+
+- **quartz** `experimental/bitchat/`: `GeohashChatEvent` (20000),
+  `GeohashPresenceEvent` (20001), `GeohashKeyDerivation` (per-geohash key),
+  registered in `EventFactory`. PoW reuses the existing `nip13Pow` `PoWTag`.
+- **commons** `service/georelay/`: `GeoRelayDirectory` (closest-N by haversine,
+  host tie-break, `:443` dedup), `GeoRelayCsvLoader` (runtime CSV fetch + fallback).
+- **amethyst**: `GeohashChatScreen` + `GeohashChatViewModel` (live subscription +
+  send), `GeohashChatDeviceSeed` (global encrypted seed store),
+  `Account.signWithAndSendPrivately`, `Route.GeohashChat`, and a chat action on
+  the geohash feed screen.
+- **cli**: `amy geochat listen|send|keys` — the interop harness. Verified with a
+  live send→relay→listen round-trip (kind 20000, PoW, `g`/`n` tags intact).
+
+## Follow-ups
+
+1. **Encrypted DMs (Phase 2).** Port the `bitchat1:` binary packet
+   (`BitchatPacket` TLV + `NoisePayloadType`) into quartz, wrap/unwrap it in the
+   existing NIP-17 stack (`GiftWrapEvent`/`SealedRumorEvent`/`ChatMessageEvent`),
+   handle geohash DMs (to a per-geohash pubkey) and delivery/read receipts.
+   Add `amy geochat dm` for interop testing.
+2. **Desktop UI.** The shared pieces (quartz events, `GeoRelayDirectory`) are
+   already cross-platform; add a desktop `GeohashChatScreen` equivalent.
+3. **LocalCache integration (optional).** The current Android screen manages its
+   own subscription/state rather than routing through `LocalCache`/the chatroom
+   list. Integrating would give unread badges and a unified chat list, at the
+   cost of a `Channel`/feed-filter/datasource fork.
+4. **Location-driven channel picker.** Use `LocationState` to offer the
+   region/province/city/neighborhood/block/building cells for the user's current
+   position, plus a manual/teleport entry.
+5. **Presence heartbeats + i18n.** Periodically emit kind 20001 while a channel
+   is open; extract the hardcoded screen strings into `strings.xml`.

amethyst/plans/2026-07-16-location-chats-first-class.md

@@ -0,0 +1,171 @@
+# Making location (geohash) chats first-class in Amethyst
+
+Builds on `2026-07-15-bitchat-geohash-interop.md` (Phase 1 shipped: protocol,
+geo-relay routing, a self-contained chat screen, `amy geochat`). This plan takes
+it from a bolt-on screen to a native feature woven into Home, Messages, and the
+map.
+
+## The one constraint that shapes everything
+
+Geohash **chat** (kind 20000) is signed with anonymous per-cell throwaway keys,
+unlinkable to npubs. So "which of my follows are chatting here" is **not
+derivable from the chat stream**. Any "follows are active near you" signal must
+come from a *linkable* source:
+
+- **kind-1 geohash notes** (`GeoHashFeedFilter` scans `LocalCache.notes` for
+  `isTaggedGeoHash`; authors are real npubs) → intersect with
+  `account.kind3FollowList` = genuine "follows near this place." This is the
+  template `HomeLiveFilter.followsThatParticipateOn` already uses, just sourced
+  from notes instead of chat events.
+- **kind-10081 geohash follow lists** (`GeohashListEvent`) — the user's own, and
+  optionally follows' public lists.
+- Anonymous **liveliness** (kind-20000/20001 presence counts) — "N people here",
+  no identities.
+
+The Home bubble is therefore: *anonymous liveliness + follows' geo-note activity
+→ tap into the cell's chat.* We will not imply the chat reveals who's there.
+
+## Key architectural decision: reuse what exists
+
+1. **Joined channels = the geohash follow list (kind 10081).** `account.geohashList`
+   (`model/nip51Lists/geohashLists/GeohashListState.kt`, `flow: StateFlow<Set<String>>`,
+   `follow`/`unfollow`, NIP-44-private capable) already models "geohashes I care
+   about." Treat *following a geohash* as *joining its location channel*. No new
+   list type, and it's private-capable. (Trade-off: today it also drives the
+   kind-1 notes feed; we're overloading one list for both "notes near here" and
+   "chat here." Acceptable — it's the same user intent. Alternative if we want
+   separation: a local, unpublished joined-set matching Bitchat's ephemerality.)
+
+2. **Make geohash chat LocalCache-backed** so it can flow through the same feed
+   machinery as every other room. This is the crux of "first-class": the Messages
+   list, Home bubbles, unread counts, and pins all read from `LocalCache`
+   channels. Model it on the ephemeral-chat feature end to end.
+
+## Phase A — Data model + LocalCache integration (foundation)
+
+- `commons/.../model/geohashChat/GeohashChatChannel.kt` — a `Channel` subtype
+  keyed by geohash (mirror `model/emphChat/EphemeralChatChannel.kt`).
+  `toBestDisplayName()` returns the reverse-geocoded place (or `#geohash`).
+- `LocalCache`: add a `geohashChannels` map + a consumer that routes
+  `GeohashChatEvent`/`GeohashPresenceEvent` into the channel (mirror
+  `ephemeralChannels`/`liveChatChannels` + `getOrCreateEphemeralChannel`).
+- A rooms-list **subassembler** that subscribes to the joined geohashes
+  (`account.geohashList.flow` → `GeoRelayDirectory.closestRelays(g)`, kinds
+  20000/20001, `#g`) and feeds LocalCache — mirror
+  `chats/rooms/datasource/FollowingEphemeralChatSubAssembler.kt` +
+  `FilterFollowingEphemeralChats.kt`.
+- Migrate `GeohashChatViewModel` to read the channel's notes from LocalCache
+  (via `LocalCache.observeNotes` like `NestLobbyScreen`) instead of its private
+  subscription — unifies the live view with the cached one and lets the screen
+  reuse the full `ChatroomMessageCompose` (reactions, replies) later. Keep the
+  send path (per-geohash signer + PoW + geo relays) as-is.
+- Ephemeral caveat: relays don't store kind 20000, so joined-cell rooms only show
+  messages seen while subscribed. Scope background subscriptions to *joined* cells
+  (+ the current-location cell) to bound battery/relay load; document the cap.
+
+## Phase B — Messages tab
+
+- `chats/rooms/dal/ChatroomListKnownFeedFilter.kt` — add a 7th family
+  (`geohashChannels` from `account.geohashList`) to `feed()` + `applyFilter`
+  (newest message per cell), mirroring `filterRelevantEphemeralChats`.
+- `chats/rooms/ChatroomHeaderCompose.kt` — add a `GeohashRoomCompose` branch in
+  `ChatroomEntry` → `nav.nav(Route.GeohashChat(geohash))`, with a location-pin
+  `HeaderPill`, the cell name (`LoadCityName`), and a live participant count (no
+  avatars — anonymous).
+- `chats/rooms/NewConversationScreen.kt` — append one `ConversationType`
+  ("Location chat", geohash icon/accent, pros/cons, `route = Route.NewGeohashChat`)
+  to the *Relay* section of `conversationSections` (single source of truth).
+
+## Phase C — The builder ("+" → create/join)
+
+- `Route.NewGeohashChat` + `NewGeohashChatScreen.kt` (mirror
+  `ephemChat/metadata/NewEphemeralChatScreen.kt`). Three ways to pick a cell:
+  1. **Current location levels.** New `GeohashChannelLevel` mapper
+     (region=2, province=4, city=5, neighborhood=6, block=7, building=8 chars —
+     the Bitchat levels; `GeohashPrecision` has the char counts but not the
+     names). From `LocationState.geohashStateFlow` (raise its hardcoded 5-char
+     precision to 8 so we can truncate to each level), list the six cells with
+     `LoadCityName` + a Join/Open button.
+  2. **Manual geohash** text field (validate against the base32 alphabet).
+  3. **Teleport** → the map picker (Phase E).
+- Join = `account.geohashList.follow(geohash)` then `nav.nav(Route.GeohashChat)`.
+- Reuse `LocationAsHash`/`ILocationGrabber` for the permission flow.
+
+### Geohash-list management (the kind-10081 add/remove UI)
+
+Today the **only** way to add to the kind-10081 list is the Follow toggle on the
+kind-1 `GeoHashScreen` — you must already be viewing that cell. Followed cells
+then appear as read-only feed chips in the Home top-nav (`TopNavFilterState`).
+There is **no** screen to view the list, remove entries, or add an *arbitrary*
+geohash. This builder is that missing "add" UI (it writes via
+`account.geohashList.follow`, the same path). Round it out with a small manage
+screen:
+
+- `NewGeohashChatScreen` doubles as the **add** surface (current-location levels /
+  manual / map).
+- Add a lightweight **"My location channels"** list (its own route, or a section
+  in the builder): render `account.geohashList.flow` with `LoadCityName` per cell,
+  a remove (`unfollowGeohash`) swipe/menu, and an "add" button into the builder.
+  This is also what Phase B's Messages rows and Phase D's Home bubble read from,
+  so it's the one management surface for the whole feature.
+
+## Phase D — Home "live near you" bubble
+
+- New feed state `homeGeohashLive` in `AccountFeedContentStates.kt` (parallel to
+  `homeLive`; different signal source, so not folded into `HomeLiveFilter`).
+  Sources: joined cells with recent activity (LocalCache, post Phase A) + the
+  current-location cell.
+- `home/live/RenderGeohashBubble.kt` — a bubble showing the cell name, a
+  liveliness dot (reuse `LiveStatusIndicator` pattern; "online" = recent presence),
+  and social proof from **geo-notes**: "N follows posted near · M chatting"
+  (follows-near count = `GeoHashFeedFilter` authors ∩ `kind3FollowList`).
+- `HomeScreen.kt` `DisplayLiveBubbles` — add the `GeohashChatChannel` (or a
+  synthetic geohash item) case to the type dispatch; click → `Route.GeohashChat`.
+
+## Phase E — Teleport + map
+
+- `LocationPickerMap.kt` — extend the display-only osmdroid `LocationPreviewMap`
+  with a `MapEventsOverlay`/`MapEventsReceiver` so long-press/tap drops a pin and
+  yields a coordinate → `GeoHash.encode(lat, lon, level)`. osmdroid (Apache-2.0)
+  already supports this; only the wiring is new.
+- Teleport screen (or a mode in `NewGeohashChatScreen`): pick a point on the map,
+  show the resulting cell name + level selector, Open → `Route.GeohashChat`.
+- **Auto-teleport flag:** in `GeohashChatViewModel`, compare the channel's geohash
+  to the current-location cell (`LocationState`); when they differ (or no
+  permission), pass `teleported = true` to the already-plumbed
+  `sendMessage(..., teleported)`. Add a manual override toggle in the composer.
+- Optional: forward geocoding (place-name search) via
+  `Geocoder.getFromLocationName` — none exists today; small addition for a
+  "search a place" box.
+
+## Phase F — Privacy, presence, polish
+
+- **"Post as my real account" opt-in** (global or per-channel, with a
+  location-exposure warning). This is also the *only* way a follow becomes
+  visible in the chat itself — relevant to the Home social-proof story.
+- **Presence heartbeats:** emit kind 20001 periodically while a channel is open
+  (`GeohashChatViewModel.announcePresence` already exists; schedule it).
+- **Privacy note:** subscribing to a cell reveals interest in that location to
+  its relays (via the `#g` REQ from your IP); Tor mitigates. The kind-10081 list
+  can stay NIP-44-private.
+- Extract hardcoded screen strings to `strings.xml` (`<plurals>` for the counts —
+  see `res/CLAUDE.md`); desktop `GeohashChatScreen` equivalent.
+
+## Open decisions (need a call)
+
+1. **Joined list:** reuse kind-10081 geohash follow list (recommended, private,
+   already wired) vs. a separate local ephemeral joined-set (closer to Bitchat).
+2. **LocalCache integration depth:** full (Phase A — enables Messages/Home/unread,
+   bigger) vs. keep the self-contained screen and only add the builder + a
+   Home bubble fed by geo-notes (smaller, but not truly "in the Messages list").
+3. **Default identity in these rooms:** stays anonymous per-cell (recommended);
+   the real-account opt-in is Phase F.
+
+## Verification
+
+- Unit: `GeohashChannelLevel` bucketing, the joined-list ↔ subscription wiring,
+  the geo-note follow-intersection count.
+- `amy geochat` remains the wire-level interop check against a real Bitchat cell.
+- Drive the app: join a cell from the "+" chooser, confirm it appears in Messages,
+  post/receive, teleport via the map and confirm the `["t","teleport"]` tag, and
+  confirm the Home bubble reflects a follow's kind-1 geo-note near you.

amethyst/plans/2026-07-16-nip46-signer-device-checklist.md

@@ -0,0 +1,184 @@
+# NIP-46 Signer — device verification checklist
+
+Everything below is behavior that JVM unit tests **cannot** exercise: interactive
+consent dialogs, the foreground service, real relay traffic, deep links, and
+cross-app interop. The protocol/authorization logic underneath is covered by
+`quartz` (`NostrConnectSignerServiceTest`) and `commons`
+(`Nip46PermissionAuthorizerTest`, `Nip46ConsentIntegrationTest`) unit tests; this
+list is the manual pass that earns "first-class" on a real device.
+
+Run as the signer on one device/account ("bunker"); use a second app/account as
+the client.
+
+## Pairing
+- [ ] **Bunker flow**: Settings → Nostr Signer → turn on → scan/copy the
+      `bunker://` QR into a client (nsec.app, Coracle, Nostrudel, or a second
+      Amethyst via `amy login bunker://…`). Client resolves your npub via
+      `get_public_key`.
+- [ ] **NostrConnect flow**: client shows a `nostrconnect://` code → "Scan a
+      code" on the signer screen pairs it and the signer turns on.
+- [ ] **NostrConnect informed consent**: pairing a `nostrconnect://` offer that
+      carries `perms=` shows a connect sheet listing the app's requested
+      permissions (e.g. "Sign notes (kind 1)", "Decrypt messages") + a trust
+      picker BEFORE anything is granted. Approving pre-grants exactly those ops
+      (unless Paranoid); Cancel/Block declines and nothing is registered. A
+      re-pair of a known app skips the sheet and keeps prior decisions.
+      Repro: `amy login --nostrconnect --perms sign_event:1,nip44_encrypt`
+      prints an offer that carries exactly those perms (see CLI interop driver).
+- [ ] **Global scanner**: scan a `nostrconnect://` from the profile/search
+      camera → lands on the signer screen and pairs.
+- [ ] **Deep link**: tap a `nostrconnect://` link (web/other app) → Amethyst
+      opens the signer screen and pairs (cold start AND already-running).
+
+## Note preview in the sign dialog (device-only)
+- [ ] A `sign_event`/publish request renders the unsigned event as a **NoteCompose
+      preview** (text + media + mentions, authored by the signing account), with
+      the "Show event" JSON toggle still available below it.
+- [ ] Works for both a NIP-46 remote app and a napplet Publish/SignEvent.
+- [ ] When the main Activity is gone (app fully backgrounded, only the signer
+      foreground service alive → `CallSessionBridge.accountViewModel` is null),
+      the dialog falls back to the plain content quote + JSON without crashing.
+- [ ] **Risk to watch:** NoteCompose is feed UI rendered inside a standalone
+      dialog Activity; if it reads a CompositionLocal only provided by the main
+      scaffold it could crash at runtime (compiles fine). Verify on device; if it
+      misbehaves, the JSON fallback path is one boolean away.
+
+## Entry point + connected-apps management (2026-07-16)
+- [ ] **Drawer entry**: the signer opens from the left drawer's "You" section, directly
+      under Wallet (moved out of Settings). It's also available as a bottom-bar favorite.
+- [ ] **Dedicated apps screen**: "Manage connected apps" on the signer screen opens a
+      NIP-46-only list (name, npub, relay count, last-used, trust chip), separate from the
+      napplet/nsite/browser Connected Apps screen. NIP-46 apps no longer appear there.
+- [ ] **Idle auto-forget**: an app left unused for 7 days is dropped on the next signer
+      start (its background relay subscription goes with it); an app still signing is kept.
+
+## Comes-to-front on a request (2026-07-16)
+- [ ] **Backgrounded surfacing**: with Amethyst fully backgrounded (Android 12+), a client
+      signing/connect request pops the consent dialog — via a full-screen-intent notification
+      on the high-importance "Signing requests" channel (the `startActivity` fast path is
+      BAL-blocked when backgrounded). On a locked screen it launches straight to the dialog;
+      while actively on another app it shows a heads-up prompt to tap.
+- [ ] **Foreground**: with Amethyst in the foreground the dialog opens directly (no extra
+      notification — `SignerConsentNotifier` no-ops when `foregroundTracker.isForeground`).
+- [ ] **Android 14+ caveat**: `USE_FULL_SCREEN_INTENT` is restricted for non-calling apps,
+      so the FSI may degrade to a heads-up rather than auto-launch — verify the prompt still
+      arrives and is tappable. Requires notification permission (already needed for the
+      always-on service).
+
+## Consent (Tier 1)
+- [ ] **First-connect trust picker**: a bunker-flow connect with a valid secret
+      shows the trust-level dialog (Full trust / Reasonable / Paranoid) BEFORE any
+      signing; choosing a level records it in Connected Apps.
+- [ ] **Cancel/Block**: dismissing the connect dialog rejects the connection (no
+      silent grant).
+- [ ] **Per-op ASK**: with a REASONABLE app, ask the client to sign a
+      **kind 0 / kind 3 / delete (5)** or **decrypt a DM** → the per-op dialog
+      appears (these are excluded from the auto-allowed set).
+- [ ] **Remember variants**: "allow for this op" stops re-prompting; "session"
+      stops until the signer restarts; "24h/30d" expire; "deny for op" sticks.
+- [ ] **PARANOID app** prompts on every request; **FULL_TRUST** never prompts.
+- [ ] **Timeout**: ignore a per-op dialog for 2 minutes → the request fails
+      closed (deny) and the signer keeps serving later requests (not wedged).
+
+## Anti-spam rotation (already shipped)
+- [ ] "New address" → confirm dialog → old `bunker://` goes dark, connected apps
+      drop, QR updates; re-pairing a legit app keeps its trust level.
+
+## Visibility (Tier 2)
+- [ ] Signer screen shows "Signing as npub1…", a live "Recent activity" feed
+      (signed kind N / encrypted / decrypted / shared pubkey, green/red dot,
+      relative time), and per-app history on the Connected-App detail screen.
+- [ ] The Connected-App detail screen for a remote client shows its name/url,
+      not a raw `nip46:` coordinate.
+
+## Reliability (Tier 3)
+- [ ] **Relay health**: kill connectivity → status shows "X of N relays
+      connected"; restore → "all connected".
+- [ ] **Boot restart**: enable the signer, reboot the device → the foreground
+      service comes back and the signer answers a request without reopening the
+      app. (Same for an app update via `MY_PACKAGE_REPLACED`.)
+- [ ] **Doze/background**: after ~30 min idle in Doze, a request still gets
+      serviced (may lag by a relay reconnect).
+
+## Interop matrix
+Pair + sign + nip44 encrypt/decrypt + logout against each:
+- [ ] nsec.app
+- [ ] Coracle
+- [ ] Nostrudel
+- [ ] snort / other NIP-46 client
+
+## CLI interop driver (`amy`) — added 2026-07-17
+The `cli` module (`amy`) drives the same quartz/commons code, so it plays either
+side of every NIP-46 flow for reproducible interop tests without a second phone.
+All of it reuses `Nip46PermissionAuthorizer.parsePerms` / `toSignerOp` — no
+protocol logic in `cli`. See `amy --help` (the `Remote signing (NIP-46)` block).
+
+Amy as the **client** (Amethyst is the signer):
+- `amy login bunker://…` — pair against Amethyst's advertised `bunker://`, then
+  every `amy` signing verb routes through it. Surfaces `auth_url` challenges to
+  stderr, so it completes even when Amethyst defers consent.
+- `amy login --nostrconnect [--perms sign_event:1,nip44_encrypt,…]` — mint an
+  offer for Amethyst to scan. `--perms` is what exercises the app's
+  **informed-consent** sheet (the offer carries the declared ops).
+
+Amy as the **signer** (Amethyst, or any client, is the client):
+- `amy bunker` — headless auto-approve signer for the operator's own key.
+- `amy bunker --perms sign_event:1,nip44_encrypt` — restricted signer: allows
+  only the listed ops, **rejects** the rest. Use to test how the app-as-client
+  handles a signer that says no.
+- `amy bunker --interactive` — keeps listening and prompts `y/N` per request on
+  the terminal (TTY-only, default-deny, prompts serialized). Composes with
+  `--perms` (auto-allow the listed ops, prompt for the rest = the "Reasonable"
+  policy on the CLI).
+
+## Audit findings — known limitations (2026-07-16)
+
+An adversarial review of the signer logic surfaced these. The head-of-line
+issues below share one root cause: `authorize()`/`onConnect()` run **inline** in
+`NostrConnectSignerService`'s single-consumer loop, and relay-set changes restart
+that loop via `collectLatest`.
+
+- **FIXED — unbounded first-connect prompt.** `Nip46ConsentBridge.requestConnect`
+  now has the same 120s `withTimeoutOrNull` as `requestOp`, so an ignored
+  first-connect dialog can no longer wedge the loop forever.
+- **FIXED — consent no longer blocks other clients (needs on-device
+  validation).** The service now fans each request out into a child coroutine
+  under a `Semaphore(maxConcurrentHandles=16)`; dedup/staleness/rate-limit stay on
+  the single consumer, only `handle()` runs concurrently. So a request awaiting a
+  prompt no longer stalls auto-allowed traffic, and several prompts can be pending
+  at once. Two guards keep this safe: (1) the identity signer's crypto is
+  serialized by `BunkerRequestProcessor.cryptoLock` — authorization (the prompt)
+  runs UNLOCKED, only the sign/encrypt/decrypt holds the lock — so an external
+  NIP-55 app never sees concurrent IPC ops; (2) first-connect consent is
+  serialized by `Nip46PermissionAuthorizer.connectLock` so two connects can't stack
+  dialogs. Per-op prompts batch: the shared `SignerConsentCoordinator.pending`
+  flow drives one dialog (1 pending) or a checkbox list (>1). Covered by
+  `BunkerRequestProcessorConcurrencyTest`, but the on-device paths below still need
+  a real run:
+  - [ ] **Burst batching:** a client fires several dangerous-kind requests at once
+        → one batched sheet with checkboxes + select-all, Allow/Deny selected,
+        "Remember" toggle. Approving a subset leaves the rest pending.
+  - [ ] **Auto-allowed keeps flowing:** while a prompt sits open, a REASONABLE
+        auto-allowed request from another app still gets signed and answered.
+  - [ ] **No concurrent external-signer ops:** with a NIP-55 external signer, two
+        approved requests do not drive overlapping IPC (they serialize).
+  - [ ] **Fail-closed on dismiss:** backing out of the batched sheet denies every
+        still-open request (not just the selected ones).
+- **Relay-set change cancels in-flight work.** A `logout` (or a new nostrconnect
+  pairing) mutates the listen set → `collectLatest` restarts the service →
+  cancels the in-flight `handle()`. Practical impact is low (a logout ACK is lost
+  but the client is leaving; a pairing-time cancel makes other clients retry).
+  Proper fix: manage subscriptions incrementally (diff add/remove) instead of a
+  full restart. Deferred (same reason).
+- **Low-severity, left as-is:** activity-log records an O(capacity) list copy per
+  serviced request (negligible under rate-limiting); the per-author rate limiter
+  evicts by insertion order rather than LRU (the 3-arg `accessOrder`
+  `LinkedHashMap` isn't in KMP commonMain); first-time transport-key/secret mint
+  is unsynchronized (practically serialized on the UI thread).
+
+## Deliberately NOT changed
+The always-on foreground **notification** was left as-is: it is shared with the
+relay/DM always-on service, so retitling it "Signing for N apps" or deep-linking
+it to the signer screen would be wrong when the service is up for another reason.
+Interactive consent uses its own dedicated dialog Activity, so it needs no
+notification actions.

amethyst/plans/2026-07-18-nip29-group-chat-subscriptions.md

@@ -0,0 +1,201 @@
+# NIP-29 group-chat subscriptions: split *state* (always-on) from *content* (paginated)
+
+**Status:** proposed · **Date:** 2026-07-18 · **Module:** `amethyst` (+ `commons` model, reuses `commons`/`quartz` paging)
+
+## Problem
+
+NIP-29 relay-group ("RelayGroup") chat is served today by **six** overlapping
+REQ assemblers, each keyed differently and each re-deriving the same two queries:
+
+| Query shape | Emitted by (today) |
+|---|---|
+| Metadata `#d` (39000–39005 + pins) | Warmup, ChannelPublic (open), MyJoinedGroups (roster subset), OnRelay (directory) |
+| Content `#h` (kind 9 + poll) | MyJoinedGroups (limit 50), Warmup (limit 50), ChannelPublic-open (limit 200) |
+| My-own `#h` (`authors=[me]`) | ChannelFromUser — **redundant for groups** (the all-authors `#h` window already returns my messages; a group is pinned to one host relay) |
+| Threads `#h` (11 + 1111) | Warmup, ThreadFeed |
+
+Two concrete defects fall out of this shape:
+
+1. **Slow / partial first load** (the reported bug). Content is fetched in **fixed
+   windows** (limit 50 / 200) gated by a *shared per-relay* `since`
+   (`RelayGroupMyJoinedGroupsSubAssembler` is keyed by `Account`, so its `since`
+   collapses to one map per relay, not per group). A group joined or surfaced
+   after that relay's `since` advanced never backfills; opening it waits a full
+   relay round-trip.
+2. **We can miss messages.** A fixed `limit=200` window has no way to reach older
+   history, and no demand-driven paging: scroll up past 200 and there is nothing
+   behind it. There is also a **serving-relay keying hazard** (see below) where a
+   referenced group message lands in a channel the UI never reads.
+
+Every *other* chat surface in the app already solved this with a **two-subscription
+model** — an always-on live tail + an on-demand backward history pager — and there
+is a reusable framework for it. Group chat is the outlier that never adopted it.
+
+## Goal
+
+Split group chat into the same shape every other chat uses, and delete the
+duplication:
+
+- **State** (metadata / roster / roles / pins) — small replaceable events →
+  **one always-on account subscription**, gated on the NIP-29 settings toggle.
+  The cache is always current; no per-screen metadata re-fetch.
+- **Content** (kind 9 chat + polls) — high volume → **live tail + backward history
+  pager**, exactly like NIP-04 DMs and Concord channels. Gap-proof (`RelayLoadingCursors`
+  handles cache-prune rewind), demand-driven by the visible feed, reconnect-safe.
+
+No message path that delivers a group message today may be dropped.
+
+## Reused framework (do not reimplement)
+
+Mapped end-to-end from the NIP-04 DM stack and the **Concord channel** stack, which
+is the closest existing template (a public group channel already paged this way):
+
+| Piece | Location | Role |
+|---|---|---|
+| `BackwardRelayPager(name, pageLimit, liveTailSeconds)` | `commons/.../relayClient/paging/` | single-active per-relay backward orchestrator |
+| `RelayLoadingCursors` | `quartz/.../relay/client/paging/` | per-relay `until`/`reached`/`done` cursors + `rewindTo` (prune realign) — **one instance per group scope** |
+| `WindowLoadTracker` + `trackingListener` | `commons/.../relayClient/paging/` | live-tail "all relays settled" indicator |
+| `PagingStatus`, `RelayPagingProgress` | paging pkg / quartz | atomic display snapshot |
+| `RelayReachCursor` / `RelayReachSentinels` / `RelayReachMarkers` | `commons/.../ui/feeds/RelayReachMarker.kt` | viewport-driven "load older" markers |
+| `DmHistoryLoadingCard`, `RefreshingChatroomFeedView(olderBoundary, markersInGap, sentinels)` | `amethyst/.../chats/feed/ChatFeedView.kt` | shared feed hooks |
+| `DmHistoryTuning.recentBoundary()` | `commons/.../model/privateChats/` | shared live-tail floor (7 days) |
+
+**Direct templates to copy:**
+`ConcordChannelHistorySubAssembler` + `ConcordChannelHistoryFilterAssembler` +
+`ConcordChannelHistorySubscription` + `ConcordChannelScreen`'s
+`ConcordBackfillHistoryToWindow`; and `ChatroomNip04SubAssembler` (live tail) /
+`ConcordChannelFilterAssembler` (batched always-on live).
+
+## Target architecture
+
+Four concerns, mirroring the DM stack (rooms-list tail + per-conversation tail +
+per-conversation history) plus a groups-only always-on state sub.
+
+1. **`RelayGroupStateSubAssembler`** — *always-on*, account-keyed.
+   Roster `#d` (39000/39001/39002/39003/39005) batched one filter per host relay
+   across the joined set. Keeps `since` (tiny replaceable events; reconnect just
+   re-confirms). Mounted at `LoggedInPage` (like `AccountFilterAssemblerSubscription`),
+   gated on `ChatFeedType.NIP29`. **This is today's `RelayGroupMyJoinedGroups` roster
+   path, promoted to always-on and stripped of content.**
+
+2. **`RelayGroupPreviewTailSubAssembler`** — *always-on*, account-keyed, batched.
+   Content `#h` (kind 9 + poll) across **all** `liveRelayGroupList` group ids,
+   `since = recentBoundary()`, **no per-group limit** (a time floor bounds it, so it
+   batches into one filter per relay). `WindowLoadTracker`. Drives Messages-list
+   previews and keeps joined groups' recent chat live app-wide. **Replaces
+   `RelayGroupMyJoinedGroups` content path (A).** Batching + time-floor `since`
+   eliminates both the per-group-`since` bug and the reconnect re-download.
+
+3. **`RelayGroupChatTailSubAssembler`** — per-open-`GroupId`, live tail for the
+   *currently open* group: content `#h` (9 + poll), `since = recentBoundary()`, host
+   relay. Covers recent + live updates for **any** open group, **including non-joined**
+   groups opened by link (which the batched preview tail — joined-only — doesn't cover).
+   Mirrors the DM per-conversation live tail.
+
+4. **`RelayGroupChatHistorySubAssembler`** — per-open-`GroupId`, `BackwardRelayPager`
+   (`liveTailSeconds` = 7d floor; the tails cover above it), cursors on
+   `RelayGroupChannel.history`, content `#h` (9 + poll, **all authors**) `until`+`limit`
+   on the host relay. Demand-driven by the feed markers; eager `advanceAll()` backfill
+   to a window target on open. **Replaces ChannelPublic-open content (C) and
+   ChannelFromUser (D).** All-authors, so it re-materializes my own history too.
+
+`ChannelFeedFilter` is unchanged — it reads `channel.notes`, so every path that fills
+the cache surfaces. (It has **no `limit()`**, so it already renders whatever is cached.)
+
+## Message-coverage proof (can't-miss-messages checklist)
+
+Every current content-delivery path and what covers it after:
+
+| Path (today) | Kinds / scope | After |
+|---|---|---|
+| **A** MyJoined content (50) | 9,poll `#h` joined | **Preview tail (batched `#h`, since=window)** for previews + **chat tail** when open |
+| **B** Warmup content (50) | 9,poll,11,1111 `#h` card | **KEEP** — non-joined cards/discovery aren't in the joined tail (screen-dependent, per design) |
+| **C** ChannelPublic-open content (200) | 9,poll `#h` open | **Chat tail (recent) + history pager (older, gap-proof)** |
+| **D** ChannelFromUser (`authors=me`) | 9,poll `#h` me | **History pager (all-authors) + tail + optimistic-send attach + host echo** → redundant |
+| **E** ThreadFeed | 11,1111 `#h` | **KEEP** (Threads screen; separate `threadNotes` feed). Pager adoption is a follow-up. |
+| **F** Notifications | 7,9,1111,1068,… `#h`+`#p=me` | **KEEP** — always-on, p-tags-me; unchanged bonus |
+| §3 by-id (`filterMissingEvents`) | ids | **KEEP** — quotes/replies/mentions; **+ serving-relay fix below** |
+| §3 pinned by-id backfill | ids `filterMetadataToRelayGroup` | **KEEP** (host relay; older-than-window pins) |
+| §3 replies/reactions `#e/#q` | 1111 etc. | **KEEP** — comments never attach to timeline (by design) |
+
+**Serving-relay keying hazard (real, pre-existing — fix as part of "can't miss").**
+`attachToRelayGroupIfScoped` keys the channel by `GroupId(groupId, servingRelay)`.
+All subscriptions here are host-pinned, so they're safe. But `filterMissingEvents`
+can deliver a referenced group message from a **non-host** relay, filing it under a
+different channel object than the host-keyed one the UI reads → cached but invisible.
+Fix: when attaching a group-scoped content event, if exactly one existing
+`RelayGroupChannel` carries that `groupId` (the joined/host one), attach there
+instead of minting a `(groupId, servingRelay)` channel — reusing the existing
+`singleOrNull`-by-groupId resolution already used for the `relay == null` optimistic
+branch. Ambiguous ids (the relay-wide `_` group joined on several relays) keep
+serving-relay keying.
+
+## File-by-file changes
+
+**New (`commons` model):**
+- `RelayGroupChannel`: add `val history = RelayLoadingCursors()` (mirror `ConcordChannel.history`).
+
+**New (`amethyst` datasource, per templates):**
+- `RelayGroupStateFilterAssembler` (+ SubAssembler) — always-on roster.
+- `RelayGroupPreviewTailFilterAssembler` (+ SubAssembler) — batched preview tail.
+- `RelayGroupChatTailFilterAssembler` (+ SubAssembler) — per-open live tail.
+- `RelayGroupChatHistoryFilterAssembler` (+ SubAssembler) — per-open history pager.
+- Subscription composables for each (`*Subscription`), copying the Concord ones.
+
+**Modified:**
+- `RelaySubscriptionsCoordinator`: register the four new assemblers; drop the retired ones (see below).
+- `LoggedInPage`: mount `RelayGroupStateSubscription` + `RelayGroupPreviewTailSubscription` (always-on, gated).
+- `RelayGroupChannelView`: mount chat-tail + history subscriptions; wire
+  `RefreshingChatroomFeedView(olderBoundary, markersInGap, sentinels)` + a
+  `BackfillHistoryToWindow` (copy `ConcordBackfillHistoryToWindow`).
+- `MessagesSinglePane`/`MessagesTwoPane`: drop `RelayGroupMyJoinedGroupsSubscription`
+  (its roster role moves to the always-on state sub; previews come from the tail).
+- `LocalCache.attachToRelayGroupIfScoped`: host-relay normalization (serving-relay fix).
+- `AccountViewModel.dataSources()`: expose the four new assemblers; remove retired handles.
+
+**Retired:**
+- `RelayGroupMyJoinedGroupsFilterAssembler` **content path** → deleted; the file's
+  roster role becomes `RelayGroupStateFilterAssembler` (rename/replace).
+- `ChannelPublicFilterSubAssembler` **`RelayGroupChannel` branch** (`filterMessagesToRelayGroup`
+  + `filterMetadataToRelayGroup`) → removed; metadata now always-on, content now tail+pager.
+  (Keep `filterMetadataToRelayGroup`'s **pinned-id backfill** — re-home it on the chat-tail or a
+  small pin sub so older-than-window pins still resolve.)
+- `ChannelFromUserFilterSubAssembler` **`RelayGroupChannel` branch** (`filterMyMessagesToRelayGroup`) → removed.
+- Keep `RelayGroupWarmup*` (non-joined cards), `RelayGroupsOnRelay*` (directory),
+  `RelayGroupsDiscovery*` (discover feed), `RelayGroupThreadFeed*` (threads), and the
+  notifications path unchanged.
+
+## Rollout order (additive first, retire last — never a window where messages drop)
+
+1. **Additive, no removals:** add `RelayGroupChannel.history`; add the four new
+   assemblers + subscriptions + coordinator/dataSources handles + `LoggedInPage`
+   and `RelayGroupChannelView` wiring. New content now flows through tail+pager
+   **alongside** the old A/C/D (harmless dedup by id). Compile + smoke.
+2. **Serving-relay normalization** in `LocalCache` (independent correctness fix).
+3. **Retire** A-content, C-relay-group-branch, D-relay-group-branch; move roster to
+   the always-on state sub; drop the Messages-pane `MyJoinedGroups` mount. Compile.
+4. Re-home the pinned-id backfill; delete now-dead code; `spotlessApply`; full suite.
+
+## Edge cases
+
+- **Quiet group** (newest message older than the 7-day tail): won't appear in the
+  preview tail; its Messages row falls back to cached / placeholder (same as NIP-04).
+  Opening it → the history pager's eager backfill loads it. Optional: a one-shot
+  newest-1 per quiet joined group in the state sub's initial snapshot.
+- **Non-joined open group:** covered by the per-open chat tail + history pager
+  (both per-`GroupId`, no joined-list dependency).
+- **Reconnect:** tails carry `since=recentBoundary()` (time floor, shared-safe,
+  incremental); history is `until`-based (position, not reconnect-sensitive);
+  `FiltersChanged` already ignores `since`-only changes → no full replay.
+- **Threads:** unchanged this pass; a follow-up can point `RelayGroupThreadFeed` at
+  a second `BackwardRelayPager` on `RelayGroupChannel` for kind 11/1111.
+
+## Testing
+
+- Unit: preview-tail filter batches one `#h` filter per relay with
+  `since=recentBoundary()` and no per-group limit; history filter emits only for
+  armed relays at their `requestedUntil`; state filter emits roster `#d` per relay.
+- Cursor behavior is already covered by `RelayLoadingCursors` tests (reused).
+- Manual (amy / device): join a group after session start → open → history backfills;
+  scroll up past the window → older pages load; reconnect → no full re-download;
+  quote a group message from a non-host relay → it appears in the group.

amethyst/plans/2026-07-18-nip29-group-chat-test-plan.md

@@ -0,0 +1,177 @@
+# NIP-29 group-chat loading — test plan (per screen × per assembler)
+
+**For:** an AI validating branch `claude/nip29-group-load-perf-wz4yca` before trusting the
+state-vs-content refactor (see `2026-07-18-nip29-group-chat-subscriptions.md`).
+**Question this answers:** *does the correct data load on every screen, and can we ever miss a message?*
+
+**Implemented on this branch (all headless-runnable tiers):**
+- **Tier B — filter shapes, every assembler.**
+  - Assemblers 1–6 + card-warmup joined-skip + reconnect stability (`needsToResendRequest`) + directory: `amethyst/src/test/.../relayGroup/datasource/RelayGroupFilterBuildersTest.kt` (tests the pure `RelayGroupFilterBuilders.kt` the assemblers now delegate to).
+  - #9 ChannelPublic relay-group branch (state+pins, no message window): `.../publicChannels/datasource/subassemblies/FilterRelayGroupStateTest.kt`.
+  - #10 group notifications (`#p`+`#h`): `.../service/relayClient/reqCommand/account/nip01Notifications/FilterGroupNotificationsToPubkeyTest.kt`.
+  - #8 discovery `#p` roster augmentation: `.../relayGroup/datasource/subassemblies/FilterRelayGroupsByAuthorsTest.kt`.
+- **Tier C — serves-the-shape, against the in-process `geode` relay** (`quartz/src/jvmAndroidTest/.../nip29RelayGroups/RelayGroupFilterServingRelayTest.kt`): C1 state `#d`, C2 batched preview tail, C5 threads, C6 pinned-body-below-window by id, C7 notification `#p`+`#h`, C8 directory.
+- **Tier C3 / E1 — can't-miss + resilience** (`quartz/src/jvmAndroidTest/.../paging/RelayGroupHistoryPagingRelayTest.kt`): backward `#h` walk covers every message once + stops on empty page; same-relay group isolation with overlapping `createdAt`; the **production `RelayLoadingCursors`** driven to the bottom over the wire; short-page-≠-exhaustion.
+
+**Deliberately not duplicated (already covered generically at the unit level):** echo-newest→done and rewind/prune are in `RelayLoadingCursorsTest`; no-EOSE watchdog in `WindowLoadTrackerIdleTest`; auth-CLOSED/stall/cannot-connect in `BackwardRelayPagerTest`. E1's remaining hostile-relay faults (ignore-`since`, out-of-order, AUTH-CLOSE, silence) are those same state-machine paths — re-asserting them under NIP-29 naming adds no coverage since the cursor/pager never sees the `#h` filter, only `onEvent(createdAt)`/`onEose`.
+
+**Not headless-runnable in this environment (flagged for a human):**
+- **Tier D** (Android emulator/device, per screen) — needs a device; each row must be run and any unrun row flagged.
+- **Tier E2** (conformance against a *real* third-party NIP-29 relay in a container) — non-deterministic + needs a container image; geode/strfry are generic and can't surface a real NIP-29 relay's bugs.
+
+## What is / isn't verifiable headless
+
+| Layer | Harness | Covers |
+|---|---|---|
+| Filter **shapes** each assembler builds | amethyst JVM unit tests (new) | the REQ is correct for the screen's job |
+| Relay **serves** those filters; **ingest** into `LocalCache`→`RelayGroupChannel.notes`; paging framework | **`amy` + `geode`/`amy serve`** (drives the same quartz+commons client) | the reused machinery + filter shapes work against a real relay |
+| **Screen loading** (mount → subscribe → feed renders); UI marker/sentinel→`advance`; always-on mounting; backfill-to-window loop | **Android emulator/device** | the amethyst wiring end-to-end |
+
+The amethyst *assemblers* are Android-module, so `amy` cannot invoke them directly — it validates the
+**framework + filter shapes + ingest** they depend on. The **screen** rows below therefore have a
+headless part (unit + amy) and a device part; do both, and mark any device row you couldn't run.
+
+## The assemblers under test (all of them)
+
+| # | Assembler | Mounts on | Must load |
+|---|---|---|---|
+| 1 | `RelayGroupJoinedState` (always-on) | LoggedInPage → every screen | joined groups' 39000/1/2/3/5 → name, roster, roles, pins, my membership |
+| 2 | `RelayGroupJoinedChatTail` (always-on) | LoggedInPage → Messages | joined groups' recent chat (`#h` since=window) → true newest-message previews |
+| 3 | `RelayGroupOpenChatTail` | open group chat screen | the open group's recent chat + live (incl. **non-joined**) |
+| 4 | `RelayGroupOpenChatHistory` | open group chat screen | older chat on demand (`#h` until+limit), gap-proof |
+| 5 | `RelayGroupOpenThreads` | Threads tab | kind-11/1111 threads |
+| 6 | `RelayGroupCardWarmup` | discovery cards, relay channel-list, members/metadata/parent screens | a **non-joined** card's metadata + preview; **skips joined** groups |
+| 7 | `RelayGroupsOnRelay` | relay channel-list, subgroups bar, parent picker | a host relay's whole group directory |
+| 8 | `RelayGroupsDiscovery` | Discovery screen | cross-relay discovery feed (by follows / global) |
+| 9 | `ChannelPublicFilter` (relay-group branch) | open group chat screen | open group metadata + **pinned-id backfill** (incl. non-joined; pins older than window) |
+| 10 | `filterGroupNotificationsToPubkey` (always-on notifications) | account-level | group content that **p-tags me**, even if I never opened the group |
+
+## Harness setup (headless)
+
+```bash
+./gradlew :cli:installDist            # build amy
+RELAY=ws://127.0.0.1:7447
+amy serve --port 7447 &               # embedded relay (geode); or run :geode directly
+# Identities: one "relay/operator" key (signs 39xxx), a few member keys, and "me".
+# Seed a group G on the relay:
+amy relaygroup create --relay $RELAY --gid G --name "Test" ...   # 39000/39001/39002
+# Seed chat spanning the live-tail boundary (7d): messages older AND newer than now-7d.
+for t in <timestamps old→new>; do amy publish --relay $RELAY --kind 9 --tag h=G --created-at $t "msg $t"; done
+# Seed: kind-11 thread + kind-1111 reply (h=G); a pinned kind-9 older than 7d + 39005 pin list;
+#       one kind-9 that p-tags "me"; a SECOND group G2 on the same relay (batching); a group on a
+#       second relay R2 (multi-relay); a group with <LIMIT total messages (small-group path).
+```
+Discover exact flags with `amy <verb> --help` (`fetch`/`subscribe`/`publish`/`relaygroup`).
+`amy fetch --json` gives machine-checkable output for assertions.
+
+---
+
+## Tier A — baseline (must stay green)
+```bash
+./gradlew :amethyst:compilePlayDebugKotlin
+./gradlew :quartz:jvmTest :commons:jvmTest :amethyst:testPlayDebugUnitTest :cli:test
+./gradlew spotlessCheck
+```
+
+## Tier B — new amethyst unit tests (filter shapes per assembler)
+
+Construct a minimal `Account` with `relayGroupList.liveRelayGroupList` = {G@R, G2@R} (+ a mock
+`INostrClient`). If wiring a full `Account` is too heavy, **first refactor the filter construction out
+of each `updateFilter` into a pure function** (`buildJoinedChatTailFilters(joinedTags, since)`,
+`buildOpenChatHistoryFilters(groupId, armed, until, limit)`, …) and test those — this is itself a
+worthwhile testability change. Assert, per assembler:
+
+- **1 State:** one `#d` filter per host relay; kinds = 39000/39001/39002/39003/39005; `d` = all joined ids on that relay; `since` = shared per-relay EOSE. Disabled when NIP-29 toggle off / joined empty.
+- **2 JoinedChatTail:** one `#h` filter per host relay; kinds = [9,poll]; `h` = all joined ids on that relay; `since = recentBoundary()`; **no per-group `limit`**. Two groups on one relay ⇒ **one** filter.
+- **3 OpenChatTail:** one `#h` filter, host relay, kinds [9,poll], `since = recentBoundary()`, the single open group id.
+- **4 OpenChatHistory:** with no relay armed ⇒ empty; after `advance(relay)` ⇒ one `#h` filter at `requestedUntilFor(relay)`, `limit = pageLimit`, **all authors** (no `authors`).
+- **5 OpenThreads:** `#h`, kinds [11,1111], host relay.
+- **6 CardWarmup:** a **joined** group ⇒ `emptyList()`; a **non-joined** group ⇒ metadata (unless contentOnly) + `#h` content (9,poll,11,1111) `limit`.
+- **7 OnRelay:** directory `#`-less filter, kinds 39000-39003, `limit 500`, that relay.
+- **8 Discovery:** by-follows + host-relay `#p` roster augmentation (see `RelayGroupsDiscoverySubAssembler`); global variant.
+- **9 ChannelPublic relay-group branch:** returns **only** `filterRelayGroupState` (metadata + pin ids) — **no** message-window filter.
+- **Reconnect stability:** re-run each `updateFilter` after a simulated EOSE; assert `FiltersChanged.needsToResendRequest(old,new)` is **false** for the tails/state (a `since`-only bump) — i.e. no full replay.
+
+## Tier C — `amy` + relay integration (framework, ingest, can't-miss)
+
+Issue the **exact filter shapes** from Tier B against the seeded relay and assert results:
+
+- **C1 State load:** `amy fetch --kind 39000,39001,39002,39003,39005 --tag d=G --json` returns the seeded state. (screen-1)
+- **C2 Preview/tail:** `amy fetch --kind 9 --tag h=G --since <now-7d> --json` returns only in-window messages; the newest equals the true newest. Batched: `--tag h=G --tag h=G2` returns both groups' recent in one query. (screens 2,3)
+- **C3 History paging (CAN'T-MISS — the crown jewel):** seed **N=120** messages (older than 7d, spread over months). Starting `until=now`, repeatedly `amy fetch --kind 9 --tag h=G --until <cursor> --limit 50 --json`, setting the next `until = oldest.created_at - 1`, until an empty page. Assert the **union of all pages = all 120 ids, no gaps, no infinite loop** (mirror `RelayLoadingCursors.advance/onEose`). Then confirm a relay that returns the same newest events on a repeat page terminates (the `onEose` "not strictly older ⇒ done" guard). (screen-4)
+- **C4 Ingest:** drive `amy subscribe`/`fetch` so events flow through the real client, then assert they land in a `RelayGroupChannel` keyed by `GroupId(G, R)` and surface via the `ChannelFeedFilter` predicate (kind 9/poll in, 1111 out). (screens 2,3)
+- **C5 Threads:** `--kind 11,1111 --tag h=G` returns thread + reply; confirm 1111 attaches to threads, not the chat timeline. (screen-5)
+- **C6 Pins:** a pinned kind-9 older than the window is **not** returned by C2 but **is** by `amy fetch --ids <pinnedId>` — proving the pinned-id backfill path still reaches it. (screen-9)
+- **C7 Notifications:** `--kind 9 --tag h=G --tag p=<me>` returns the me-tagged message. (screen-10)
+- **C8 Directory / discovery:** `--kind 39000 --limit 500` on R lists G+G2; a `#p=<follow>` roster query on the host relay surfaces a follow's group (the discovery augmentation). (screens 7,8)
+- **C9 Multi-relay + reconnect:** repeat C2 against R and R2; drop and re-issue the subscription and confirm (via `--json` counts / relay logs) that a `since`-carrying re-REQ returns only the tail, not a full replay.
+
+## Tier D — Android app, per screen (emulator/device; flag if unrunnable)
+
+Boot `:amethyst:installDebug` against the seeded relay (point the account's relay list at `$RELAY`).
+Watch logcat: `adb logcat | grep -E "DMPagination|relayGroup"`.
+
+For **each screen**, the pass criteria:
+
+- **D1 Messages list (1,2):** cold start with app already having joined G → the G row shows its **true newest** message (not a stale/scattered one), and its name/avatar (state). Join **G2 mid-session** (don't restart) → within seconds G2 appears with a real preview — *this is the original bug; it must now pass.*
+- **D2 Open joined group (3,4,9 + backfill):** tap G → lands on a populated first screen (~50, the backfill-to-window), name/pins present. **Scroll up** past the window → older pages load, the reach marker advances, the "loading older" card shows then flips to "all caught up" at the bottom. No duplicate rows.
+- **D3 Open non-joined group by link (3,4,9):** open a `naddr`/link to a group you have **not** joined → recent chat + live updates load (OpenChatTail) and scroll-up pages (OpenChatHistory), even though it's absent from the joined tail.
+- **D4 Threads tab (5):** open Threads → kind-11 threads list; open one → its 1111 replies.
+- **D5 Discovery (8,6):** open Discovery → groups list; a card fills name+activity (CardWarmup for non-joined). A **joined** group shown in "My Groups" still renders (from cache) though CardWarmup emits nothing for it.
+- **D6 Relay channel-list / browse (7,6):** browse a relay → its directory lists groups; tapping one warms + opens.
+- **D7 Members / Metadata screens (6/1):** roster + roles render.
+- **D8 Reconnect (2,3,4):** toggle airplane mode on the open group and Messages → on reconnect, logcat shows incremental `since`/`until` REQs, **not** a full page replay; no missing or duplicated messages.
+- **D9 Notifications (10):** with G *not* open, have another key post a message p-tagging me → it appears in notifications / unread.
+- **D10 Quiet group:** a group whose newest message is older than 7d → Messages row falls back to cached/placeholder (documented limitation), and opening it backfills via the pager.
+
+## Tier E — relay-behavior resilience & third-party conformance
+
+Tiers C/D run against geode/`amy serve` — a **compliant relay we control**. Real NIP-29 groups live on
+relays managed by other people, which have bugs and quirks. Two distinct concerns:
+
+### E1 — client resilience to a MISBEHAVING relay (deterministic, mock)
+Build a scriptable WebSocket relay (reuse the quartz relay-server + `RelayClientTestFakes`) that injects
+one fault per run; assert the tail/pager still **converge** — all messages ingested, no infinite
+`advance`, no hang, correct terminal state (`done` vs `stalled`), no duplicate rows:
+- ignores `since` (returns everything) → tail must **dedup**, not duplicate.
+- ignores / partial `until` → pager makes progress or marks done, **never loops**.
+- **short page** (returns < `limit` though more exist) → NOT exhaustion (only an *empty* page ends a relay).
+- **echoes the same newest events every page** → `RelayLoadingCursors.onEose` "not strictly older ⇒ done" fires.
+- out-of-order / duplicate events → cursor takes `min(createdAt)`; dedup by id.
+- EOSE before any event, or **no EOSE at all** → `WindowLoadTracker` idle/abs-cap; pager silence watchdog → `stalled`.
+- **AUTH-required → CLOSED("auth-required")** → relay `stalled`-but-kept; re-`advance` retries; **not silently dropped**.
+- mid-stream socket drop → resubscribe with `since`/`until`, **no full replay, no gap** (`rewindTo` on prune).
+- relay result cap below `limit` → treated like a short page.
+
+`UntilLimitPagingRelayTest` + `BackwardRelayPagerTest` already cover the empty-page / until-limit-walk /
+echo-newest cases for the **generic** pager. E1 is to (a) re-run them against the NIP-29 `#h` filter
+shapes and (b) add the not-yet-covered faults (ignore-since, out-of-order, AUTH-CLOSE, silence, reorder).
+
+### E2 — conformance against REAL NIP-29 relay implementations (surfaces THEIR bugs)
+geode / strfry / nostr-rs-relay are **generic** (store+serve by tag; no NIP-29 semantics), so they can't
+surface a real NIP-29 relay's bugs. Point the harness (reuse relayBench's `RelayUnderTest` adapter) at an
+actual NIP-29 relay (e.g. relay29, chorus, a self-hosted groups relay) in a **container**, seed a group
+via `amy relaygroup`, and run C1–C9 + E1's corpus. A failure is a **relay** bug or a client/relay
+mismatch — a NIP-29 conformance report the operator can act on. Cover the behaviors only a real NIP-29
+relay has:
+- **AUTH gating** on closed/private groups (39002 membership): does the client AUTH and then receive the `#h` timeline?
+- **relay-signed 39xxx** (the relay's own key) → the `isRelaySignedGroupEvent` gate.
+- **`previous`-tag fork rejection** on send (a relay rejecting an event whose `previous` refs it doesn't recognise).
+- the relay's actual **`since`/`until` inclusivity** and **result caps / rate limits** on the `#h` timeline.
+
+Public relays are non-deterministic (live data): use a containerized instance for CI, a public one only
+for exploratory runs. **E1 hardens our client against buggy relays; E2 tells us which third-party relay
+is buggy** — both are needed before trusting "loads correctly" in the wild.
+
+## Cross-cutting invariants (assert throughout)
+
+- **No missed messages:** the union of tail + history + pins + notifications = the full timeline; C3 is the decisive test. Also exercise `RelayLoadingCursors.rewindTo` — trim the cache below the window, page again, confirm the pruned band re-loads.
+- **No double-download on reconnect** (C9/D8).
+- **Retirement left no gap:** with `RelayGroupMyJoinedGroups` deleted and `ChannelPublic`/`ChannelFromUser` relay-group content removed, D1/D2/D3 still load — proving the tail+pager replaced them.
+- **CardWarmup joined-skip** (Tier B #6 / D5): a joined card issues no warmup REQ.
+- **Serving-relay hazard (FIXED):** a group message fetched from a **non-host** relay (e.g. `filterMissingEvents` quote resolution) used to be filed under `GroupId(G, otherR)` and lost. `LocalCache.attachToRelayGroupIfScoped`/`attachThreadToRelayGroupIfScoped` now redirect a stray (no channel for the serving relay) to the group's single confirmed **host** channel via `redirectStrayRelayGroupContent`, keyed off `RelayGroupChannel.hasRelaySignedState()` (a phantom never has relay-signed state, so the redirect only ever lands on a real host — strictly safe, the common host-pinned path is an untouched O(1) fast path). Covered by `RelayGroupContentRoutingTest`. **Device-untested:** the pure router + channel signal are unit-tested; the LocalCache wiring is a guarded fast-path/slow-path swap that still needs a device pass (Tier D) to confirm end-to-end.
+
+## Exit criteria
+- Tier A green; Tier B all assertions pass; Tier C1–C9 pass (esp. **C3**).
+- Tier D1–D9 pass on device, or each unrun row is explicitly flagged for a human.
+- Known-failing by design until follow-ups: the serving-relay hazard row and (if unadopted) a threads pager.

amethyst/plans/2026-07-20-v1.13.0-release-qa.md

@@ -0,0 +1,190 @@
+# v1.13.0 release QA — coverage, open findings, and recipes
+
+One extended testing session against v1.13.0 (~2011 commits since v1.12.6). Fixes landed on
+`fix/napplet-account-isolation-and-consent` (30 commits); each commit message carries its own
+root-cause reasoning and is the better reference for *why* a given change looks the way it does.
+
+This document records what that session **could not** capture in commit messages: what was actually
+exercised, what was not, what we chose to leave broken, and how to reproduce the setups.
+
+**Device under test:** Samsung SM-T220 tablet, Android 14, `sw600dp`, `play`/`benchmark`, arm64.
+Everything below is that one configuration unless stated.
+
+---
+
+## 1. Coverage
+
+### Exercised on device
+
+| Area | Notes |
+|---|---|
+| Upgrade path | install over a month-old build; migrations survived, ~880 ms cold start |
+| Napplet / web app per-account isolation | leak found and fixed; each account now has its own jar |
+| Embedded tab rebuild on account switch | blank-tab bug found and fixed; verified both directions + a forced-failure A/B |
+| Launch-account signing binding | desync reproduced end to end, then verified fixed |
+| NIP-46 remote signer | 13 checks, all passing (pairing gate, 22242 prompt, decrypt counterparty/plaintext/narrow grant/scoping) |
+| Concord | invite consent gate, private/voice rename, role rank gate, revoke gate |
+| NIP-29 relay groups | directory browse (crash found), naddr deep-link join, membership resolution |
+| Breadth sweep | Messages, NIP-29, Git, Podcasts, Blossom list, Location, Theming |
+| Location | map picker + teleport, before/after on 4 symptoms, composer path |
+| Notifications | tab showed ~3 items; root-caused to a `since` deadlock and fixed — feed now scrolls back 16 months |
+| Concord role grants | picker built and device-verified (rank gating, preselection, survives the fold) |
+
+### Fixed but **only unit-verified** — never run on a device
+
+Concord rollback floor · stranded recovery · member-set gap · invite expiry · moderation head ·
+**chain-poisoning fix** · community-list unknown-key preservation · V4V fee clamp · Cashu SSRF
+validator · Blossom 402 (cap / re-prompt / double-spend / `X-Reason`) · amountless-invoice display ·
+**napplet consent diff dialog** (never seen rendered) · connect-dialog capability disclosure ·
+`identity.watch` DENY · DM ciphertext previews and the `User` metadata race · chat date separators ·
+podcast duplicate description · Concord leave affordance · the three revocation wirings.
+
+### Never opened at all
+
+Nests / audio rooms (`quic` + MoQ) · Marmot / MLS · **the entire Desktop app** (where Privacy Lock
+actually ships) · Blossom "Sync all" (skipped deliberately — uploads to real servers) · podcast
+chapters / transcripts / credits · Git branch switching · Messages live-typing and per-type toggles ·
+real payments (zaps, V4V streaming, Cashu redeem) · push notifications · search · Calendar, Chess,
+Polls, Marketplace, Workouts, Badges, Follow Packs, Emojis, HLS Upload, App Store, Live Streams.
+
+NIP-29 admin: the menu is reachable and renders, but Edit metadata, invite creation, subgroups and
+pinned messages were never exercised.
+
+### Platform gaps
+
+- **Android 14 only.** `targetSdk` is 37; Android 15+ forces edge-to-edge and that path is untested.
+  An emulator makes this cheap and it is the highest-value remaining gap.
+- **Tablet only** — no phone layout. **`play` only** — no fdroid. **`benchmark` only** — the real
+  `release` (full R8) has never been built or run. **arm64 only.**
+- **Amber / NIP-55** external signer never tested, including a known decrypt double-prompt risk.
+- **Tor-on paths** — Tor was disabled for untrusted relays mid-session and not restored.
+
+---
+
+## 2. Open findings (known, deliberately not fixed)
+
+**Release mechanics**
+- `appCode` still `454` and `app` still `1.12.6` — Play hard-rejects a duplicate versionCode.
+- Firebase `TransportRuntime` cannot schedule (`JobInfoSchedulerService` missing from the merged
+  manifest). If this reproduces in `release`, **Crashlytics delivery is broken** and the release
+  ships blind.
+
+**Correctness / UX**
+- Tor settings do not take effect until app restart, with no indication.
+- An unreachable relay is reported as "No groups on this relay yet" — indistinguishable from empty.
+- NIP-29: a stale "Requested" join state is never reconciled against an arriving 39002 roster.
+- Concord: leaving does not unpin from the bottom bar, leaving a dead tab.
+- Read-only accounts render nothing for a kind:4 chatroom body (better than ciphertext, still wrong).
+- Modal geohash picker header is overdrawn by the MapView (pre-existing).
+- `amy relaygroup create` reports success on relays that silently reject it — always verify with `info`.
+- `amy login bunker://…` hangs and never delivers a `connect`.
+
+**Security / protocol**
+- NIP-46 "Generate a new address" claims to disconnect every app; it rotates the transport key and
+  revokes nothing.
+- WebView storage profiles are never deleted on logout — a removed account's cookies persist.
+  Requires a broker message so `:napplet` can call `ProfileStore.deleteProfile`.
+- Control-plane *edit* paths (`editConcordMetadata`, `grant`, channel edits) still drop unknown JSON
+  keys; only the community list was fixed.
+- **CORD-05: `community_id` does not commit to `community_root`**, so a crafted invite can carry a
+  real community's identity with an attacker's root. **Armada has the identical gap** — this needs a
+  spec conversation, not a unilateral fix.
+- **CORD-04: the BANLIST is not rank-gated, so any BAN holder can ban anyone — including the owner.**
+  Role/grant editions are rank-gated (`canActOn`), but a banlist edition is a single *whole-list*
+  entity, so no client rank-checks its contents; the gate is the author's BAN bit alone. A rank-5
+  moderator's ban of a rank-1 admin is therefore **accepted** by the fold, and the admin then loses
+  every permission (`hasPermission` is `!isBanned && …`). **Armada has the identical gap** — its
+  `banlistGate` calls the rank-blind `isAuthorized(.., Permissions.BAN)` while its role path uses
+  the rank-aware `canActOnPosition`.
+  **This is a conformance bug, NOT a spec gap** — an earlier note here said the opposite and was
+  wrong. CORD-04 §3 is explicit and normative: "One hard rule binds every action: the actor must
+  hold the required bit **and** *strictly* outrank its target — equal cannot act on equal (an admin
+  cannot ban a peer admin)", restated as step 3 of §5. Only §4, the section that defines the
+  Banlist, omits the rank half — and both independent implementations read §4 in isolation and made
+  the same mistake. Spec: <https://github.com/concord-protocol/concord> (`04.md`).
+  **FIXED and shipping** — `AuthorityResolver` now enforces §3 as a *delta rule* (an edition may only
+  add/remove npubs its signer strictly outranks; the owner is never a valid target; unpermitted
+  entries are ignored rather than rejecting the edition, so a bulk-ban survives). The UI and the
+  ban/unban write path route through it too — `ConcordModeration.currentBanned` now reads the
+  *honored* banlist via the resolver instead of decoding the raw head, which also closes a
+  laundering path where our own next ban would re-publish an unauthorized entry under our signature.
+  **Known consequence: Armada has not shipped this, so banlists can differ between clients** —
+  we ignore a ban Armada honors when the signer did not outrank the target. Deliberate.
+  Write-up to send upstream: `docs/concord-banlist-rank-conformance.md`.
+  Still open, both covered in the write-up: a banned member holding BAN can lift their own ban (the
+  gate reads role-derived permissions, so bans do not stick against any BAN holder — this one is a
+  genuine fixpoint-ordering question and needs a spec ruling), and a forked ban survives an unban
+  that does not chain onto it.
+- Notification cards whose target note isn't in `LocalCache` render "Event is loading or can't be
+  found in your relay list" (seen on old zaps). `tagsAnEventByUser` needs the reacted-to note
+  loaded, so deep history stays partially unresolved. Cosmetic, pre-existing.
+
+---
+
+## 3. Setup recipes
+
+**`amy` with an isolated identity** (never touch the maintainer's real one):
+
+```
+AMY=$(pwd)/cli/build/install/amy/bin/amy
+H=/tmp/qa-home; mkdir -p $H
+HOME=$H $AMY --account qa login <nsec> --secret-backend plaintext
+```
+`amy` scopes by `$HOME`, not a flag. `init` prompts for a passphrase and hangs without a TTY — use
+`--secret-backend plaintext` for throwaway identities.
+
+**NIP-29 test group.** `relaygroup create` on `communities.nos.social` and `relay.groups.nip29.com`
+returned success but published nothing; `groups.0xchat.com` worked. Always confirm with
+`relaygroup info`. To reach a group in a 1000+ entry directory, skip the UI and deep-link:
+`adb shell am start -a android.intent.action.VIEW -d "nostr:<naddr>"`, encoded via
+`amy encode naddr --pubkey <relay-nip11-pubkey> --kind 39000 --identifier <groupId> --relay <url>`.
+To make a device account an admin, have it join first, read its pubkey from `relaygroup info`, then
+`put-user … --role admin`.
+
+**Proving "no network before consent."** Run a local relay (`amy serve`), expose it with
+`adb reverse tcp:7777`, and make it the *only* relay in the artefact under test. Count events before
+and after the user action — that turns "I didn't see traffic" into an actual measurement.
+
+---
+
+## 4. Patterns worth acting on
+
+These recurred often enough to be process problems rather than individual bugs.
+
+**Tests that assert the bug.** At least five encoded the buggy behaviour as intended — a NIP-46 test
+named `getPublicKeyReturnsUserPubKeyWithoutAuthorization`, a V4V invariant only ever run on
+well-formed input, a napplet session test that never crossed accounts. *Always verify a new
+regression test fails without the fix* — and beware that **Gradle will serve a stale up-to-date
+`jvmTest` and report BUILD SUCCESSFUL**, which makes that check silently lie. Use `--rerun-tasks`.
+
+**Implemented-but-unreachable capabilities.** Five found: `leaveConcordCommunity`,
+`ConcordInviteBundle.isExpired`, `NappletPermissionLedger.endSession`, `grantConcordRole`, and
+`NappletBroker.revokeSessionGrants`. Each made a feature look complete to anyone reading the model
+while being unreachable to users, and the first one actually invoked turned out to be **broken as
+written**. A lint for "public capability with no caller outside its declaring file" would catch the
+whole class cheaply.
+
+**A narrow query window can deadlock against its own paging.** The Notifications tab asked relays
+for 7 days, and its backward-paging fallback only armed once the feed held a *full page* — so a
+quiet inbox could never fill a page, and therefore never widened the window. The EOSE `since` map
+is in-memory, so every cold start re-pinned it. Look for this shape wherever a "load more" boundary
+is gated on a full page: the empty state is self-sustaining. Note also that the relay-side `limit`
+already bounds these queries, which is what makes dropping the time floor safe.
+
+**Hypotheses need measurement, not plausibility.** Four confident diagnoses were wrong: the "npub in
+title" bug was a `User` lazy-init data race, not a display bug; chat date separators were a
+`reverseLayout` misconception, not bubble grouping; the map picker had no tile problem at all; and
+NIP-29 membership was a *relay rejecting the REQ* (`blocked: it's not allowed to mix metadata kinds
+with others`), not membership modelling. Instrument first.
+
+**Check the reference implementation.** Reading Armada changed the answer three times out of three —
+it corrected an owner-rotation rule that would have stranded owners, stopped an invite-binding "fix"
+that was both interop-breaking and ineffective, and supplied the chain-poisoning design (gate *after*
+folding, not before). Armada is **AGPLv3** and Amethyst is MIT: read for semantics, copy nothing.
+
+**Comments encoding constraints are load-bearing.** The synchronous SharedPreferences read looks like
+an obvious StrictMode fix; its comment records that an async hydrate reopens a settings-clobber race.
+Removing it would have been a confident, review-passing regression.
+
+**Beware concurrent agents and `git add -A`.** Two commits were contaminated, and one silently
+committed another worker's temporary revert. Stage explicit paths, always.

amethyst/src/androidTest/java/com/vitorpamplona/amethyst/ui/screen/loggedIn/relays/eventsync/EventSyncTest.kt

@@ -97,7 +97,7 @@ class EventSyncTest {
                             RelayAuthenticator(
                                 newClient,
                                 appScope,
-                                signWithAllLoggedInUsers = { authTemplate ->
+                                signWithAllLoggedInUsers = { _, authTemplate, _ ->
                                     listOf(signer.sign(authTemplate))
                                 },
                             )

amethyst/src/main/AndroidManifest.xml

@@ -54,6 +54,7 @@
     <uses-permission android:name="android.permission.FOREGROUND_SERVICE_CAMERA" />
     <uses-permission android:name="android.permission.FOREGROUND_SERVICE_PHONE_CALL" />
     <uses-permission android:name="android.permission.FOREGROUND_SERVICE_SPECIAL_USE" />
+    <uses-permission android:name="android.permission.FOREGROUND_SERVICE_DATA_SYNC" />
     <uses-permission android:name="android.permission.USE_FULL_SCREEN_INTENT" />
 
     <!-- Phone calls -->
@@ -151,6 +152,14 @@
                 <data android:scheme="amethyst+walletconnect" />
             </intent-filter>
 
+            <!-- NIP-46: an app's `nostrconnect://` offer opens the signer screen, which pairs it. -->
+            <intent-filter android:label="Amethyst">
+                <action android:name="android.intent.action.VIEW" />
+                <category android:name="android.intent.category.DEFAULT" />
+                <category android:name="android.intent.category.BROWSABLE" />
+                <data android:scheme="nostrconnect" />
+            </intent-filter>
+
             <intent-filter android:label="New Post">
                 <action android:name="android.intent.action.SEND" />
                 <category android:name="android.intent.category.DEFAULT" />
@@ -193,6 +202,16 @@
                 <data android:host="iris.to" />
             </intent-filter>
 
+            <!-- Concord community invite links: https://amethyst.social/invite/<naddr>#<fragment> -->
+            <intent-filter android:label="Amethyst">
+                <action android:name="android.intent.action.VIEW" />
+                <category android:name="android.intent.category.DEFAULT" />
+                <category android:name="android.intent.category.BROWSABLE" />
+                <data android:scheme="https" />
+                <data android:host="amethyst.social" />
+                <data android:pathPrefix="/invite/" />
+            </intent-filter>
+
             <intent-filter android:label="zap.stream">
                 <action android:name="android.intent.action.VIEW" />
                 <category android:name="android.intent.category.DEFAULT" />
@@ -355,6 +374,15 @@
             android:stopWithTask="false"
             android:exported="false" />
 
+        <!-- Keeps the "sync all blobs to all servers" (BUD-04) sweep alive while backgrounded.
+             dataSync is the correct type for an upload/download/sync; it must be started from the
+             foreground, which "Sync all" (user-initiated in the manager) satisfies. -->
+        <service
+            android:name=".service.uploads.blossom.BlossomSyncForegroundService"
+            android:foregroundServiceType="dataSync"
+            android:stopWithTask="false"
+            android:exported="false" />
+
         <provider
             android:name="androidx.core.content.FileProvider"
             android:authorities="${applicationId}.provider"
@@ -374,6 +402,17 @@
                 android:value="Persistent real-time messaging relay connection for Nostr protocol. Maintains WebSocket connections to user-configured inbox relays for immediate notification delivery of direct messages, zaps, and mentions." />
         </service>
 
+        <service
+            android:name=".service.notifications.NotificationServiceTileService"
+            android:icon="@drawable/amethyst_service"
+            android:label="@string/always_on_notif_tile_label"
+            android:permission="android.permission.BIND_QUICK_SETTINGS_TILE"
+            android:exported="true">
+            <intent-filter>
+                <action android:name="android.service.quicksettings.action.QS_TILE" />
+            </intent-filter>
+        </service>
+
         <receiver
             android:name=".service.notifications.BootCompletedReceiver"
             android:exported="false">
@@ -442,14 +481,14 @@
             android:theme="@android:style/Theme.Translucent.NoTitleBar" />
         <!-- First-connect "Connect to Nostr" dialog. -->
         <activity
-            android:name=".napplet.NappletConnectActivity"
+            android:name=".connectedApps.consent.SignerConnectActivity"
             android:exported="false"
             android:excludeFromRecents="true"
             android:launchMode="singleTop"
             android:theme="@android:style/Theme.Translucent.NoTitleBar" />
         <!-- Per-operation signer consent dialog. -->
         <activity
-            android:name=".napplet.NappletSignerConsentActivity"
+            android:name=".connectedApps.consent.SignerConsentActivity"
             android:exported="false"
             android:excludeFromRecents="true"
             android:launchMode="singleTop"

amethyst/src/main/java/com/vitorpamplona/amethyst/Amethyst.kt

@@ -32,6 +32,9 @@ import com.vitorpamplona.amethyst.service.nests.AppForegroundRecycleHook
 import com.vitorpamplona.amethyst.ui.screen.loggedIn.embed.EmbeddedTabHost
 import com.vitorpamplona.quartz.utils.Log
 import com.vitorpamplona.quartz.utils.LogLevel
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.launch
 import java.io.File
 
 /**
@@ -95,6 +98,10 @@ class Amethyst : Application() {
         // Index device-local captured favicons (main process only; decorates favorites + suggestions).
         BrowserIconRegistry.init(this)
 
+        // Warm the global-settings prefs off-main so the first (deliberately synchronous) read of
+        // them does not hit disk on the main thread. See LocalPreferences.warmGlobalSettings.
+        CoroutineScope(Dispatchers.IO).launch { LocalPreferences.warmGlobalSettings() }
+
         // Hydrate the per-web-client Tor routing preferences so a site opted out of Tor (some reject Tor
         // exits) starts on the open web without first flashing a failed Tor load.
         WebAppNetworkRegistry.init(this)

amethyst/src/main/java/com/vitorpamplona/amethyst/AppModules.kt

@@ -27,12 +27,17 @@ import androidx.security.crypto.EncryptedSharedPreferences
 import coil3.disk.DiskCache
 import coil3.memory.MemoryCache
 import com.vitorpamplona.amethyst.commons.model.NoteState
+import com.vitorpamplona.amethyst.commons.napplet.permissions.NappletPermissionLedger
 import com.vitorpamplona.amethyst.commons.relayClient.BlockedRelayFilteringClient
+import com.vitorpamplona.amethyst.commons.richtext.CachedRichTextParser
 import com.vitorpamplona.amethyst.commons.robohash.CachedRobohash
+import com.vitorpamplona.amethyst.commons.scheduledposts.ScheduledPostStore
 import com.vitorpamplona.amethyst.commons.service.lnurl.OkHttpLnurlEndpointResolver
 import com.vitorpamplona.amethyst.commons.service.pow.PoWPolicy
 import com.vitorpamplona.amethyst.commons.service.pow.PoWPublishQueue
 import com.vitorpamplona.amethyst.commons.tor.TorSettings
+import com.vitorpamplona.amethyst.connectedApps.DataStoreNostrSignerPermissionStore
+import com.vitorpamplona.amethyst.connectedApps.nip46.DataStoreNip46ClientStore
 import com.vitorpamplona.amethyst.model.Account
 import com.vitorpamplona.amethyst.model.LocalCache
 import com.vitorpamplona.amethyst.model.UiSettings
@@ -49,8 +54,6 @@ import com.vitorpamplona.amethyst.model.privacyOptions.RoleBasedHttpClientBuilde
 import com.vitorpamplona.amethyst.model.torState.AccountsTorStateConnector
 import com.vitorpamplona.amethyst.model.torState.TorRelayState
 import com.vitorpamplona.amethyst.napplet.DataStoreNappletPermissionStore
-import com.vitorpamplona.amethyst.napplet.DataStoreNostrSignerPermissionStore
-import com.vitorpamplona.amethyst.service.CachedRichTextParser
 import com.vitorpamplona.amethyst.service.calendar.CalendarReminderPrefs
 import com.vitorpamplona.amethyst.service.calendar.CalendarReminderWorker
 import com.vitorpamplona.amethyst.service.cast.CastRegistry
@@ -82,6 +85,7 @@ import com.vitorpamplona.amethyst.service.relayClient.CacheClientConnector
 import com.vitorpamplona.amethyst.service.relayClient.RelayProxyClientConnector
 import com.vitorpamplona.amethyst.service.relayClient.TorCircuitHealthTracker
 import com.vitorpamplona.amethyst.service.relayClient.authCommand.model.AuthCoordinator
+import com.vitorpamplona.amethyst.service.relayClient.diagnostics.BootRelayDiagnostics
 import com.vitorpamplona.amethyst.service.relayClient.notifyCommand.model.NotifyCoordinator
 import com.vitorpamplona.amethyst.service.relayClient.reqCommand.RelaySubscriptionsCoordinator
 import com.vitorpamplona.amethyst.service.relayClient.reqCommand.event.EventFinderQueryState
@@ -103,9 +107,10 @@ import com.vitorpamplona.amethyst.service.resourceusage.SessionTimeIntegrator
 import com.vitorpamplona.amethyst.service.resourceusage.UsageCountingInterceptor
 import com.vitorpamplona.amethyst.service.resourceusage.UsageKeys
 import com.vitorpamplona.amethyst.service.safeCacheDir
-import com.vitorpamplona.amethyst.service.scheduledposts.ScheduledPostStore
 import com.vitorpamplona.amethyst.service.scheduledposts.ScheduledPostWorkGate
 import com.vitorpamplona.amethyst.service.scheduledposts.ScheduledPostWorker
+import com.vitorpamplona.amethyst.service.uploads.blossom.BlossomMirrorQueue
+import com.vitorpamplona.amethyst.service.uploads.blossom.BlossomSyncForegroundService
 import com.vitorpamplona.amethyst.service.uploads.blossom.bud10.BlossomServerResolver
 import com.vitorpamplona.amethyst.service.uploads.blossom.bud10.LocalBlossomCacheProbe
 import com.vitorpamplona.amethyst.service.uploads.nip95.Nip95CacheFactory
@@ -122,6 +127,7 @@ import com.vitorpamplona.quartz.nip01Core.relay.client.INostrClient
 import com.vitorpamplona.quartz.nip01Core.relay.client.NostrClient
 import com.vitorpamplona.quartz.nip01Core.relay.client.accessories.RelayLogger
 import com.vitorpamplona.quartz.nip01Core.relay.client.accessories.RelayOfflineTracker
+import com.vitorpamplona.quartz.nip01Core.relay.client.limits.RelayLimitsTracker
 import com.vitorpamplona.quartz.nip01Core.relay.client.reqs.stats.RelayReqStats
 import com.vitorpamplona.quartz.nip01Core.relay.client.stats.RelayStats
 import com.vitorpamplona.quartz.nip01Core.relay.commands.toClient.CachingEventDecoder
@@ -689,10 +695,37 @@ class AppModules(
     // Per-relay NIP-42 ALLOW/DENY overrides are now per-account (Account.relayAuthPermissions,
     // backed by a file under accounts/<pubkey>/), so there is no app-wide store here anymore.
 
+    /**
+     * The account every napplet/web-app grant and byte of storage is scoped to. Read lazily on each
+     * call (never captured) so an account switch immediately moves embedded apps to the new account's
+     * namespace: an app authorized by one npub is never authorized under another.
+     */
+    val nappletAccountScope: () -> String = { sessionManager.loggedInAccount()?.pubKey ?: "" }
+
     // Singleton stores for napplet permissions — DataStore v1 enforces one instance per file.
-    val nappletPermissionStore by lazy { DataStoreNappletPermissionStore(appContext) }
+    val nappletPermissionStore by lazy { DataStoreNappletPermissionStore(appContext, nappletAccountScope) }
+
+    /**
+     * The one napplet permission ledger for the main process. Its persistent half is just the store
+     * above, but it also holds the in-memory ALLOW_SESSION grants — and *those* only work if every
+     * caller shares this instance. The broker service and the Connected Apps screens used to build
+     * a ledger each, so a "Forget"/revoke tapped in the UI cleared the screen's own (always empty)
+     * session map while the grants the broker was actually consulting lived on untouched.
+     *
+     * Session lifetime is bounded by [com.vitorpamplona.amethyst.napplet.NappletBrokerService]'s
+     * onDestroy (all applet/browser surfaces gone), which calls `endSession()`.
+     */
+    val nappletPermissionLedger by lazy { NappletPermissionLedger(nappletPermissionStore, nappletAccountScope) }
+
+    // NOT account-scoped here on purpose: this store is shared with NIP-46, whose coordinates already
+    // carry their owning account (`nip46:<signer>:<client>`) and whose sessions run for a specific
+    // account rather than the active one. The napplet path namespaces its own coordinate the same way
+    // (see NappletBroker.signerCoordinateFor) instead.
     val signerPermissionStore by lazy { DataStoreNostrSignerPermissionStore(appContext) }
 
+    // Display + relay info for connected NIP-46 remote-signer clients.
+    val nip46ClientStore by lazy { DataStoreNip46ClientStore(appContext) }
+
     // Authenticates with relays.
     val authCoordinator = AuthCoordinator(client, applicationIOScope)
 
@@ -710,6 +743,9 @@ class AppModules(
     // Captures statistics about relays
     val relayStats = RelayStats(client)
 
+    // Caches the latest LIMITS (rights + limits) each relay advertises.
+    val relayLimits = RelayLimitsTracker(client)
+
     // Resource-usage ledger: relay traffic/reconnect + connection-time,
     // foreground-time, process-CPU, and signature-verification collectors.
     init {
@@ -745,6 +781,10 @@ class AppModules(
     // Focused timeline for the DM / gift-wrap loading path (tag: DMPagination).
     // val dmDiagnostics = if (isDebug) DmRelayDiagnosticsLogger(client) else null
 
+    // Per-relay cold-start census: connection outcome by cause, REQ/EOSE/CLOSED accounting,
+    // and which relays actually carried the boot (tag: BootRelayDiag).
+    val bootDiagnostics = if (isDebug) BootRelayDiagnostics(client) else null
+
     // Coordinates all subscriptions for the Nostr Client
     val sources: RelaySubscriptionsCoordinator =
         RelaySubscriptionsCoordinator(
@@ -787,6 +827,14 @@ class AppModules(
         }
     }
 
+    /** App-level BUD-04 mirror sweep, so "sync all" keeps running as the user navigates. */
+    val blossomMirrorQueue by lazy {
+        BlossomMirrorQueue(
+            scope = applicationIOScope,
+            onActive = { BlossomSyncForegroundService.start(appContext) },
+        )
+    }
+
     val powJobRestorer by lazy {
         PowJobRestorer(powPublishQueue, powJobStore, scheduledPostStore)
     }
@@ -806,6 +854,8 @@ class AppModules(
             rootFilesDir = { appContext.filesDir },
             powQueue = { powPublishQueue },
             meterSigner = { MeteringNostrSigner(it, resourceUsage) },
+            signerPermissionStore = signerPermissionStore,
+            nip46ClientStore = nip46ClientStore,
         )
 
     val sessionManager =
@@ -1100,11 +1150,13 @@ class AppModules(
                 }
         }
 
-        // Watch for account login and start/stop always-on notification service
+        // Watch for account login and start/stop always-on notification service.
+        // The manager gates on the global master switch + each account's participation
+        // (not the active account), so it only needs to run while someone is logged in.
         applicationIOScope.launch {
             sessionManager.accountContent.collectLatest { state ->
                 if (state is AccountState.LoggedIn) {
-                    alwaysOnNotificationServiceManager.watchAccount(state.account)
+                    alwaysOnNotificationServiceManager.start()
                 } else {
                     alwaysOnNotificationServiceManager.stop()
                 }

amethyst/src/main/java/com/vitorpamplona/amethyst/LocalPreferences.kt

@@ -25,7 +25,9 @@ import android.content.Context
 import android.content.SharedPreferences
 import androidx.compose.runtime.Immutable
 import androidx.core.content.edit
+import com.vitorpamplona.amethyst.commons.model.chats.ChatFeedType
 import com.vitorpamplona.amethyst.commons.model.clink.ClinkDebitWalletEntry
+import com.vitorpamplona.amethyst.commons.model.concord.ConcordViewMode
 import com.vitorpamplona.amethyst.commons.model.nip29RelayGroups.RelayGroupViewMode
 import com.vitorpamplona.amethyst.commons.model.nip47WalletConnect.NwcWalletEntry
 import com.vitorpamplona.amethyst.commons.model.nip47WalletConnect.NwcWalletEntryNorm
@@ -36,8 +38,10 @@ import com.vitorpamplona.amethyst.model.UiSettings
 import com.vitorpamplona.amethyst.service.checkNotInMainThread
 import com.vitorpamplona.amethyst.ui.actions.mediaServers.DEFAULT_MEDIA_SERVERS
 import com.vitorpamplona.amethyst.ui.actions.mediaServers.ServerName
+import com.vitorpamplona.quartz.concord.cord02Community.ConcordCommunityListEvent
 import com.vitorpamplona.quartz.experimental.ephemChat.list.EphemeralChatListEvent
 import com.vitorpamplona.quartz.experimental.nipA3.PaymentTargetsEvent
+import com.vitorpamplona.quartz.marmot.mip00KeyPackages.KeyPackageRelayListEvent
 import com.vitorpamplona.quartz.nip01Core.core.Event
 import com.vitorpamplona.quartz.nip01Core.core.HexKey
 import com.vitorpamplona.quartz.nip01Core.core.JsonMapper
@@ -53,6 +57,7 @@ import com.vitorpamplona.quartz.nip28PublicChat.list.ChannelListEvent
 import com.vitorpamplona.quartz.nip37Drafts.privateOutbox.PrivateOutboxRelayListEvent
 import com.vitorpamplona.quartz.nip47WalletConnect.Nip47WalletConnect
 import com.vitorpamplona.quartz.nip50Search.SearchRelayListEvent
+import com.vitorpamplona.quartz.nip51Lists.favoriteAlgoFeedsList.FavoriteAlgoFeedsListEvent
 import com.vitorpamplona.quartz.nip51Lists.geohashList.GeohashListEvent
 import com.vitorpamplona.quartz.nip51Lists.hashtagList.HashtagListEvent
 import com.vitorpamplona.quartz.nip51Lists.muteList.MuteListEvent
@@ -70,6 +75,7 @@ import kotlinx.coroutines.CancellationException
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.async
 import kotlinx.coroutines.flow.MutableStateFlow
+import kotlinx.coroutines.flow.StateFlow
 import kotlinx.coroutines.sync.Mutex
 import kotlinx.coroutines.sync.withLock
 import kotlinx.coroutines.withContext
@@ -93,6 +99,11 @@ data class AccountInfo(
 
 private object PrefKeys {
     const val CURRENT_ACCOUNT = "currently_logged_in_account"
+
+    // Global (non-account) master switch for the always-on notification service.
+    // When off, the service is suppressed for every account regardless of each
+    // account's own participation flag. Persisted so it survives restarts/crashes.
+    const val NOTIFICATION_SERVICE_ENABLED = "notification_service_enabled"
     const val SAVED_ACCOUNTS = "all_saved_accounts"
     const val NOSTR_PRIVKEY = "nostr_privkey"
     const val NOSTR_PUBKEY = "nostr_pubkey"
@@ -101,7 +112,13 @@ private object PrefKeys {
     const val STRIP_LOCATION_ON_UPLOAD = "stripLocationOnUpload"
     const val USE_LOCAL_BLOSSOM_CACHE = "useLocalBlossomCache"
     const val LOCAL_BLOSSOM_CACHE_PROFILE_PICTURES_ONLY = "localBlossomCacheProfilePicturesOnly"
+    const val MIRROR_UPLOADS_TO_ALL_SERVERS = "mirrorUploadsToAllServers"
+    const val OPTIMIZE_MEDIA_ON_UPLOAD = "optimizeMediaOnUpload"
     const val HIDE_COMMUNITY_RULES_VIOLATIONS = "hideCommunityRulesViolations"
+    const val NIP46_SIGNER_ENABLED = "nip46SignerEnabled"
+    const val NIP46_BUNKER_SECRET = "nip46BunkerSecret"
+    const val NIP46_TRANSPORT_KEY = "nip46TransportKey"
+    const val NIP46_SEEN_IDS = "nip46SeenRequestIds"
     const val DEFAULT_HOME_FOLLOW_LIST = "defaultHomeFollowList"
     const val DEFAULT_STORIES_FOLLOW_LIST = "defaultStoriesFollowList"
     const val DEFAULT_NOTIFICATION_FOLLOW_LIST = "defaultNotificationFollowList"
@@ -154,7 +171,10 @@ private object PrefKeys {
     const val LATEST_GEOHASH_LIST = "latestGeohashList"
     const val LATEST_EPHEMERAL_LIST = "latestEphemeralChatList"
     const val LATEST_RELAY_GROUP_LIST = "latestRelayGroupList"
+    const val LATEST_CONCORD_LIST = "latestConcordList"
     const val LATEST_TRUST_PROVIDER_LIST = "latestTrustProviderList"
+    const val LATEST_KEY_PACKAGE_RELAY_LIST = "latestKeyPackageRelayList"
+    const val LATEST_FAVORITE_ALGO_FEEDS_LIST = "latestFavoriteAlgoFeedsList"
     const val CALLS_ENABLED = "calls_enabled"
     const val HIDE_DELETE_REQUEST_DIALOG = "hide_delete_request_dialog"
     const val HIDE_BLOCK_ALERT_DIALOG = "hide_block_alert_dialog"
@@ -162,6 +182,11 @@ private object PrefKeys {
     const val ALWAYS_ON_NOTIFICATION_SERVICE = "always_on_notification_service"
     const val DEFAULT_RELAY_AUTH_POLICY = "default_relay_auth_policy"
     const val RELAY_GROUP_VIEW_MODE = "relay_group_view_mode"
+    const val CONCORD_VIEW_MODE = "concord_view_mode"
+
+    // Stores the DISABLED chat feed types (comma-joined codes) so absence = all-on and any newly
+    // added type defaults enabled for accounts that customized before it existed.
+    const val DISABLED_CHAT_FEEDS = "disabled_chat_feeds"
     const val RELAY_AUTH_TRUST_MY_RELAYS = "relay_auth_trust_my_relays_and_venues"
     const val RELAY_AUTH_TRUST_READ_FOLLOWS = "relay_auth_trust_read_follows"
     const val RELAY_AUTH_TRUST_MESSAGE_FOLLOWS = "relay_auth_trust_message_follows"
@@ -203,6 +228,49 @@ object LocalPreferences {
     private val savedAccountsMutex = Mutex()
     private val cachedAccounts: MutableMap<String, AccountSettings?> = mutableMapOf()
 
+    // Global master switch for the always-on notification service ("Background
+    // notification service"). Default ON: existing users keep current behavior, and
+    // per-account participation decides who actually stays active.
+    //
+    // Stored in PLAIN (non-encrypted) SharedPreferences on purpose. It is a non-sensitive
+    // global boolean, and — unlike encryptedPreferences(), which asserts non-main — plain
+    // prefs can be read synchronously on ANY thread. The restart-layer gate
+    // (NotificationRelayService.isEnabled) is synchronous and runs in fresh processes (boot
+    // receiver, WorkManager), so it MUST read the persisted value without a suspend hop;
+    // otherwise a saved OFF would be missed on cold boot and the service would resurrect.
+    // The flow is lazily seeded from disk once (synchronous, main-safe) and is thereafter
+    // the source of truth, so there is no async hydrate that could clobber a user toggle.
+    private fun globalSettingsPrefs(): SharedPreferences = Amethyst.instance.appContext.getSharedPreferences("amethyst_global_settings", Context.MODE_PRIVATE)
+
+    /**
+     * Loads the global-settings prefs file into SharedPreferences' in-memory cache, off the main
+     * thread, so the first synchronous read below hits memory rather than disk.
+     *
+     * The read itself is deliberately synchronous — see [setNotificationServiceEnabled]: an async
+     * hydrate reintroduces a window where a late disk read clobbers a user's toggle. So this warms
+     * the cache instead of deferring the read. Best-effort: if a main-thread reader wins the race it
+     * simply pays the disk hit once, exactly as before.
+     */
+    fun warmGlobalSettings() {
+        globalSettingsPrefs().getBoolean(PrefKeys.NOTIFICATION_SERVICE_ENABLED, true)
+    }
+
+    private val notificationServiceEnabled: MutableStateFlow<Boolean> by lazy {
+        MutableStateFlow(globalSettingsPrefs().getBoolean(PrefKeys.NOTIFICATION_SERVICE_ENABLED, true))
+    }
+
+    fun notificationServiceEnabledFlow(): StateFlow<Boolean> = notificationServiceEnabled
+
+    fun isNotificationServiceEnabled(): Boolean = notificationServiceEnabled.value
+
+    fun setNotificationServiceEnabled(enabled: Boolean) {
+        // In-memory update is the source of truth (main-safe); plain-prefs edit{} persists
+        // asynchronously via apply(), also main-safe. No suspend/hydrate hop, so no window
+        // where a late disk read can clobber this write.
+        notificationServiceEnabled.value = enabled
+        globalSettingsPrefs().edit { putBoolean(PrefKeys.NOTIFICATION_SERVICE_ENABLED, enabled) }
+    }
+
     suspend fun currentAccount(): String? {
         if (currentAccount == null) {
             currentAccount =
@@ -426,7 +494,13 @@ object LocalPreferences {
                     putBoolean(PrefKeys.STRIP_LOCATION_ON_UPLOAD, settings.stripLocationOnUpload)
                     putBoolean(PrefKeys.USE_LOCAL_BLOSSOM_CACHE, settings.useLocalBlossomCache.value)
                     putBoolean(PrefKeys.LOCAL_BLOSSOM_CACHE_PROFILE_PICTURES_ONLY, settings.localBlossomCacheProfilePicturesOnly.value)
+                    putBoolean(PrefKeys.MIRROR_UPLOADS_TO_ALL_SERVERS, settings.mirrorUploadsToAllServers.value)
+                    putBoolean(PrefKeys.OPTIMIZE_MEDIA_ON_UPLOAD, settings.optimizeMediaOnUpload.value)
                     putBoolean(PrefKeys.HIDE_COMMUNITY_RULES_VIOLATIONS, settings.hideCommunityRulesViolations.value)
+                    putBoolean(PrefKeys.NIP46_SIGNER_ENABLED, settings.nip46SignerEnabled.value)
+                    putString(PrefKeys.NIP46_BUNKER_SECRET, settings.nip46BunkerSecret.value)
+                    putString(PrefKeys.NIP46_TRANSPORT_KEY, settings.nip46TransportKey.value)
+                    putStringSet(PrefKeys.NIP46_SEEN_IDS, settings.nip46SeenRequestIds.value)
 
                     putString(PrefKeys.DEFAULT_HOME_FOLLOW_LIST, JsonMapper.toJson(settings.defaultHomeFollowList.value))
                     putString(PrefKeys.DEFAULT_STORIES_FOLLOW_LIST, JsonMapper.toJson(settings.defaultStoriesFollowList.value))
@@ -509,7 +583,10 @@ object LocalPreferences {
                     putOrRemove(PrefKeys.LATEST_GEOHASH_LIST, settings.backupGeohashList)
                     putOrRemove(PrefKeys.LATEST_EPHEMERAL_LIST, settings.backupEphemeralChatList)
                     putOrRemove(PrefKeys.LATEST_RELAY_GROUP_LIST, settings.backupRelayGroupList)
+                    putOrRemove(PrefKeys.LATEST_CONCORD_LIST, settings.backupConcordList)
                     putOrRemove(PrefKeys.LATEST_TRUST_PROVIDER_LIST, settings.backupTrustProviderList)
+                    putOrRemove(PrefKeys.LATEST_KEY_PACKAGE_RELAY_LIST, settings.backupKeyPackageRelayList)
+                    putOrRemove(PrefKeys.LATEST_FAVORITE_ALGO_FEEDS_LIST, settings.backupFavoriteAlgoFeedsList)
                     putOrRemove(PrefKeys.LATEST_PAYMENT_TARGETS, settings.backupNipA3PaymentTargets)
                     putOrRemove(PrefKeys.LATEST_CASHU_WALLET, settings.backupCashuWallet)
                     putOrRemove(PrefKeys.LATEST_NUTZAP_INFO, settings.backupNutzapInfo)
@@ -521,6 +598,8 @@ object LocalPreferences {
                     putBoolean(PrefKeys.ALWAYS_ON_NOTIFICATION_SERVICE, settings.alwaysOnNotificationService.value)
                     putString(PrefKeys.DEFAULT_RELAY_AUTH_POLICY, settings.defaultRelayAuthPolicy.value.name)
                     putString(PrefKeys.RELAY_GROUP_VIEW_MODE, settings.relayGroupViewMode.value.name)
+                    putString(PrefKeys.CONCORD_VIEW_MODE, settings.concordViewMode.value.name)
+                    putString(PrefKeys.DISABLED_CHAT_FEEDS, ChatFeedType.encode(ChatFeedType.ALL - settings.enabledChatFeeds.value))
                     putBoolean(PrefKeys.RELAY_AUTH_TRUST_MY_RELAYS, settings.relayAuthTrustMyRelaysAndVenues.value)
                     putBoolean(PrefKeys.RELAY_AUTH_TRUST_READ_FOLLOWS, settings.relayAuthTrustReadFollows.value)
                     putBoolean(PrefKeys.RELAY_AUTH_TRUST_MESSAGE_FOLLOWS, settings.relayAuthTrustMessageFollows.value)
@@ -635,7 +714,13 @@ object LocalPreferences {
                     val stripLocationOnUpload = getBoolean(PrefKeys.STRIP_LOCATION_ON_UPLOAD, true)
                     val useLocalBlossomCache = getBoolean(PrefKeys.USE_LOCAL_BLOSSOM_CACHE, true)
                     val localBlossomCacheProfilePicturesOnly = getBoolean(PrefKeys.LOCAL_BLOSSOM_CACHE_PROFILE_PICTURES_ONLY, false)
+                    val mirrorUploadsToAllServers = getBoolean(PrefKeys.MIRROR_UPLOADS_TO_ALL_SERVERS, true)
+                    val optimizeMediaOnUpload = getBoolean(PrefKeys.OPTIMIZE_MEDIA_ON_UPLOAD, false)
                     val hideCommunityRulesViolations = getBoolean(PrefKeys.HIDE_COMMUNITY_RULES_VIOLATIONS, false)
+                    val nip46SignerEnabled = getBoolean(PrefKeys.NIP46_SIGNER_ENABLED, false)
+                    val nip46BunkerSecret = getString(PrefKeys.NIP46_BUNKER_SECRET, "") ?: ""
+                    val nip46TransportKey = getString(PrefKeys.NIP46_TRANSPORT_KEY, "") ?: ""
+                    val nip46SeenRequestIds = getStringSet(PrefKeys.NIP46_SEEN_IDS, null) ?: setOf()
                     val hideDeleteRequestDialog = getBoolean(PrefKeys.HIDE_DELETE_REQUEST_DIALOG, false)
                     val hideBlockAlertDialog = getBoolean(PrefKeys.HIDE_BLOCK_ALERT_DIALOG, false)
                     val hideNIP17WarningDialog = getBoolean(PrefKeys.HIDE_NIP_17_WARNING_DIALOG, false)
@@ -646,6 +731,8 @@ object LocalPreferences {
                             ?.let { runCatching { RelayAuthPolicy.valueOf(it) }.getOrNull() }
                             ?: RelayAuthPolicy.CUSTOM
                     val relayGroupViewMode = RelayGroupViewMode.fromName(getString(PrefKeys.RELAY_GROUP_VIEW_MODE, null))
+                    val concordViewMode = ConcordViewMode.fromName(getString(PrefKeys.CONCORD_VIEW_MODE, null))
+                    val enabledChatFeeds = ChatFeedType.ALL - ChatFeedType.decode(getString(PrefKeys.DISABLED_CHAT_FEEDS, null))
                     val relayAuthTrustMyRelays = getBoolean(PrefKeys.RELAY_AUTH_TRUST_MY_RELAYS, true)
                     val relayAuthTrustReadFollows = getBoolean(PrefKeys.RELAY_AUTH_TRUST_READ_FOLLOWS, true)
                     val relayAuthTrustMessageFollows = getBoolean(PrefKeys.RELAY_AUTH_TRUST_MESSAGE_FOLLOWS, true)
@@ -685,7 +772,10 @@ object LocalPreferences {
                     val latestGeohashListStr = getString(PrefKeys.LATEST_GEOHASH_LIST, null)
                     val latestEphemeralListStr = getString(PrefKeys.LATEST_EPHEMERAL_LIST, null)
                     val latestRelayGroupListStr = getString(PrefKeys.LATEST_RELAY_GROUP_LIST, null)
+                    val latestConcordListStr = getString(PrefKeys.LATEST_CONCORD_LIST, null)
                     val latestTrustProviderListStr = getString(PrefKeys.LATEST_TRUST_PROVIDER_LIST, null)
+                    val latestKeyPackageRelayListStr = getString(PrefKeys.LATEST_KEY_PACKAGE_RELAY_LIST, null)
+                    val latestFavoriteAlgoFeedsListStr = getString(PrefKeys.LATEST_FAVORITE_ALGO_FEEDS_LIST, null)
                     val latestPaymentTargetsStr = getString(PrefKeys.LATEST_PAYMENT_TARGETS, null)
                     val latestCashuWalletStr = getString(PrefKeys.LATEST_CASHU_WALLET, null)
                     val latestNutzapInfoStr = getString(PrefKeys.LATEST_NUTZAP_INFO, null)
@@ -745,7 +835,10 @@ object LocalPreferences {
                     val latestGeohashList = async { parseEventOrNull<GeohashListEvent>(latestGeohashListStr) }
                     val latestEphemeralList = async { parseEventOrNull<EphemeralChatListEvent>(latestEphemeralListStr) }
                     val latestRelayGroupList = async { parseEventOrNull<SimpleGroupListEvent>(latestRelayGroupListStr) }
+                    val latestConcordList = async { parseEventOrNull<ConcordCommunityListEvent>(latestConcordListStr) }
                     val latestTrustProviderList = async { parseEventOrNull<TrustProviderListEvent>(latestTrustProviderListStr) }
+                    val latestKeyPackageRelayList = async { parseEventOrNull<KeyPackageRelayListEvent>(latestKeyPackageRelayListStr) }
+                    val latestFavoriteAlgoFeedsList = async { parseEventOrNull<FavoriteAlgoFeedsListEvent>(latestFavoriteAlgoFeedsListStr) }
                     val latestPaymentTargets = async { parseEventOrNull<PaymentTargetsEvent>(latestPaymentTargetsStr) }
                     val latestCashuWallet =
                         async {
@@ -797,7 +890,10 @@ object LocalPreferences {
                     val latestGeohashListResolved = latestGeohashList.await()
                     val latestEphemeralListResolved = latestEphemeralList.await()
                     val latestRelayGroupListResolved = latestRelayGroupList.await()
+                    val latestConcordListResolved = latestConcordList.await()
                     val latestTrustProviderListResolved = latestTrustProviderList.await()
+                    val latestKeyPackageRelayListResolved = latestKeyPackageRelayList.await()
+                    val latestFavoriteAlgoFeedsListResolved = latestFavoriteAlgoFeedsList.await()
                     val latestPaymentTargetsResolved = latestPaymentTargets.await()
                     val latestCashuWalletResolved = latestCashuWallet.await()
                     val latestNutzapInfoResolved = latestNutzapInfo.await()
@@ -813,7 +909,13 @@ object LocalPreferences {
                         stripLocationOnUpload = stripLocationOnUpload,
                         useLocalBlossomCache = MutableStateFlow(useLocalBlossomCache),
                         localBlossomCacheProfilePicturesOnly = MutableStateFlow(localBlossomCacheProfilePicturesOnly),
+                        mirrorUploadsToAllServers = MutableStateFlow(mirrorUploadsToAllServers),
+                        optimizeMediaOnUpload = MutableStateFlow(optimizeMediaOnUpload),
                         hideCommunityRulesViolations = MutableStateFlow(hideCommunityRulesViolations),
+                        nip46SignerEnabled = MutableStateFlow(nip46SignerEnabled),
+                        nip46BunkerSecret = MutableStateFlow(nip46BunkerSecret),
+                        nip46TransportKey = MutableStateFlow(nip46TransportKey),
+                        nip46SeenRequestIds = MutableStateFlow(nip46SeenRequestIds),
                         defaultHomeFollowList = MutableStateFlow(followListPrefs.home),
                         defaultStoriesFollowList = MutableStateFlow(followListPrefs.stories),
                         defaultNotificationFollowList = MutableStateFlow(followListPrefs.notification),
@@ -859,6 +961,8 @@ object LocalPreferences {
                         alwaysOnNotificationService = MutableStateFlow(alwaysOnNotificationService),
                         defaultRelayAuthPolicy = MutableStateFlow(defaultRelayAuthPolicy),
                         relayGroupViewMode = MutableStateFlow(relayGroupViewMode),
+                        concordViewMode = MutableStateFlow(concordViewMode),
+                        enabledChatFeeds = MutableStateFlow(enabledChatFeeds),
                         relayAuthTrustMyRelaysAndVenues = MutableStateFlow(relayAuthTrustMyRelays),
                         relayAuthTrustReadFollows = MutableStateFlow(relayAuthTrustReadFollows),
                         relayAuthTrustMessageFollows = MutableStateFlow(relayAuthTrustMessageFollows),
@@ -883,7 +987,10 @@ object LocalPreferences {
                         backupGeohashList = latestGeohashListResolved,
                         backupEphemeralChatList = latestEphemeralListResolved,
                         backupRelayGroupList = latestRelayGroupListResolved,
+                        backupConcordList = latestConcordListResolved,
                         backupTrustProviderList = latestTrustProviderListResolved,
+                        backupKeyPackageRelayList = latestKeyPackageRelayListResolved,
+                        backupFavoriteAlgoFeedsList = latestFavoriteAlgoFeedsListResolved,
                         lastReadPerRoute = MutableStateFlow(lastReadPerRouteResolved),
                         hasDonatedInVersion = MutableStateFlow(hasDonatedInVersion),
                         dismissedPollNoteIds = MutableStateFlow(dismissedPollNoteIds),

amethyst/src/main/java/com/vitorpamplona/amethyst/connectedApps/DataStoreNostrSignerPermissionStore.kt

@@ -18,7 +18,7 @@
  * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
  * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
  */
-package com.vitorpamplona.amethyst.napplet
+package com.vitorpamplona.amethyst.connectedApps
 
 import android.content.Context
 import androidx.datastore.core.DataStore
@@ -26,12 +26,14 @@ import androidx.datastore.preferences.core.PreferenceDataStoreFactory
 import androidx.datastore.preferences.core.Preferences
 import androidx.datastore.preferences.core.edit
 import androidx.datastore.preferences.core.stringPreferencesKey
-import com.vitorpamplona.amethyst.commons.napplet.signers.AppSignerPolicy
-import com.vitorpamplona.amethyst.commons.napplet.signers.NostrOpDecision
-import com.vitorpamplona.amethyst.commons.napplet.signers.NostrSignerOp
-import com.vitorpamplona.amethyst.commons.napplet.signers.NostrSignerPermissionStore
+import com.vitorpamplona.amethyst.commons.connectedApps.signers.AppSignerPolicy
+import com.vitorpamplona.amethyst.commons.connectedApps.signers.NostrOpDecision
+import com.vitorpamplona.amethyst.commons.connectedApps.signers.NostrSignerOp
+import com.vitorpamplona.amethyst.commons.connectedApps.signers.NostrSignerPermissionStore
 import com.vitorpamplona.quartz.utils.cache.LargeCache
+import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.flow.first
+import kotlinx.coroutines.withContext
 import java.io.File
 import java.security.MessageDigest
 
@@ -102,21 +104,24 @@ class DataStoreNostrSignerPermissionStore(
         storeFor(coordinate).edit { it.remove(opKey(op)) }
     }
 
-    override suspend fun allPolicies(): Map<String, AppSignerPolicy> {
-        val dir = File(filesDir, "datastore")
-        if (!dir.exists()) return emptyMap()
-        val result = mutableMapOf<String, AppSignerPolicy>()
-        for (file in dir.listFiles { f -> f.name.startsWith("nsp_") } ?: emptyArray()) {
-            val ds =
-                cache.getOrCreate(file.absolutePath) {
-                    PreferenceDataStoreFactory.create(produceFile = { file })
-                }
-            val coordinate = ds.data.first()[KEY_COORDINATE] ?: continue
-            val policy = loadPolicy(coordinate) ?: continue
-            result[coordinate] = policy
+    override suspend fun allPolicies(): Map<String, AppSignerPolicy> =
+        // Enumerates the datastore directory + reads each file — blocking disk IO, so keep it off the
+        // caller's thread (callers invoke this from Compose LaunchedEffects on the main dispatcher).
+        withContext(Dispatchers.IO) {
+            val dir = File(filesDir, "datastore")
+            if (!dir.exists()) return@withContext emptyMap()
+            val result = mutableMapOf<String, AppSignerPolicy>()
+            for (file in dir.listFiles { f -> f.name.startsWith("nsp_") } ?: emptyArray()) {
+                val ds =
+                    cache.getOrCreate(file.absolutePath) {
+                        PreferenceDataStoreFactory.create(produceFile = { file })
+                    }
+                val coordinate = ds.data.first()[KEY_COORDINATE] ?: continue
+                val policy = loadPolicy(coordinate) ?: continue
+                result[coordinate] = policy
+            }
+            result
         }
-        return result
-    }
 
     override suspend fun allOpDecisions(coordinate: String): Map<String, NostrOpDecision> {
         val prefs = storeFor(coordinate).data.first()

amethyst/src/main/java/com/vitorpamplona/amethyst/connectedApps/consent/ConnectedAccountRow.kt

@@ -0,0 +1,68 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.connectedApps.consent
+
+import androidx.compose.foundation.layout.Arrangement
+import androidx.compose.foundation.layout.Row
+import androidx.compose.foundation.layout.size
+import androidx.compose.foundation.shape.CircleShape
+import androidx.compose.material3.MaterialTheme
+import androidx.compose.material3.Text
+import androidx.compose.runtime.Composable
+import androidx.compose.ui.Alignment
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.draw.clip
+import androidx.compose.ui.text.style.TextOverflow
+import androidx.compose.ui.unit.dp
+import com.vitorpamplona.amethyst.ui.components.RobohashFallbackAsyncImage
+
+/**
+ * The account a signer request acts as — avatar + display name — so it's clear WHICH logged-in
+ * identity is approving/signing/encrypting/decrypting. Shown in both consent dialogs in place of a
+ * raw pubkey. Falls back to a robohash avatar seeded on [pubKey] when there's no [picture].
+ */
+@Composable
+fun ConnectedAccountRow(
+    name: String,
+    picture: String?,
+    pubKey: String?,
+) {
+    Row(
+        verticalAlignment = Alignment.CenterVertically,
+        horizontalArrangement = Arrangement.spacedBy(8.dp),
+    ) {
+        RobohashFallbackAsyncImage(
+            robot = pubKey ?: name,
+            model = picture,
+            contentDescription = null,
+            modifier = Modifier.size(26.dp).clip(CircleShape),
+            loadProfilePicture = true,
+            loadRobohash = true,
+        )
+        Text(
+            name,
+            style = MaterialTheme.typography.labelLarge,
+            color = MaterialTheme.colorScheme.onSurface,
+            maxLines = 1,
+            overflow = TextOverflow.Ellipsis,
+        )
+    }
+}

amethyst/src/main/java/com/vitorpamplona/amethyst/connectedApps/consent/SignerConnectActivity.kt

@@ -18,7 +18,7 @@
  * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
  * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
  */
-package com.vitorpamplona.amethyst.napplet
+package com.vitorpamplona.amethyst.connectedApps.consent
 
 import android.os.Bundle
 import androidx.activity.ComponentActivity
@@ -58,23 +58,24 @@ import androidx.compose.ui.unit.dp
 import androidx.compose.ui.window.Dialog
 import androidx.compose.ui.window.DialogProperties
 import com.vitorpamplona.amethyst.R
+import com.vitorpamplona.amethyst.commons.connectedApps.signers.AppConnectResult
+import com.vitorpamplona.amethyst.commons.connectedApps.signers.AppSignerPolicy
 import com.vitorpamplona.amethyst.commons.favorites.FavoriteApp
 import com.vitorpamplona.amethyst.commons.favorites.FavoriteAppIcon
 import com.vitorpamplona.amethyst.commons.icons.symbols.Icon
+import com.vitorpamplona.amethyst.commons.icons.symbols.MaterialSymbol
 import com.vitorpamplona.amethyst.commons.icons.symbols.MaterialSymbols
-import com.vitorpamplona.amethyst.commons.napplet.signers.AppConnectResult
-import com.vitorpamplona.amethyst.commons.napplet.signers.AppSignerPolicy
 import com.vitorpamplona.amethyst.ui.theme.AmethystTheme
 
-class NappletConnectActivity : ComponentActivity() {
+class SignerConnectActivity : ComponentActivity() {
     private var token: String? = null
     private var decided = false
 
     override fun onCreate(savedInstanceState: Bundle?) {
         super.onCreate(savedInstanceState)
-        val token = intent.getStringExtra(NappletConnectCoordinator.EXTRA_TOKEN)
+        val token = intent.getStringExtra(SignerConnectCoordinator.EXTRA_TOKEN)
         this.token = token
-        val info = token?.let { NappletConnectCoordinator.infoFor(it) }
+        val info = token?.let { SignerConnectCoordinator.infoFor(it) }
         if (token == null || info == null) {
             finish()
             return
@@ -82,21 +83,21 @@ class NappletConnectActivity : ComponentActivity() {
 
         setContent {
             AmethystTheme {
-                NappletConnectScreen(
+                SignerConnectScreen(
                     info = info,
                     onConnect = { policy ->
                         decided = true
-                        NappletConnectCoordinator.complete(token, AppConnectResult.Connected(policy))
+                        SignerConnectCoordinator.complete(token, AppConnectResult.Connected(policy))
                         finish()
                     },
                     onBlock = {
                         decided = true
-                        NappletConnectCoordinator.complete(token, AppConnectResult.Blocked)
+                        SignerConnectCoordinator.complete(token, AppConnectResult.Blocked)
                         finish()
                     },
                     onCancel = {
                         decided = true
-                        NappletConnectCoordinator.complete(token, AppConnectResult.Cancelled)
+                        SignerConnectCoordinator.complete(token, AppConnectResult.Cancelled)
                         finish()
                     },
                 )
@@ -105,14 +106,14 @@ class NappletConnectActivity : ComponentActivity() {
     }
 
     override fun finish() {
-        if (!decided) token?.let { NappletConnectCoordinator.cancel(it) }
+        if (!decided) token?.let { SignerConnectCoordinator.cancel(it) }
         super.finish()
     }
 }
 
 @Composable
-private fun NappletConnectScreen(
-    info: NappletConnectInfo,
+private fun SignerConnectScreen(
+    info: SignerConnectInfo,
     onConnect: (AppSignerPolicy) -> Unit,
     onBlock: () -> Unit,
     onCancel: () -> Unit,
@@ -168,12 +169,46 @@ private fun NappletConnectScreen(
                         color = MaterialTheme.colorScheme.onSurfaceVariant,
                         textAlign = TextAlign.Center,
                     )
-                    Text(
-                        info.domain,
-                        style = MaterialTheme.typography.labelSmall,
-                        color = MaterialTheme.colorScheme.onSurfaceVariant,
-                        textAlign = TextAlign.Center,
-                    )
+                    // Show WHICH account is being connected (avatar + name), not a raw pubkey.
+                    if (info.accountName != null) {
+                        ConnectedAccountRow(info.accountName, info.accountPicture, info.accountPubKey)
+                    } else {
+                        Text(
+                            info.domain,
+                            style = MaterialTheme.typography.labelSmall,
+                            color = MaterialTheme.colorScheme.onSurfaceVariant,
+                            textAlign = TextAlign.Center,
+                        )
+                    }
+                }
+
+                // What the app declared it needs (nostrconnect `perms`) — so consent is informed,
+                // not a silent grant. Approving connects and pre-grants exactly these.
+                if (info.requestedPermissions.isNotEmpty()) {
+                    Spacer(Modifier.height(16.dp))
+                    Surface(
+                        modifier = Modifier.padding(horizontal = 24.dp).fillMaxWidth(),
+                        color = MaterialTheme.colorScheme.surfaceVariant,
+                        shape = MaterialTheme.shapes.medium,
+                    ) {
+                        Column(modifier = Modifier.padding(14.dp), verticalArrangement = Arrangement.spacedBy(6.dp)) {
+                            Text(
+                                stringResource(R.string.nip46_connect_requests_title),
+                                style = MaterialTheme.typography.labelLarge,
+                            )
+                            info.requestedPermissions.forEach { perm ->
+                                Row(horizontalArrangement = Arrangement.spacedBy(8.dp)) {
+                                    Icon(
+                                        MaterialSymbols.Check,
+                                        contentDescription = null,
+                                        tint = MaterialTheme.colorScheme.primary,
+                                        modifier = Modifier.size(16.dp),
+                                    )
+                                    Text(perm, style = MaterialTheme.typography.bodySmall)
+                                }
+                            }
+                        }
+                    }
                 }
 
                 Spacer(Modifier.height(16.dp))
@@ -194,21 +229,21 @@ private fun NappletConnectScreen(
                 ) {
                     PolicyOption(
                         selected = selected == AppSignerPolicy.FULL_TRUST,
-                        icon = "❤",
+                        symbol = MaterialSymbols.LockOpen,
                         label = stringResource(R.string.napplet_policy_full_trust),
                         description = stringResource(R.string.napplet_policy_full_trust_desc),
                         onClick = { selected = AppSignerPolicy.FULL_TRUST },
                     )
                     PolicyOption(
                         selected = selected == AppSignerPolicy.REASONABLE,
-                        icon = "👍",
+                        symbol = MaterialSymbols.Shield,
                         label = stringResource(R.string.napplet_policy_reasonable),
                         description = stringResource(R.string.napplet_policy_reasonable_desc),
                         onClick = { selected = AppSignerPolicy.REASONABLE },
                     )
                     PolicyOption(
                         selected = selected == AppSignerPolicy.PARANOID,
-                        icon = "🕶",
+                        symbol = MaterialSymbols.Lock,
                         label = stringResource(R.string.napplet_policy_paranoid),
                         description = stringResource(R.string.napplet_policy_paranoid_desc),
                         onClick = { selected = AppSignerPolicy.PARANOID },
@@ -249,7 +284,7 @@ private fun NappletConnectScreen(
 @Composable
 private fun PolicyOption(
     selected: Boolean,
-    icon: String,
+    symbol: MaterialSymbol,
     label: String,
     description: String,
     onClick: () -> Unit,
@@ -271,7 +306,12 @@ private fun PolicyOption(
             verticalAlignment = Alignment.CenterVertically,
             horizontalArrangement = Arrangement.spacedBy(12.dp),
         ) {
-            Text(icon, style = MaterialTheme.typography.headlineSmall)
+            Icon(
+                symbol = symbol,
+                contentDescription = null,
+                tint = if (selected) MaterialTheme.colorScheme.primary else MaterialTheme.colorScheme.onSurfaceVariant,
+                modifier = Modifier.size(26.dp),
+            )
             Column(modifier = Modifier.weight(1f)) {
                 Text(label, style = MaterialTheme.typography.titleSmall, color = MaterialTheme.colorScheme.onSurface)
                 Text(description, style = MaterialTheme.typography.bodySmall, color = MaterialTheme.colorScheme.onSurfaceVariant)

amethyst/src/main/java/com/vitorpamplona/amethyst/connectedApps/consent/SignerConnectCoordinator.kt

@@ -18,21 +18,36 @@
  * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
  * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
  */
-package com.vitorpamplona.amethyst.napplet
+package com.vitorpamplona.amethyst.connectedApps.consent
 
 import android.content.Context
 import android.content.Intent
-import com.vitorpamplona.amethyst.commons.napplet.signers.AppConnectResult
+import com.vitorpamplona.amethyst.R
+import com.vitorpamplona.amethyst.commons.connectedApps.signers.AppConnectResult
 import kotlinx.coroutines.CompletableDeferred
 import java.util.UUID
 import java.util.concurrent.ConcurrentHashMap
 
 /** Everything the "Connect to Nostr" dialog needs to render. */
-data class NappletConnectInfo(
+data class SignerConnectInfo(
     val appletTitle: String,
     val coordinate: String,
     val domain: String,
     val iconUrl: String? = null,
+    /**
+     * The account the app is connecting to, shown as an avatar + name instead of a raw pubkey. When
+     * [accountName] is null (e.g. napplet/browser paths that don't resolve it) the dialog falls back
+     * to [domain]. [accountPubKey] seeds the robohash avatar fallback when there's no picture.
+     */
+    val accountName: String? = null,
+    val accountPicture: String? = null,
+    val accountPubKey: String? = null,
+    /**
+     * Human-readable permissions the app declared it needs (from a `nostrconnect://…?perms=` offer),
+     * shown so the user gives INFORMED consent before those ops are pre-granted. Empty for flows that
+     * carry no declaration (bunker connect), which just show the trust picker.
+     */
+    val requestedPermissions: List<String> = emptyList(),
 )
 
 /**
@@ -40,9 +55,9 @@ data class NappletConnectInfo(
  * the Activity resolves the deferred with the user's choice.
  * A dismissed dialog resolves to [AppConnectResult.Cancelled] — fails closed, no silent grant.
  */
-object NappletConnectCoordinator {
+object SignerConnectCoordinator {
     private class Pending(
-        val info: NappletConnectInfo,
+        val info: SignerConnectInfo,
         val deferred: CompletableDeferred<AppConnectResult>,
     )
 
@@ -50,26 +65,41 @@ object NappletConnectCoordinator {
 
     suspend fun requestConnect(
         context: Context,
-        info: NappletConnectInfo,
+        info: SignerConnectInfo,
     ): AppConnectResult {
         val token = UUID.randomUUID().toString()
         val deferred = CompletableDeferred<AppConnectResult>()
         pending[token] = Pending(info, deferred)
 
-        context.startActivity(
-            Intent(context, NappletConnectActivity::class.java)
-                .addFlags(Intent.FLAG_ACTIVITY_NEW_TASK)
-                .putExtra(EXTRA_TOKEN, token),
-        )
+        // Fast path when Amethyst already owns the foreground; the full-screen-intent notification
+        // below is what surfaces the dialog when a connect request arrives while backgrounded (see
+        // SignerConsentNotifier). Wrapped because a BAL-blocked launch can throw on some OEMs.
+        runCatching {
+            context.startActivity(
+                Intent(context, SignerConnectActivity::class.java)
+                    .addFlags(Intent.FLAG_ACTIVITY_NEW_TASK)
+                    .putExtra(EXTRA_TOKEN, token),
+            )
+        }
+
+        val notificationId =
+            SignerConsentNotifier.show(
+                context = context,
+                activityClass = SignerConnectActivity::class.java,
+                extraKey = EXTRA_TOKEN,
+                token = token,
+                titleRes = R.string.nip46_signer_notif_connect_title,
+            )
 
         return try {
             deferred.await()
         } finally {
             pending.remove(token)
+            SignerConsentNotifier.cancel(context, notificationId)
         }
     }
 
-    fun infoFor(token: String): NappletConnectInfo? = pending[token]?.info
+    fun infoFor(token: String): SignerConnectInfo? = pending[token]?.info
 
     fun complete(
         token: String,

amethyst/src/main/java/com/vitorpamplona/amethyst/connectedApps/consent/SignerConsentActivity.kt

@@ -0,0 +1,591 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.connectedApps.consent
+
+import android.os.Bundle
+import androidx.activity.ComponentActivity
+import androidx.activity.compose.setContent
+import androidx.compose.foundation.clickable
+import androidx.compose.foundation.horizontalScroll
+import androidx.compose.foundation.layout.Arrangement
+import androidx.compose.foundation.layout.Box
+import androidx.compose.foundation.layout.Column
+import androidx.compose.foundation.layout.PaddingValues
+import androidx.compose.foundation.layout.Row
+import androidx.compose.foundation.layout.Spacer
+import androidx.compose.foundation.layout.fillMaxWidth
+import androidx.compose.foundation.layout.height
+import androidx.compose.foundation.layout.heightIn
+import androidx.compose.foundation.layout.padding
+import androidx.compose.foundation.layout.size
+import androidx.compose.foundation.rememberScrollState
+import androidx.compose.foundation.shape.CircleShape
+import androidx.compose.foundation.text.selection.SelectionContainer
+import androidx.compose.foundation.verticalScroll
+import androidx.compose.material3.Button
+import androidx.compose.material3.ButtonDefaults
+import androidx.compose.material3.Checkbox
+import androidx.compose.material3.HorizontalDivider
+import androidx.compose.material3.MaterialTheme
+import androidx.compose.material3.OutlinedButton
+import androidx.compose.material3.Surface
+import androidx.compose.material3.Switch
+import androidx.compose.material3.Text
+import androidx.compose.material3.TextButton
+import androidx.compose.runtime.Composable
+import androidx.compose.runtime.LaunchedEffect
+import androidx.compose.runtime.getValue
+import androidx.compose.runtime.mutableStateOf
+import androidx.compose.runtime.remember
+import androidx.compose.runtime.setValue
+import androidx.compose.ui.Alignment
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.draw.clip
+import androidx.compose.ui.platform.LocalConfiguration
+import androidx.compose.ui.res.pluralStringResource
+import androidx.compose.ui.res.stringResource
+import androidx.compose.ui.text.font.FontFamily
+import androidx.compose.ui.text.style.TextAlign
+import androidx.compose.ui.text.style.TextOverflow
+import androidx.compose.ui.unit.dp
+import androidx.compose.ui.window.Dialog
+import androidx.compose.ui.window.DialogProperties
+import androidx.lifecycle.compose.collectAsStateWithLifecycle
+import com.vitorpamplona.amethyst.R
+import com.vitorpamplona.amethyst.commons.connectedApps.signers.SignerOpGrant
+import com.vitorpamplona.amethyst.commons.favorites.FavoriteApp
+import com.vitorpamplona.amethyst.commons.favorites.FavoriteAppIcon
+import com.vitorpamplona.amethyst.commons.icons.symbols.Icon
+import com.vitorpamplona.amethyst.commons.icons.symbols.MaterialSymbols
+import com.vitorpamplona.amethyst.model.LocalCache
+import com.vitorpamplona.amethyst.service.call.CallSessionBridge
+import com.vitorpamplona.amethyst.ui.components.RobohashFallbackAsyncImage
+import com.vitorpamplona.amethyst.ui.navigation.navs.EmptyNav
+import com.vitorpamplona.amethyst.ui.note.NoteCompose
+import com.vitorpamplona.amethyst.ui.theme.AmethystTheme
+import com.vitorpamplona.quartz.nip01Core.core.Event
+import com.vitorpamplona.quartz.nip59Giftwrap.rumors.RumorAssembler
+import com.vitorpamplona.quartz.utils.TimeUtils
+
+class SignerConsentActivity : ComponentActivity() {
+    override fun onCreate(savedInstanceState: Bundle?) {
+        super.onCreate(savedInstanceState)
+        setContent {
+            AmethystTheme {
+                // The signer services requests concurrently, so more than one may await consent. We never
+                // mix accounts in one sheet: render only the requests for the OLDEST-pending account as a
+                // group. When that account's group clears, the next account's requests render (a fresh
+                // per-account sheet). One request → the rich dialog; several → a batched list. When the
+                // whole queue empties, close.
+                val pending by SignerConsentCoordinator.pending.collectAsStateWithLifecycle()
+                val group =
+                    run {
+                        val account = pending.firstOrNull()?.info?.accountPubKey
+                        pending.filter { it.info.accountPubKey == account }
+                    }
+                LaunchedEffect(pending.isEmpty()) { if (pending.isEmpty()) finish() }
+                when {
+                    group.isEmpty() -> Unit
+                    group.size == 1 -> {
+                        val p = group.first()
+                        SignerConsentDialog(
+                            info = p.info,
+                            onGrant = { SignerConsentCoordinator.complete(p.token, it) },
+                            onDismiss = { SignerConsentCoordinator.complete(p.token, SignerOpGrant.DenyOnce) },
+                        )
+                    }
+                    else ->
+                        BatchedConsentDialog(
+                            pending = group,
+                            onResolve = { tokens, grant -> SignerConsentCoordinator.completeAll(tokens, grant) },
+                            // Dismissing denies only THIS account's group; other accounts' requests stay
+                            // pending and render next as their own sheet.
+                            onDismiss = { SignerConsentCoordinator.completeAll(group.map { it.token }, SignerOpGrant.DenyOnce) },
+                        )
+                }
+            }
+        }
+    }
+    // Dismissal is failed-closed at the source: each dialog's onDismissRequest (back / tap-outside)
+    // denies its own request(s). We deliberately do NOT deny-all in onDestroy — a request arriving as
+    // this Activity finishes is owned by a freshly-launched instance, and denying it here would race
+    // that instance and reject a legitimate request. A process kill falls back to the bridge's 120s
+    // timeout, which also fails closed.
+}
+
+@Composable
+private fun SignerConsentDialog(
+    info: SignerConsentInfo,
+    onGrant: (SignerOpGrant) -> Unit,
+    onDismiss: () -> Unit,
+) {
+    var showMoreOptions by remember { mutableStateOf(false) }
+    val scrollState = rememberScrollState()
+    val maxHeight = LocalConfiguration.current.screenHeightDp.dp * 0.85f
+
+    Dialog(
+        onDismissRequest = onDismiss,
+        properties = DialogProperties(usePlatformDefaultWidth = false),
+    ) {
+        Surface(
+            modifier =
+                Modifier
+                    .fillMaxWidth()
+                    .padding(horizontal = 16.dp)
+                    .heightIn(max = maxHeight),
+            shape = MaterialTheme.shapes.extraLarge,
+            color = MaterialTheme.colorScheme.surface,
+            tonalElevation = 6.dp,
+        ) {
+            Column(
+                modifier =
+                    Modifier
+                        .verticalScroll(scrollState)
+                        .padding(vertical = 24.dp),
+            ) {
+                // Centered header: icon + title + description
+                Column(
+                    modifier = Modifier.fillMaxWidth().padding(horizontal = 24.dp),
+                    horizontalAlignment = Alignment.CenterHorizontally,
+                    verticalArrangement = Arrangement.spacedBy(8.dp),
+                ) {
+                    val isBrowser = info.coordinate.startsWith("browser:")
+                    FavoriteAppIcon(
+                        app =
+                            if (isBrowser) {
+                                FavoriteApp.WebApp(info.coordinate.substringAfter(':'), info.appletTitle, 0L, info.iconUrl)
+                            } else {
+                                FavoriteApp.NostrApp(info.coordinate, info.appletTitle, 0L, info.iconUrl)
+                            },
+                        tint = MaterialTheme.colorScheme.onPrimaryContainer,
+                        modifier = Modifier.size(56.dp),
+                    )
+                    Text(
+                        info.appletTitle,
+                        style = MaterialTheme.typography.titleLarge,
+                        textAlign = TextAlign.Center,
+                    )
+                    Text(
+                        stringResource(R.string.napplet_consent_wants_to, info.operationSummary),
+                        style = MaterialTheme.typography.bodyMedium,
+                        color = MaterialTheme.colorScheme.onSurfaceVariant,
+                        textAlign = TextAlign.Center,
+                    )
+                    // Show WHICH account would sign/encrypt/decrypt (avatar + name), not the coordinate hex.
+                    if (info.accountName != null) {
+                        ConnectedAccountRow(info.accountName, info.accountPicture, info.accountPubKey)
+                    }
+                    // For a decrypt request, WHOSE conversation is being read is the decision. Show
+                    // that person as an avatar + name, never as nothing.
+                    if (info.counterpartyName != null) {
+                        Text(
+                            stringResource(R.string.nip46_signer_messages_with),
+                            style = MaterialTheme.typography.labelSmall,
+                            color = MaterialTheme.colorScheme.onSurfaceVariant,
+                        )
+                        ConnectedAccountRow(info.counterpartyName, info.counterpartyPicture, info.counterpartyPubKey)
+                    }
+                }
+
+                Spacer(Modifier.height(12.dp))
+                Box(modifier = Modifier.padding(horizontal = 24.dp)) {
+                    SignerConsentPreview(info)
+                }
+
+                Spacer(Modifier.height(16.dp))
+                HorizontalDivider()
+                Spacer(Modifier.height(8.dp))
+
+                // Primary: the NARROWEST "remember" available. For decrypt that is "always allow for
+                // Alice" — one broad decrypt grant would otherwise hand over every conversation
+                // forever, and scoping the op itself would mean a prompt per conversation.
+                val narrowOp = info.narrowOp
+                if (narrowOp != null && info.narrowOpLabel != null) {
+                    Button(
+                        onClick = { onGrant(SignerOpGrant.AllowForOp(narrowOp)) },
+                        modifier = Modifier.fillMaxWidth().padding(horizontal = 24.dp),
+                    ) {
+                        Text(info.narrowOpLabel)
+                    }
+                    // The broad grant stays available, but demoted below the scoped one.
+                    OutlinedButton(
+                        onClick = { onGrant(SignerOpGrant.AllowForOp(info.op)) },
+                        modifier = Modifier.fillMaxWidth().padding(horizontal = 24.dp),
+                    ) {
+                        Text(stringResource(R.string.napplet_consent_allow_always))
+                    }
+                } else {
+                    Button(
+                        onClick = { onGrant(SignerOpGrant.AllowForOp(info.op)) },
+                        modifier = Modifier.fillMaxWidth().padding(horizontal = 24.dp),
+                    ) {
+                        Text(stringResource(R.string.napplet_consent_allow_always))
+                    }
+                }
+
+                // Secondary: allow just once
+                OutlinedButton(
+                    onClick = { onGrant(SignerOpGrant.AllowOnce) },
+                    modifier = Modifier.fillMaxWidth().padding(horizontal = 24.dp),
+                ) {
+                    Text(stringResource(R.string.napplet_signer_allow_once))
+                }
+
+                // "More options" toggle: session and time-bound grants
+                TextButton(
+                    onClick = { showMoreOptions = !showMoreOptions },
+                    modifier = Modifier.fillMaxWidth(),
+                    contentPadding = PaddingValues(horizontal = 24.dp, vertical = 8.dp),
+                ) {
+                    Row(
+                        verticalAlignment = Alignment.CenterVertically,
+                        horizontalArrangement = Arrangement.spacedBy(4.dp),
+                    ) {
+                        Text(
+                            if (showMoreOptions) {
+                                stringResource(R.string.napplet_consent_fewer_options)
+                            } else {
+                                stringResource(R.string.napplet_consent_more_options)
+                            },
+                            style = MaterialTheme.typography.bodyMedium,
+                        )
+                        Icon(
+                            if (showMoreOptions) MaterialSymbols.ExpandLess else MaterialSymbols.ExpandMore,
+                            contentDescription = null,
+                            modifier = Modifier.size(18.dp),
+                        )
+                    }
+                }
+
+                if (showMoreOptions) {
+                    OutlinedButton(
+                        onClick = { onGrant(SignerOpGrant.AllowForSession(info.op)) },
+                        modifier = Modifier.fillMaxWidth().padding(horizontal = 24.dp),
+                    ) {
+                        Text(stringResource(R.string.napplet_signer_allow_session))
+                    }
+                    OutlinedButton(
+                        onClick = { onGrant(SignerOpGrant.AllowUntil(info.op, TimeUtils.now() + 86_400L)) },
+                        modifier = Modifier.fillMaxWidth().padding(horizontal = 24.dp),
+                    ) {
+                        Text(stringResource(R.string.napplet_signer_allow_24h))
+                    }
+                    OutlinedButton(
+                        onClick = { onGrant(SignerOpGrant.AllowUntil(info.op, TimeUtils.now() + 30L * 86_400L)) },
+                        modifier = Modifier.fillMaxWidth().padding(horizontal = 24.dp),
+                    ) {
+                        Text(stringResource(R.string.napplet_signer_allow_30d))
+                    }
+                    OutlinedButton(
+                        onClick = { onGrant(SignerOpGrant.AllowAll) },
+                        modifier = Modifier.fillMaxWidth().padding(horizontal = 24.dp),
+                    ) {
+                        Text(stringResource(R.string.napplet_signer_allow_all))
+                    }
+                }
+
+                Spacer(Modifier.height(4.dp))
+                HorizontalDivider()
+                Spacer(Modifier.height(8.dp))
+
+                OutlinedButton(
+                    onClick = { onGrant(SignerOpGrant.DenyOnce) },
+                    modifier = Modifier.fillMaxWidth().padding(horizontal = 24.dp),
+                    colors = ButtonDefaults.outlinedButtonColors(contentColor = MaterialTheme.colorScheme.error),
+                ) {
+                    Text(stringResource(R.string.napplet_signer_deny_once))
+                }
+                OutlinedButton(
+                    onClick = { onGrant(SignerOpGrant.DenyForOp(info.op)) },
+                    modifier = Modifier.fillMaxWidth().padding(horizontal = 24.dp),
+                    colors = ButtonDefaults.outlinedButtonColors(contentColor = MaterialTheme.colorScheme.error),
+                ) {
+                    Text(stringResource(R.string.napplet_signer_deny_op, info.operationSummary))
+                }
+            }
+        }
+    }
+}
+
+/**
+ * The "what you're acting on" block: the unsigned event rendered as a real NoteCompose (what it will
+ * look like once signed) with a JSON toggle for sign/publish, or the raw content / decrypted plaintext
+ * for encrypt/decrypt. Shared by the single-request dialog and each expanded batch row so a user can
+ * always inspect exactly what they are signing/encrypting/decrypting. Best-effort: if the main Activity
+ * is gone (only the foreground signer service alive) the NoteCompose is skipped and the JSON stands in.
+ */
+@Composable
+private fun SignerConsentPreview(info: SignerConsentInfo) {
+    var showRawData by remember(info) { mutableStateOf(false) }
+    val accountViewModel = remember { CallSessionBridge.accountViewModel }
+    val previewNav = remember { EmptyNav() }
+    val previewNote =
+        remember(info, accountViewModel) {
+            val template = info.previewTemplate
+            val author = info.accountPubKey ?: accountViewModel?.account?.signer?.pubKey
+            if (template != null && author != null && accountViewModel != null) {
+                runCatching {
+                    val unsigned = RumorAssembler.assembleRumor<Event>(author, template)
+                    accountViewModel.createTempDraftNote(unsigned, LocalCache.getOrCreateUser(author))
+                }.getOrNull()
+            } else {
+                null
+            }
+        }
+
+    val hasContent = previewNote != null || info.contentPreview.isNotBlank() || info.rawData.isNotBlank()
+    if (!hasContent) return
+    Surface(
+        modifier = Modifier.fillMaxWidth(),
+        color = MaterialTheme.colorScheme.surfaceVariant,
+        shape = MaterialTheme.shapes.medium,
+    ) {
+        Column(modifier = Modifier.padding(12.dp)) {
+            if (previewNote != null && accountViewModel != null) {
+                NoteCompose(
+                    baseNote = previewNote,
+                    isQuotedNote = true,
+                    quotesLeft = 0,
+                    accountViewModel = accountViewModel,
+                    nav = previewNav,
+                )
+            } else if (info.contentPreview.isNotBlank()) {
+                Text("“${info.contentPreview}”", style = MaterialTheme.typography.bodySmall)
+            }
+            if (info.rawData.isNotBlank()) {
+                if (showRawData) {
+                    Spacer(Modifier.height(8.dp))
+                    Box(modifier = Modifier.horizontalScroll(rememberScrollState())) {
+                        SelectionContainer {
+                            Text(
+                                info.rawData,
+                                style = MaterialTheme.typography.labelSmall.copy(fontFamily = FontFamily.Monospace),
+                                color = MaterialTheme.colorScheme.onSurfaceVariant,
+                                softWrap = false,
+                            )
+                        }
+                    }
+                }
+                TextButton(
+                    onClick = { showRawData = !showRawData },
+                    contentPadding = PaddingValues(horizontal = 4.dp, vertical = 0.dp),
+                ) {
+                    Text(
+                        if (showRawData) {
+                            stringResource(R.string.napplet_consent_hide_event)
+                        } else {
+                            stringResource(R.string.napplet_consent_show_event)
+                        },
+                        style = MaterialTheme.typography.labelSmall,
+                    )
+                }
+            }
+        }
+    }
+}
+
+/**
+ * Shown when more than one request is awaiting consent at once (the signer services requests
+ * concurrently). Lists each with a checkbox — all selected by default — and resolves the selected
+ * ones together as Allow or Deny. "Remember" makes an Allow persist per-op ([SignerOpGrant.AllowForOp]);
+ * off is a one-time [SignerOpGrant.AllowOnce]. Requests left unselected stay pending and re-render
+ * (as this list, or the single-request dialog once one remains).
+ */
+@Composable
+private fun BatchedConsentDialog(
+    pending: List<PendingConsent>,
+    onResolve: (tokens: List<String>, grant: SignerOpGrant) -> Unit,
+    onDismiss: () -> Unit,
+) {
+    val maxHeight = LocalConfiguration.current.screenHeightDp.dp * 0.85f
+    val tokens = pending.map { it.token }.toSet()
+    // Seed all-selected ONCE for the initial batch the user opened. The signer services requests
+    // concurrently, so `tokens` can change under an open sheet; reconcile incrementally instead of
+    // re-seeding — drop resolved tokens but KEEP the user's deselections, and never auto-select a
+    // newly-arrived request. Otherwise a request landing (or resolving) mid-decision would silently
+    // re-check everything, and an "Allow selected" tap would grant ops the user deselected or never saw.
+    var selected by remember { mutableStateOf(tokens) }
+    LaunchedEffect(tokens) { selected = selected intersect tokens }
+    var rememberChoice by remember { mutableStateOf(false) }
+    // Tokens whose full preview (rendered event + JSON, or encrypt/decrypt plaintext) is expanded.
+    var expanded by remember { mutableStateOf(emptySet<String>()) }
+
+    Dialog(
+        onDismissRequest = onDismiss,
+        properties = DialogProperties(usePlatformDefaultWidth = false),
+    ) {
+        Surface(
+            modifier =
+                Modifier
+                    .fillMaxWidth()
+                    .padding(horizontal = 16.dp)
+                    .heightIn(max = maxHeight),
+            shape = MaterialTheme.shapes.extraLarge,
+            color = MaterialTheme.colorScheme.surface,
+            tonalElevation = 6.dp,
+        ) {
+            Column(modifier = Modifier.padding(vertical = 20.dp)) {
+                // The sheet is single-account (grouped upstream), so the account is a header, not a
+                // per-row label. It says WHO every request in this sheet would act as.
+                val account = pending.first().info
+                Row(
+                    modifier = Modifier.fillMaxWidth().padding(horizontal = 24.dp),
+                    verticalAlignment = Alignment.CenterVertically,
+                    horizontalArrangement = Arrangement.spacedBy(10.dp),
+                ) {
+                    account.accountName?.let { name ->
+                        RobohashFallbackAsyncImage(
+                            robot = account.accountPubKey ?: name,
+                            model = account.accountPicture,
+                            contentDescription = null,
+                            modifier = Modifier.size(34.dp).clip(CircleShape),
+                            loadProfilePicture = true,
+                            loadRobohash = true,
+                        )
+                    }
+                    Column(modifier = Modifier.weight(1f)) {
+                        Text(
+                            pluralStringResource(R.plurals.nip46_signer_batch_title, pending.size, pending.size),
+                            style = MaterialTheme.typography.titleLarge,
+                        )
+                        account.accountName?.let { name ->
+                            Text(
+                                stringResource(R.string.nip46_signer_batch_signing_as, name),
+                                style = MaterialTheme.typography.labelMedium,
+                                color = MaterialTheme.colorScheme.onSurfaceVariant,
+                                maxLines = 1,
+                                overflow = TextOverflow.Ellipsis,
+                            )
+                        }
+                    }
+                }
+                TextButton(
+                    onClick = {
+                        selected = if (selected.size == pending.size) emptySet() else pending.map { it.token }.toSet()
+                    },
+                    contentPadding = PaddingValues(horizontal = 20.dp, vertical = 2.dp),
+                ) {
+                    Text(
+                        stringResource(
+                            if (selected.size == pending.size) R.string.nip46_signer_batch_select_none else R.string.nip46_signer_batch_select_all,
+                        ),
+                        style = MaterialTheme.typography.labelLarge,
+                    )
+                }
+
+                Column(
+                    modifier =
+                        Modifier
+                            .weight(1f, fill = false)
+                            .verticalScroll(rememberScrollState()),
+                ) {
+                    pending.forEach { p ->
+                        val isExpanded = p.token in expanded
+                        Column(modifier = Modifier.fillMaxWidth()) {
+                            Row(
+                                modifier =
+                                    Modifier
+                                        .fillMaxWidth()
+                                        .clickable {
+                                            expanded = if (isExpanded) expanded - p.token else expanded + p.token
+                                        }.padding(horizontal = 12.dp, vertical = 4.dp),
+                                verticalAlignment = Alignment.CenterVertically,
+                                horizontalArrangement = Arrangement.spacedBy(4.dp),
+                            ) {
+                                // Checkbox handles its own tap (select); tapping elsewhere on the row expands.
+                                Checkbox(
+                                    checked = p.token in selected,
+                                    onCheckedChange = { on -> selected = if (on) selected + p.token else selected - p.token },
+                                )
+                                Column(modifier = Modifier.weight(1f)) {
+                                    Text(
+                                        "${p.info.appletTitle} · ${p.info.operationSummary}",
+                                        style = MaterialTheme.typography.bodyMedium,
+                                        maxLines = 1,
+                                    )
+                                    if (p.info.contentPreview.isNotBlank()) {
+                                        Text(
+                                            p.info.contentPreview,
+                                            style = MaterialTheme.typography.bodySmall,
+                                            color = MaterialTheme.colorScheme.onSurfaceVariant,
+                                            maxLines = 1,
+                                        )
+                                    }
+                                }
+                                Icon(
+                                    if (isExpanded) MaterialSymbols.ExpandLess else MaterialSymbols.ExpandMore,
+                                    contentDescription = null,
+                                    tint = MaterialTheme.colorScheme.onSurfaceVariant,
+                                    modifier = Modifier.size(20.dp),
+                                )
+                            }
+                            if (isExpanded) {
+                                Box(modifier = Modifier.padding(start = 12.dp, end = 12.dp, bottom = 8.dp)) {
+                                    SignerConsentPreview(p.info)
+                                }
+                            }
+                        }
+                    }
+                }
+
+                Row(
+                    modifier = Modifier.fillMaxWidth().padding(horizontal = 24.dp, vertical = 4.dp),
+                    verticalAlignment = Alignment.CenterVertically,
+                    horizontalArrangement = Arrangement.spacedBy(8.dp),
+                ) {
+                    Switch(checked = rememberChoice, onCheckedChange = { rememberChoice = it })
+                    Text(
+                        stringResource(R.string.nip46_signer_batch_remember),
+                        style = MaterialTheme.typography.bodyMedium,
+                    )
+                }
+
+                Spacer(Modifier.height(8.dp))
+                HorizontalDivider()
+                Spacer(Modifier.height(8.dp))
+
+                Button(
+                    onClick = {
+                        val tokens = pending.filter { it.token in selected }
+                        // Per-op remember uses each request's own op; one-time is a single AllowOnce.
+                        if (rememberChoice) {
+                            tokens.forEach { onResolve(listOf(it.token), SignerOpGrant.AllowForOp(it.info.op)) }
+                        } else {
+                            onResolve(tokens.map { it.token }, SignerOpGrant.AllowOnce)
+                        }
+                    },
+                    enabled = selected.isNotEmpty(),
+                    modifier = Modifier.fillMaxWidth().padding(horizontal = 24.dp),
+                ) {
+                    Text(stringResource(R.string.nip46_signer_batch_allow, selected.size))
+                }
+                OutlinedButton(
+                    onClick = { onResolve(pending.filter { it.token in selected }.map { it.token }, SignerOpGrant.DenyOnce) },
+                    enabled = selected.isNotEmpty(),
+                    modifier = Modifier.fillMaxWidth().padding(horizontal = 24.dp),
+                    colors = ButtonDefaults.outlinedButtonColors(contentColor = MaterialTheme.colorScheme.error),
+                ) {
+                    Text(stringResource(R.string.nip46_signer_batch_deny, selected.size))
+                }
+            }
+        }
+    }
+}

amethyst/src/main/java/com/vitorpamplona/amethyst/connectedApps/consent/SignerConsentCoordinator.kt

@@ -0,0 +1,175 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.connectedApps.consent
+
+import android.content.Context
+import android.content.Intent
+import com.vitorpamplona.amethyst.R
+import com.vitorpamplona.amethyst.commons.connectedApps.signers.NostrSignerOp
+import com.vitorpamplona.amethyst.commons.connectedApps.signers.SignerOpGrant
+import com.vitorpamplona.quartz.nip01Core.core.Event
+import com.vitorpamplona.quartz.nip01Core.signers.EventTemplate
+import kotlinx.coroutines.CompletableDeferred
+import kotlinx.coroutines.flow.MutableStateFlow
+import kotlinx.coroutines.flow.StateFlow
+import kotlinx.coroutines.flow.update
+import kotlinx.coroutines.flow.updateAndGet
+import kotlinx.coroutines.sync.Mutex
+import kotlinx.coroutines.sync.withLock
+import java.util.UUID
+import java.util.concurrent.ConcurrentHashMap
+
+/** Everything the per-operation consent dialog needs to render. */
+data class SignerConsentInfo(
+    val appletTitle: String,
+    val coordinate: String,
+    val op: NostrSignerOp,
+    val operationSummary: String,
+    /** Short excerpt shown in the dialog body (≤ 160 chars). */
+    val contentPreview: String,
+    /**
+     * Full raw content for the "See more" toggle — event JSON for sign/encrypt operations,
+     * decrypted plaintext for decrypt (Amethyst decrypts first, then asks permission to expose).
+     */
+    val rawData: String = "",
+    val iconUrl: String? = null,
+    /**
+     * The account that would sign/encrypt/decrypt, shown as an avatar + name so it's clear which
+     * logged-in identity is acting. Null on paths that don't resolve it; [accountPubKey] seeds the
+     * robohash avatar fallback when there's no picture.
+     */
+    val accountName: String? = null,
+    val accountPicture: String? = null,
+    val accountPubKey: String? = null,
+    /**
+     * The unsigned event a `sign_event`/publish request would sign, so the dialog can render it as a
+     * note preview (what it will look like) in addition to the raw JSON. Null for encrypt/decrypt and
+     * non-event ops.
+     */
+    val previewTemplate: EventTemplate<Event>? = null,
+    /**
+     * The OTHER party of a decrypt request — whose conversation the app is asking to read — shown as
+     * an avatar + name. "X wants to read your messages with Alice" is a categorically different
+     * decision from "X wants to read your private messages", so this must reach the dialog.
+     * Null for every op that has no counterparty (signing, and the napplet/browser paths).
+     */
+    val counterpartyName: String? = null,
+    val counterpartyPicture: String? = null,
+    val counterpartyPubKey: String? = null,
+    /**
+     * A NARROWER op the dialog may offer to remember instead of [op] — today only
+     * [com.vitorpamplona.amethyst.commons.connectedApps.signers.NostrSignerOp.DecryptFrom], i.e.
+     * "always allow, but only for this counterparty". Offered ALONGSIDE the broad "Always allow" so
+     * the user gets granularity without a prompt per conversation. [narrowOpLabel] is its button text.
+     */
+    val narrowOp: NostrSignerOp? = null,
+    val narrowOpLabel: String? = null,
+)
+
+/** One pending per-operation consent request, as the batched sheet renders it. */
+data class PendingConsent(
+    val token: String,
+    val info: SignerConsentInfo,
+)
+
+/**
+ * Bridges the broker to the per-operation signer consent UI. The signer services requests
+ * concurrently (so their prompts can batch), so several requests can await consent at once: they all
+ * land in [pending], one [SignerConsentActivity] observes that list and shows a single-request dialog
+ * or a batched list, and each resolved token completes its own deferred. A dismissed/ignored request
+ * resolves to [SignerOpGrant.DenyOnce] — fails closed.
+ */
+object SignerConsentCoordinator {
+    private val deferreds = ConcurrentHashMap<String, CompletableDeferred<SignerOpGrant>>()
+    private val _pending = MutableStateFlow<List<PendingConsent>>(emptyList())
+
+    /** The live set of requests awaiting the user's decision; the Activity renders this. */
+    val pending: StateFlow<List<PendingConsent>> = _pending
+
+    // A stable notification id (one prompt notification for the whole batch, updated as requests
+    // arrive) so concurrent requests don't each post their own.
+    private val batchNotificationId = "nip46-signer-consent".hashCode()
+
+    // Guards the surface (post/cancel of the one shared notification) against the pending set so a
+    // concurrent arrival's post can't be clobbered by another request's teardown cancel. Without it,
+    // request A could read "pending now empty" and then cancel AFTER request B posted a fresh
+    // notification under the same id, leaving B with no UI while backgrounded (silent deny at timeout).
+    private val surfaceLock = Mutex()
+
+    suspend fun requestConsent(
+        context: Context,
+        info: SignerConsentInfo,
+    ): SignerOpGrant {
+        val token = UUID.randomUUID().toString()
+        val deferred = CompletableDeferred<SignerOpGrant>()
+        deferreds[token] = deferred
+
+        surfaceLock.withLock {
+            _pending.update { it + PendingConsent(token, info) }
+            // Fast path when Amethyst already owns the foreground: open the dialog directly. When the app
+            // is backgrounded this is silently dropped by Android 12+ BAL, so the full-screen-intent
+            // notification is what surfaces the prompt. Both are idempotent — the Activity is singleTop and
+            // observes [pending], and the notification uses a stable id, so concurrent requests just
+            // refresh the one prompt. Wrapped because a BAL-blocked launch can throw rather than no-op.
+            runCatching {
+                context.startActivity(
+                    Intent(context, SignerConsentActivity::class.java)
+                        .addFlags(Intent.FLAG_ACTIVITY_NEW_TASK or Intent.FLAG_ACTIVITY_SINGLE_TOP),
+                )
+            }
+            SignerConsentNotifier.show(
+                context = context,
+                activityClass = SignerConsentActivity::class.java,
+                extraKey = EXTRA_TOKEN,
+                token = "nip46-signer-consent",
+                titleRes = R.string.nip46_signer_notif_sign_title,
+            )
+        }
+
+        return try {
+            deferred.await()
+        } finally {
+            deferreds.remove(token)
+            surfaceLock.withLock {
+                // Remove + emptiness check + cancel are one critical section vs. another request's
+                // add + show, so a fresh notification is never cancelled out from under a live request.
+                val stillPending = _pending.updateAndGet { list -> list.filterNot { it.token == token } }
+                if (stillPending.isEmpty()) SignerConsentNotifier.cancel(context, batchNotificationId)
+            }
+        }
+    }
+
+    fun complete(
+        token: String,
+        grant: SignerOpGrant,
+    ) {
+        deferreds[token]?.complete(grant)
+    }
+
+    fun completeAll(
+        tokens: Collection<String>,
+        grant: SignerOpGrant,
+    ) {
+        tokens.forEach { complete(it, grant) }
+    }
+
+    const val EXTRA_TOKEN = "napplet_signer_consent_token"
+}

amethyst/src/main/java/com/vitorpamplona/amethyst/connectedApps/consent/SignerConsentNotifier.kt

@@ -0,0 +1,141 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.connectedApps.consent
+
+import android.app.NotificationChannel
+import android.app.NotificationManager
+import android.app.PendingIntent
+import android.content.Context
+import android.content.Intent
+import androidx.core.app.NotificationCompat
+import com.vitorpamplona.amethyst.Amethyst
+import com.vitorpamplona.amethyst.R
+import com.vitorpamplona.amethyst.ui.stringRes
+
+/**
+ * Surfaces a signer consent/connect [android.app.Activity] from the **background**.
+ *
+ * A bare `context.startActivity(...)` from the application context only opens a window while
+ * Amethyst already owns the foreground. When a signing request arrives over a relay while the app
+ * is backgrounded, Android 12+ background-activity-launch (BAL) restrictions silently drop that
+ * `startActivity`, so the dialog would never appear and the request would sit until it times out.
+ *
+ * A full-screen-intent notification on an `IMPORTANCE_HIGH` channel (with the
+ * `USE_FULL_SCREEN_INTENT` permission the manifest declares) is the documented BAL exception — the
+ * same mechanism [com.vitorpamplona.amethyst.service.call.notification.CallNotifier] uses for
+ * incoming calls. On a locked/idle screen it launches the Activity immediately; while the user is
+ * actively on another app it shows as a heads-up banner they tap to review.
+ *
+ * Each coordinator posts one notification keyed by the request token's hash so concurrent requests
+ * don't clobber each other, and cancels it once the deferred resolves (approved, denied, or timed
+ * out) so no stale prompt lingers.
+ */
+object SignerConsentNotifier {
+    private const val CHANNEL_ID = "com.vitorpamplona.amethyst.SIGNER_CONSENT_CHANNEL"
+
+    private fun ensureChannel(context: Context): NotificationChannel {
+        val manager = context.getSystemService(Context.NOTIFICATION_SERVICE) as NotificationManager
+        manager.getNotificationChannel(CHANNEL_ID)?.let { return it }
+
+        val channel =
+            NotificationChannel(
+                CHANNEL_ID,
+                stringRes(context, R.string.nip46_signer_notif_channel_name),
+                NotificationManager.IMPORTANCE_HIGH,
+            ).apply {
+                description = stringRes(context, R.string.nip46_signer_notif_channel_desc)
+            }
+        manager.createNotificationChannel(channel)
+        return channel
+    }
+
+    /**
+     * Posts a full-screen-intent notification whose content/full-screen [PendingIntent] opens
+     * [activityClass] carrying [token]. Returns the notification id to pass to [cancel] once the
+     * request resolves.
+     */
+    fun show(
+        context: Context,
+        activityClass: Class<*>,
+        extraKey: String,
+        token: String,
+        titleRes: Int,
+    ): Int {
+        // When Amethyst already owns the foreground the direct startActivity opens the dialog, so a
+        // heads-up notification would just be redundant noise on top of it. Only fall back to the
+        // full-screen intent when we're backgrounded — the case where startActivity is BAL-blocked.
+        if (appInForeground()) return NO_NOTIFICATION
+
+        val channel = ensureChannel(context)
+        val notificationId = token.hashCode()
+
+        val intent =
+            Intent(context, activityClass)
+                .addFlags(Intent.FLAG_ACTIVITY_NEW_TASK or Intent.FLAG_ACTIVITY_SINGLE_TOP)
+                .putExtra(extraKey, token)
+
+        val pendingIntent =
+            PendingIntent.getActivity(
+                context,
+                notificationId,
+                intent,
+                PendingIntent.FLAG_IMMUTABLE or PendingIntent.FLAG_UPDATE_CURRENT,
+            )
+
+        val notification =
+            NotificationCompat
+                .Builder(context, channel.id)
+                .setSmallIcon(R.drawable.amethyst)
+                .setContentTitle(stringRes(context, titleRes))
+                .setContentText(stringRes(context, R.string.nip46_signer_notif_tap))
+                .setContentIntent(pendingIntent)
+                .setFullScreenIntent(pendingIntent, true)
+                .setPriority(NotificationCompat.PRIORITY_HIGH)
+                .setCategory(NotificationCompat.CATEGORY_RECOMMENDATION)
+                .setAutoCancel(true)
+                .setOngoing(true)
+                .setTimeoutAfter(TIMEOUT_MS)
+                .setVisibility(NotificationCompat.VISIBILITY_PUBLIC)
+                .build()
+
+        val manager = context.getSystemService(Context.NOTIFICATION_SERVICE) as NotificationManager
+        manager.notify(notificationId, notification)
+        return notificationId
+    }
+
+    fun cancel(
+        context: Context,
+        notificationId: Int,
+    ) {
+        if (notificationId == NO_NOTIFICATION) return
+        val manager = context.getSystemService(Context.NOTIFICATION_SERVICE) as NotificationManager
+        manager.cancel(notificationId)
+    }
+
+    private fun appInForeground(): Boolean =
+        // Defensive: the signer consent path only runs in the main process (where Amethyst.instance
+        // is set), but touching it from the keyless :napplet process would throw. Treat any failure
+        // as "not foreground" so the notification fallback still fires.
+        runCatching { Amethyst.instance.foregroundTracker.isForeground.value }.getOrDefault(false)
+
+    private const val NO_NOTIFICATION = Int.MIN_VALUE
+    private const val TIMEOUT_MS = 120_000L
+}

amethyst/src/main/java/com/vitorpamplona/amethyst/connectedApps/nip46/DataStoreNip46ClientStore.kt

@@ -0,0 +1,128 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.connectedApps.nip46
+
+import android.content.Context
+import androidx.datastore.core.DataStore
+import androidx.datastore.preferences.core.PreferenceDataStoreFactory
+import androidx.datastore.preferences.core.Preferences
+import androidx.datastore.preferences.core.edit
+import androidx.datastore.preferences.core.stringPreferencesKey
+import com.vitorpamplona.amethyst.commons.connectedApps.nip46.Nip46ClientInfo
+import com.vitorpamplona.amethyst.commons.connectedApps.nip46.Nip46ClientStore
+import kotlinx.coroutines.flow.first
+import java.io.File
+import java.security.MessageDigest
+import java.util.concurrent.ConcurrentHashMap
+
+/**
+ * Single-file DataStore-backed [Nip46ClientStore]. Every connected client's
+ * display + relay info lives in one `datastore/nip46_clients.preferences_pb`
+ * file; a SHA-256 prefix of the coordinate is the key so the (already public)
+ * coordinate is kept alongside for [all]'s reverse lookup. Fields are stored
+ * individually so no serialization library is needed; [relays] is newline-joined.
+ */
+class DataStoreNip46ClientStore(
+    private val filesDir: File,
+) : Nip46ClientStore {
+    constructor(context: Context) : this(context.applicationContext.filesDir)
+
+    private val store: DataStore<Preferences> get() = dataStoreFor(File(filesDir, "datastore/nip46_clients.preferences_pb"))
+
+    override suspend fun load(coordinate: String): Nip46ClientInfo? {
+        val prefs = store.data.first()
+        if (prefs[coordKey(coordinate)] == null) return null
+        return Nip46ClientInfo(
+            name = prefs[nameKey(coordinate)],
+            url = prefs[urlKey(coordinate)],
+            image = prefs[imageKey(coordinate)],
+            relays = prefs[relaysKey(coordinate)].toRelaySet(),
+        )
+    }
+
+    override suspend fun store(
+        coordinate: String,
+        info: Nip46ClientInfo,
+    ) {
+        store.edit { prefs ->
+            prefs[coordKey(coordinate)] = coordinate
+            info.name?.let { prefs[nameKey(coordinate)] = it } ?: prefs.remove(nameKey(coordinate))
+            info.url?.let { prefs[urlKey(coordinate)] = it } ?: prefs.remove(urlKey(coordinate))
+            info.image?.let { prefs[imageKey(coordinate)] = it } ?: prefs.remove(imageKey(coordinate))
+            if (info.relays.isNotEmpty()) prefs[relaysKey(coordinate)] = info.relays.joinToString("\n") else prefs.remove(relaysKey(coordinate))
+        }
+    }
+
+    override suspend fun remove(coordinate: String) {
+        store.edit { prefs ->
+            prefs.remove(coordKey(coordinate))
+            prefs.remove(nameKey(coordinate))
+            prefs.remove(urlKey(coordinate))
+            prefs.remove(imageKey(coordinate))
+            prefs.remove(relaysKey(coordinate))
+        }
+    }
+
+    override suspend fun all(): Map<String, Nip46ClientInfo> {
+        val prefs = store.data.first()
+        val result = mutableMapOf<String, Nip46ClientInfo>()
+        for ((key, value) in prefs.asMap()) {
+            if (!key.name.startsWith(COORD_PREFIX)) continue
+            val coordinate = value as? String ?: continue
+            result[coordinate] =
+                Nip46ClientInfo(
+                    name = prefs[nameKey(coordinate)],
+                    url = prefs[urlKey(coordinate)],
+                    image = prefs[imageKey(coordinate)],
+                    relays = prefs[relaysKey(coordinate)].toRelaySet(),
+                )
+        }
+        return result
+    }
+
+    private fun String?.toRelaySet(): Set<String> = this?.split("\n")?.filterTo(mutableSetOf()) { it.isNotEmpty() } ?: emptySet()
+
+    private fun coordKey(coordinate: String) = stringPreferencesKey("$COORD_PREFIX${hash(coordinate)}")
+
+    private fun nameKey(coordinate: String) = stringPreferencesKey("name:${hash(coordinate)}")
+
+    private fun urlKey(coordinate: String) = stringPreferencesKey("url:${hash(coordinate)}")
+
+    private fun imageKey(coordinate: String) = stringPreferencesKey("img:${hash(coordinate)}")
+
+    private fun relaysKey(coordinate: String) = stringPreferencesKey("relays:${hash(coordinate)}")
+
+    companion object {
+        private val stores = ConcurrentHashMap<String, DataStore<Preferences>>()
+
+        private fun dataStoreFor(file: File): DataStore<Preferences> =
+            stores.computeIfAbsent(file.absolutePath) {
+                PreferenceDataStoreFactory.create(produceFile = { file })
+            }
+
+        private const val COORD_PREFIX = "coord:"
+
+        private fun hash(coordinate: String): String {
+            val digest = MessageDigest.getInstance("SHA-256").digest(coordinate.toByteArray())
+            return digest.take(8).joinToString("") { "%02x".format(it) }
+        }
+    }
+}

amethyst/src/main/java/com/vitorpamplona/amethyst/favorites/BrowserIconRegistry.kt

@@ -22,10 +22,14 @@ package com.vitorpamplona.amethyst.favorites
 
 import android.content.Context
 import android.util.Log
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.SupervisorJob
 import kotlinx.coroutines.flow.MutableStateFlow
 import kotlinx.coroutines.flow.StateFlow
 import kotlinx.coroutines.flow.asStateFlow
 import kotlinx.coroutines.flow.update
+import kotlinx.coroutines.launch
 import java.io.File
 
 /**
@@ -50,12 +54,28 @@ object BrowserIconRegistry {
 
     @Volatile private var iconDir: File? = null
 
-    /** Binds the app context and indexes already-stored icons. Idempotent. */
+    // Disk work runs here, never on the caller's thread. Both entry points are reached from threads
+    // that must not block: init() from app startup and record() from the broker's IPC handler, which
+    // is the main looper — StrictMode flagged the write, and a slow filesystem would have stalled the
+    // UI while a favicon was saved.
+    private val io = CoroutineScope(SupervisorJob() + Dispatchers.IO)
+
+    /**
+     * Binds the app context and indexes already-stored icons. Idempotent.
+     *
+     * [iconDir] is published synchronously so [iconModelFor] and [record] work immediately; only the
+     * directory scan is deferred. Until it lands [keys] is empty, so an icon simply renders its
+     * placeholder for one frame and then recomposes — [keys] is a StateFlow precisely so that arrival
+     * drives recomposition.
+     */
     fun init(context: Context) {
         if (iconDir != null) return
-        val dir = File(context.applicationContext.filesDir, DIR).apply { mkdirs() }
+        val dir = File(context.applicationContext.filesDir, DIR)
         iconDir = dir
-        _keys.value = dir.listFiles()?.mapNotNull { it.name.removeSuffix(PNG).takeIf { n -> n.isNotBlank() } }?.toSet() ?: emptySet()
+        io.launch {
+            dir.mkdirs()
+            _keys.value = dir.listFiles()?.mapNotNull { it.name.removeSuffix(PNG).takeIf { n -> n.isNotBlank() } }?.toSet() ?: emptySet()
+        }
     }
 
     /** Persists [bytes] as the favicon for [host] and marks it available. Called from the broker on IPC. */
@@ -66,11 +86,17 @@ object BrowserIconRegistry {
         val dir = iconDir ?: return
         if (host.isBlank() || bytes.isEmpty()) return
         val key = sanitize(host)
-        try {
-            File(dir, key + PNG).writeBytes(bytes)
-            _keys.update { it + key }
-        } catch (e: Exception) {
-            Log.w("BrowserIconRegistry", "Failed to store favicon for $host", e)
+        // Fire-and-forget: a favicon is a decoration, and the IPC handler must not wait on disk.
+        // [keys] updates only after the bytes are actually on disk, so a reader can never be told an
+        // icon exists before the file backing it does.
+        io.launch {
+            try {
+                dir.mkdirs()
+                File(dir, key + PNG).writeBytes(bytes)
+                _keys.update { it + key }
+            } catch (e: Exception) {
+                Log.w("BrowserIconRegistry", "Failed to store favicon for $host", e)
+            }
         }
     }
 

amethyst/src/main/java/com/vitorpamplona/amethyst/favorites/FavoriteAppLauncher.kt

@@ -32,6 +32,7 @@ import com.vitorpamplona.amethyst.commons.favorites.FavoriteApp
 import com.vitorpamplona.amethyst.model.LocalCache
 import com.vitorpamplona.amethyst.model.ThemeType
 import com.vitorpamplona.amethyst.napplet.NappletLauncher
+import com.vitorpamplona.amethyst.napplet.NappletWebViewProfiles
 import com.vitorpamplona.amethyst.napplet.WebAppNetworkRegistry
 import com.vitorpamplona.amethyst.napplethost.HostProfile
 import com.vitorpamplona.amethyst.napplethost.NappletBrowserActivity
@@ -92,9 +93,20 @@ object FavoriteAppLauncher {
             }
         val isFavorite = FavoriteAppsRegistry.isFavorite("url:$url")
         val intent =
-            NappletBrowserActivity.intent(context, url, proxyPort, useTor, theme = theme, isFavorite = isFavorite).apply {
-                if (context !is Activity) addFlags(android.content.Intent.FLAG_ACTIVITY_NEW_TASK)
-            }
+            NappletBrowserActivity
+                .intent(
+                    context,
+                    url,
+                    proxyPort,
+                    useTor,
+                    theme = theme,
+                    isFavorite = isFavorite,
+                    // Opaque per-account storage partition, so a web app can't carry one npub's session
+                    // into another. Derived here (the sandbox never sees the pubkey).
+                    webViewProfile = NappletWebViewProfiles.current(),
+                ).apply {
+                    if (context !is Activity) addFlags(android.content.Intent.FLAG_ACTIVITY_NEW_TASK)
+                }
         context.startActivity(intent)
     }
 

amethyst/src/main/java/com/vitorpamplona/amethyst/model/AccountSettings.kt

@@ -22,7 +22,10 @@ package com.vitorpamplona.amethyst.model
 
 import androidx.compose.runtime.Stable
 import com.vitorpamplona.amethyst.commons.audio.VisualizerStyle
+import com.vitorpamplona.amethyst.commons.model.chats.ChatFeedType
 import com.vitorpamplona.amethyst.commons.model.clink.ClinkDebitWalletEntryNorm
+import com.vitorpamplona.amethyst.commons.model.concord.ConcordListRepository
+import com.vitorpamplona.amethyst.commons.model.concord.ConcordViewMode
 import com.vitorpamplona.amethyst.commons.model.emphChat.EphemeralChatRepository
 import com.vitorpamplona.amethyst.commons.model.nip28PublicChats.PublicChatListRepository
 import com.vitorpamplona.amethyst.commons.model.nip29RelayGroups.RelayGroupRepository
@@ -36,6 +39,7 @@ import com.vitorpamplona.amethyst.model.nip60Cashu.CashuPreferences
 import com.vitorpamplona.amethyst.ui.actions.mediaServers.DEFAULT_MEDIA_SERVERS
 import com.vitorpamplona.amethyst.ui.actions.mediaServers.ServerName
 import com.vitorpamplona.amethyst.ui.screen.FeedDefinition
+import com.vitorpamplona.quartz.concord.cord02Community.ConcordCommunityListEvent
 import com.vitorpamplona.quartz.experimental.ephemChat.list.EphemeralChatListEvent
 import com.vitorpamplona.quartz.experimental.nipA3.PaymentTargetsEvent
 import com.vitorpamplona.quartz.marmot.mip00KeyPackages.KeyPackageRelayListEvent
@@ -123,6 +127,14 @@ sealed class TopFilter(
     @Serializable
     object AroundMe : TopFilter(" Around Me ")
 
+    /**
+     * Not a real selection: a sentinel for the "Teleport" chip in the top-nav filter.
+     * The spinner intercepts it to open the map picker and then applies the chosen
+     * [Geohash] instead — it is never persisted or dispatched to a feed flow.
+     */
+    @Serializable
+    object TeleportPicker : TopFilter(" Teleport ")
+
     @Serializable
     object Mine : TopFilter(" Mine ")
 
@@ -182,6 +194,45 @@ class AccountSettings(
     var stripLocationOnUpload: Boolean = true,
     val useLocalBlossomCache: MutableStateFlow<Boolean> = MutableStateFlow(true),
     val localBlossomCacheProfilePicturesOnly: MutableStateFlow<Boolean> = MutableStateFlow(false),
+    /**
+     * BUD-04: after uploading a blob to the primary Blossom server, replicate it to
+     * the user's other configured servers (kind 10063) for redundancy.
+     */
+    val mirrorUploadsToAllServers: MutableStateFlow<Boolean> = MutableStateFlow(true),
+    /**
+     * BUD-05: upload media through the server's `/media` endpoint so the server may
+     * strip metadata and optimize it, instead of the bit-exact `/upload`.
+     */
+    val optimizeMediaOnUpload: MutableStateFlow<Boolean> = MutableStateFlow(false),
+    /**
+     * NIP-46: when true, this account acts as a remote signer (a "bunker") for
+     * other apps, listening on the user's inbox relays for kind:24133 requests.
+     * See [com.vitorpamplona.amethyst.model.nip46Signer.Nip46SignerState].
+     */
+    val nip46SignerEnabled: MutableStateFlow<Boolean> = MutableStateFlow(false),
+    /**
+     * The active pairing secret advertised in this account's `bunker://` URI. An
+     * app that connects with this secret is accepted and registered as a
+     * connected app; regenerating it revokes the ability of not-yet-connected
+     * apps to pair with an old string.
+     */
+    val nip46BunkerSecret: MutableStateFlow<String> = MutableStateFlow(""),
+    /**
+     * A dedicated per-account transport keypair (hex private key) for the NIP-46
+     * bunker. The kind-24133 envelope is wrapped with THIS key, not the account's
+     * identity key, so the bunker address and on-relay traffic don't reveal which
+     * user the bunker belongs to (the identity is disclosed only to a connected
+     * app via `get_public_key`). Generated once and kept stable so the advertised
+     * `bunker://` address doesn't change.
+     */
+    val nip46TransportKey: MutableStateFlow<String> = MutableStateFlow(""),
+    /**
+     * The kind-24133 **event ids** this signer recently serviced. Persisted so that a relay replaying
+     * stored ephemeral requests across an app restart doesn't make it sign the same request twice —
+     * matched by exact event id, so it is immune to client clock skew (unlike a timestamp watermark,
+     * a global timestamp would wrongly drop a second app whose clock lags). Bounded to a recent window.
+     */
+    val nip46SeenRequestIds: MutableStateFlow<Set<String>> = MutableStateFlow(emptySet()),
     /**
      * NIP-9B opt-in: when true, community feeds drop events whose latest cached
      * `kind:34551` rules document fails [com.vitorpamplona.quartz.nip72ModCommunities.rules.CommunityRulesValidator].
@@ -248,6 +299,7 @@ class AccountSettings(
     var backupGeohashList: GeohashListEvent? = null,
     var backupEphemeralChatList: EphemeralChatListEvent? = null,
     var backupRelayGroupList: SimpleGroupListEvent? = null,
+    var backupConcordList: ConcordCommunityListEvent? = null,
     var backupTrustProviderList: TrustProviderListEvent? = null,
     var backupCashuWallet: CashuWalletEvent? = null,
     var backupNutzapInfo: NutzapInfoEvent? = null,
@@ -276,6 +328,10 @@ class AccountSettings(
     val callsEnabled: MutableStateFlow<Boolean> = MutableStateFlow(true),
     val defaultRelayAuthPolicy: MutableStateFlow<RelayAuthPolicy> = MutableStateFlow(RelayAuthPolicy.CUSTOM),
     val relayGroupViewMode: MutableStateFlow<RelayGroupViewMode> = MutableStateFlow(RelayGroupViewMode.DEFAULT),
+    val concordViewMode: MutableStateFlow<ConcordViewMode> = MutableStateFlow(ConcordViewMode.DEFAULT),
+    // Which conversation protocols the Messages inbox loads and shows. A disabled type is both hidden
+    // from the inbox and dropped from the always-on downloading routes. Defaults to everything on.
+    val enabledChatFeeds: MutableStateFlow<Set<ChatFeedType>> = MutableStateFlow(ChatFeedType.ALL),
     // The per-situation toggles applied under RelayAuthPolicy.CUSTOM.
     val relayAuthTrustMyRelaysAndVenues: MutableStateFlow<Boolean> = MutableStateFlow(true),
     val relayAuthTrustReadFollows: MutableStateFlow<Boolean> = MutableStateFlow(true),
@@ -283,6 +339,7 @@ class AccountSettings(
     val relayAuthTrustMessageStrangers: MutableStateFlow<Boolean> = MutableStateFlow(false),
 ) : EphemeralChatRepository,
     RelayGroupRepository,
+    ConcordListRepository,
     PublicChatListRepository {
     val saveable = MutableStateFlow(AccountSettingsUpdater(null))
     val syncedSettings: AccountSyncedSettings = AccountSyncedSettings(AccountSyncedSettingsInternal())
@@ -304,6 +361,27 @@ class AccountSettings(
         }
     }
 
+    fun updateConcordViewMode(mode: ConcordViewMode) {
+        if (concordViewMode.value != mode) {
+            concordViewMode.tryEmit(mode)
+            saveAccountSettings()
+        }
+    }
+
+    fun isChatFeedEnabled(type: ChatFeedType): Boolean = type in enabledChatFeeds.value
+
+    fun setChatFeedEnabled(
+        type: ChatFeedType,
+        enabled: Boolean,
+    ) {
+        val current = enabledChatFeeds.value
+        val next = if (enabled) current + type else current - type
+        if (next != current) {
+            enabledChatFeeds.tryEmit(next)
+            saveAccountSettings()
+        }
+    }
+
     // ---
     // Always-on Notification Service
     // ---
@@ -569,6 +647,35 @@ class AccountSettings(
         }
     }
 
+    fun changeNip46SignerEnabled(enabled: Boolean) {
+        if (nip46SignerEnabled.value != enabled) {
+            nip46SignerEnabled.tryEmit(enabled)
+            saveAccountSettings()
+        }
+    }
+
+    fun changeNip46BunkerSecret(secret: String) {
+        if (nip46BunkerSecret.value != secret) {
+            nip46BunkerSecret.tryEmit(secret)
+            saveAccountSettings()
+        }
+    }
+
+    fun changeNip46TransportKey(hexPrivKey: String) {
+        if (nip46TransportKey.value != hexPrivKey) {
+            nip46TransportKey.tryEmit(hexPrivKey)
+            saveAccountSettings()
+        }
+    }
+
+    /** Replaces the recent serviced-request id set (already bounded by the caller). */
+    fun changeNip46SeenRequestIds(ids: Set<String>) {
+        if (nip46SeenRequestIds.value != ids) {
+            nip46SeenRequestIds.tryEmit(ids)
+            saveAccountSettings()
+        }
+    }
+
     fun changeLocalBlossomCacheProfilePicturesOnly(enabled: Boolean) {
         if (localBlossomCacheProfilePicturesOnly.value != enabled) {
             localBlossomCacheProfilePicturesOnly.tryEmit(enabled)
@@ -576,6 +683,20 @@ class AccountSettings(
         }
     }
 
+    fun changeMirrorUploadsToAllServers(enabled: Boolean) {
+        if (mirrorUploadsToAllServers.value != enabled) {
+            mirrorUploadsToAllServers.tryEmit(enabled)
+            saveAccountSettings()
+        }
+    }
+
+    fun changeOptimizeMediaOnUpload(enabled: Boolean) {
+        if (optimizeMediaOnUpload.value != enabled) {
+            optimizeMediaOnUpload.tryEmit(enabled)
+            saveAccountSettings()
+        }
+    }
+
     fun updateAddClientTag(add: Boolean): Boolean =
         if (syncedSettings.security.updateAddClientTag(add)) {
             saveAccountSettings()
@@ -1277,6 +1398,19 @@ class AccountSettings(
         }
     }
 
+    override fun concordList() = backupConcordList
+
+    override fun updateConcordListTo(newConcordList: ConcordCommunityListEvent?) {
+        // The joined list lives entirely in NIP-44-encrypted content (secrets),
+        // so an empty `tags` is NOT an empty list — guard only on null.
+        if (newConcordList == null) return
+
+        if (backupConcordList?.id != newConcordList.id) {
+            backupConcordList = newConcordList
+            saveAccountSettings()
+        }
+    }
+
     fun updateTrustProviderListTo(trustProviderList: TrustProviderListEvent?) {
         if (trustProviderList == null || trustProviderList.tags.isEmpty()) return
 

amethyst/src/main/java/com/vitorpamplona/amethyst/model/ConcordInviteResult.kt

@@ -0,0 +1,63 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.model
+
+/**
+ * The outcome of redeeming a Concord invite link (CORD-05). Separating the failure
+ * modes lets the UI tell the user *why* it failed and — crucially — whether
+ * retrying could ever help, so a link we can never open doesn't strand the user on
+ * an endless "redeeming…" spinner with a retry button that loops forever.
+ */
+sealed interface ConcordInviteResult {
+    /** Redeemed and joined; navigate to [communityId]. */
+    data class Joined(
+        val communityId: String,
+    ) : ConcordInviteResult
+
+    /** The link itself is malformed, or this account can't join (read-only key). Retrying can't help. */
+    data object InvalidLink : ConcordInviteResult
+
+    /**
+     * No invite bundle was reachable on any relay — a transient miss (relays down,
+     * link too new to have propagated, or expired). Retrying may help.
+     */
+    data object NotReachable : ConcordInviteResult
+
+    /**
+     * The link was revoked: the newest event at its coordinate is a `vsk=9` revocation
+     * tombstone (CORD-05 §2). Retrying can't help — the owner retired this link.
+     */
+    data object Revoked : ConcordInviteResult
+
+    /**
+     * The bundle opened fine, but its `expires_at` has passed. Retrying can't help —
+     * unlike [Revoked] the owner didn't retire the link, it simply timed out, so the
+     * user's next step is to ask for a fresh one.
+     */
+    data object Expired : ConcordInviteResult
+
+    /**
+     * The bundle event was found but could not be opened with the link's token —
+     * typically because it was minted by a newer/incompatible Concord client whose
+     * bundle format this app can't read yet. Retrying can't help.
+     */
+    data object Incompatible : ConcordInviteResult
+}

amethyst/src/main/java/com/vitorpamplona/amethyst/model/GeohashChatIdentityState.kt

@@ -0,0 +1,123 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.model
+
+import androidx.core.content.edit
+import com.vitorpamplona.amethyst.Amethyst
+import com.vitorpamplona.quartz.experimental.bitchat.identity.GeohashKeyDerivation
+import com.vitorpamplona.quartz.nip01Core.core.hexToByteArray
+import com.vitorpamplona.quartz.nip01Core.core.toHexKey
+import com.vitorpamplona.quartz.nip01Core.crypto.KeyPair
+import com.vitorpamplona.quartz.nip01Core.signers.NostrSigner
+import com.vitorpamplona.quartz.nip01Core.signers.NostrSignerInternal
+import com.vitorpamplona.quartz.utils.RandomInstance
+
+/**
+ * The account's anonymous, per-geohash chat identities.
+ *
+ * Geohash channels are location-tagged, so posting under the account's real npub
+ * would publish the user's movements tied to their public identity. Instead each
+ * cell gets a throwaway key that is unlinkable to the npub (and to the user's key
+ * in every other cell). This state object caches the derived keys and owns the
+ * seed they come from, keyed to a single account — so switching accounts (or
+ * logging out) switches identities with it.
+ *
+ * The seed is chosen per signer:
+ * - **Local key account** → derived from the account private key
+ *   ([GeohashKeyDerivation.accountSeed]). Stable across all of the user's devices
+ *   and recoverable from the account, while staying publicly unlinkable.
+ * - **Remote (NIP-46) / external (NIP-55) signer** → the raw key is unreachable,
+ *   so a random 32-byte seed is kept in this account's encrypted storage. Because
+ *   the store is scoped to the account's pubkey, two accounts on one device get
+ *   different seeds (a global seed would have made their throwaway identities
+ *   collide, linking the accounts in every cell).
+ */
+class GeohashChatIdentityState(
+    private val signer: NostrSigner,
+) {
+    private val lock = Any()
+    private val cache = HashMap<String, KeyPair>()
+
+    @Volatile private var cachedDeviceSeed: ByteArray? = null
+
+    @Volatile private var cachedNickname: String? = null
+
+    /**
+     * The user's display handle for location chats: a single global nickname, persisted per account.
+     * Bitchat carries this as the per-message `["n", …]` tag rather than a kind-0 profile, and kind-20000
+     * messages are ephemeral (relays needn't store them), so the only durable home for it is the device.
+     * Kept in this account's encrypted storage, so it survives restarts and switches with the account.
+     * Empty string means "no nickname set". Reads touch disk on first call — invoke off the main thread.
+     */
+    fun nickname(): String {
+        cachedNickname?.let { return it }
+        synchronized(lock) {
+            cachedNickname?.let { return it }
+            val value = Amethyst.instance.encryptedStorage(signer.pubKey).getString(PREF_NICKNAME, "") ?: ""
+            cachedNickname = value
+            return value
+        }
+    }
+
+    /** Persists the global location-chat nickname (trimmed) for this account. */
+    fun setNickname(value: String) {
+        val trimmed = value.trim()
+        synchronized(lock) {
+            cachedNickname = trimmed
+            Amethyst.instance.encryptedStorage(signer.pubKey).edit { putString(PREF_NICKNAME, trimmed) }
+        }
+    }
+
+    /** The Nostr key pair to use inside [geohash]. Derivation is cheap but cached; call off the main thread. */
+    fun keyPair(geohash: String): KeyPair =
+        synchronized(lock) {
+            cache.getOrPut(geohash) { GeohashKeyDerivation.deriveKeyPair(seed(), geohash) }
+        }
+
+    private fun seed(): ByteArray = accountPrivKey()?.let { GeohashKeyDerivation.accountSeed(it) } ?: deviceSeed()
+
+    private fun accountPrivKey(): ByteArray? = (signer as? NostrSignerInternal)?.keyPair?.privKey
+
+    /** Random per-account seed, used only when the account key is unreachable (bunker / external signer). */
+    private fun deviceSeed(): ByteArray {
+        cachedDeviceSeed?.let { return it }
+        synchronized(lock) {
+            cachedDeviceSeed?.let { return it }
+            val prefs = Amethyst.instance.encryptedStorage(signer.pubKey)
+            val existing = prefs.getString(PREF_KEY, null)
+            val seed =
+                if (existing != null && existing.length == GeohashKeyDerivation.SEED_SIZE * 2) {
+                    existing.hexToByteArray()
+                } else {
+                    val fresh = RandomInstance.bytes(GeohashKeyDerivation.SEED_SIZE)
+                    prefs.edit { putString(PREF_KEY, fresh.toHexKey()) }
+                    fresh
+                }
+            cachedDeviceSeed = seed
+            return seed
+        }
+    }
+
+    companion object {
+        private const val PREF_KEY = "geohash_chat_device_seed"
+        private const val PREF_NICKNAME = "geohash_chat_nickname"
+    }
+}

amethyst/src/main/java/com/vitorpamplona/amethyst/model/HashtagIcon.kt

@@ -20,99 +20,12 @@
  */
 package com.vitorpamplona.amethyst.model
 
-import androidx.compose.foundation.layout.padding
-import androidx.compose.material3.Text
-import androidx.compose.runtime.Composable
-import androidx.compose.runtime.Immutable
-import androidx.compose.ui.Modifier
-import androidx.compose.ui.graphics.vector.ImageVector
-import androidx.compose.ui.tooling.preview.Preview
-import androidx.compose.ui.unit.dp
-import com.vitorpamplona.amethyst.commons.hashtags.Amethyst
-import com.vitorpamplona.amethyst.commons.hashtags.Btc
-import com.vitorpamplona.amethyst.commons.hashtags.Cashu
-import com.vitorpamplona.amethyst.commons.hashtags.Coffee
-import com.vitorpamplona.amethyst.commons.hashtags.CustomHashTagIcons
-import com.vitorpamplona.amethyst.commons.hashtags.Flowerstr
-import com.vitorpamplona.amethyst.commons.hashtags.Footstr
-import com.vitorpamplona.amethyst.commons.hashtags.Gamestr
-import com.vitorpamplona.amethyst.commons.hashtags.Grownostr
-import com.vitorpamplona.amethyst.commons.hashtags.Lightning
-import com.vitorpamplona.amethyst.commons.hashtags.Mate
-import com.vitorpamplona.amethyst.commons.hashtags.Nostr
-import com.vitorpamplona.amethyst.commons.hashtags.Plebs
-import com.vitorpamplona.amethyst.commons.hashtags.Skull
-import com.vitorpamplona.amethyst.commons.hashtags.Tunestr
-import com.vitorpamplona.amethyst.commons.hashtags.Weed
-import com.vitorpamplona.amethyst.commons.hashtags.Zap
-import com.vitorpamplona.amethyst.commons.model.EmptyTagList
-import com.vitorpamplona.amethyst.commons.richtext.HashTagSegment
-import com.vitorpamplona.amethyst.commons.richtext.RegularTextSegment
-import com.vitorpamplona.amethyst.ui.components.HashTag
-import com.vitorpamplona.amethyst.ui.components.RenderRegular
-import com.vitorpamplona.amethyst.ui.components.RenderTextParagraph
-import com.vitorpamplona.amethyst.ui.navigation.navs.EmptyNav
-import com.vitorpamplona.amethyst.ui.theme.ThemeComparisonColumn
+import com.vitorpamplona.amethyst.commons.ui.richtext.HashtagIcon as CommonsHashtagIcon
+import com.vitorpamplona.amethyst.commons.ui.richtext.checkForHashtagWithIcon as commonsCheckForHashtagWithIcon
 
-@Preview
-@Composable
-fun RenderHashTagIconsPreview() {
-    ThemeComparisonColumn {
-        RenderRegular(
-            "Testing rendering of hashtags: #flowerstr #Bitcoin, #nostr, #lightning, #zap, #amethyst, #cashu, #plebs, #coffee, #skullofsatoshi, #grownostr, #footstr, #tunestr, #weed, #mate, #gamestr, #gamechain",
-            EmptyTagList,
-        ) { paragraph, _, spaceWidth, modifier ->
-            RenderTextParagraph(paragraph, spaceWidth, modifier) { word ->
-                when (word) {
-                    is HashTagSegment -> HashTag(word, EmptyNav())
-                    is RegularTextSegment -> Text(word.segmentText)
-                }
-            }
-        }
-    }
-}
+// The hashtag-icon table now lives in commons/ui/richtext so the shared
+// RichTextViewer and both front ends resolve the same icons. These re-exports keep
+// the historical `com.vitorpamplona.amethyst.model` call sites working.
+typealias HashtagIcon = CommonsHashtagIcon
 
-fun checkForHashtagWithIcon(tag: String): HashtagIcon? =
-    when (tag.lowercase()) {
-        "₿itcoin", "bitcoin", "btc", "timechain", "bitcoiner", "bitcoiners" -> bitcoin
-        "nostr", "nostrich", "nostriches", "thenostr" -> nostr
-        "lightning", "lightningnetwork" -> lightning
-        "zap", "zaps", "zapper", "zappers", "zapping", "zapped", "zapathon", "zapraiser", "zaplife", "zapchain" -> zap
-        "amethyst" -> amethyst
-        "cashu", "ecash", "nut", "nuts", "deeznuts" -> cashu
-        "plebs", "pleb", "plebchain" -> plebs
-        "coffee", "coffeechain", "cafe" -> coffee
-        "skullofsatoshi" -> skull
-        "grownostr", "gardening", "garden" -> growstr
-        "footstr" -> footstr
-        "flowerstr" -> flowerstr
-        "tunestr", "music", "nowplaying" -> tunestr
-        "mate", "matechain", "matestr" -> matestr
-        "weed", "weedstr", "420", "cannabis", "marijuana" -> weed
-        "gamestr", "gaming", "gamechain" -> gamestr
-        else -> null
-    }
-
-val bitcoin = HashtagIcon(CustomHashTagIcons.Btc, "Bitcoin", Modifier.padding(start = 1.dp, bottom = 1.dp, top = 1.dp))
-val nostr = HashtagIcon(CustomHashTagIcons.Nostr, "Nostr", Modifier.padding(start = 1.dp, bottom = 1.dp, top = 1.dp))
-val lightning = HashtagIcon(CustomHashTagIcons.Lightning, "Lightning", Modifier.padding(start = 1.dp, bottom = 1.dp, top = 1.dp))
-val zap = HashtagIcon(CustomHashTagIcons.Zap, "Zap", Modifier.padding(start = 1.dp, bottom = 1.dp, top = 1.dp))
-val amethyst = HashtagIcon(CustomHashTagIcons.Amethyst, "Amethyst", Modifier.padding(start = 2.dp, bottom = 1.dp, top = 1.dp))
-val cashu = HashtagIcon(CustomHashTagIcons.Cashu, "Cashu", Modifier.padding(start = 1.dp, bottom = 1.dp, top = 1.dp))
-val plebs = HashtagIcon(CustomHashTagIcons.Plebs, "Pleb", Modifier.padding(start = 2.dp, bottom = 1.dp, top = 1.dp))
-val coffee = HashtagIcon(CustomHashTagIcons.Coffee, "Coffee", Modifier.padding(start = 3.dp, bottom = 1.dp, top = 1.dp))
-val skull = HashtagIcon(CustomHashTagIcons.Skull, "SkullofSatoshi", Modifier.padding(start = 1.dp, bottom = 1.dp, top = 1.dp))
-val growstr = HashtagIcon(CustomHashTagIcons.Grownostr, "GrowNostr", Modifier.padding(start = 1.dp, bottom = 1.dp, top = 1.dp))
-val footstr = HashtagIcon(CustomHashTagIcons.Footstr, "Footstr", Modifier.padding(start = 2.dp, bottom = 1.dp, top = 1.dp))
-val flowerstr = HashtagIcon(CustomHashTagIcons.Flowerstr, "Flowerstr", Modifier.padding(start = 2.dp, bottom = 1.dp, top = 1.dp))
-val tunestr = HashtagIcon(CustomHashTagIcons.Tunestr, "Tunestr", Modifier.padding(start = 1.dp, bottom = 1.dp, top = 1.dp))
-val weed = HashtagIcon(CustomHashTagIcons.Weed, "Weed", Modifier.padding(start = 1.dp, bottom = 0.dp, top = 0.dp))
-val matestr = HashtagIcon(CustomHashTagIcons.Mate, "Mate", Modifier.padding(start = 1.dp, bottom = 0.dp, top = 0.dp))
-val gamestr = HashtagIcon(CustomHashTagIcons.Gamestr, "GameStr", Modifier.padding(start = 1.dp, bottom = 0.dp, top = 0.dp))
-
-@Immutable
-class HashtagIcon(
-    val icon: ImageVector,
-    val description: String,
-    val modifier: Modifier = Modifier,
-)
+fun checkForHashtagWithIcon(tag: String): HashtagIcon? = commonsCheckForHashtagWithIcon(tag)

amethyst/src/main/java/com/vitorpamplona/amethyst/model/LocalCache.kt

@@ -30,7 +30,9 @@ import com.vitorpamplona.amethyst.commons.model.Channel
 import com.vitorpamplona.amethyst.commons.model.OnchainZapStatus
 import com.vitorpamplona.amethyst.commons.model.cache.ICacheProvider
 import com.vitorpamplona.amethyst.commons.model.cache.LargeSoftCache
+import com.vitorpamplona.amethyst.commons.model.concord.ConcordChannel
 import com.vitorpamplona.amethyst.commons.model.emphChat.EphemeralChatChannel
+import com.vitorpamplona.amethyst.commons.model.geohashChat.GeohashChatChannel
 import com.vitorpamplona.amethyst.commons.model.nip28PublicChats.PublicChatChannel
 import com.vitorpamplona.amethyst.commons.model.nip29RelayGroups.RelayGroupChannel
 import com.vitorpamplona.amethyst.commons.model.nip53LiveActivities.LiveActivitiesChannel
@@ -48,6 +50,8 @@ import com.vitorpamplona.amethyst.model.nipBCOnchainZaps.OnchainZapResolver
 import com.vitorpamplona.amethyst.service.BundledInsert
 import com.vitorpamplona.amethyst.service.checkNotInMainThread
 import com.vitorpamplona.amethyst.ui.note.dateFormatter
+import com.vitorpamplona.quartz.concord.cord02Community.ConcordCommunityListEvent
+import com.vitorpamplona.quartz.concord.cord03Channels.ConcordChannelId
 import com.vitorpamplona.quartz.experimental.agora.FundraiserEvent
 import com.vitorpamplona.quartz.experimental.attestations.attestation.AttestationEvent
 import com.vitorpamplona.quartz.experimental.attestations.proficiency.AttestorProficiencyEvent
@@ -57,6 +61,7 @@ import com.vitorpamplona.quartz.experimental.audio.header.AudioHeaderEvent
 import com.vitorpamplona.quartz.experimental.audio.track.AudioTrackEvent
 import com.vitorpamplona.quartz.experimental.birdstar.BirdDetectionEvent
 import com.vitorpamplona.quartz.experimental.birdstar.BirdexEvent
+import com.vitorpamplona.quartz.experimental.bitchat.geohash.GeohashChatEvent
 import com.vitorpamplona.quartz.experimental.edits.TextNoteModificationEvent
 import com.vitorpamplona.quartz.experimental.ephemChat.chat.EphemeralChatEvent
 import com.vitorpamplona.quartz.experimental.ephemChat.chat.RoomId
@@ -159,6 +164,7 @@ import com.vitorpamplona.quartz.nip29RelayGroups.metadata.GroupAdminsEvent
 import com.vitorpamplona.quartz.nip29RelayGroups.metadata.GroupMembersEvent
 import com.vitorpamplona.quartz.nip29RelayGroups.metadata.GroupMetadataEvent
 import com.vitorpamplona.quartz.nip29RelayGroups.metadata.GroupParticipantsEvent
+import com.vitorpamplona.quartz.nip29RelayGroups.metadata.GroupPinnedEvent
 import com.vitorpamplona.quartz.nip29RelayGroups.metadata.SupportedRolesEvent
 import com.vitorpamplona.quartz.nip29RelayGroups.moderation.CreateGroupEvent
 import com.vitorpamplona.quartz.nip29RelayGroups.moderation.CreateInviteEvent
@@ -167,6 +173,7 @@ import com.vitorpamplona.quartz.nip29RelayGroups.moderation.DeleteGroupEvent
 import com.vitorpamplona.quartz.nip29RelayGroups.moderation.EditMetadataEvent
 import com.vitorpamplona.quartz.nip29RelayGroups.moderation.PutUserEvent
 import com.vitorpamplona.quartz.nip29RelayGroups.moderation.RemoveUserEvent
+import com.vitorpamplona.quartz.nip29RelayGroups.moderation.UpdatePinListEvent
 import com.vitorpamplona.quartz.nip29RelayGroups.request.JoinRequestEvent
 import com.vitorpamplona.quartz.nip29RelayGroups.request.LeaveRequestEvent
 import com.vitorpamplona.quartz.nip30CustomEmoji.pack.EmojiPackEvent
@@ -354,7 +361,9 @@ object LocalCache : ILocalCache, ICacheProvider {
     val publicChatChannels = LargeCache<HexKey, PublicChatChannel>()
     val liveChatChannels = LargeCache<Address, LiveActivitiesChannel>()
     val ephemeralChannels = LargeCache<RoomId, EphemeralChatChannel>()
+    val geohashChannels = LargeCache<String, GeohashChatChannel>()
     val relayGroupChannels = LargeCache<GroupId, RelayGroupChannel>()
+    val concordChannels = LargeCache<ConcordChannelId, ConcordChannel>()
 
     val paymentTracker = NwcPaymentTracker()
 
@@ -628,6 +637,8 @@ object LocalCache : ILocalCache, ICacheProvider {
 
     fun getEphemeralChatChannelIfExists(key: RoomId): EphemeralChatChannel? = ephemeralChannels.get(key)
 
+    fun getGeohashChannelIfExists(geohash: String): GeohashChatChannel? = geohashChannels.get(geohash)
+
     fun getRelayGroupChannelIfExists(key: GroupId): RelayGroupChannel? = relayGroupChannels.get(key)
 
     /** Every relay group we know of that is hosted on [relay] (its channel directory). */
@@ -721,8 +732,85 @@ object LocalCache : ILocalCache, ICacheProvider {
 
     fun getOrCreateEphemeralChannel(key: RoomId): EphemeralChatChannel = ephemeralChannels.getOrCreate(key) { EphemeralChatChannel(key) }
 
+    fun getOrCreateGeohashChannel(geohash: String): GeohashChatChannel = geohashChannels.getOrCreate(geohash) { GeohashChatChannel(geohash) }
+
     fun getOrCreateRelayGroupChannel(key: GroupId): RelayGroupChannel = relayGroupChannels.getOrCreate(key) { RelayGroupChannel(key) }
 
+    fun getConcordChannelIfExists(key: ConcordChannelId): ConcordChannel? = concordChannels.get(key)
+
+    fun getOrCreateConcordChannel(key: ConcordChannelId): ConcordChannel = concordChannels.getOrCreate(key) { ConcordChannel(key) }
+
+    /**
+     * Lands a decrypted Concord chat rumor in the cache as a real Note and, for
+     * message-like kinds, attaches it to its channel so the shared chat feed and
+     * the Messages inbox render it (with previews, threading, OTS, reactions/zaps
+     * reusing the same id-keyed machinery as every other chat). Reactions (kind 7),
+     * deletes (kind 5), etc. are consumed too — they wire to their target Note by
+     * `e`-tag through [justConsume] — but are not themselves added as channel rows.
+     *
+     * Fed by [com.vitorpamplona.amethyst.commons.model.concord.ConcordSessionManager]
+     * once a wrap decrypts + validates against the folded Control Plane.
+     */
+    fun consumeConcordRumor(
+        communityId: String,
+        channelIdHex: String,
+        rumor: Event,
+        seenOnRelays: Set<NormalizedRelayUrl> = emptySet(),
+    ) {
+        // Attach to the channel BEFORE justConsume sets the event and notifies feeds,
+        // so the note already carries its ConcordChannel gatherer when it flows through
+        // the Messages-list incremental filter (which routes rows by that gatherer).
+        val messageRow =
+            if (rumor is ChatEvent || rumor is CommentEvent) {
+                val ch = getOrCreateConcordChannel(ConcordChannelId(communityId, channelIdHex))
+                val note = getOrCreateNote(rumor.id)
+                // Skip attaching a row for a message we already know is deleted (its kind-5 delete
+                // was processed first). Otherwise every reproject — which re-emits the whole wrap
+                // buffer — would re-add then re-remove it, churning the feed. justConsume still
+                // records the (already-known) deletion below; a delete arriving LATER is handled by
+                // the normal deletion cascade unlinking the note from its gatherers.
+                if (!deletionIndex.hasBeenDeleted(rumor)) ch.addNote(note)
+                ch to note
+            } else {
+                null
+            }
+        // wasVerified = true: a Concord rumor is unsigned (its `sig` is empty), so a signature
+        // check would fail and the event would never load onto its Note — leaving the chat row
+        // stuck on the "loading / not found" placeholder. Its authenticity is already established
+        // by the envelope open path (ConcordStreamEnvelope.open verifies the seal signature,
+        // binds rumor.pubKey == seal.pubKey, and checks rumor.verifyId()), exactly like a NIP-59
+        // gift-wrapped DM rumor, so we consume it as pre-verified.
+        justConsume(rumor, null, true)
+
+        // A Concord rumor is decrypted locally with the plane key, so it arrives with no
+        // per-relay attribution (relay = null above). Stamp the relays its carrying wrap was
+        // seen on — mirroring NIP-17's addRelayToNoteAndInners — so the chat UI can show where
+        // the message actually came from, not just the channel's configured relays.
+        if (seenOnRelays.isNotEmpty()) {
+            getNoteIfExists(rumor.id)?.takeIf { it.event != null }?.let { note ->
+                seenOnRelays.forEach { note.addRelay(it) }
+            }
+        }
+
+        // justConsume bails without loading the event when the rumor has already been deleted
+        // (a kind-5 delete referencing it was processed first — easy to hit in Concord because a
+        // reproject re-emits the whole wrap buffer and ordering isn't guaranteed) or fails to
+        // verify. We attached the row up front, so an unpopulated note would otherwise linger as a
+        // permanent "Event is loading…" ghost. Drop it; the reverse order (delete after the message)
+        // is already handled by the normal deletion cascade unlinking the note from its gatherers.
+        messageRow?.let { (ch, note) ->
+            if (note.event == null) {
+                ch.removeNote(note)
+            } else {
+                // The row was attached (addNote) BEFORE justConsume set the event, so addNote saw a
+                // null createdAt and could not pick lastNote or order the feed. The event is loaded
+                // now — refresh so the channel's last-message preview, unread count, and ordering are
+                // correct (otherwise lastNote stays null forever and every row reads "No messages yet").
+                ch.refreshAfterEventLoad(note)
+            }
+        }
+    }
+
     fun checkGetOrCreatePublicChatChannel(key: String): PublicChatChannel? {
         if (isValidHex(key)) {
             return getOrCreatePublicChatChannel(key)
@@ -1407,6 +1495,7 @@ object LocalCache : ILocalCache, ICacheProvider {
             is LiveActivitiesChatMessageEvent -> noteEvent.activityAddress()?.let { getLiveActivityChannelIfExists(it) }
             is LiveActivitiesEvent -> getLiveActivityChannelIfExists(noteEvent.address())
             is EphemeralChatEvent -> noteEvent.roomId()?.let { getEphemeralChatChannelIfExists(it) }
+            is GeohashChatEvent -> noteEvent.geohash()?.let { getGeohashChannelIfExists(it) }
             else -> null
         }
 
@@ -1537,9 +1626,9 @@ object LocalCache : ILocalCache, ICacheProvider {
     ): Boolean {
         val note = getOrCreateNote(event.id)
 
-        // Approval notes are badge-rendered directly in community feeds
-        // (BadgeBox has no repost-style indirection for them), so without
-        // this attribution their relay list stays empty forever.
+        // Approval notes render their own relay list directly in community feeds
+        // (there is no repost-style indirection to a replyTo for them), so without
+        // this attribution the "accepted by relays" gallery line stays empty forever.
         if (relay != null) {
             getOrCreateUser(event.pubKey).addRelayBeingUsed(relay, event.createdAt)
             note.addRelay(relay)
@@ -1772,6 +1861,51 @@ object LocalCache : ILocalCache, ICacheProvider {
         return new
     }
 
+    /**
+     * Public geohash chat message (kind 20000). Routes into the cell's
+     * [GeohashChatChannel]. Presence (kind 20001) is deliberately NOT consumed
+     * here — it is an empty-content heartbeat handled by the live chat screen, so
+     * it never becomes a room's "last message".
+     */
+    fun consume(
+        event: GeohashChatEvent,
+        relay: NormalizedRelayUrl?,
+        wasVerified: Boolean,
+    ): Boolean {
+        val geohash = event.geohash() ?: return false
+
+        val new = consumeRegularEvent(event, relay, wasVerified)
+
+        if (new) {
+            val note = getOrCreateNote(event.id)
+            val channel = getOrCreateGeohashChannel(geohash)
+            channel.addNote(note, relay)
+        }
+
+        return new
+    }
+
+    /**
+     * NIP-29 addressables (kinds 39000-39005) are authoritative for a group's metadata,
+     * roster, roles and pins ONLY when signed by the relay's own key — the NIP-11 `self`
+     * pubkey. This returns false only when we can positively tell an event is NOT relay-signed
+     * (the relay advertises a `self` and the event's author differs), so a stray or malicious
+     * user-published 39000/39001/… served by a lax relay can't overwrite a group's state (e.g.
+     * inject itself into the admin list). When `self` isn't known yet — the NIP-11 doc hasn't
+     * loaded, or the relay doesn't advertise one — we don't block, so legitimate groups still
+     * populate and this never regresses a relay whose key we simply haven't fetched.
+     */
+    private fun isRelaySignedGroupEvent(
+        event: Event,
+        relay: NormalizedRelayUrl,
+    ): Boolean {
+        val self =
+            Amethyst.instance.nip11Cache
+                .getFromCache(relay)
+                .self ?: return true
+        return event.pubKey == self
+    }
+
     /**
      * NIP-29 relay-signed group metadata (kind 39000). Stored as an addressable
      * note and used to populate the [RelayGroupChannel]'s name/picture/about/
@@ -1787,7 +1921,7 @@ object LocalCache : ILocalCache, ICacheProvider {
     ): Boolean {
         val new = consumeBaseReplaceable(event, relay, wasVerified)
 
-        if (relay != null) {
+        if (relay != null && isRelaySignedGroupEvent(event, relay)) {
             val note = getOrCreateAddressableNote(event.address())
             val channel = getOrCreateRelayGroupChannel(GroupId(event.groupId(), relay))
             (note.event as? GroupMetadataEvent)?.let { channel.updateGroupInfo(it, note) }
@@ -1803,7 +1937,7 @@ object LocalCache : ILocalCache, ICacheProvider {
         wasVerified: Boolean,
     ): Boolean {
         val new = consumeBaseReplaceable(event, relay, wasVerified)
-        if (relay != null) {
+        if (relay != null && isRelaySignedGroupEvent(event, relay)) {
             val latest = getOrCreateAddressableNote(event.address()).event as? GroupMembersEvent
             latest?.let { getOrCreateRelayGroupChannel(GroupId(it.groupId(), relay)).updateMembers(it) }
         }
@@ -1817,13 +1951,41 @@ object LocalCache : ILocalCache, ICacheProvider {
         wasVerified: Boolean,
     ): Boolean {
         val new = consumeBaseReplaceable(event, relay, wasVerified)
-        if (relay != null) {
+        if (relay != null && isRelaySignedGroupEvent(event, relay)) {
             val latest = getOrCreateAddressableNote(event.address()).event as? GroupAdminsEvent
             latest?.let { getOrCreateRelayGroupChannel(GroupId(it.groupId(), relay)).updateAdmins(it) }
         }
         return new
     }
 
+    /** NIP-29 relay-signed pinned-message list (kind 39005) → the group's pins. */
+    fun consume(
+        event: GroupPinnedEvent,
+        relay: NormalizedRelayUrl?,
+        wasVerified: Boolean,
+    ): Boolean {
+        val new = consumeBaseReplaceable(event, relay, wasVerified)
+        if (relay != null && isRelaySignedGroupEvent(event, relay)) {
+            val latest = getOrCreateAddressableNote(event.address()).event as? GroupPinnedEvent
+            latest?.let { getOrCreateRelayGroupChannel(GroupId(it.groupId(), relay)).updatePinned(it) }
+        }
+        return new
+    }
+
+    /** NIP-29 relay-declared supported roles (kind 39003) → the group's role set. */
+    fun consume(
+        event: SupportedRolesEvent,
+        relay: NormalizedRelayUrl?,
+        wasVerified: Boolean,
+    ): Boolean {
+        val new = consumeBaseReplaceable(event, relay, wasVerified)
+        if (relay != null && isRelaySignedGroupEvent(event, relay)) {
+            val latest = getOrCreateAddressableNote(event.address()).event as? SupportedRolesEvent
+            latest?.let { getOrCreateRelayGroupChannel(GroupId(it.groupId(), relay)).updateSupportedRoles(it) }
+        }
+        return new
+    }
+
     /**
      * Attach a group-scoped content event (a kind-9 chat, kind-1068 poll, …
      * carrying an `h` tag) to its [RelayGroupChannel]. NIP-29 reuses the generic
@@ -1844,9 +2006,20 @@ object LocalCache : ILocalCache, ICacheProvider {
         if (note.event == null) return
 
         if (relay != null) {
-            // Normal arrival: the group only exists on its host relay and the
-            // filters are host-pinned, so the serving relay is the group's key.
-            getOrCreateRelayGroupChannel(GroupId(groupId, relay)).addNote(note, relay)
+            val exact = GroupId(groupId, relay)
+            val existing = getRelayGroupChannelIfExists(exact)
+            if (existing != null) {
+                // Normal arrival: the group's host-pinned filters served it, so the serving relay IS the
+                // group's key and its channel already exists. Fast O(1) path — no scan.
+                existing.addNote(note, relay)
+            } else {
+                // No channel keyed to the serving relay: this may be a stray from a NON-host relay (e.g. a
+                // quoted kind-9 resolved by id). Redirect it to the group's single confirmed host rather
+                // than mint a phantom channel the group's screens never read (the serving-relay hazard);
+                // fall back to the serving-relay key when there is no single host (new/ambiguous group).
+                val target = redirectStrayRelayGroupContent(relayGroupCandidatesFor(groupId)) ?: exact
+                getOrCreateRelayGroupChannel(target).addNote(note, relay)
+            }
         } else {
             // Our own optimistic send has no provenance relay, so we can't build the (groupId,
             // relay) key. Attach only when a SINGLE open channel has this group id (the room being
@@ -1860,6 +2033,12 @@ object LocalCache : ILocalCache, ICacheProvider {
         }
     }
 
+    /** Candidate group channels for the [redirectStrayRelayGroupContent] slow path — one scan by group id. */
+    private fun relayGroupCandidatesFor(groupId: String): List<RelayGroupTargetCandidate> =
+        relayGroupChannels
+            .filter { key, _ -> key.id == groupId }
+            .map { RelayGroupTargetCandidate(it.groupId, it.hasRelaySignedState()) }
+
     /**
      * Same routing as [attachToRelayGroupIfScoped] but for kind-11 threads, which
      * are kept in a separate collection from the chat timeline so the two content
@@ -1874,7 +2053,15 @@ object LocalCache : ILocalCache, ICacheProvider {
         if (note.event == null) return
 
         if (relay != null) {
-            getOrCreateRelayGroupChannel(GroupId(groupId, relay)).addThread(note)
+            val exact = GroupId(groupId, relay)
+            val existing = getRelayGroupChannelIfExists(exact)
+            if (existing != null) {
+                existing.addThread(note)
+            } else {
+                // Same serving-relay hazard as the chat path: prefer the single confirmed host over a phantom.
+                val target = redirectStrayRelayGroupContent(relayGroupCandidatesFor(groupId)) ?: exact
+                getOrCreateRelayGroupChannel(target).addThread(note)
+            }
         } else {
             // See attachToRelayGroupIfScoped: only attach when the group id is unambiguous.
             relayGroupChannels
@@ -2810,6 +2997,10 @@ object LocalCache : ILocalCache, ICacheProvider {
             pruneHiddenMessagesChannel(channel, account)
         }
 
+        geohashChannels.forEach { _, channel ->
+            pruneHiddenMessagesChannel(channel, account)
+        }
+
         liveChatChannels.forEach { _, channel ->
             pruneHiddenMessagesChannel(channel, account)
         }
@@ -2863,6 +3054,10 @@ object LocalCache : ILocalCache, ICacheProvider {
             pruneOldMessagesChannel(channel)
         }
 
+        geohashChannels.forEach { _, channel ->
+            pruneOldMessagesChannel(channel)
+        }
+
         liveChatChannels.forEach { _, channel ->
             pruneOldMessagesChannel(channel)
         }
@@ -3746,6 +3941,10 @@ object LocalCache : ILocalCache, ICacheProvider {
                     consume(event, relay, wasVerified)
                 }
 
+                is GeohashChatEvent -> {
+                    consume(event, relay, wasVerified)
+                }
+
                 is EphemeralChatListEvent -> {
                     consumeBaseReplaceable(event, relay, wasVerified)
                 }
@@ -3757,6 +3956,14 @@ object LocalCache : ILocalCache, ICacheProvider {
                     consumeBaseReplaceable(event, relay, wasVerified)
                 }
 
+                // Concord private joined-communities list (kind 13302). Replaceable, self-encrypted;
+                // ConcordChannelListState observes it via the addressable cache (Address(13302, me, "")),
+                // so — exactly like the 10009 list above — it must be stored replaceably or the Concord
+                // hub stays empty even after the event arrives.
+                is ConcordCommunityListEvent -> {
+                    consumeBaseReplaceable(event, relay, wasVerified)
+                }
+
                 is GroupMetadataEvent -> {
                     consume(event, relay, wasVerified)
                 }
@@ -3769,16 +3976,22 @@ object LocalCache : ILocalCache, ICacheProvider {
                     consume(event, relay, wasVerified)
                 }
 
-                // Remaining NIP-29 relay-group kinds. The two relay-signed addressables (39003
-                // roles, 39004 AV participants) are durable group state alongside 39000/39001/39002,
-                // so they're stored replaceably. The 9xxx moderation actions and join/leave requests
-                // are regular one-shot events the relay is authoritative for (it applies them and
-                // republishes the 39000/39001/39002); we store them so they're queryable and don't
-                // fall through to the "Not Supported" warning, but we don't act on them client-side.
-                is SupportedRolesEvent -> {
-                    consumeBaseReplaceable(event, relay, wasVerified)
+                is GroupPinnedEvent -> {
+                    consume(event, relay, wasVerified)
                 }
 
+                // 39003 (relay-declared roles) is durable group state like 39000/39001/39002:
+                // route it onto the channel so a moderation UI can offer the relay's role set.
+                is SupportedRolesEvent -> {
+                    consume(event, relay, wasVerified)
+                }
+
+                // Remaining NIP-29 relay-group kinds. The relay-signed 39004 AV-participants
+                // addressable is durable group state, so it's stored replaceably. The 9xxx
+                // moderation actions and join/leave requests are regular one-shot events the
+                // relay is authoritative for (it applies them and republishes the
+                // 39000/39001/39002); we store them so they're queryable and don't fall through
+                // to the "Not Supported" warning, but we don't act on them client-side.
                 is GroupParticipantsEvent -> {
                     consumeBaseReplaceable(event, relay, wasVerified)
                 }
@@ -3799,6 +4012,10 @@ object LocalCache : ILocalCache, ICacheProvider {
                     consumeRegularEvent(event, relay, wasVerified)
                 }
 
+                is UpdatePinListEvent -> {
+                    consumeRegularEvent(event, relay, wasVerified)
+                }
+
                 is DeleteGroupEvent -> {
                     consumeRegularEvent(event, relay, wasVerified)
                 }

amethyst/src/main/java/com/vitorpamplona/amethyst/model/MiniFhir.kt

@@ -21,51 +21,71 @@
 package com.vitorpamplona.amethyst.model
 
 import androidx.compose.runtime.Stable
-import com.fasterxml.jackson.annotation.JsonSubTypes
-import com.fasterxml.jackson.annotation.JsonTypeInfo
-import com.fasterxml.jackson.databind.DeserializationFeature
-import com.fasterxml.jackson.module.kotlin.jacksonObjectMapper
-import com.fasterxml.jackson.module.kotlin.readValue
 import com.vitorpamplona.quartz.utils.Log
 import kotlinx.collections.immutable.ImmutableMap
 import kotlinx.collections.immutable.persistentMapOf
 import kotlinx.collections.immutable.toImmutableMap
+import kotlinx.serialization.DeserializationStrategy
+import kotlinx.serialization.Serializable
+import kotlinx.serialization.json.Json
+import kotlinx.serialization.json.JsonContentPolymorphicSerializer
+import kotlinx.serialization.json.JsonElement
+import kotlinx.serialization.json.jsonObject
+import kotlinx.serialization.json.jsonPrimitive
 
-@JsonTypeInfo(
-    use = JsonTypeInfo.Id.NAME,
-    include = JsonTypeInfo.As.PROPERTY,
-    property = "resourceType",
-)
-@JsonSubTypes(
-    JsonSubTypes.Type(value = Practitioner::class, name = "Practitioner"),
-    JsonSubTypes.Type(value = Patient::class, name = "Patient"),
-    JsonSubTypes.Type(value = Bundle::class, name = "Bundle"),
-    JsonSubTypes.Type(value = VisionPrescription::class, name = "VisionPrescription"),
-)
+/**
+ * FHIR resources are polymorphic on the `resourceType` string. We only model the
+ * handful of types Amethyst renders; anything else (and any resource with a
+ * missing/unrecognized type) decodes into [UnknownResource] so a mixed [Bundle]
+ * never fails to parse just because it carries a type we don't know about.
+ */
+object ResourceSerializer : JsonContentPolymorphicSerializer<Resource>(Resource::class) {
+    override fun selectDeserializer(element: JsonElement): DeserializationStrategy<Resource> =
+        when (element.jsonObject["resourceType"]?.jsonPrimitive?.content) {
+            "Practitioner" -> Practitioner.serializer()
+            "Patient" -> Patient.serializer()
+            "Bundle" -> Bundle.serializer()
+            "VisionPrescription" -> VisionPrescription.serializer()
+            else -> UnknownResource.serializer()
+        }
+}
+
+@Serializable(with = ResourceSerializer::class)
 @Stable
-open class Resource(
-    var resourceType: String? = null,
-    var id: String = "",
-)
+abstract class Resource {
+    abstract val resourceType: String?
+    abstract val id: String
+}
 
+/** Fallback for any FHIR resourceType we don't model. */
+@Serializable
+@Stable
+class UnknownResource(
+    override val resourceType: String? = null,
+    override val id: String = "",
+) : Resource()
+
+@Serializable
 @Stable
 class Practitioner(
-    resourceType: String? = null,
-    id: String = "",
+    override val resourceType: String? = null,
+    override val id: String = "",
     var active: Boolean? = null,
     var name: ArrayList<HumanName> = arrayListOf(),
     var gender: String? = null,
-) : Resource(resourceType, id)
+) : Resource()
 
+@Serializable
 @Stable
 class Patient(
-    resourceType: String? = null,
-    id: String = "",
+    override val resourceType: String? = null,
+    override val id: String = "",
     var active: Boolean? = null,
     var name: ArrayList<HumanName> = arrayListOf(),
     var gender: String? = null,
-) : Resource(resourceType, id)
+) : Resource()
 
+@Serializable
 @Stable
 class HumanName(
     var use: String? = null,
@@ -75,19 +95,21 @@ class HumanName(
     fun assembleName(): String = given.joinToString(" ") + " " + family
 }
 
+@Serializable
 @Stable
 class Bundle(
-    resourceType: String? = null,
-    id: String = "",
+    override val resourceType: String? = null,
+    override val id: String = "",
     var type: String? = null,
     var created: String? = null,
     var entry: List<Resource> = arrayListOf(),
-) : Resource(resourceType, id)
+) : Resource()
 
+@Serializable
 @Stable
 class VisionPrescription(
-    resourceType: String? = null,
-    id: String = "",
+    override val resourceType: String? = null,
+    override val id: String = "",
     var status: String? = null,
     var created: String? = null,
     var patient: Reference? = Reference(),
@@ -95,7 +117,7 @@ class VisionPrescription(
     var dateWritten: String? = null,
     var prescriber: Reference? = Reference(),
     var lensSpecification: List<LensSpecification> = arrayListOf(),
-) : Resource(resourceType, id) {
+) : Resource() {
     fun glasses() = lensSpecification.filter { it.product == "lens" }
 
     fun contacts() = lensSpecification.filter { it.product == "contacts" }
@@ -109,6 +131,7 @@ class VisionPrescription(
     fun contactsLeftEyes() = lensSpecification.filter { it.product == "contacts" && it.eye == "left" }
 }
 
+@Serializable
 @Stable
 class LensSpecification(
     var product: String? = null,
@@ -129,12 +152,14 @@ class LensSpecification(
     var note: String? = null,
 )
 
+@Serializable
 @Stable
 class Prism(
     var amount: Double? = null,
     var base: String? = null,
 )
 
+@Serializable
 class Reference(
     var reference: String? = null,
 )
@@ -156,12 +181,22 @@ fun findReferenceInDb(
     }
 }
 
-fun parseResourceBundleOrNull(json: String): FhirElementDatabase? {
-    val mapper =
-        jacksonObjectMapper().configure(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES, false)
+/**
+ * Lenient FHIR JSON reader: unknown keys are ignored (implementations routinely add
+ * their own fields) and missing keys fall back to the property defaults, so we parse
+ * as much of a resource as we can rather than rejecting the whole document.
+ */
+val FhirJson =
+    Json {
+        ignoreUnknownKeys = true
+        isLenient = true
+        explicitNulls = false
+        coerceInputValues = true
+    }
 
-    return try {
-        val resource = mapper.readValue<Resource>(json)
+fun parseResourceBundleOrNull(json: String): FhirElementDatabase? =
+    try {
+        val resource = FhirJson.decodeFromString(ResourceSerializer, json)
 
         val db =
             when (resource) {
@@ -182,4 +217,3 @@ fun parseResourceBundleOrNull(json: String): FhirElementDatabase? {
         Log.e("RenderEyeGlassesPrescription", "Parser error", e)
         null
     }
-}

amethyst/src/main/java/com/vitorpamplona/amethyst/model/RelayGroupContentRouting.kt

@@ -0,0 +1,52 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.model
+
+import com.vitorpamplona.quartz.nip29RelayGroups.GroupId
+
+/**
+ * A candidate group channel when routing a stray group-scoped content event: its [key] and whether it is a
+ * confirmed host (has received relay-signed state). See [redirectStrayRelayGroupContent].
+ */
+data class RelayGroupTargetCandidate(
+    val key: GroupId,
+    val hasRelaySignedState: Boolean,
+)
+
+/**
+ * Resolves the **serving-relay hazard**. A group-scoped content event (kind-9 chat, poll, kind-11 thread…)
+ * is keyed to its group channel by the relay that served it, because a NIP-29 event doesn't carry its host
+ * relay. That is correct for the group's own host-pinned subscriptions, but a message resolved from a
+ * **non-host** relay — e.g. a quoted kind-9 fetched by id during missing-event resolution — would be filed
+ * under a channel keyed to that stranger relay, one the group's own screens never read, so the message
+ * silently vanishes.
+ *
+ * Called only when there is **no** channel keyed to the serving relay for this group id (the fast, common
+ * path attaches directly and never gets here). It picks the group's single confirmed **host** channel — one
+ * that has received relay-signed state — to attach the stray to instead. Returns that host key, or null when
+ * there is no single confirmed host (a genuinely new group on the serving relay, or an id ambiguous across
+ * several hosts), in which case the caller keeps the serving-relay key as today's best effort.
+ *
+ * A phantom channel (one minted from an earlier stray) never has relay-signed state, so it can never be
+ * chosen here — the redirect only ever lands on a real host, never on another phantom. This makes the fix
+ * strictly safe: it can redirect a stray to a known host, but never divert a message away from one.
+ */
+fun redirectStrayRelayGroupContent(candidates: List<RelayGroupTargetCandidate>): GroupId? = candidates.filter { it.hasRelaySignedState }.singleOrNull()?.key

amethyst/src/main/java/com/vitorpamplona/amethyst/model/accountsCache/AccountCacheState.kt

@@ -22,6 +22,10 @@ package com.vitorpamplona.amethyst.model.accountsCache
 
 import android.content.ContentResolver
 import com.vitorpamplona.amethyst.LocalPreferences
+import com.vitorpamplona.amethyst.commons.connectedApps.nip46.InMemoryNip46ClientStore
+import com.vitorpamplona.amethyst.commons.connectedApps.nip46.Nip46ClientStore
+import com.vitorpamplona.amethyst.commons.connectedApps.signers.InMemoryNostrSignerPermissionStore
+import com.vitorpamplona.amethyst.commons.connectedApps.signers.NostrSignerPermissionStore
 import com.vitorpamplona.amethyst.commons.service.pow.PoWPublishQueue
 import com.vitorpamplona.amethyst.model.Account
 import com.vitorpamplona.amethyst.model.AccountSettings
@@ -66,13 +70,23 @@ class AccountCacheState(
     val powQueue: () -> PoWPublishQueue? = { null },
     /** Optional resource-ledger wrapper applied to every account signer (see MeteringNostrSigner). */
     val meterSigner: (NostrSigner) -> NostrSigner = { it },
+    /** App-global Connected-Apps signer permission store (shared with napplets), gating the NIP-46 bunker. */
+    val signerPermissionStore: NostrSignerPermissionStore = InMemoryNostrSignerPermissionStore(),
+    /** App-global store of connected NIP-46 client display + relay info. */
+    val nip46ClientStore: Nip46ClientStore = InMemoryNip46ClientStore(),
 ) {
     val accounts = MutableStateFlow<Map<HexKey, Account>>(emptyMap())
 
+    /** Guards [loadAccount]'s check-then-create so concurrent callers can't build twin Accounts. */
+    private val loadLock = Any()
+
     fun removeAccount(pubkey: HexKey) {
         accounts.update { existingAccounts ->
             val oldValue = existingAccounts[pubkey]
             oldValue?.scope?.cancel()
+            // Unregisters the tracker's persistent listener from the shared
+            // client; without this every removed account leaks a listener.
+            oldValue?.chatDeliveryTracker?.destroy()
             existingAccounts.minus(pubkey)
         }
     }
@@ -176,6 +190,22 @@ class AccountCacheState(
         val cached = accounts.value[signer.pubKey]
         if (cached != null) return cached
 
+        // Serialize construction: the UI login path and the always-on service's preload race
+        // to load the same account on cold start. Without the lock both see a null cache and
+        // both build an Account — the loser is never cancelled, leaving a zombie whose
+        // Nip46SignerState answers bunker requests with a NostrSignerExternal no Activity
+        // ever registers a launcher on (every sign fails "No activity to launch from"),
+        // while duplicating consent prompts and racing error replies to NIP-46 clients.
+        return synchronized(loadLock) {
+            accounts.value[signer.pubKey]?.let { return it }
+            createAccount(signer, accountSettings)
+        }
+    }
+
+    private fun createAccount(
+        signer: NostrSigner,
+        accountSettings: AccountSettings,
+    ): Account {
         val signerWithClientTag =
             NostrSignerWithClientTag(
                 inner = meterSigner(signer),
@@ -255,6 +285,8 @@ class AccountCacheState(
             marmotKeyPackageStore = marmotKeyPackageStore,
             powQueue = powQueue,
             relayAuthPermissionStore = relayAuthPermissionStore,
+            signerPermissionStore = signerPermissionStore,
+            nip46ClientStore = nip46ClientStore,
         ).also { newAccount ->
             accounts.update { existingAccounts ->
                 existingAccounts.plus(Pair(signer.pubKey, newAccount))
@@ -266,6 +298,7 @@ class AccountCacheState(
         accounts.update { existingAccounts ->
             existingAccounts.forEach {
                 it.value.scope.cancel()
+                it.value.chatDeliveryTracker.destroy()
             }
             emptyMap()
         }

amethyst/src/main/java/com/vitorpamplona/amethyst/model/nip11RelayInfo/RelaySupportsNip.kt

@@ -43,6 +43,15 @@ fun relayAdvertisesNip(
 /** NIP-29 (relay-based groups): the relay must run it for its groups to be real. */
 fun relayAdvertisesNip29(relay: NormalizedRelayUrl): Boolean = relayAdvertisesNip(relay, "29")
 
+/**
+ * Whether [relayInfo] affirmatively signals that its relay does NOT run NIP-29 groups: the doc
+ * resolved with an explicit `supported_nips` list that lacks "29" and no `self` key (the field
+ * NIP-29 relays publish so clients can verify their relay-signed group metadata — see
+ * [isRelaySignedRelayGroup]). A doc with a null `supported_nips` proves nothing (still loading,
+ * or the fetch failed), so it never triggers the warning.
+ */
+fun looksLikeNonNip29Relay(relayInfo: Nip11RelayInformation): Boolean = relayInfo.supported_nips?.none { it == "29" } == true && relayInfo.self == null
+
 /**
  * Whether [channel]'s relay-signed metadata is genuinely from its host relay, per NIP-29:
  * "these are addressable events signed by the relay keypair directly … as stated by the NIP-11

amethyst/src/main/java/com/vitorpamplona/amethyst/model/nip46Signer/Nip46ActivityLog.kt

@@ -0,0 +1,56 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.model.nip46Signer
+
+import com.vitorpamplona.quartz.nip01Core.core.HexKey
+import kotlinx.coroutines.flow.MutableStateFlow
+import kotlinx.coroutines.flow.StateFlow
+import kotlinx.coroutines.flow.update
+
+/** One serviced NIP-46 request, for the "recent activity" feed. */
+data class Nip46ActivityEntry(
+    val atSeconds: Long,
+    val clientPubKey: HexKey,
+    /** The NIP-46 method (`sign_event`, `nip44_encrypt`, `get_public_key`, …). */
+    val method: String,
+    /** Event kind for a `sign_event`, else `null`. */
+    val kind: Int? = null,
+    /** `null` when the request succeeded; the error string when it failed or was denied. */
+    val error: String? = null,
+) {
+    val ok: Boolean get() = error == null
+}
+
+/**
+ * A bounded, newest-first, in-memory log of the requests this account's signer has serviced, so the
+ * user can see what apps are actually doing. Not persisted across app restarts (it is a live feed,
+ * not an audit trail); it survives service restarts because it lives on the account's signer state.
+ */
+class Nip46ActivityLog(
+    private val capacity: Int = 100,
+) {
+    private val _entries = MutableStateFlow<List<Nip46ActivityEntry>>(emptyList())
+    val entries: StateFlow<List<Nip46ActivityEntry>> = _entries
+
+    fun record(entry: Nip46ActivityEntry) {
+        _entries.update { (listOf(entry) + it).take(capacity) }
+    }
+}

amethyst/src/main/java/com/vitorpamplona/amethyst/model/nip46Signer/Nip46ConsentBridge.kt

@@ -0,0 +1,192 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.model.nip46Signer
+
+import com.vitorpamplona.amethyst.Amethyst
+import com.vitorpamplona.amethyst.R
+import com.vitorpamplona.amethyst.commons.connectedApps.nip46.Nip46PermissionAuthorizer
+import com.vitorpamplona.amethyst.commons.connectedApps.signers.AppConnectResult
+import com.vitorpamplona.amethyst.commons.connectedApps.signers.NostrSignerOp
+import com.vitorpamplona.amethyst.commons.connectedApps.signers.SignerOpGrant
+import com.vitorpamplona.amethyst.connectedApps.consent.SignerConnectCoordinator
+import com.vitorpamplona.amethyst.connectedApps.consent.SignerConnectInfo
+import com.vitorpamplona.amethyst.connectedApps.consent.SignerConsentCoordinator
+import com.vitorpamplona.amethyst.model.LocalCache
+import com.vitorpamplona.amethyst.napplet.label
+import com.vitorpamplona.quartz.nip01Core.core.HexKey
+import com.vitorpamplona.quartz.nip01Core.signers.NostrSigner
+import com.vitorpamplona.quartz.nip46RemoteSigner.BunkerRequest
+import com.vitorpamplona.quartz.nip46RemoteSigner.BunkerRequestConnect
+import com.vitorpamplona.quartz.nip46RemoteSigner.BunkerRequestNip04Decrypt
+import com.vitorpamplona.quartz.nip46RemoteSigner.BunkerRequestNip44Decrypt
+import kotlinx.coroutines.withTimeoutOrNull
+
+/**
+ * Bridges the (KMP, headless) [com.vitorpamplona.amethyst.commons.connectedApps.nip46.Nip46PermissionAuthorizer]
+ * to the interactive consent UI. It reuses the SAME dialogs the napplet/browser signer path uses —
+ * [SignerConnectCoordinator] (first-connect trust picker) and [SignerConsentCoordinator]
+ * (per-operation allow/deny) — so a NIP-46 remote app prompts through one consistent surface, and
+ * the user's "remember" choices land in the same [com.vitorpamplona.amethyst.commons.connectedApps.signers.NostrSignerPermissionLedger].
+ *
+ * Runs only in the main process (the signer never runs in `:napplet`), so [Amethyst.instance] is set;
+ * the coordinators launch their Activity from the application context.
+ */
+object Nip46ConsentBridge {
+    /**
+     * Upper bound on how long a consent prompt may block the signer's single-consumer loop. A user who
+     * ignores the dialog eventually fails the request closed (deny / declined) instead of wedging the
+     * signer for every other client whose requests queue behind that one blocked prompt.
+     */
+    private const val CONSENT_TIMEOUT_MS = 120_000L
+
+    /** First-connect consent: show the app's self-declared identity and let the user pick a trust level. */
+    suspend fun requestConnect(
+        coordinate: String,
+        clientPubKey: HexKey,
+        request: BunkerRequestConnect,
+    ): AppConnectResult {
+        val context = Amethyst.instance.appContext
+        val meta = request.clientMetadata
+        val title = meta?.name?.ifBlank { null } ?: context.getString(R.string.nip46_signer_remote_app)
+        val domain = meta?.url?.ifBlank { null } ?: (clientPubKey.take(12) + "…")
+        // The identity being connected to lives in the coordinate; show it as an avatar + name.
+        val face = accountFace(coordinate)
+        val info =
+            SignerConnectInfo(
+                appletTitle = title,
+                coordinate = coordinate,
+                domain = domain,
+                iconUrl = meta?.image,
+                accountName = face.name,
+                accountPicture = face.picture,
+                accountPubKey = face.pubKey,
+            )
+        // Fail closed (declined) if the prompt is never answered, so a stuck first-connect dialog can't
+        // hold the single-consumer loop hostage against every other client.
+        return withTimeoutOrNull(CONSENT_TIMEOUT_MS) {
+            SignerConnectCoordinator.requestConnect(context, info)
+        } ?: AppConnectResult.Cancelled
+    }
+
+    /**
+     * First-connect consent for the client-initiated (`nostrconnect://`) flow: like [requestConnect]
+     * but built from the pasted/scanned offer, and — crucially — it surfaces the app's declared
+     * [requestedOps] so the user gives informed consent before those ops are pre-granted. Returns the
+     * user's [AppConnectResult] (or [AppConnectResult.Cancelled] if the prompt is never answered).
+     */
+    suspend fun requestNostrConnectConsent(
+        coordinate: String,
+        name: String?,
+        url: String?,
+        image: String?,
+        requestedOps: List<NostrSignerOp>,
+    ): AppConnectResult {
+        val context = Amethyst.instance.appContext
+        val title = name?.ifBlank { null } ?: context.getString(R.string.nip46_signer_remote_app)
+        val domain = url?.ifBlank { null } ?: (Nip46PermissionAuthorizer.clientPubKeyOf(coordinate)?.take(12)?.plus("…") ?: "")
+        val face = accountFace(coordinate)
+        val info =
+            SignerConnectInfo(
+                appletTitle = title,
+                coordinate = coordinate,
+                domain = domain,
+                iconUrl = image,
+                accountName = face.name,
+                accountPicture = face.picture,
+                accountPubKey = face.pubKey,
+                requestedPermissions = requestedOps.map { it.label(context) },
+            )
+        return withTimeoutOrNull(CONSENT_TIMEOUT_MS) {
+            SignerConnectCoordinator.requestConnect(context, info)
+        } ?: AppConnectResult.Cancelled
+    }
+
+    /**
+     * Per-operation consent: describe the request and await the user's grant.
+     *
+     * For a decrypt request this DECRYPTS FIRST and shows the resulting plaintext, together with the
+     * counterparty the conversation is with. That is what makes the decision reviewable: without it
+     * the dialog said only "wants to read your private messages" with no way to tell one request from
+     * another. Decryption is local — [signer] runs on this device and nothing leaves it unless the
+     * user approves — and it is bounded by [Nip46ConsentInfoBuilder.DECRYPT_PREVIEW_TIMEOUT_MS] so a slow or failing signer
+     * degrades to an explanatory message instead of hanging or blanking the prompt.
+     */
+    suspend fun requestOp(
+        coordinate: String,
+        clientPubKey: HexKey,
+        op: NostrSignerOp,
+        request: BunkerRequest,
+        signer: NostrSigner,
+    ): SignerOpGrant {
+        val context = Amethyst.instance.appContext
+        val info = runCatching { Amethyst.instance.nip46ClientStore.load(coordinate) }.getOrNull()
+        val title = info?.name?.ifBlank { null } ?: context.getString(R.string.nip46_signer_remote_app)
+
+        val consentInfo =
+            Nip46ConsentInfoBuilder.build(
+                coordinate = coordinate,
+                title = title,
+                iconUrl = info?.image,
+                op = op,
+                request = request,
+                account = accountFace(coordinate),
+                faceOf = ::userFace,
+                strings =
+                    Nip46ConsentStrings(
+                        opLabel = { it.label(context) },
+                        allowAlwaysFor = { context.getString(R.string.nip46_signer_allow_always_for, it) },
+                        decryptFailed = context.getString(R.string.nip46_signer_decrypt_failed),
+                    ),
+                decrypt = { decryptWithAccountSigner(signer, it) },
+            )
+        // Fail closed if the prompt is never answered so a stuck dialog can't hold the signer hostage.
+        return withTimeoutOrNull(CONSENT_TIMEOUT_MS) {
+            SignerConsentCoordinator.requestConsent(context, consentInfo)
+        } ?: SignerOpGrant.DenyOnce
+    }
+
+    /**
+     * Performs the local decryption behind the decrypt preview with the account's own signer. Errors
+     * and timeouts are handled by [Nip46ConsentInfoBuilder]; this only maps the request to a call.
+     */
+    private suspend fun decryptWithAccountSigner(
+        signer: NostrSigner,
+        request: BunkerRequest,
+    ): String? =
+        when (request) {
+            is BunkerRequestNip04Decrypt -> signer.nip04Decrypt(request.ciphertext, request.pubKey)
+            is BunkerRequestNip44Decrypt -> signer.nip44Decrypt(request.ciphertext, request.pubKey)
+            else -> null
+        }
+
+    /** The account being signed for (avatar + name), resolved from the coordinate's signer pubkey. */
+    private fun accountFace(coordinate: String): SignerFace {
+        val pubKey = Nip46PermissionAuthorizer.signerPubKeyOf(coordinate)
+        val user = pubKey?.let { LocalCache.getUserIfExists(it) }
+        return SignerFace(name = user?.toBestDisplayName(), picture = user?.profilePicture(), pubKey = pubKey)
+    }
+
+    /** Cached profile for a counterparty; the builder supplies the shortened-npub fallback. */
+    private fun userFace(pubKey: HexKey): SignerFace {
+        val user = LocalCache.getUserIfExists(pubKey)
+        return SignerFace(name = user?.toBestDisplayName(), picture = user?.profilePicture(), pubKey = pubKey)
+    }
+}

amethyst/src/main/java/com/vitorpamplona/amethyst/model/nip46Signer/Nip46ConsentInfoBuilder.kt

@@ -0,0 +1,176 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.model.nip46Signer
+
+import com.vitorpamplona.amethyst.commons.connectedApps.nip46.Nip46PermissionAuthorizer.Companion.decryptCounterparty
+import com.vitorpamplona.amethyst.commons.connectedApps.nip46.Nip46PermissionAuthorizer.Companion.toNarrowSignerOp
+import com.vitorpamplona.amethyst.commons.connectedApps.signers.NostrSignerOp
+import com.vitorpamplona.amethyst.connectedApps.consent.SignerConsentInfo
+import com.vitorpamplona.quartz.nip01Core.core.HexKey
+import com.vitorpamplona.quartz.nip01Core.jackson.JacksonMapper
+import com.vitorpamplona.quartz.nip19Bech32.entities.NPub
+import com.vitorpamplona.quartz.nip46RemoteSigner.BunkerRequest
+import com.vitorpamplona.quartz.nip46RemoteSigner.BunkerRequestSign
+import com.vitorpamplona.quartz.utils.Log
+import kotlinx.coroutines.CancellationException
+import kotlinx.coroutines.withTimeoutOrNull
+
+/** Avatar + display name for one pubkey, as the consent dialogs render it. */
+data class SignerFace(
+    val name: String?,
+    val picture: String?,
+    val pubKey: String?,
+)
+
+/**
+ * The user-visible strings the builder needs, injected rather than read from `R.string` so the
+ * builder itself carries no Android dependency and can be unit-tested.
+ */
+class Nip46ConsentStrings(
+    /** Human-readable label for an op, e.g. "read your private messages with Alice". */
+    val opLabel: (NostrSignerOp) -> String,
+    /** Button text for the counterparty-scoped grant; the argument is the counterparty's name. */
+    val allowAlwaysFor: (String) -> String,
+    /** Shown as the preview when Amethyst itself could not decrypt the message. */
+    val decryptFailed: String,
+)
+
+/**
+ * Builds the [SignerConsentInfo] for one NIP-46 per-operation prompt.
+ *
+ * Split out of [Nip46ConsentBridge] (which owns the Android `Context`/`LocalCache` lookups) so the
+ * decisions that matter for safety are testable without an emulator:
+ *  - a decrypt request is DECRYPTED FIRST and the plaintext becomes the preview, honouring the
+ *    contract the dialog documented but never implemented;
+ *  - a decrypt that cannot be decrypted still produces a populated dialog, never a blank one;
+ *  - the counterparty label is never empty — it degrades to a shortened npub, never to nothing.
+ */
+object Nip46ConsentInfoBuilder {
+    /** Characters of plaintext/content shown inline before the "show more" toggle takes over. */
+    const val PREVIEW_MAX_CHARS = 160
+
+    /**
+     * Upper bound on the pre-consent decryption. Short on purpose: the preview is a nicety, the
+     * prompt is not, so a signer that stalls (e.g. an external NIP-55 app that is not responding)
+     * must not delay the dialog.
+     */
+    const val DECRYPT_PREVIEW_TIMEOUT_MS = 8_000L
+
+    suspend fun build(
+        coordinate: String,
+        title: String,
+        iconUrl: String?,
+        op: NostrSignerOp,
+        request: BunkerRequest,
+        account: SignerFace,
+        /** Resolves a pubkey to a cached profile; the builder supplies its own npub fallback. */
+        faceOf: (HexKey) -> SignerFace,
+        strings: Nip46ConsentStrings,
+        /** Performs the local decryption. May fail, return null, or hang — all are handled. */
+        decrypt: suspend (BunkerRequest) -> String?,
+    ): SignerConsentInfo {
+        val counterparty = request.decryptCounterparty()
+        val plaintext = if (counterparty != null) decryptPreview(request, decrypt, strings.decryptFailed) else null
+
+        val preview =
+            when {
+                request is BunkerRequestSign ->
+                    request.event.content
+                        .take(PREVIEW_MAX_CHARS)
+                        .trim()
+                plaintext != null -> plaintext.take(PREVIEW_MAX_CHARS).trim()
+                else -> ""
+            }
+        val rawData =
+            when {
+                request is BunkerRequestSign -> JacksonMapper.toJsonPretty(request.event)
+                // Only worth a "show more" toggle when the preview actually truncated it.
+                plaintext != null && plaintext.length > PREVIEW_MAX_CHARS -> plaintext
+                else -> ""
+            }
+
+        // A decrypt grant can be scoped to one conversation: offer "always allow for Alice" next to
+        // the broad "always allow", instead of only the all-conversations-forever choice.
+        val narrowOp = request.toNarrowSignerOp()
+        val counterpartyFace = counterparty?.let { face(it, faceOf) }
+
+        return SignerConsentInfo(
+            appletTitle = title,
+            coordinate = coordinate,
+            op = op,
+            // For decrypt this names the counterparty ("read your private messages with Alice").
+            operationSummary = strings.opLabel(narrowOp ?: op),
+            contentPreview = preview,
+            rawData = rawData,
+            iconUrl = iconUrl,
+            accountName = account.name,
+            accountPicture = account.picture,
+            accountPubKey = account.pubKey,
+            previewTemplate = (request as? BunkerRequestSign)?.event,
+            counterpartyName = counterpartyFace?.name,
+            counterpartyPicture = counterpartyFace?.picture,
+            counterpartyPubKey = counterparty,
+            narrowOp = narrowOp,
+            narrowOpLabel = counterpartyFace?.name?.let { strings.allowAlwaysFor(it) },
+        )
+    }
+
+    /**
+     * Decrypts the message the app asked to read. Never throws and never hangs: a signer that fails,
+     * refuses, returns nothing, or takes too long yields [failureText], because a request whose
+     * ciphertext we cannot even read is itself worth showing — a blank dialog is not.
+     */
+    private suspend fun decryptPreview(
+        request: BunkerRequest,
+        decrypt: suspend (BunkerRequest) -> String?,
+        failureText: String,
+    ): String =
+        withTimeoutOrNull(DECRYPT_PREVIEW_TIMEOUT_MS) {
+            try {
+                decrypt(request)?.ifBlank { null }
+            } catch (e: CancellationException) {
+                // Includes this block's own timeout — must propagate so withTimeoutOrNull sees it.
+                throw e
+            } catch (e: Exception) {
+                Log.w("NIP46Signer") { "decrypt preview failed: ${e.message}" }
+                null
+            }
+        } ?: failureText
+
+    /** [faceOf], but with a guaranteed non-blank name (shortened npub when the user isn't cached). */
+    private fun face(
+        pubKey: HexKey,
+        faceOf: (HexKey) -> SignerFace,
+    ): SignerFace {
+        val resolved = runCatching { faceOf(pubKey) }.getOrNull()
+        return SignerFace(
+            name = resolved?.name?.ifBlank { null } ?: shortIdentifier(pubKey),
+            picture = resolved?.picture,
+            pubKey = pubKey,
+        )
+    }
+
+    /** A shortened npub for an uncached pubkey; falls back to the hex prefix if it isn't valid hex. */
+    fun shortIdentifier(pubKey: HexKey): String {
+        val npub = runCatching { NPub.create(pubKey) }.getOrNull()
+        return if (!npub.isNullOrBlank()) npub.take(12) + "…" else pubKey.take(12) + "…"
+    }
+}

amethyst/src/main/java/com/vitorpamplona/amethyst/model/nip46Signer/Nip46SignerState.kt

@@ -0,0 +1,401 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.model.nip46Signer
+
+import com.vitorpamplona.amethyst.commons.connectedApps.nip46.Nip46ClientInfo
+import com.vitorpamplona.amethyst.commons.connectedApps.nip46.Nip46ClientStore
+import com.vitorpamplona.amethyst.commons.connectedApps.nip46.Nip46PermissionAuthorizer
+import com.vitorpamplona.amethyst.commons.connectedApps.signers.AppConnectResult
+import com.vitorpamplona.amethyst.commons.connectedApps.signers.AppSignerPolicy
+import com.vitorpamplona.amethyst.commons.connectedApps.signers.NostrOpDecision
+import com.vitorpamplona.amethyst.commons.connectedApps.signers.NostrSignerPermissionLedger
+import com.vitorpamplona.amethyst.model.AccountSettings
+import com.vitorpamplona.quartz.nip01Core.core.HexKey
+import com.vitorpamplona.quartz.nip01Core.core.hexToByteArray
+import com.vitorpamplona.quartz.nip01Core.core.toHexKey
+import com.vitorpamplona.quartz.nip01Core.crypto.KeyPair
+import com.vitorpamplona.quartz.nip01Core.relay.client.INostrClient
+import com.vitorpamplona.quartz.nip01Core.relay.client.single.newSubId
+import com.vitorpamplona.quartz.nip01Core.relay.normalizer.NormalizedRelayUrl
+import com.vitorpamplona.quartz.nip01Core.relay.normalizer.RelayUrlNormalizer
+import com.vitorpamplona.quartz.nip01Core.signers.NostrSigner
+import com.vitorpamplona.quartz.nip01Core.signers.NostrSignerInternal
+import com.vitorpamplona.quartz.nip46RemoteSigner.BunkerRequestSign
+import com.vitorpamplona.quartz.nip46RemoteSigner.BunkerResponse
+import com.vitorpamplona.quartz.nip46RemoteSigner.NostrConnectEvent
+import com.vitorpamplona.quartz.nip46RemoteSigner.NostrConnectURI
+import com.vitorpamplona.quartz.nip46RemoteSigner.server.BunkerRequestProcessor
+import com.vitorpamplona.quartz.nip46RemoteSigner.server.NostrConnectSignerService
+import com.vitorpamplona.quartz.utils.Log
+import com.vitorpamplona.quartz.utils.RandomInstance
+import com.vitorpamplona.quartz.utils.TimeUtils
+import kotlinx.coroutines.CancellationException
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.flow.MutableStateFlow
+import kotlinx.coroutines.flow.SharingStarted
+import kotlinx.coroutines.flow.StateFlow
+import kotlinx.coroutines.flow.collectLatest
+import kotlinx.coroutines.flow.combine
+import kotlinx.coroutines.flow.distinctUntilChanged
+import kotlinx.coroutines.flow.stateIn
+import kotlinx.coroutines.launch
+
+/** How many recently-serviced request ids to persist for cross-restart replay dedup. */
+private const val MAX_SEEN_IDS = 128
+
+/**
+ * Auto-forget a connected app after this long with no activity. Each connected NIP-46 app makes the
+ * signer hold a background relay subscription indefinitely, so an app paired once and abandoned would
+ * leak a relay connection forever; pruning idle apps bounds that growth. Last-used is stamped on
+ * connect and on every serviced request, so an app still in use is never pruned.
+ */
+private const val IDLE_PRUNE_SECONDS = 7 * 24 * 60 * 60L
+
+/**
+ * Runs Amethyst as a NIP-46 remote signer ("bunker") for the account, so other
+ * apps can sign through it. While [AccountSettings.nip46SignerEnabled] is on, a
+ * [NostrConnectSignerService] listens on the user's inbox relays (plus any relays
+ * pulled in by a pasted `nostrconnect://` offer) for kind:24133 requests.
+ *
+ * Two keys are kept apart: a dedicated local [transportSigner] wraps/unwraps the
+ * kind-24133 envelope (so the bunker address never reveals the user, and an
+ * external NIP-55 account pays no IPC cost for envelope crypto), while the actual
+ * sign/encrypt/decrypt and `get_public_key` use the account's identity [signer] —
+ * a local key or a NIP-55 external app, whichever the user logged in with.
+ *
+ * Every request is gated by [Nip46PermissionAuthorizer], i.e. the same
+ * "Connected Apps" trust ledger that governs napplets and web origins: a remote
+ * client is a connected app under the coordinate `nip46:<signerPubKey>:<clientPubKey>`.
+ *
+ * The listener restarts whenever the enabled flag or the relay set changes
+ * ([collectLatest] cancels the previous run), so editing inbox relays or toggling
+ * the feature takes effect immediately.
+ */
+class Nip46SignerState(
+    val signer: NostrSigner,
+    val client: INostrClient,
+    val ledger: NostrSignerPermissionLedger,
+    val clientStore: Nip46ClientStore,
+    val inboxRelays: StateFlow<Set<NormalizedRelayUrl>>,
+    val scope: CoroutineScope,
+    val settings: AccountSettings,
+) {
+    /** Relays contributed by pasted `nostrconnect://` offers this session, unioned with the inbox set. */
+    private val extraRelays = MutableStateFlow<Set<NormalizedRelayUrl>>(emptySet())
+
+    /** Newest-first, in-memory feed of serviced requests, so the UI can show what apps are doing. */
+    val activityLog = Nip46ActivityLog()
+
+    /**
+     * A bounded, recently-serviced set of kind-24133 event ids, persisted so a relay replaying stored
+     * requests after an app restart is deduped by exact id (see [NostrConnectSignerService.initialSeen]).
+     * Touched only from the service's single consumer coroutine, so it needs no synchronization.
+     */
+    private val recentHandledIds = LinkedHashSet(settings.nip46SeenRequestIds.value)
+
+    private fun rememberHandledId(eventId: HexKey) {
+        if (!recentHandledIds.add(eventId)) return
+        while (recentHandledIds.size > MAX_SEEN_IDS) {
+            recentHandledIds.iterator().let {
+                it.next()
+                it.remove()
+            }
+        }
+        settings.changeNip46SeenRequestIds(recentHandledIds.toSet())
+    }
+
+    /**
+     * The dedicated per-account transport signer that wraps the kind-24133 envelope — a local key
+     * unrelated to the account identity, so the bunker address/traffic doesn't reveal who it is for,
+     * and (unlike the identity signer) an external NIP-55 account pays no IPC cost for envelope crypto.
+     * Generated + persisted lazily on first use so accounts that never enable the signer mint nothing.
+     *
+     * Rebuilt from the persisted key on every call rather than cached, so [rotateAddress] takes effect:
+     * the service-restart trigger includes [AccountSettings.nip46TransportKey], and this reads the
+     * current value — deriving a keypair from stored bytes is cheap enough for the per-restart cost.
+     */
+    private fun transportSigner(): NostrSignerInternal = NostrSignerInternal(KeyPair(ensureTransportKeyBytes()))
+
+    /** All relays the signer listens on: the account inbox plus any nostrconnect offer relays. */
+    val listeningRelays: StateFlow<Set<NormalizedRelayUrl>> =
+        combine(inboxRelays, extraRelays) { inbox, extra -> inbox + extra }
+            .stateIn(scope, SharingStarted.Eagerly, inboxRelays.value)
+
+    private val authorizer =
+        Nip46PermissionAuthorizer(
+            ledger = ledger,
+            signerPubKey = signer.pubKey,
+            validateSecret = { clientPubKey, offered ->
+                // A new app pairs with the current bunker secret; an already-connected app
+                // re-authenticates by identity (it already holds a trust level in the ledger).
+                val secret = settings.nip46BunkerSecret.value
+                (secret.isNotEmpty() && offered == secret) ||
+                    ledger.hasPolicy(Nip46PermissionAuthorizer.coordinateFor(signer.pubKey, clientPubKey))
+            },
+            onConnected = { clientPubKey, request ->
+                // A bunker-flow client talks to us on the inbox relays we always listen on, so we
+                // only persist its self-declared display metadata (never as authorization — just a label).
+                val meta = request.clientMetadata
+                if (meta != null && !meta.isEmpty()) {
+                    clientStore.store(
+                        Nip46PermissionAuthorizer.coordinateFor(signer.pubKey, clientPubKey),
+                        Nip46ClientInfo(name = meta.name, url = meta.url, image = meta.image),
+                    )
+                }
+            },
+            clientStore = clientStore,
+            // A forgotten client's relays are gone from the store now; recompute the listen set so we
+            // stop listening on them this session instead of waiting for a restart.
+            onDisconnected = { refreshExtraRelaysFromStore() },
+            // Interactive consent through the shared signer dialogs: a trust-level picker on first
+            // connect, and an allow/deny prompt whenever the ledger says ASK (dangerous kinds,
+            // decryption, DMs, or a PARANOID app). Same surface + ledger as napplet/browser signing.
+            connectConsent = Nip46ConsentBridge::requestConnect,
+            // The account's own signer goes to the bridge so a decrypt request can be decrypted
+            // BEFORE the prompt — the dialog shows the actual plaintext instead of an opaque
+            // "wants to read your private messages". Local only; nothing is disclosed until approval.
+            opConsent = { coordinate, clientPubKey, op, request ->
+                Nip46ConsentBridge.requestOp(coordinate, clientPubKey, op, request, signer)
+            },
+        )
+
+    init {
+        // extraRelays is a live projection of the persisted client store (the nostrconnect apps' own
+        // relays). Load it on start so paired apps stay reachable across restarts; it is refreshed
+        // whenever a client connects or is forgotten (bunker-flow apps use the inbox relays instead).
+        // Prune apps idle past IDLE_PRUNE_SECONDS first so we don't re-subscribe to a relay only an
+        // abandoned app used — forget() already refreshes extraRelays, and we refresh again in case
+        // nothing was pruned.
+        scope.launch(Dispatchers.IO) {
+            runCatching { authorizer.pruneIdle(IDLE_PRUNE_SECONDS) }
+                .onFailure { Log.w("NIP46Signer") { "idle prune failed: ${it.message}" } }
+            refreshExtraRelaysFromStore()
+        }
+
+        scope.launch(Dispatchers.IO) {
+            combine(settings.nip46SignerEnabled, listeningRelays, settings.nip46TransportKey) { enabled, relays, transportKey ->
+                Triple(enabled, relays, transportKey)
+            }
+                // Inbox/relay/key StateFlows can re-emit an identical value; without this every duplicate
+                // would tear the subscription down and re-open it on every relay for no reason. Including
+                // the transport key here makes rotateAddress() re-subscribe under the fresh key.
+                .distinctUntilChanged()
+                .collectLatest { (enabled, relays, _) ->
+                    if (!enabled) return@collectLatest
+                    if (!signer.isWriteable()) {
+                        Log.w("NIP46Signer") { "signer not writeable; cannot host a bunker" }
+                        return@collectLatest
+                    }
+                    if (relays.isEmpty()) return@collectLatest
+
+                    // Envelope wrapped with the local transport key; the actual work (and get_public_key)
+                    // uses the account's identity signer inside the processor.
+                    val processor = BunkerRequestProcessor(signer, { listeningRelays.value }, authorizer)
+                    val service =
+                        NostrConnectSignerService(
+                            client = client,
+                            transportSigner = transportSigner(),
+                            processor = processor,
+                            relays = relays,
+                            onServiced = { request, clientPubKey, error ->
+                                Log.d("NIP46Signer") { "${request.method} from ${clientPubKey.take(8)}… → ${error ?: "ok"}" }
+                                activityLog.record(
+                                    Nip46ActivityEntry(
+                                        atSeconds = TimeUtils.now(),
+                                        clientPubKey = clientPubKey,
+                                        method = request.method,
+                                        kind = (request as? BunkerRequestSign)?.event?.kind,
+                                        error = error,
+                                    ),
+                                )
+                            },
+                            // Seed dedup with the ids we serviced last session so an app restart doesn't
+                            // re-sign a relay's replay of the same stored requests (matched by exact id).
+                            initialSeen = settings.nip46SeenRequestIds.value,
+                            onHandledId = { id -> rememberHandledId(id) },
+                        )
+                    service.run()
+                }
+        }
+    }
+
+    /** Whether the account is currently advertising itself as a signer. */
+    val enabled: StateFlow<Boolean> get() = settings.nip46SignerEnabled
+
+    fun setEnabled(enabled: Boolean) {
+        if (enabled) {
+            // Settle the secret and transport key BEFORE flipping the flag, so the service-restart
+            // trigger sees the final transport key on its first emission (no throwaway double-start).
+            ensureSecret()
+            ensureTransportKeyBytes()
+        }
+        settings.changeNip46SignerEnabled(enabled)
+    }
+
+    /** The `bunker://<transport-pubkey>?relay=…&secret=…` string to paste into another app. Generates keys/secret if needed. */
+    fun bunkerUri(): String {
+        val secret = ensureSecret()
+        // Advertise the transport key, not the identity key, so the address doesn't reveal who we are.
+        return NostrConnectURI.buildBunker(transportSigner().pubKey, inboxRelays.value, secret)
+    }
+
+    /** Replaces the pairing secret with a fresh one, revoking the ability of not-yet-connected apps to use the old one. */
+    fun regenerateSecret(): String {
+        val fresh = RandomInstance.randomChars(32)
+        settings.changeNip46BunkerSecret(fresh)
+        return fresh
+    }
+
+    /**
+     * The anti-spam "burn it down" action: mints a brand-new transport key (and pairing secret), so
+     * the old `bunker://` address goes dark — anyone who had it (a spammer included) can no longer
+     * reach us, and every app talking to the old transport pubkey is dropped. The running service
+     * re-subscribes under the new key because [AccountSettings.nip46TransportKey] feeds the restart
+     * trigger. Legit apps re-pair by re-scanning the new address; their trust survives because the
+     * Connected-Apps coordinate keys off the stable identity pubkey, not the transport key.
+     */
+    fun rotateAddress(): String {
+        val fresh = KeyPair()
+        settings.changeNip46TransportKey(fresh.privKey!!.toHexKey())
+        regenerateSecret()
+        return NostrConnectURI.buildBunker(fresh.pubKey.toHexKey(), inboxRelays.value, settings.nip46BunkerSecret.value)
+    }
+
+    /** Recomputes [extraRelays] from the persisted client store — the source of truth for nostrconnect relays. */
+    private suspend fun refreshExtraRelaysFromStore() {
+        extraRelays.value =
+            clientStore
+                .all()
+                .filterKeys { Nip46PermissionAuthorizer.belongsTo(it, signer.pubKey) }
+                .values
+                .flatMap { it.relays }
+                .mapNotNull { RelayUrlNormalizer.normalizeOrNull(it) }
+                .toSet()
+    }
+
+    /**
+     * Forgets a connected client (the user's "Forget" action): revokes its grant, drops its stored
+     * metadata/relays, and stops listening on relays that only it used. Same path as a client-sent
+     * `logout`, so both are consistent.
+     */
+    suspend fun forgetClient(clientPubKey: HexKey) = authorizer.forget(clientPubKey)
+
+    /** Returns the current pairing secret, generating and persisting one the first time. */
+    private fun ensureSecret(): String {
+        val current = settings.nip46BunkerSecret.value
+        if (current.isNotEmpty()) return current
+        val fresh = RandomInstance.randomChars(32)
+        settings.changeNip46BunkerSecret(fresh)
+        return fresh
+    }
+
+    /** The transport private key bytes, generating and persisting a fresh keypair the first time (or if corrupt). */
+    private fun ensureTransportKeyBytes(): ByteArray {
+        val stored = settings.nip46TransportKey.value
+        val existing = stored.takeIf { it.length == 64 }?.let { runCatching { it.hexToByteArray() }.getOrNull() }
+        if (existing != null) return existing
+        val fresh = KeyPair()
+        settings.changeNip46TransportKey(fresh.privKey!!.toHexKey())
+        return fresh.privKey!!
+    }
+
+    /**
+     * The client-initiated (`nostrconnect://`) pairing flow: parse a client's
+     * offer, send the connect ack that echoes its secret (so the client learns
+     * our signer pubkey), register it as a connected app, and start listening on
+     * its relays. Enables the signer if it was off.
+     */
+    suspend fun connectViaNostrConnect(uri: String): ConnectResult {
+        val offer = NostrConnectURI.parseNostrConnect(uri) ?: return ConnectResult.InvalidUri
+        if (offer.relays.isEmpty()) return ConnectResult.NoRelays
+        if (!signer.isWriteable()) return ConnectResult.NotWriteable
+
+        val coordinate = authorizer.coordinateFor(offer.clientPubKey)
+        val requestedOps = Nip46PermissionAuthorizer.parsePerms(offer.perms)
+        val firstContact = !ledger.hasPolicy(coordinate)
+
+        // First contact: get informed consent — the app's identity, the perms it declared, and a trust
+        // level — BEFORE we publish the ack or grant anything. A re-pair keeps the existing trust and
+        // per-op decisions the user may have since changed (e.g. an op set to DENY), so it skips the prompt.
+        val grantedPolicy: AppSignerPolicy? =
+            if (firstContact) {
+                when (val result = Nip46ConsentBridge.requestNostrConnectConsent(coordinate, offer.name, offer.url, offer.image, requestedOps)) {
+                    is AppConnectResult.Connected -> result.policy
+                    AppConnectResult.Blocked, AppConnectResult.Cancelled -> return ConnectResult.Declined
+                }
+            } else {
+                null
+            }
+
+        return try {
+            // Echo the offer secret back to the client — authored by the transport key so the client
+            // learns THAT as our remote-signer pubkey (not our identity). Only after consent.
+            val ack = BunkerResponse(newSubId(), offer.secret, null)
+            val reply = NostrConnectEvent.create(ack, offer.clientPubKey, transportSigner())
+            client.publish(reply, offer.relays)
+
+            if (grantedPolicy != null) {
+                ledger.setPolicy(coordinate, grantedPolicy)
+                // The user just reviewed and approved these declared perms, so honor them — including
+                // sensitive ones — unless they chose PARANOID (ask every time, pre-grant nothing).
+                if (grantedPolicy != AppSignerPolicy.PARANOID) {
+                    requestedOps.forEach { ledger.setOpDecision(coordinate, it, NostrOpDecision.ALLOW) }
+                }
+            }
+            ledger.updateLastUsed(coordinate)
+            // Persist the app's label + its relays so it survives a restart, then start listening now.
+            clientStore.store(
+                coordinate,
+                Nip46ClientInfo(name = offer.name, url = offer.url, image = offer.image, relays = offer.relays.map { it.url }.toSet()),
+            )
+            refreshExtraRelaysFromStore()
+
+            setEnabled(true)
+            ConnectResult.Connected(offer.clientPubKey, offer.name)
+        } catch (e: CancellationException) {
+            throw e
+        } catch (e: Exception) {
+            Log.w("NIP46Signer") { "nostrconnect pairing failed: ${e.message}" }
+            ConnectResult.Failed(e.message ?: "unknown error")
+        }
+    }
+
+    sealed interface ConnectResult {
+        data class Connected(
+            val clientPubKey: String,
+            val name: String?,
+        ) : ConnectResult
+
+        data object InvalidUri : ConnectResult
+
+        data object NoRelays : ConnectResult
+
+        data object NotWriteable : ConnectResult
+
+        /** The user reviewed the connect request and declined (cancelled or blocked). */
+        data object Declined : ConnectResult
+
+        data class Failed(
+            val reason: String,
+        ) : ConnectResult
+    }
+}

amethyst/src/main/java/com/vitorpamplona/amethyst/model/nip51Lists/HiddenUsersState.kt

@@ -25,6 +25,7 @@ import com.vitorpamplona.amethyst.model.AccountSettings
 import com.vitorpamplona.amethyst.service.checkNotInMainThread
 import com.vitorpamplona.quartz.nip01Core.core.HexKey
 import com.vitorpamplona.quartz.nip51Lists.muteList.tags.EventTag
+import com.vitorpamplona.quartz.nip51Lists.muteList.tags.HashtagTag
 import com.vitorpamplona.quartz.nip51Lists.muteList.tags.MuteTag
 import com.vitorpamplona.quartz.nip51Lists.muteList.tags.UserTag
 import com.vitorpamplona.quartz.nip51Lists.muteList.tags.WordTag
@@ -57,6 +58,7 @@ class HiddenUsersState(
     ): LiveHiddenUsers {
         val hiddenUsers = blockList.mapNotNullTo(mutableSetOf()) { if (it is UserTag) it.pubKey else null } + muteList.mapNotNull { if (it is UserTag) it.pubKey else null }
         val hiddenWords = blockList.mapNotNullTo(mutableSetOf()) { if (it is WordTag) it.word else null } + muteList.mapNotNull { if (it is WordTag) it.word else null }
+        val hiddenHashtags = blockList.mapNotNullTo(mutableSetOf()) { if (it is HashtagTag) it.hashtag.lowercase() else null } + muteList.mapNotNull { if (it is HashtagTag) it.hashtag.lowercase() else null }
         val mutedThreads = muteList.mapNotNullTo(mutableSetOf()) { if (it is EventTag) it.eventId else null }
 
         return LiveHiddenUsers(
@@ -67,6 +69,7 @@ class HiddenUsersState(
             hiddenUsers = hiddenUsers,
             spammers = transientHiddenUsers,
             hiddenWords = hiddenWords,
+            hiddenHashtags = hiddenHashtags,
             maxHashtagLimit = maxHashtagLimit,
             mutedThreads = mutedThreads,
         )

amethyst/src/main/java/com/vitorpamplona/amethyst/model/nip51Lists/muteList/MuteListState.kt

@@ -29,6 +29,7 @@ import com.vitorpamplona.quartz.nip01Core.core.HexKey
 import com.vitorpamplona.quartz.nip01Core.signers.NostrSigner
 import com.vitorpamplona.quartz.nip51Lists.muteList.MuteListEvent
 import com.vitorpamplona.quartz.nip51Lists.muteList.tags.EventTag
+import com.vitorpamplona.quartz.nip51Lists.muteList.tags.HashtagTag
 import com.vitorpamplona.quartz.nip51Lists.muteList.tags.MuteTag
 import com.vitorpamplona.quartz.nip51Lists.muteList.tags.UserTag
 import com.vitorpamplona.quartz.nip51Lists.muteList.tags.WordTag
@@ -142,6 +143,39 @@ class MuteListState(
         }
     }
 
+    suspend fun hideHashtag(hashtag: String): MuteListEvent {
+        val muteList = getMuteList()
+
+        return if (muteList != null) {
+            MuteListEvent.add(
+                earlierVersion = muteList,
+                mute = HashtagTag(hashtag),
+                isPrivate = true,
+                signer = signer,
+            )
+        } else {
+            MuteListEvent.create(
+                mute = HashtagTag(hashtag),
+                isPrivate = true,
+                signer = signer,
+            )
+        }
+    }
+
+    suspend fun showHashtag(hashtag: String): MuteListEvent? {
+        val muteList = getMuteList()
+
+        return if (muteList != null) {
+            MuteListEvent.remove(
+                earlierVersion = muteList,
+                mute = HashtagTag(hashtag),
+                signer = signer,
+            )
+        } else {
+            null
+        }
+    }
+
     suspend fun hideThread(rootHex: HexKey): MuteListEvent {
         val muteList = getMuteList()
         return if (muteList != null) {

amethyst/src/main/java/com/vitorpamplona/amethyst/model/nipB7Blossom/BlossomServerListState.kt

@@ -120,12 +120,26 @@ class BlossomServerListState(
         hash: HexKey,
         size: Long,
         alt: String,
-    ): BlossomAuthorizationEvent = BlossomAuthorizationEvent.createUploadAuth(hash, size, alt, signer)
+        servers: List<String> = emptyList(),
+    ): BlossomAuthorizationEvent = BlossomAuthorizationEvent.createUploadAuth(hash, size, alt, signer, servers)
+
+    suspend fun createBlossomMediaAuth(
+        hash: HexKey,
+        size: Long,
+        alt: String,
+        servers: List<String> = emptyList(),
+    ): BlossomAuthorizationEvent = BlossomAuthorizationEvent.createMediaAuth(hash, size, alt, signer, servers)
 
     suspend fun createBlossomDeleteAuth(
         hash: HexKey,
         alt: String,
-    ): BlossomAuthorizationEvent = BlossomAuthorizationEvent.createDeleteAuth(hash, alt, signer)
+        servers: List<String> = emptyList(),
+    ): BlossomAuthorizationEvent = BlossomAuthorizationEvent.createDeleteAuth(hash, alt, signer, servers)
+
+    suspend fun createBlossomListAuth(
+        alt: String,
+        servers: List<String> = emptyList(),
+    ): BlossomAuthorizationEvent = BlossomAuthorizationEvent.createListAuth(signer, alt, servers)
 }
 
 /**

amethyst/src/main/java/com/vitorpamplona/amethyst/model/topNavFeeds/FeedTopNavFilterState.kt

@@ -74,7 +74,9 @@ class FeedTopNavFilterState(
 ) {
     fun loadFlowsFor(listName: TopFilter): IFeedFlowsType =
         when (listName) {
-            TopFilter.Global, TopFilter.Selected -> {
+            // TeleportPicker is a UI-only sentinel (intercepted by the spinner to open the
+            // map picker); it never reaches here, but fall back to Global for exhaustiveness.
+            TopFilter.Global, TopFilter.Selected, TopFilter.TeleportPicker -> {
                 GlobalFeedFlow(followsRelays, proxyRelays, relayFeeds)
             }
 

amethyst/src/main/java/com/vitorpamplona/amethyst/napplet/DataStoreNappletPermissionStore.kt

@@ -41,12 +41,21 @@ private val Context.nappletPermissionsDataStore by preferencesDataStore(name = "
  */
 class DataStoreNappletPermissionStore(
     private val dataStore: DataStore<Preferences>,
+    private val accountPubKey: () -> String,
 ) : NappletPermissionStore {
-    constructor(context: Context) : this(context.applicationContext.nappletPermissionsDataStore)
+    constructor(context: Context, accountPubKey: () -> String) :
+        this(context.applicationContext.nappletPermissionsDataStore, accountPubKey)
+
+    /**
+     * Grants belong to one account. [accountPubKey] is read at call time, so an account switch moves
+     * every read and write to that account's namespace with no rebuild — a grant made by one account
+     * can never authorize another.
+     */
+    private fun scoped(coordinate: String) = "${accountPubKey()}$SEP$coordinate"
 
     override suspend fun load(coordinate: String): Map<NappletCapability, GrantState> {
         val prefs = dataStore.data.first()
-        val prefix = "$coordinate$SEP"
+        val prefix = "${scoped(coordinate)}$SEP"
         val result = mutableMapOf<NappletCapability, GrantState>()
         for ((key, value) in prefs.asMap()) {
             val name = key.name
@@ -68,7 +77,7 @@ class DataStoreNappletPermissionStore(
     }
 
     override suspend fun clear(coordinate: String) {
-        val prefix = "$coordinate$SEP"
+        val prefix = "${scoped(coordinate)}$SEP"
         dataStore.edit { prefs ->
             val toRemove = prefs.asMap().keys.filter { it.name.startsWith(prefix) }
             toRemove.forEach { prefs.remove(it) }
@@ -78,11 +87,15 @@ class DataStoreNappletPermissionStore(
     override suspend fun all(): Map<String, Map<NappletCapability, GrantState>> {
         val prefs = dataStore.data.first()
         val result = mutableMapOf<String, MutableMap<NappletCapability, GrantState>>()
+        val accountPrefix = "${accountPubKey()}$SEP"
         for ((key, value) in prefs.asMap()) {
             val name = key.name
-            // Key is "<coordinate> <CAPABILITY>"; the capability is the final space-delimited token.
-            val capName = name.substringAfterLast(SEP, "")
-            val coordinate = name.substringBeforeLast(SEP, "")
+            // Key is "<account><SEP><coordinate><SEP><CAPABILITY>". Only the active account's grants
+            // are listed, so the Connected Apps screen never surfaces another account's permissions.
+            if (!name.startsWith(accountPrefix)) continue
+            val scoped = name.removePrefix(accountPrefix)
+            val capName = scoped.substringAfterLast(SEP, "")
+            val coordinate = scoped.substringBeforeLast(SEP, "")
             if (capName.isEmpty() || coordinate.isEmpty()) continue
             val capability = runCatching { NappletCapability.valueOf(capName) }.getOrNull() ?: continue
             val grant = runCatching { GrantState.valueOf(value as String) }.getOrNull() ?: continue
@@ -103,7 +116,7 @@ class DataStoreNappletPermissionStore(
     private fun keyOf(
         coordinate: String,
         capability: NappletCapability,
-    ) = stringPreferencesKey("$coordinate$SEP${capability.name}")
+    ) = stringPreferencesKey("${scoped(coordinate)}$SEP${capability.name}")
 
     companion object {
         private const val SEP = "\u0000"

amethyst/src/main/java/com/vitorpamplona/amethyst/napplet/DataStoreNappletStorage.kt

@@ -32,14 +32,20 @@ import kotlinx.coroutines.flow.first
 private val Context.nappletStorageDataStore by preferencesDataStore(name = "napplet_storage")
 
 /**
- * DataStore-backed [NappletStorage]. Every key is prefixed with the applet's coordinate, so one
- * napplet's keys can never collide with another's, and this store is entirely separate from the
- * app's own preferences.
+ * DataStore-backed [NappletStorage]. Every key is prefixed with the **active account** and then the
+ * applet's coordinate, so one napplet's keys can never collide with another's, one account's data is
+ * never visible to another, and this store is entirely separate from the app's own preferences.
+ *
+ * [accountPubKey] is read at call time rather than captured, so switching accounts moves reads and
+ * writes to the new namespace with no rebuild — an embedded applet always sees the current account's
+ * data and never the previous one's.
  */
 class DataStoreNappletStorage(
     private val dataStore: DataStore<Preferences>,
+    private val accountPubKey: () -> String,
 ) : NappletStorage {
-    constructor(context: Context) : this(context.applicationContext.nappletStorageDataStore)
+    constructor(context: Context, accountPubKey: () -> String) :
+        this(context.applicationContext.nappletStorageDataStore, accountPubKey)
 
     override suspend fun get(
         coordinate: String,
@@ -62,7 +68,9 @@ class DataStoreNappletStorage(
     }
 
     override suspend fun keys(coordinate: String): List<String> {
-        val prefix = "$coordinate "
+        // Must match keyOf's separator exactly. This filtered on a space while keys are written
+        // with NUL, so no key could ever match and keys() always returned an empty list.
+        val prefix = prefixOf(coordinate)
         return dataStore.data
             .first()
             .asMap()
@@ -72,8 +80,11 @@ class DataStoreNappletStorage(
             .map { it.removePrefix(prefix) }
     }
 
+    /** Account first, then applet: isolates accounts from each other, and applets within an account. */
+    private fun prefixOf(coordinate: String) = "${accountPubKey()}\u0000$coordinate\u0000"
+
     private fun keyOf(
         coordinate: String,
         key: String,
-    ) = stringPreferencesKey("$coordinate\u0000$key")
+    ) = stringPreferencesKey(prefixOf(coordinate) + key)
 }

amethyst/src/main/java/com/vitorpamplona/amethyst/napplet/NappletBrokerService.kt

@@ -34,15 +34,14 @@ import android.os.SystemClock
 import android.util.Log
 import androidx.core.net.toUri
 import com.vitorpamplona.amethyst.Amethyst
+import com.vitorpamplona.amethyst.commons.connectedApps.signers.NostrSignerPermissionLedger
 import com.vitorpamplona.amethyst.commons.favorites.FavoriteApp
 import com.vitorpamplona.amethyst.commons.napplet.NappletBroker
 import com.vitorpamplona.amethyst.commons.napplet.NappletCapability
 import com.vitorpamplona.amethyst.commons.napplet.NappletIdentity
 import com.vitorpamplona.amethyst.commons.napplet.NappletRequestRouter
-import com.vitorpamplona.amethyst.commons.napplet.permissions.NappletPermissionLedger
 import com.vitorpamplona.amethyst.commons.napplet.protocol.NappletProtocolJson
 import com.vitorpamplona.amethyst.commons.napplet.protocol.NappletResponse
-import com.vitorpamplona.amethyst.commons.napplet.signers.NostrSignerPermissionLedger
 import com.vitorpamplona.amethyst.favorites.BrowserHistoryRegistry
 import com.vitorpamplona.amethyst.favorites.BrowserIconRegistry
 import com.vitorpamplona.amethyst.favorites.FavoriteAppsRegistry
@@ -50,7 +49,7 @@ import com.vitorpamplona.amethyst.model.Account
 import com.vitorpamplona.amethyst.napplet.gateways.AccountNappletGateways
 import com.vitorpamplona.amethyst.napplethost.NappletIpc
 import com.vitorpamplona.amethyst.ui.MainActivity
-import com.vitorpamplona.amethyst.ui.screen.AccountState
+import com.vitorpamplona.quartz.nip01Core.core.HexKey
 import kotlinx.coroutines.CoroutineScope
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.Job
@@ -78,32 +77,37 @@ import kotlinx.coroutines.launch
 class NappletBrokerService : Service() {
     private val scope = CoroutineScope(SupervisorJob() + Dispatchers.IO)
 
-    // One ledger for the whole service lifetime: persistent grants on disk, session grants in RAM.
-    private val ledger by lazy { NappletPermissionLedger(Amethyst.instance.nappletPermissionStore) }
+    // Persistent grants on disk, session grants in RAM. Shared app-wide (see AppModules) so the
+    // Connected Apps screens revoke the very grants this broker consults; session grants are dropped
+    // in onDestroy, which is the "all applet surfaces closed" boundary.
+    private val ledger get() = Amethyst.instance.nappletPermissionLedger
 
     // Per-app internal-signer permission ledger (policy + per-op overrides). Lazy so it's only
     // instantiated in the main process where the signer lives; never touched from :napplet.
     private val signerLedger by lazy { NostrSignerPermissionLedger(Amethyst.instance.signerPermissionStore) }
 
-    // Per-applet sandboxed key-value store (namespaced by coordinate inside the impl).
-    private val storage by lazy { DataStoreNappletStorage(applicationContext) }
+    // Per-applet sandboxed key-value store (namespaced by account + coordinate inside the impl).
+    private val storage by lazy { DataStoreNappletStorage(applicationContext, Amethyst.instance.nappletAccountScope) }
 
     private val incoming by lazy { Messenger(Handler(Looper.getMainLooper(), ::handleMessage)) }
 
-    // The broker for the current account, rebuilt only on account switch (see broker()).
-    private var cachedBroker: Pair<Account, NappletBroker>? = null
-
-    // Live relay subscriptions, keyed by the applet's subId; reads the current account live.
-    private val liveSubscriptions = NappletLiveSubscriptions { Amethyst.instance.sessionManager.loggedInAccount() }
+    // Live relay subscriptions, keyed by the applet's subId. The account comes per-open from the
+    // requesting surface's launch token, so a surface's REQs always target the account it acts as.
+    private val liveSubscriptions = NappletLiveSubscriptions()
 
     // The app-wide inc pub/sub bus: routes inc.emit between live napplet sessions as inc.event pushes.
     private val incBus = NappletIncBus { replyTo, payload -> push(replyTo, payload) }
 
-    // Streams identity.changed pushes (account switch / connect / disconnect) to a watching applet.
+    // Streams identity.changed to a watching applet. Bound to the surface's LAUNCH account, not the
+    // app's active one: a surface acts as the account that opened it for its whole life, so switching
+    // accounts elsewhere is not an identity change *for it*. Announcing the newly-active pubkey here
+    // would tell a page it had become someone else while its signatures still came back as the
+    // original — the same desync the launch binding exists to prevent. What this does still report is
+    // that account going away (logout/removal), which emits "".
     private val identityWatch =
-        NappletIdentityWatch(scope) {
-            Amethyst.instance.sessionManager.accountContent
-                .map { (it as? AccountState.LoggedIn)?.account?.signer?.pubKey ?: "" }
+        NappletIdentityWatch(scope) { boundPubKey ->
+            Amethyst.instance.accountsCache.accounts
+                .map { loaded -> if (loaded.containsKey(boundPubKey)) boundPubKey else "" }
         }
 
     // Binding is restricted to our own UID by exported=false in the manifest, enforced by the OS.
@@ -114,6 +118,13 @@ class NappletBrokerService : Service() {
     override fun onDestroy() {
         liveSubscriptions.closeAll()
         identityWatch.stop()
+        // Every applet/browser surface has unbound, so the "session" the user granted for is over.
+        // The ledger and the broker cache are now app-wide singletons that outlive this service, so
+        // their in-memory session grants have to be dropped explicitly here — that keeps the lifetime
+        // the consent dialog promises ("allow for this session") instead of letting it become
+        // "allow until the app process dies".
+        dropCachedBroker()
+        Amethyst.instance.nappletPermissionLedger.endSession()
         // Drop any foreground holds this broker still owns so they don't leak past the service.
         synchronized(foregroundLeases) {
             repeat(foregroundLeases.size) { SandboxForegroundHold.release() }
@@ -241,7 +252,10 @@ class NappletBrokerService : Service() {
             val replyTo = msg.replyTo ?: return true
             val origin = data.getString(NappletIpc.KEY_BROWSER_ORIGIN)?.takeIf { it.isNotBlank() } ?: return true
             val identity = NappletIdentity(authorPubKey = BROWSER_IDENTITY_AUTHOR, identifier = origin)
-            val token = NappletLaunchRegistry.register(identity, setOf(NappletCapability.IDENTITY, NappletCapability.RELAY))
+            // Bind to the account active at mint time: a browser token minted for one account must
+            // never sign as another if the user switches while the page is still open.
+            val mintAccount = Amethyst.instance.sessionManager.loggedInAccount() ?: return true
+            val token = NappletLaunchRegistry.register(identity, setOf(NappletCapability.IDENTITY, NappletCapability.RELAY), mintAccount.pubKey)
             val response =
                 Message.obtain(null, NappletIpc.MSG_BROWSER_TOKEN).apply {
                     this.data =
@@ -278,17 +292,20 @@ class NappletBrokerService : Service() {
             // The shared, host-agnostic router owns decode → broker → encode and the subscribe-vs-reply
             // decision (it stays wire-identical with the future desktop host). This service only supplies
             // the broker, the Messenger transport, and the live relay subscription each Outcome implies.
-            val broker = broker()
+            // The launch token decides whose key signs — not the active account. A surface opened by
+            // one account can never be handed another's signer, even while it stays open across a switch.
+            val broker = brokerFor(session.accountPubKey)
             if (broker == null) {
-                reply(replyTo, requestId, NappletProtocolJson.encodeResponse(requestType, NappletResponse.Failed("No account is signed in.")))
+                reply(replyTo, requestId, NappletProtocolJson.encodeResponse(requestType, NappletResponse.Failed("That account is no longer signed in.")))
                 return@launch
             }
             when (val outcome = NappletRequestRouter.route(broker, identity, declared, payload)) {
                 is NappletRequestRouter.Outcome.Ignore -> {}
                 is NappletRequestRouter.Outcome.Reply -> reply(replyTo, requestId, outcome.payload)
-                is NappletRequestRouter.Outcome.OpenSubscription -> liveSubscriptions.open(outcome.subId, outcome.filters) { push(replyTo, it) }
+                is NappletRequestRouter.Outcome.OpenSubscription ->
+                    liveSubscriptions.open(outcome.subId, outcome.filters, accountFor(session.accountPubKey)) { push(replyTo, it) }
                 is NappletRequestRouter.Outcome.CloseSubscription -> liveSubscriptions.close(outcome.subId)
-                is NappletRequestRouter.Outcome.WatchIdentity -> identityWatch.start { push(replyTo, it) }
+                is NappletRequestRouter.Outcome.WatchIdentity -> identityWatch.start(session.accountPubKey) { push(replyTo, it) }
                 is NappletRequestRouter.Outcome.UnwatchIdentity -> identityWatch.stop()
                 is NappletRequestRouter.Outcome.Push -> outcome.payloads.forEach { push(replyTo, it) }
                 is NappletRequestRouter.Outcome.SubscribeInc -> incBus.subscribe(replyTo, outcome.topic)
@@ -327,28 +344,44 @@ class NappletBrokerService : Service() {
             }
     }
 
+    /** The launched-as account, or null once it is no longer loaded. */
+    private fun accountFor(accountPubKey: HexKey): Account? = Amethyst.instance.accountsCache.accounts.value[accountPubKey]
+
     /**
-     * The broker for the *currently* signed-in account, cached and rebuilt only when the account
-     * changes (reference identity). The gateways capture the account and read its flows live, so a
-     * cached broker stays correct across requests without per-request allocation.
+     * The broker for the account a surface was LAUNCHED as — [NappletLaunchRegistry.Session.accountPubKey],
+     * never whichever account is active right now.
+     *
+     * Resolving live was wrong in a way that defeated per-account isolation: a full-screen host is a
+     * separate activity that an account switch does not tear down, so its WebView kept account A's
+     * cookies while requests were signed by B. The page displayed one identity while another signed,
+     * and B's session was written into A's storage jar — after which even the embedded tab, which is
+     * rebuilt correctly, showed the wrong account.
+     *
+     * Binding to the launch account satisfies both halves of the rule with no extra machinery:
+     * embedded surfaces are torn down and re-minted on a switch, so they follow the active account,
+     * while a full-screen surface stays on the account it was opened with.
+     *
+     * Returns null when that account is no longer loaded (logged out), so requests fail closed
+     * rather than silently falling back to someone else's key.
      */
-    @Synchronized
-    private fun broker(): NappletBroker? {
-        val account = Amethyst.instance.sessionManager.loggedInAccount() ?: return null
-        cachedBroker?.let { (acc, broker) -> if (acc === account) return broker }
-        val broker =
-            AccountNappletGateways(
-                account = account,
-                context = applicationContext,
-                ledger = ledger,
-                storage = storage,
-                // Per-applet Tor decision (see NappletResourceFetcher): the shared manager routes
-                // through Tor when asked + active, and falls back to clearnet otherwise.
-                httpClient = { useProxy -> Amethyst.instance.okHttpClients.getHttpClient(useProxy) },
-                signerLedger = signerLedger,
-            ).broker()
-        cachedBroker = account to broker
-        return broker
+    private fun brokerFor(accountPubKey: HexKey): NappletBroker? {
+        val account = accountFor(accountPubKey) ?: return null
+        synchronized(brokerLock) {
+            cachedBroker?.let { (acc, broker) -> if (acc === account) return broker }
+            val broker =
+                AccountNappletGateways(
+                    account = account,
+                    context = applicationContext,
+                    ledger = ledger,
+                    storage = storage,
+                    // Per-applet Tor decision (see NappletResourceFetcher): the shared manager routes
+                    // through Tor when asked + active, and falls back to clearnet otherwise.
+                    httpClient = { useProxy -> Amethyst.instance.okHttpClients.getHttpClient(useProxy) },
+                    signerLedger = signerLedger,
+                ).broker()
+            cachedBroker = account to broker
+            return broker
+        }
     }
 
     /**
@@ -403,6 +436,38 @@ class NappletBrokerService : Service() {
     }
 
     companion object {
+        /**
+         * Guards [cachedBroker]. Both live on the companion rather than the service instance so the
+         * Connected Apps UI can reach the running broker to revoke its live session grants — the
+         * screens are plain composables with no binder to this service, and the broker is the only
+         * holder of the in-memory "allow for this session" signer grants.
+         *
+         * Main-process only, like the sibling `Napplet*Registry` objects: the `:napplet` process gets
+         * its own (unused, empty) copy of these statics and must never touch them.
+         */
+        private val brokerLock = Any()
+
+        // The broker for the current account, rebuilt only on account switch (see brokerFor()).
+        private var cachedBroker: Pair<Account, NappletBroker>? = null
+
+        /**
+         * Drops the live "allow for this session" signer grants the running broker holds for
+         * [coordinate] (the bare app coordinate). Called when the user revokes or forgets an app in
+         * Connected Apps: without it the persisted grants are cleared but the in-memory session ones
+         * keep authorizing signatures until the broker dies, so a revoked app goes on signing.
+         *
+         * No-op when no broker has been built yet (no applet has run this process).
+         */
+        suspend fun revokeSessionGrants(coordinate: String) {
+            val broker = synchronized(brokerLock) { cachedBroker?.second } ?: return
+            broker.revokeSessionGrants(coordinate)
+        }
+
+        /** Forgets the cached broker, dropping every session grant it holds. */
+        private fun dropCachedBroker() {
+            synchronized(brokerLock) { cachedBroker = null }
+        }
+
         /**
          * Sentinel "author" for a browser-mode per-origin identity. The real key is the visited origin,
          * carried in the identity's identifier (which the consent dialog shows); this constant only fills

amethyst/src/main/java/com/vitorpamplona/amethyst/napplet/NappletConsentActivity.kt

@@ -23,15 +23,19 @@ package com.vitorpamplona.amethyst.napplet
 import android.os.Bundle
 import androidx.activity.ComponentActivity
 import androidx.activity.compose.setContent
+import androidx.compose.foundation.horizontalScroll
 import androidx.compose.foundation.layout.Arrangement
 import androidx.compose.foundation.layout.Column
+import androidx.compose.foundation.layout.Row
 import androidx.compose.foundation.layout.Spacer
 import androidx.compose.foundation.layout.fillMaxWidth
 import androidx.compose.foundation.layout.height
 import androidx.compose.foundation.layout.heightIn
 import androidx.compose.foundation.layout.padding
 import androidx.compose.foundation.layout.size
+import androidx.compose.foundation.layout.width
 import androidx.compose.foundation.rememberScrollState
+import androidx.compose.foundation.shape.CircleShape
 import androidx.compose.foundation.text.selection.SelectionContainer
 import androidx.compose.foundation.verticalScroll
 import androidx.compose.material3.Button
@@ -41,11 +45,18 @@ import androidx.compose.material3.MaterialTheme
 import androidx.compose.material3.OutlinedButton
 import androidx.compose.material3.Surface
 import androidx.compose.material3.Text
+import androidx.compose.material3.TextButton
 import androidx.compose.runtime.Composable
+import androidx.compose.runtime.getValue
+import androidx.compose.runtime.mutableStateOf
+import androidx.compose.runtime.remember
+import androidx.compose.runtime.setValue
 import androidx.compose.ui.Alignment
 import androidx.compose.ui.Modifier
+import androidx.compose.ui.draw.clip
 import androidx.compose.ui.platform.LocalConfiguration
 import androidx.compose.ui.res.stringResource
+import androidx.compose.ui.text.font.FontFamily
 import androidx.compose.ui.text.style.TextAlign
 import androidx.compose.ui.unit.dp
 import androidx.compose.ui.window.Dialog
@@ -54,6 +65,7 @@ import com.vitorpamplona.amethyst.R
 import com.vitorpamplona.amethyst.commons.favorites.FavoriteApp
 import com.vitorpamplona.amethyst.commons.favorites.FavoriteAppIcon
 import com.vitorpamplona.amethyst.commons.napplet.permissions.GrantState
+import com.vitorpamplona.amethyst.ui.components.RobohashFallbackAsyncImage
 import com.vitorpamplona.amethyst.ui.theme.AmethystTheme
 
 /**
@@ -168,20 +180,74 @@ private fun NappletConsentDialog(
                     )
                 }
 
-                // Operation detail box (may include content preview)
-                if (info.operationSummary.isNotBlank()) {
+                // Operation detail box (may include content preview), plus the full event behind a
+                // toggle: the summary truncates content and cannot spell out every tag, so for kinds
+                // whose payload IS the tags (3, 5, 10000, 10002) this is the only complete disclosure.
+                if (info.operationSummary.isNotBlank() || info.rawData.isNotBlank()) {
                     Spacer(Modifier.height(12.dp))
                     Surface(
                         modifier = Modifier.padding(horizontal = 24.dp).fillMaxWidth(),
                         color = MaterialTheme.colorScheme.surfaceVariant,
                         shape = MaterialTheme.shapes.medium,
                     ) {
-                        SelectionContainer {
-                            Text(
-                                info.operationSummary,
-                                modifier = Modifier.padding(12.dp),
-                                style = MaterialTheme.typography.bodySmall,
-                            )
+                        Column(modifier = Modifier.padding(12.dp)) {
+                            if (info.operationSummary.isNotBlank()) {
+                                SelectionContainer {
+                                    Text(
+                                        info.operationSummary,
+                                        style = MaterialTheme.typography.bodySmall,
+                                    )
+                                }
+                            }
+                            // A single-account follow/mute change: show who, so the user recognizes
+                            // the face rather than parsing a name they may not read carefully.
+                            info.subject?.let { subject ->
+                                Spacer(Modifier.height(8.dp))
+                                Row(verticalAlignment = Alignment.CenterVertically) {
+                                    RobohashFallbackAsyncImage(
+                                        robot = subject.pubKey,
+                                        model = subject.pictureUrl,
+                                        contentDescription = subject.name,
+                                        modifier = Modifier.size(36.dp).clip(CircleShape),
+                                        loadProfilePicture = true,
+                                        loadRobohash = true,
+                                    )
+                                    Spacer(Modifier.width(8.dp))
+                                    Text(
+                                        subject.name,
+                                        style = MaterialTheme.typography.bodyMedium,
+                                    )
+                                }
+                            }
+                            if (info.rawData.isNotBlank()) {
+                                var showRawData by remember { mutableStateOf(false) }
+                                if (showRawData) {
+                                    Spacer(Modifier.height(8.dp))
+                                    Surface(modifier = Modifier.horizontalScroll(rememberScrollState())) {
+                                        SelectionContainer {
+                                            Text(
+                                                info.rawData,
+                                                style =
+                                                    MaterialTheme.typography.labelSmall.copy(
+                                                        fontFamily = FontFamily.Monospace,
+                                                    ),
+                                                color = MaterialTheme.colorScheme.onSurfaceVariant,
+                                                softWrap = false,
+                                            )
+                                        }
+                                    }
+                                }
+                                TextButton(onClick = { showRawData = !showRawData }) {
+                                    Text(
+                                        if (showRawData) {
+                                            stringResource(R.string.napplet_consent_hide_event)
+                                        } else {
+                                            stringResource(R.string.napplet_consent_show_event)
+                                        },
+                                        style = MaterialTheme.typography.labelSmall,
+                                    )
+                                }
+                            }
                         }
                     }
                 }

amethyst/src/main/java/com/vitorpamplona/amethyst/napplet/NappletConsentCoordinator.kt

@@ -36,6 +36,26 @@ data class NappletConsentInfo(
     /** Whether a persistent "Always allow" choice may be offered (false for per-use caps like payments). */
     val allowAlways: Boolean,
     val iconUrl: String? = null,
+    /**
+     * The full unsigned event the applet asked us to sign, pretty-printed, shown behind a
+     * "Show Event" toggle. Blank for requests that sign nothing. [operationSummary] is a lossy
+     * rendering — it truncates content and cannot spell out every tag — so this is the only place
+     * the user can see exactly what a signature would cover.
+     */
+    val rawData: String = "",
+    /**
+     * The one account a follow/mute change is about, when the change names exactly one. Rendered as
+     * an avatar + name so the user can recognize *who* at a glance instead of reading a bare count.
+     * Null for multi-account edits and every other request.
+     */
+    val subject: ConsentSubject? = null,
+)
+
+/** A single account a consent dialog is about: enough to draw an avatar and a name. */
+data class ConsentSubject(
+    val pubKey: String,
+    val name: String,
+    val pictureUrl: String?,
 )
 
 /**

amethyst/src/main/java/com/vitorpamplona/amethyst/napplet/NappletConsentSummary.kt

@@ -21,22 +21,35 @@
 package com.vitorpamplona.amethyst.napplet
 
 import android.content.Context
+import androidx.annotation.PluralsRes
+import androidx.annotation.StringRes
 import com.vitorpamplona.amethyst.R
 import com.vitorpamplona.amethyst.commons.browser.OmniboxInput
 import com.vitorpamplona.amethyst.commons.napplet.NappletCapability
 import com.vitorpamplona.amethyst.commons.napplet.NappletIdentity
 import com.vitorpamplona.amethyst.commons.napplet.protocol.NappletRequest
 import com.vitorpamplona.amethyst.favorites.BrowserIconRegistry
+import com.vitorpamplona.amethyst.model.Account
 import com.vitorpamplona.amethyst.ui.pluralStringRes
 import com.vitorpamplona.quartz.lightning.LnInvoiceUtil
+import com.vitorpamplona.quartz.nip01Core.core.fastForEach
+import com.vitorpamplona.quartz.nip02FollowList.ContactListEvent
+import com.vitorpamplona.quartz.nip09Deletions.DeletionEvent
+import com.vitorpamplona.quartz.nip51Lists.muteList.MuteListEvent
+import com.vitorpamplona.quartz.nip65RelayList.AdvertisedRelayListEvent
 
 /**
  * Turns a pending [NappletRequest] into the human-readable [NappletConsentInfo] the consent dialog
  * shows — the applet's title, the capability label, and a per-operation summary (e.g. a note preview
- * or a sat amount). Localized via app resources; holds only a [Context], no account state.
+ * or a sat amount). Localized via app resources.
+ *
+ * Reads [account] only to diff a proposed replaceable list (follows, relays, mutes) against the copy
+ * already cached there, so the dialog can say what a signature would actually change. It never signs,
+ * mutates, or exposes account state — the values it reads are the user's own public lists.
  */
 class NappletConsentSummary(
     private val context: Context,
+    private val account: Account,
 ) {
     fun info(
         identity: NappletIdentity,
@@ -51,16 +64,196 @@ class NappletConsentSummary(
             } else {
                 resolveNappletMeta(identity.authorPubKey, identity.identifier, untitled)
             }
+        val consequence = consequenceFor(request)
         return NappletConsentInfo(
             appletTitle = title,
             coordinate = identity.coordinate,
             capabilityLabel = context.getString(capability.labelRes()),
-            operationSummary = summaryFor(request),
+            operationSummary = listOfNotNull(summaryFor(request).ifBlank { null }, consequence?.text).joinToString("\n\n"),
             allowAlways = capability.canGrantAlways,
             iconUrl = iconUrl,
+            rawData = rawEventFor(request),
+            subject = consequence?.subject,
         )
     }
 
+    /**
+     * Pretty-prints the unsigned event behind the consent dialog's "Show Event" toggle. Only the
+     * signing requests carry one; everything else has nothing to disclose.
+     */
+    private fun rawEventFor(request: NappletRequest): String =
+        when (request) {
+            is NappletRequest.Publish -> rawEvent(request.kind, request.tags, request.content, null)
+            is NappletRequest.SignEvent -> rawEvent(request.kind, request.tags, request.content, request.createdAt)
+            else -> ""
+        }
+
+    private fun rawEvent(
+        kind: Int,
+        tags: Array<Array<String>>,
+        content: String,
+        createdAt: Long?,
+    ): String =
+        buildString {
+            append("kind: ").append(kind).append('\n')
+            createdAt?.let { append("created_at: ").append(it).append('\n') }
+            append("tags:")
+            if (tags.isEmpty()) {
+                append(" []\n")
+            } else {
+                append('\n')
+                tags.fastForEach { tag -> append("  ").append(tag.joinToString(", ", "[", "]")).append('\n') }
+            }
+            append("content: ").append(content.ifEmpty { "(empty)" })
+        }
+
+    /** A consequence line, plus the single account it is about when the change names exactly one. */
+    private data class Consequence(
+        val text: String,
+        val subject: ConsentSubject? = null,
+    )
+
+    /**
+     * A plain-language warning for the kinds whose payload lives entirely in the tags. Without this
+     * the dialog reads "publish a kind 3 event" while the user is actually about to replace their
+     * whole social graph — the summary would be technically true and practically useless.
+     */
+    private fun consequenceFor(request: NappletRequest): Consequence? =
+        when (request) {
+            is NappletRequest.Publish -> consequenceFor(request.kind, request.tags)
+            is NappletRequest.SignEvent -> consequenceFor(request.kind, request.tags)
+            else -> null
+        }
+
+    private fun consequenceFor(
+        kind: Int,
+        tags: Array<Array<String>>,
+    ): Consequence? =
+        when (kind) {
+            ContactListEvent.KIND ->
+                diffOf(
+                    current = account.kind3FollowList.getFollowListEvent()?.tags,
+                    proposed = tags,
+                    tagName = "p",
+                    template = R.string.napplet_consent_diff_follows,
+                    added = R.plurals.napplet_consent_diff_follow_added,
+                    removed = R.plurals.napplet_consent_diff_follow_removed,
+                    oneAdded = R.string.napplet_consent_diff_follow_one,
+                    oneRemoved = R.string.napplet_consent_diff_unfollow_one,
+                )
+            AdvertisedRelayListEvent.KIND ->
+                diffOf(
+                    current = account.nip65RelayList.getNIP65RelayList()?.tags,
+                    proposed = tags,
+                    tagName = "r",
+                    template = R.string.napplet_consent_diff_relays,
+                    added = R.plurals.napplet_consent_diff_relay_added,
+                    removed = R.plurals.napplet_consent_diff_relay_removed,
+                )
+            // Public entries only: a mute list also carries encrypted ones, which are not in `tags`
+            // and so cannot be diffed here.
+            MuteListEvent.KIND ->
+                diffOf(
+                    current = account.muteList.getMuteList()?.tags,
+                    proposed = tags,
+                    tagName = "p",
+                    template = R.string.napplet_consent_diff_mutes,
+                    added = R.plurals.napplet_consent_diff_mute_added,
+                    removed = R.plurals.napplet_consent_diff_mute_removed,
+                    oneAdded = R.string.napplet_consent_diff_mute_one,
+                    oneRemoved = R.string.napplet_consent_diff_unmute_one,
+                )
+            // Deletions have no prior version to compare against — the tags are the whole request.
+            DeletionEvent.KIND ->
+                pluralFor(R.plurals.napplet_consent_effect_deletes, countTag(tags, "e") + countTag(tags, "a"))
+                    ?.let { Consequence(it) }
+            // Any other kind: at least tell the user tags exist and can be inspected, so an empty
+            // content preview never reads as "there is nothing else here".
+            else ->
+                if (tags.isNotEmpty()) {
+                    pluralFor(R.plurals.napplet_consent_effect_tags, tags.size)?.let { Consequence(it) }
+                } else {
+                    null
+                }
+        }
+
+    /**
+     * Describes what a proposed replaceable list changes relative to the copy already on the account.
+     * A bare total ("a list of 12 accounts") hides the dangerous case: the alarming edit is a list
+     * that silently drops 130 follows, and only a diff surfaces that. Falls back to the total when
+     * nothing is cached to compare against.
+     */
+    private fun diffOf(
+        current: Array<Array<String>>?,
+        proposed: Array<Array<String>>,
+        tagName: String,
+        @StringRes template: Int,
+        @PluralsRes added: Int,
+        @PluralsRes removed: Int,
+        @StringRes oneAdded: Int? = null,
+        @StringRes oneRemoved: Int? = null,
+    ): Consequence {
+        val next = valuesOf(proposed, tagName)
+        val previous =
+            current?.let { valuesOf(it, tagName) }
+                ?: return Consequence(pluralStringRes(context, R.plurals.napplet_consent_diff_no_baseline, next.size, next.size))
+
+        val addedKeys = next.filter { it !in previous }
+        val removedKeys = previous.filter { it !in next }
+        if (addedKeys.isEmpty() && removedKeys.isEmpty()) {
+            return Consequence(context.getString(R.string.napplet_consent_diff_none))
+        }
+
+        // The overwhelmingly common edit is a single follow/unfollow. Naming and picturing that one
+        // account is far more use than "follows 1 new account" — the user can tell at a glance
+        // whether it is who they expected.
+        if (oneAdded != null && addedKeys.size == 1 && removedKeys.isEmpty()) {
+            subjectOf(addedKeys.first())?.let { return Consequence(context.getString(oneAdded, it.name), it) }
+        }
+        if (oneRemoved != null && removedKeys.size == 1 && addedKeys.isEmpty()) {
+            subjectOf(removedKeys.first())?.let { return Consequence(context.getString(oneRemoved, it.name), it) }
+        }
+
+        val parts = listOfNotNull(pluralFor(added, addedKeys.size), pluralFor(removed, removedKeys.size))
+        val summary =
+            if (parts.size == 2) {
+                context.getString(R.string.napplet_consent_diff_joiner, parts[0], parts[1])
+            } else {
+                parts.first()
+            }
+        return Consequence(context.getString(template, summary))
+    }
+
+    /** Resolves a pubkey to a name + picture for the dialog, or null when the user isn't cached. */
+    private fun subjectOf(pubKey: String): ConsentSubject? {
+        val user = account.cache.getUserIfExists(pubKey) ?: return null
+        return ConsentSubject(
+            pubKey = pubKey,
+            name = user.toBestDisplayName(),
+            pictureUrl = user.profilePicture(),
+        )
+    }
+
+    /** The distinct values of every `[tagName, value, …]` tag. */
+    private fun valuesOf(
+        tags: Array<Array<String>>,
+        tagName: String,
+    ): Set<String> {
+        val out = mutableSetOf<String>()
+        tags.fastForEach { if (it.size > 1 && it[0] == tagName) out.add(it[1]) }
+        return out
+    }
+
+    private fun pluralFor(
+        resId: Int,
+        count: Int,
+    ): String? = if (count <= 0) null else pluralStringRes(context, resId, count, count)
+
+    private fun countTag(
+        tags: Array<Array<String>>,
+        name: String,
+    ): Int = tags.count { it.isNotEmpty() && it[0] == name }
+
     private fun summaryFor(request: NappletRequest): String =
         when (request) {
             is NappletRequest.GetPublicKey -> context.getString(R.string.napplet_consent_get_pubkey)
@@ -91,11 +284,14 @@ class NappletConsentSummary(
             }
             is NappletRequest.NotifyList, is NappletRequest.NotifyDismiss -> context.getString(R.string.napplet_consent_notify)
             is NappletRequest.PayInvoice -> {
+                // getAmountInSats returns ZERO (not null, not a throw) for an amountless BOLT11, so a
+                // naive read renders "pay 0 sats" — telling the user a payment is free when the amount
+                // is in fact unspecified and decided by the payee. Treat non-positive as "no amount".
                 val sats = runCatching { LnInvoiceUtil.getAmountInSats(request.invoice).toLong() }.getOrNull()
-                if (sats != null) {
+                if (sats != null && sats > 0) {
                     pluralStringRes(context, R.plurals.napplet_consent_pay_amount, sats.toInt(), sats)
                 } else {
-                    context.getString(R.string.napplet_consent_pay)
+                    context.getString(R.string.napplet_consent_pay_no_amount)
                 }
             }
             is NappletRequest.ResourceBytes -> context.getString(R.string.napplet_consent_resource)

amethyst/src/main/java/com/vitorpamplona/amethyst/napplet/NappletIdentityWatch.kt

@@ -39,15 +39,18 @@ import kotlinx.coroutines.launch
  */
 class NappletIdentityWatch(
     private val scope: CoroutineScope,
-    private val pubKey: () -> Flow<String>,
+    private val pubKey: (boundPubKey: String) -> Flow<String>,
 ) {
     private var job: Job? = null
 
-    fun start(push: (String) -> Unit) {
+    fun start(
+        boundPubKey: String,
+        push: (String) -> Unit,
+    ) {
         stop()
         job =
             scope.launch {
-                pubKey()
+                pubKey(boundPubKey)
                     .distinctUntilChanged()
                     .drop(1)
                     .collect { push(NappletProtocolJson.encodeIdentityChanged(it)) }

amethyst/src/main/java/com/vitorpamplona/amethyst/napplet/NappletLaunchRegistry.kt

@@ -22,6 +22,7 @@ package com.vitorpamplona.amethyst.napplet
 
 import com.vitorpamplona.amethyst.commons.napplet.NappletCapability
 import com.vitorpamplona.amethyst.commons.napplet.NappletIdentity
+import com.vitorpamplona.quartz.nip01Core.core.HexKey
 import com.vitorpamplona.quartz.nip01Core.core.toHexKey
 import java.security.SecureRandom
 
@@ -45,6 +46,18 @@ object NappletLaunchRegistry {
     data class Session(
         val identity: NappletIdentity,
         val declared: Set<NappletCapability>,
+        /**
+         * The account this surface was launched as. Requests resolve their signer through THIS, not
+         * through whichever account happens to be active when they arrive.
+         *
+         * A full-screen host is a separate activity that an account switch does not tear down, so
+         * resolving live meant its WebView kept account A's cookies while the broker signed as B —
+         * a page showing one identity while another signed, and B's session written into A's
+         * storage jar. Binding here gives both halves of the rule for free: embedded surfaces are
+         * rebuilt on a switch, so they re-mint and follow the active account, while a full-screen
+         * surface keeps the account it was opened with.
+         */
+        val accountPubKey: HexKey,
     )
 
     // Access-ordered + capped so tokens from long-closed napplets can't accumulate without bound. The
@@ -60,9 +73,10 @@ object NappletLaunchRegistry {
     fun register(
         identity: NappletIdentity,
         declared: Set<NappletCapability>,
+        accountPubKey: HexKey,
     ): String {
         val token = ByteArray(32).also(secureRandom::nextBytes).toHexKey()
-        sessions[token] = Session(identity, declared)
+        sessions[token] = Session(identity, declared, accountPubKey)
         return token
     }
 

amethyst/src/main/java/com/vitorpamplona/amethyst/napplet/NappletLauncher.kt

@@ -120,7 +120,16 @@ object NappletLauncher {
         // requests back to THIS identity + declared set, regardless of anything the sandbox sends.
         val identity = NappletIdentity(authorPubKey = authorPubKey, identifier = identifier, aggregateHash = aggregateHash)
         val declared = profile.declaredCapabilities(requires)
-        val launchToken = NappletLaunchRegistry.register(identity, declared)
+        // Bound to the account launching it, so the surface keeps signing as that account even if the
+        // user switches while it is open (an embedded surface is rebuilt on a switch and re-mints).
+        // An empty key can never match a loaded account, so a launch with nobody signed in fails
+        // closed at the broker rather than falling back to whoever signs in later.
+        val launchAccountPubKey =
+            Amethyst.instance.sessionManager
+                .loggedInAccount()
+                ?.pubKey
+                .orEmpty()
+        val launchToken = NappletLaunchRegistry.register(identity, declared, launchAccountPubKey)
 
         // Resolve the per-site network choice (Tor default; a site can be opted out to the open web).
         // Locked napplets always keep Tor for their blob fetches — only nSites expose the toggle.
@@ -156,6 +165,9 @@ object NappletLauncher {
             putString(NappletHostContract.EXTRA_HOST_PROFILE, profile.name)
             putBoolean(NappletHostContract.EXTRA_USE_TOR, useTor)
             putString(NappletHostContract.EXTRA_THEME, theme)
+            // Opaque per-account storage partition, so a napplet/nSite can't carry one npub's cookies
+            // and localStorage into another. Derived here (the sandbox never sees the pubkey).
+            putString(NappletHostContract.EXTRA_WEBVIEW_PROFILE, NappletWebViewProfiles.current())
         }
     }
 }

amethyst/src/main/java/com/vitorpamplona/amethyst/napplet/NappletLiveSubscriptions.kt

@@ -38,12 +38,13 @@ import java.util.concurrent.atomic.AtomicInteger
  * `relay.eose`. Encodes the `relay.event`/`relay.eose`/`relay.closed` pushes and hands them to the
  * caller-supplied sink — it never touches the transport itself.
  *
- * [account] is read live (so it always targets the currently signed-in account); [open] is reached
- * only after the broker authorized the subscription (RELAY consent).
+ * The account is supplied per [open] by the caller, which resolves it from the requesting surface's
+ * LAUNCH account — not from whoever is signed in at the time. A full-screen surface survives an
+ * account switch, and reading live would have pointed its REQs at the new account's relays while its
+ * signatures still came from the old one. [open] is reached only after the broker authorized the
+ * subscription (RELAY consent).
  */
-class NappletLiveSubscriptions(
-    private val account: () -> Account?,
-) {
+class NappletLiveSubscriptions {
     private val liveSubs = ConcurrentHashMap<String, LiveSub>()
     private val liveSeq = AtomicInteger(0)
 
@@ -62,9 +63,9 @@ class NappletLiveSubscriptions(
     fun open(
         nappletSubId: String,
         filters: List<Filter>,
+        account: Account?,
         push: (String) -> Unit,
     ) {
-        val account = account()
         val relays = account?.homeRelays?.flow?.value ?: emptySet()
         if (account == null || filters.isEmpty() || relays.isEmpty()) {
             push(NappletProtocolJson.encodeRelayEose(nappletSubId))

amethyst/src/main/java/com/vitorpamplona/amethyst/napplet/NappletSignerConsentActivity.kt

@@ -1,325 +0,0 @@
-/*
- * Copyright (c) 2025 Vitor Pamplona
- *
- * Permission is hereby granted, free of charge, to any person obtaining a copy of
- * this software and associated documentation files (the "Software"), to deal in
- * the Software without restriction, including without limitation the rights to use,
- * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
- * Software, and to permit persons to whom the Software is furnished to do so,
- * subject to the following conditions:
- *
- * The above copyright notice and this permission notice shall be included in all
- * copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
- * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
- * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
- * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
- * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
- */
-package com.vitorpamplona.amethyst.napplet
-
-import android.os.Bundle
-import androidx.activity.ComponentActivity
-import androidx.activity.compose.setContent
-import androidx.compose.foundation.horizontalScroll
-import androidx.compose.foundation.layout.Arrangement
-import androidx.compose.foundation.layout.Box
-import androidx.compose.foundation.layout.Column
-import androidx.compose.foundation.layout.PaddingValues
-import androidx.compose.foundation.layout.Row
-import androidx.compose.foundation.layout.Spacer
-import androidx.compose.foundation.layout.fillMaxWidth
-import androidx.compose.foundation.layout.height
-import androidx.compose.foundation.layout.heightIn
-import androidx.compose.foundation.layout.padding
-import androidx.compose.foundation.layout.size
-import androidx.compose.foundation.rememberScrollState
-import androidx.compose.foundation.text.selection.SelectionContainer
-import androidx.compose.foundation.verticalScroll
-import androidx.compose.material3.Button
-import androidx.compose.material3.ButtonDefaults
-import androidx.compose.material3.HorizontalDivider
-import androidx.compose.material3.MaterialTheme
-import androidx.compose.material3.OutlinedButton
-import androidx.compose.material3.Surface
-import androidx.compose.material3.Text
-import androidx.compose.material3.TextButton
-import androidx.compose.runtime.Composable
-import androidx.compose.runtime.getValue
-import androidx.compose.runtime.mutableStateOf
-import androidx.compose.runtime.remember
-import androidx.compose.runtime.setValue
-import androidx.compose.ui.Alignment
-import androidx.compose.ui.Modifier
-import androidx.compose.ui.platform.LocalConfiguration
-import androidx.compose.ui.res.stringResource
-import androidx.compose.ui.text.font.FontFamily
-import androidx.compose.ui.text.style.TextAlign
-import androidx.compose.ui.unit.dp
-import androidx.compose.ui.window.Dialog
-import androidx.compose.ui.window.DialogProperties
-import com.vitorpamplona.amethyst.R
-import com.vitorpamplona.amethyst.commons.favorites.FavoriteApp
-import com.vitorpamplona.amethyst.commons.favorites.FavoriteAppIcon
-import com.vitorpamplona.amethyst.commons.icons.symbols.Icon
-import com.vitorpamplona.amethyst.commons.icons.symbols.MaterialSymbols
-import com.vitorpamplona.amethyst.commons.napplet.signers.SignerOpGrant
-import com.vitorpamplona.amethyst.ui.theme.AmethystTheme
-import com.vitorpamplona.quartz.utils.TimeUtils
-
-class NappletSignerConsentActivity : ComponentActivity() {
-    private var token: String? = null
-    private var decided = false
-
-    override fun onCreate(savedInstanceState: Bundle?) {
-        super.onCreate(savedInstanceState)
-        val token = intent.getStringExtra(NappletSignerConsentCoordinator.EXTRA_TOKEN)
-        this.token = token
-        val info = token?.let { NappletSignerConsentCoordinator.infoFor(it) }
-        if (token == null || info == null) {
-            finish()
-            return
-        }
-
-        setContent {
-            AmethystTheme {
-                NappletSignerConsentDialog(
-                    info = info,
-                    onGrant = { grant ->
-                        decided = true
-                        NappletSignerConsentCoordinator.complete(token, grant)
-                        finish()
-                    },
-                    onDismiss = {
-                        decided = true
-                        NappletSignerConsentCoordinator.cancel(token)
-                        finish()
-                    },
-                )
-            }
-        }
-    }
-
-    override fun finish() {
-        if (!decided) token?.let { NappletSignerConsentCoordinator.cancel(it) }
-        super.finish()
-    }
-}
-
-@Composable
-private fun NappletSignerConsentDialog(
-    info: NappletSignerConsentInfo,
-    onGrant: (SignerOpGrant) -> Unit,
-    onDismiss: () -> Unit,
-) {
-    var showRawData by remember { mutableStateOf(false) }
-    var showMoreOptions by remember { mutableStateOf(false) }
-    val scrollState = rememberScrollState()
-    val maxHeight = LocalConfiguration.current.screenHeightDp.dp * 0.85f
-
-    Dialog(
-        onDismissRequest = onDismiss,
-        properties = DialogProperties(usePlatformDefaultWidth = false),
-    ) {
-        Surface(
-            modifier =
-                Modifier
-                    .fillMaxWidth()
-                    .padding(horizontal = 16.dp)
-                    .heightIn(max = maxHeight),
-            shape = MaterialTheme.shapes.extraLarge,
-            color = MaterialTheme.colorScheme.surface,
-            tonalElevation = 6.dp,
-        ) {
-            Column(
-                modifier =
-                    Modifier
-                        .verticalScroll(scrollState)
-                        .padding(vertical = 24.dp),
-            ) {
-                // Centered header: icon + title + description
-                Column(
-                    modifier = Modifier.fillMaxWidth().padding(horizontal = 24.dp),
-                    horizontalAlignment = Alignment.CenterHorizontally,
-                    verticalArrangement = Arrangement.spacedBy(8.dp),
-                ) {
-                    val isBrowser = info.coordinate.startsWith("browser:")
-                    FavoriteAppIcon(
-                        app =
-                            if (isBrowser) {
-                                FavoriteApp.WebApp(info.coordinate.substringAfter(':'), info.appletTitle, 0L, info.iconUrl)
-                            } else {
-                                FavoriteApp.NostrApp(info.coordinate, info.appletTitle, 0L, info.iconUrl)
-                            },
-                        tint = MaterialTheme.colorScheme.onPrimaryContainer,
-                        modifier = Modifier.size(56.dp),
-                    )
-                    Text(
-                        info.appletTitle,
-                        style = MaterialTheme.typography.titleLarge,
-                        textAlign = TextAlign.Center,
-                    )
-                    Text(
-                        stringResource(R.string.napplet_consent_wants_to, info.operationSummary),
-                        style = MaterialTheme.typography.bodyMedium,
-                        color = MaterialTheme.colorScheme.onSurfaceVariant,
-                        textAlign = TextAlign.Center,
-                    )
-                    Text(
-                        info.coordinate.substringAfter(':', "").ifBlank { info.coordinate.substringBefore(':').take(12) + "…" },
-                        style = MaterialTheme.typography.labelSmall,
-                        color = MaterialTheme.colorScheme.onSurfaceVariant,
-                        textAlign = TextAlign.Center,
-                    )
-                }
-
-                val hasContent = info.contentPreview.isNotBlank() || info.rawData.isNotBlank()
-                if (hasContent) {
-                    Spacer(Modifier.height(12.dp))
-                    Surface(
-                        modifier =
-                            Modifier
-                                .padding(horizontal = 24.dp)
-                                .fillMaxWidth(),
-                        color = MaterialTheme.colorScheme.surfaceVariant,
-                        shape = MaterialTheme.shapes.medium,
-                    ) {
-                        Column(modifier = Modifier.padding(12.dp)) {
-                            if (info.contentPreview.isNotBlank()) {
-                                Text(
-                                    "“${info.contentPreview}”",
-                                    style = MaterialTheme.typography.bodySmall,
-                                )
-                            }
-                            if (info.rawData.isNotBlank()) {
-                                if (showRawData) {
-                                    Spacer(Modifier.height(8.dp))
-                                    Box(modifier = Modifier.horizontalScroll(rememberScrollState())) {
-                                        SelectionContainer {
-                                            Text(
-                                                info.rawData,
-                                                style =
-                                                    MaterialTheme.typography.labelSmall.copy(
-                                                        fontFamily = FontFamily.Monospace,
-                                                    ),
-                                                color = MaterialTheme.colorScheme.onSurfaceVariant,
-                                                softWrap = false,
-                                            )
-                                        }
-                                    }
-                                }
-                                TextButton(
-                                    onClick = { showRawData = !showRawData },
-                                    contentPadding = PaddingValues(horizontal = 4.dp, vertical = 0.dp),
-                                ) {
-                                    Text(
-                                        if (showRawData) {
-                                            stringResource(R.string.napplet_consent_hide_event)
-                                        } else {
-                                            stringResource(R.string.napplet_consent_show_event)
-                                        },
-                                        style = MaterialTheme.typography.labelSmall,
-                                    )
-                                }
-                            }
-                        }
-                    }
-                }
-
-                Spacer(Modifier.height(16.dp))
-                HorizontalDivider()
-                Spacer(Modifier.height(8.dp))
-
-                // Primary: always allow this op
-                Button(
-                    onClick = { onGrant(SignerOpGrant.AllowForOp(info.op)) },
-                    modifier = Modifier.fillMaxWidth().padding(horizontal = 24.dp),
-                ) {
-                    Text(stringResource(R.string.napplet_consent_allow_always))
-                }
-
-                // Secondary: allow just once
-                OutlinedButton(
-                    onClick = { onGrant(SignerOpGrant.AllowOnce) },
-                    modifier = Modifier.fillMaxWidth().padding(horizontal = 24.dp),
-                ) {
-                    Text(stringResource(R.string.napplet_signer_allow_once))
-                }
-
-                // "More options" toggle: session and time-bound grants
-                TextButton(
-                    onClick = { showMoreOptions = !showMoreOptions },
-                    modifier = Modifier.fillMaxWidth(),
-                    contentPadding = PaddingValues(horizontal = 24.dp, vertical = 8.dp),
-                ) {
-                    Row(
-                        verticalAlignment = Alignment.CenterVertically,
-                        horizontalArrangement = Arrangement.spacedBy(4.dp),
-                    ) {
-                        Text(
-                            if (showMoreOptions) {
-                                stringResource(R.string.napplet_consent_fewer_options)
-                            } else {
-                                stringResource(R.string.napplet_consent_more_options)
-                            },
-                            style = MaterialTheme.typography.bodyMedium,
-                        )
-                        Icon(
-                            if (showMoreOptions) MaterialSymbols.ExpandLess else MaterialSymbols.ExpandMore,
-                            contentDescription = null,
-                            modifier = Modifier.size(18.dp),
-                        )
-                    }
-                }
-
-                if (showMoreOptions) {
-                    OutlinedButton(
-                        onClick = { onGrant(SignerOpGrant.AllowForSession(info.op)) },
-                        modifier = Modifier.fillMaxWidth().padding(horizontal = 24.dp),
-                    ) {
-                        Text(stringResource(R.string.napplet_signer_allow_session))
-                    }
-                    OutlinedButton(
-                        onClick = { onGrant(SignerOpGrant.AllowUntil(info.op, TimeUtils.now() + 86_400L)) },
-                        modifier = Modifier.fillMaxWidth().padding(horizontal = 24.dp),
-                    ) {
-                        Text(stringResource(R.string.napplet_signer_allow_24h))
-                    }
-                    OutlinedButton(
-                        onClick = { onGrant(SignerOpGrant.AllowUntil(info.op, TimeUtils.now() + 30L * 86_400L)) },
-                        modifier = Modifier.fillMaxWidth().padding(horizontal = 24.dp),
-                    ) {
-                        Text(stringResource(R.string.napplet_signer_allow_30d))
-                    }
-                    OutlinedButton(
-                        onClick = { onGrant(SignerOpGrant.AllowAll) },
-                        modifier = Modifier.fillMaxWidth().padding(horizontal = 24.dp),
-                    ) {
-                        Text(stringResource(R.string.napplet_signer_allow_all))
-                    }
-                }
-
-                Spacer(Modifier.height(4.dp))
-                HorizontalDivider()
-                Spacer(Modifier.height(8.dp))
-
-                OutlinedButton(
-                    onClick = { onGrant(SignerOpGrant.DenyOnce) },
-                    modifier = Modifier.fillMaxWidth().padding(horizontal = 24.dp),
-                    colors = ButtonDefaults.outlinedButtonColors(contentColor = MaterialTheme.colorScheme.error),
-                ) {
-                    Text(stringResource(R.string.napplet_signer_deny_once))
-                }
-                OutlinedButton(
-                    onClick = { onGrant(SignerOpGrant.DenyForOp(info.op)) },
-                    modifier = Modifier.fillMaxWidth().padding(horizontal = 24.dp),
-                    colors = ButtonDefaults.outlinedButtonColors(contentColor = MaterialTheme.colorScheme.error),
-                ) {
-                    Text(stringResource(R.string.napplet_signer_deny_op, info.operationSummary))
-                }
-            }
-        }
-    }
-}

amethyst/src/main/java/com/vitorpamplona/amethyst/napplet/NappletSignerConsentCoordinator.kt

@@ -1,94 +0,0 @@
-/*
- * Copyright (c) 2025 Vitor Pamplona
- *
- * Permission is hereby granted, free of charge, to any person obtaining a copy of
- * this software and associated documentation files (the "Software"), to deal in
- * the Software without restriction, including without limitation the rights to use,
- * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
- * Software, and to permit persons to whom the Software is furnished to do so,
- * subject to the following conditions:
- *
- * The above copyright notice and this permission notice shall be included in all
- * copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
- * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
- * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
- * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
- * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
- */
-package com.vitorpamplona.amethyst.napplet
-
-import android.content.Context
-import android.content.Intent
-import com.vitorpamplona.amethyst.commons.napplet.signers.NostrSignerOp
-import com.vitorpamplona.amethyst.commons.napplet.signers.SignerOpGrant
-import kotlinx.coroutines.CompletableDeferred
-import java.util.UUID
-import java.util.concurrent.ConcurrentHashMap
-
-/** Everything the per-operation consent dialog needs to render. */
-data class NappletSignerConsentInfo(
-    val appletTitle: String,
-    val coordinate: String,
-    val op: NostrSignerOp,
-    val operationSummary: String,
-    /** Short excerpt shown in the dialog body (≤ 160 chars). */
-    val contentPreview: String,
-    /**
-     * Full raw content for the "See more" toggle — event JSON for sign/encrypt operations,
-     * decrypted plaintext for decrypt (Amethyst decrypts first, then asks permission to expose).
-     */
-    val rawData: String = "",
-    val iconUrl: String? = null,
-)
-
-/**
- * Bridges the broker to the per-operation signer consent UI.
- * A dismissed dialog resolves to [SignerOpGrant.DenyOnce] — fails closed.
- */
-object NappletSignerConsentCoordinator {
-    private class Pending(
-        val info: NappletSignerConsentInfo,
-        val deferred: CompletableDeferred<SignerOpGrant>,
-    )
-
-    private val pending = ConcurrentHashMap<String, Pending>()
-
-    suspend fun requestConsent(
-        context: Context,
-        info: NappletSignerConsentInfo,
-    ): SignerOpGrant {
-        val token = UUID.randomUUID().toString()
-        val deferred = CompletableDeferred<SignerOpGrant>()
-        pending[token] = Pending(info, deferred)
-
-        context.startActivity(
-            Intent(context, NappletSignerConsentActivity::class.java)
-                .addFlags(Intent.FLAG_ACTIVITY_NEW_TASK)
-                .putExtra(EXTRA_TOKEN, token),
-        )
-
-        return try {
-            deferred.await()
-        } finally {
-            pending.remove(token)
-        }
-    }
-
-    fun infoFor(token: String): NappletSignerConsentInfo? = pending[token]?.info
-
-    fun complete(
-        token: String,
-        grant: SignerOpGrant,
-    ) {
-        pending[token]?.deferred?.complete(grant)
-    }
-
-    fun cancel(token: String) {
-        pending[token]?.deferred?.complete(SignerOpGrant.DenyOnce)
-    }
-
-    const val EXTRA_TOKEN = "napplet_signer_consent_token"
-}

amethyst/src/main/java/com/vitorpamplona/amethyst/napplet/NappletWebViewProfiles.kt

@@ -0,0 +1,63 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.napplet
+
+import com.vitorpamplona.amethyst.Amethyst
+import com.vitorpamplona.quartz.nip01Core.core.HexKey
+import com.vitorpamplona.quartz.nip01Core.core.toHexKey
+import java.security.MessageDigest
+
+/**
+ * Mints the opaque per-account WebView storage-profile name the sandbox partitions cookies,
+ * localStorage, IndexedDB and service workers by.
+ *
+ * Every embedded app follows the currently-selected account, and each account gets its OWN storage
+ * jar: switching from A to B hands B a clean jar, switching back to A restores A's session intact
+ * (this is a partition, not a wipe).
+ *
+ * The name is a hash rather than the pubkey because the `:napplet` sandbox must never learn which
+ * account it is running for — it only gets a stable, meaningless token. Stability is what makes
+ * sessions survive a switch, so the derivation must never change once shipped.
+ *
+ * The applying half lives in `:nappletHost` (`NappletWebViewProfile`), which validates the shape
+ * before handing it to `ProfileStore`.
+ */
+object NappletWebViewProfiles {
+    /** Domain separator so this hash can never collide with another use of SHA-256(pubkey). */
+    private const val DOMAIN = "amethyst-webview-profile-v1:"
+
+    /** 128 bits of a SHA-256 is far past collision-proof for a handful of on-device accounts. */
+    private const val NAME_LENGTH = 32
+
+    /** The profile name for the account embedded apps currently run as, or null when logged out. */
+    fun current(): String? = forPubKey(Amethyst.instance.nappletAccountScope())
+
+    /** Stable profile name for [pubKey]; null for a blank scope (no account -> shared default jar). */
+    fun forPubKey(pubKey: HexKey): String? {
+        if (pubKey.isBlank()) return null
+
+        return MessageDigest
+            .getInstance("SHA-256")
+            .digest((DOMAIN + pubKey).toByteArray())
+            .toHexKey()
+            .take(NAME_LENGTH)
+    }
+}

amethyst/src/main/java/com/vitorpamplona/amethyst/napplet/NostrSignerOpLabels.kt

@@ -23,13 +23,20 @@ package com.vitorpamplona.amethyst.napplet
 import android.content.Context
 import com.vitorpamplona.amethyst.R
 import com.vitorpamplona.amethyst.commons.browser.OmniboxInput
+import com.vitorpamplona.amethyst.commons.connectedApps.signers.NostrSignerOp
+import com.vitorpamplona.amethyst.commons.napplet.NappletCapability
 import com.vitorpamplona.amethyst.commons.napplet.NappletIdentity
 import com.vitorpamplona.amethyst.commons.napplet.protocol.NappletRequest
-import com.vitorpamplona.amethyst.commons.napplet.signers.NostrSignerOp
+import com.vitorpamplona.amethyst.connectedApps.consent.SignerConnectInfo
+import com.vitorpamplona.amethyst.connectedApps.consent.SignerConsentInfo
 import com.vitorpamplona.amethyst.favorites.BrowserIconRegistry
+import com.vitorpamplona.amethyst.model.LocalCache
 import com.vitorpamplona.amethyst.ui.screen.loggedIn.relays.kindNameFor
+import com.vitorpamplona.quartz.nip01Core.core.Event
+import com.vitorpamplona.quartz.nip01Core.core.HexKey
 import com.vitorpamplona.quartz.nip01Core.jackson.JacksonMapper
 import com.vitorpamplona.quartz.nip01Core.signers.EventTemplate
+import com.vitorpamplona.quartz.nip19Bech32.entities.NPub
 import com.vitorpamplona.quartz.utils.TimeUtils
 
 /** Human-readable label for a [NostrSignerOp]. */
@@ -38,15 +45,31 @@ fun NostrSignerOp.label(context: Context): String =
         is NostrSignerOp.SignKind -> context.getString(R.string.napplet_op_sign_kind_named, kindNameFor(context, kind), kind)
         NostrSignerOp.Encrypt -> context.getString(R.string.napplet_op_encrypt)
         NostrSignerOp.Decrypt -> context.getString(R.string.napplet_op_decrypt)
+        is NostrSignerOp.DecryptFrom -> context.getString(R.string.napplet_op_decrypt_from, counterpartyLabel(counterparty))
     }
 
-/** Builds the [NappletSignerConsentInfo] needed by the per-op consent dialog. */
+/**
+ * A person's display name for a consent prompt: their profile name when we have it cached, otherwise
+ * a shortened npub. Never empty — "read your private messages with <nothing>" would be worse than the
+ * broad wording it replaces.
+ */
+fun counterpartyLabel(pubKeyHex: HexKey): String {
+    LocalCache
+        .getUserIfExists(pubKeyHex)
+        ?.toBestDisplayName()
+        ?.ifBlank { null }
+        ?.let { return it }
+    val npub = runCatching { NPub.create(pubKeyHex) }.getOrNull()
+    return if (npub != null) npub.take(12) + "…" else pubKeyHex.take(12) + "…"
+}
+
+/** Builds the [SignerConsentInfo] needed by the per-op consent dialog. */
 fun buildSignerConsentInfo(
     context: Context,
     identity: NappletIdentity,
     op: NostrSignerOp,
     request: NappletRequest,
-): NappletSignerConsentInfo {
+): SignerConsentInfo {
     val untitled = context.getString(R.string.napplet_fallback_title, identity.authorPubKey.take(8))
     val (title, iconUrl) =
         if (identity.authorPubKey == "browser") {
@@ -84,7 +107,13 @@ fun buildSignerConsentInfo(
             }
             else -> ""
         }
-    return NappletSignerConsentInfo(
+    val previewTemplate =
+        when (request) {
+            is NappletRequest.Publish -> EventTemplate<Event>(TimeUtils.now(), request.kind, request.tags, request.content)
+            is NappletRequest.SignEvent -> EventTemplate<Event>(request.createdAt, request.kind, request.tags, request.content)
+            else -> null
+        }
+    return SignerConsentInfo(
         appletTitle = title,
         coordinate = identity.coordinate,
         op = op,
@@ -92,14 +121,21 @@ fun buildSignerConsentInfo(
         contentPreview = preview,
         rawData = rawData,
         iconUrl = iconUrl,
+        previewTemplate = previewTemplate,
     )
 }
 
-/** Creates a [NappletConnectInfo] for the first-connect dialog. */
+/**
+ * Creates a [SignerConnectInfo] for the first-connect dialog. [declared] is the capability set the
+ * connection pre-grants as ALLOW_ALWAYS on accept, so it is surfaced as
+ * [SignerConnectInfo.requestedPermissions] — otherwise the dialog would be asking the user to
+ * approve a set it never showed them.
+ */
 fun buildConnectInfo(
     context: Context,
     identity: NappletIdentity,
-): NappletConnectInfo {
+    declared: Set<NappletCapability> = emptySet(),
+): SignerConnectInfo {
     val untitled = context.getString(R.string.napplet_fallback_title, identity.authorPubKey.take(8))
     val (title, iconUrl) =
         if (identity.authorPubKey == "browser") {
@@ -114,5 +150,18 @@ fun buildConnectInfo(
         } else {
             identity.identifier.ifBlank { identity.authorPubKey.take(12) + "…" }
         }
-    return NappletConnectInfo(appletTitle = title, coordinate = identity.coordinate, domain = domain, iconUrl = iconUrl)
+    // Only the capabilities that actually get pre-granted are listed; SHELL/THEME never prompt and
+    // VALUE is per-use, so listing them would overstate what accepting hands over.
+    val preGranted =
+        declared
+            .filter { it.requiresConsent && !it.requiresPerUseConsent }
+            .map { context.getString(it.labelRes()) }
+            .sorted()
+    return SignerConnectInfo(
+        appletTitle = title,
+        coordinate = identity.coordinate,
+        domain = domain,
+        iconUrl = iconUrl,
+        requestedPermissions = preGranted,
+    )
 }

amethyst/src/main/java/com/vitorpamplona/amethyst/napplet/gateways/AccountNappletGateways.kt

@@ -27,6 +27,9 @@ import androidx.core.app.NotificationCompat
 import androidx.core.app.NotificationManagerCompat
 import com.vitorpamplona.amethyst.Amethyst
 import com.vitorpamplona.amethyst.R
+import com.vitorpamplona.amethyst.commons.connectedApps.signers.NostrConnectPrompt
+import com.vitorpamplona.amethyst.commons.connectedApps.signers.NostrSignerConsentPrompt
+import com.vitorpamplona.amethyst.commons.connectedApps.signers.NostrSignerPermissionLedger
 import com.vitorpamplona.amethyst.commons.napplet.NappletBroker
 import com.vitorpamplona.amethyst.commons.napplet.NappletConsentPrompt
 import com.vitorpamplona.amethyst.commons.napplet.NappletIdentityGateway
@@ -41,15 +44,12 @@ import com.vitorpamplona.amethyst.commons.napplet.NappletUploadGateway
 import com.vitorpamplona.amethyst.commons.napplet.NappletUploadResult
 import com.vitorpamplona.amethyst.commons.napplet.NappletWalletGateway
 import com.vitorpamplona.amethyst.commons.napplet.permissions.NappletPermissionLedger
-import com.vitorpamplona.amethyst.commons.napplet.signers.NostrConnectPrompt
-import com.vitorpamplona.amethyst.commons.napplet.signers.NostrSignerConsentPrompt
-import com.vitorpamplona.amethyst.commons.napplet.signers.NostrSignerPermissionLedger
+import com.vitorpamplona.amethyst.connectedApps.consent.SignerConnectCoordinator
+import com.vitorpamplona.amethyst.connectedApps.consent.SignerConsentCoordinator
 import com.vitorpamplona.amethyst.model.Account
-import com.vitorpamplona.amethyst.napplet.NappletConnectCoordinator
 import com.vitorpamplona.amethyst.napplet.NappletConsentCoordinator
 import com.vitorpamplona.amethyst.napplet.NappletConsentSummary
 import com.vitorpamplona.amethyst.napplet.NappletNotificationStore
-import com.vitorpamplona.amethyst.napplet.NappletSignerConsentCoordinator
 import com.vitorpamplona.amethyst.napplet.buildConnectInfo
 import com.vitorpamplona.amethyst.napplet.buildSignerConsentInfo
 import com.vitorpamplona.amethyst.service.uploads.blossom.BlossomUploader
@@ -81,7 +81,9 @@ class AccountNappletGateways(
     private val httpClient: (useProxy: Boolean) -> OkHttpClient,
     private val signerLedger: NostrSignerPermissionLedger? = null,
 ) {
-    private val consentSummary = NappletConsentSummary(context)
+    // Takes the account so the consent dialog can diff a proposed replaceable list (follows, relays,
+    // mutes) against the copy already cached here, and say what actually changes.
+    private val consentSummary = NappletConsentSummary(context, account)
 
     // Reuse the app-wide HTTP client so napplet blob fetches inherit the same Tor
     // routing, Onion-Location discovery/rewriting, Blossom cache and pool as the
@@ -138,16 +140,16 @@ class AccountNappletGateways(
             }
 
         val connectPrompt =
-            NostrConnectPrompt { identity ->
-                NappletConnectCoordinator.requestConnect(
+            NostrConnectPrompt { identity, declared ->
+                SignerConnectCoordinator.requestConnect(
                     context = context,
-                    info = buildConnectInfo(context, identity),
+                    info = buildConnectInfo(context, identity, declared),
                 )
             }
 
         val signerConsent =
             NostrSignerConsentPrompt { identity, op, request ->
-                NappletSignerConsentCoordinator.requestConsent(
+                SignerConsentCoordinator.requestConsent(
                     context = context,
                     info = buildSignerConsentInfo(context, identity, op, request),
                 )

amethyst/src/main/java/com/vitorpamplona/amethyst/service/calendar/CalendarReminderNotifier.kt

@@ -34,7 +34,7 @@ import com.vitorpamplona.amethyst.ui.stringRes
 
 /**
  * Posts user-visible "starting soon" notifications for NIP-52 appointments the user has RSVP'd
- * to as ACCEPTED. Mirrors the shape of [com.vitorpamplona.amethyst.service.scheduledposts.ScheduledPostNotifier]
+ * to as ACCEPTED. Mirrors the shape of [com.vitorpamplona.amethyst.service.scheduledposts.AndroidScheduledPostNotifier]
  * so the two notification surfaces stay consistent.
  */
 object CalendarReminderNotifier {

amethyst/src/main/java/com/vitorpamplona/amethyst/service/cashu/melt/MeltProcessor.kt

@@ -26,6 +26,7 @@ import com.vitorpamplona.amethyst.service.lnurl.LightningAddressResolver
 import com.vitorpamplona.amethyst.ui.stringRes
 import com.vitorpamplona.quartz.nip60Cashu.mintApi.CashuMintOperations
 import com.vitorpamplona.quartz.nip60Cashu.mintApi.MintHttpClient
+import com.vitorpamplona.quartz.nip60Cashu.mintApi.MintUrlException
 import com.vitorpamplona.quartz.nip60Cashu.token.CashuToken
 import okhttp3.OkHttpClient
 import kotlin.coroutines.cancellation.CancellationException
@@ -45,14 +46,23 @@ import kotlin.coroutines.cancellation.CancellationException
  * it also picks up NUT-02 per-input fee handling for free.
  */
 class MeltProcessor {
+    /**
+     * @param knownWalletMints the mint URLs of the user's own NIP-60 wallet. A token
+     *   pointing at one of those was, by definition, issued by a mint the user
+     *   deliberately added, so it is exempt from the private-address block that
+     *   [com.vitorpamplona.quartz.nip60Cashu.mintApi.CashuMintUrlValidator] applies
+     *   to arbitrary pasted tokens (a self-hosted mint on the LAN is legitimate).
+     */
     suspend fun melt(
         token: CashuToken,
         lud16: String,
         okHttpClient: (String) -> OkHttpClient,
         context: Context,
+        knownWalletMints: Set<String> = emptySet(),
     ): MeltResult {
         try {
-            val ops = CashuMintOperations(MintHttpClient(token.mint, okHttpClient))
+            val isOwnMint = knownWalletMints.any { it.trim().trimEnd('/').equals(token.mint.trim().trimEnd('/'), ignoreCase = true) }
+            val ops = CashuMintOperations(MintHttpClient(token.mint, userConfigured = isOwnMint, okHttpClient = okHttpClient))
             val proofs = token.proofs
 
             // A Lightning address must commit to an amount before we know the
@@ -106,6 +116,14 @@ class MeltProcessor {
         } catch (e: Exception) {
             if (e is CancellationException) throw e
             if (e is LightningAddressResolver.LightningAddressError) throw e
+            // The mint URL was refused before any request went out: this is OUR
+            // message, not the mint's, so don't dress it up as "the mint said".
+            if (e is MintUrlException) {
+                throw LightningAddressResolver.LightningAddressError(
+                    stringRes(context, R.string.cashu_unsafe_mint_url),
+                    stringRes(context, R.string.cashu_unsafe_mint_url_explainer, e.message),
+                )
+            }
             throw LightningAddressResolver.LightningAddressError(
                 stringRes(context, R.string.cashu_failed_redemption),
                 stringRes(context, R.string.cashu_failed_redemption_explainer_error_msg, e.message),

amethyst/src/main/java/com/vitorpamplona/amethyst/service/foreground/FlowProgressForegroundService.kt

@@ -0,0 +1,302 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.service.foreground
+
+import android.app.Notification
+import android.app.NotificationChannel
+import android.app.NotificationManager
+import android.app.PendingIntent
+import android.app.Service
+import android.content.Context
+import android.content.Intent
+import android.os.Build
+import android.os.IBinder
+import androidx.core.app.NotificationCompat
+import androidx.core.app.NotificationManagerCompat
+import com.vitorpamplona.amethyst.R
+import com.vitorpamplona.amethyst.ui.MainActivity
+import com.vitorpamplona.amethyst.ui.stringRes
+import com.vitorpamplona.quartz.utils.Log
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.Job
+import kotlinx.coroutines.SupervisorJob
+import kotlinx.coroutines.cancel
+import kotlinx.coroutines.delay
+import kotlinx.coroutines.flow.StateFlow
+import kotlinx.coroutines.launch
+
+/**
+ * Shared scaffolding for a foreground service that shields a background job from the
+ * cached-apps freezer while it runs, rendering a live [NotificationCompat.ProgressStyle]
+ * progress card driven by a [StateFlow].
+ *
+ * This is deliberately NOT a single "do everything" service: Android 14+ binds
+ * `foregroundServiceType` to the service's actual behavior (and each type carries its
+ * own permission, budget and start rules), so each workload keeps its own concrete
+ * subclass with the correct [fgsType]. What's shared here is only the boilerplate —
+ * channel setup, start/stop-when-idle, the notification skeleton, tap + cancel intents,
+ * and `onTimeout` — parameterized by a handful of hooks.
+ *
+ * Subclasses supply the [fgsType], the [state] flow to watch, [isActive] to decide when
+ * to stop, [render] to build the card, and [cancelAll] for the cancel action. See
+ * `PowMiningForegroundService` (shortService) and `BlossomSyncForegroundService`
+ * (dataSync) for the two consumers.
+ */
+abstract class FlowProgressForegroundService<T> : Service() {
+    protected val scope = CoroutineScope(Dispatchers.Main.immediate + SupervisorJob())
+    private var watchJob: Job? = null
+
+    /** The Android 14+ `ServiceInfo.FOREGROUND_SERVICE_TYPE_*` this service runs as. */
+    protected abstract val fgsType: Int
+    protected abstract val channelId: String
+    protected abstract val channelNameRes: Int
+    protected abstract val channelDescRes: Int
+    protected abstract val notificationId: Int
+
+    /** The intent action that routes back here to cancel everything. */
+    protected abstract val cancelAction: String
+    protected abstract val cancelLabelRes: Int
+    protected open val smallIcon: Int = R.drawable.amethyst
+
+    /** When non-null, re-render the card on this cadence (for clock-driven text like "time left"). */
+    protected open val refreshMs: Long? = null
+
+    protected abstract fun state(): StateFlow<T>
+
+    /** Keep the service (and notification) alive while this is true; stop once it goes false. */
+    protected abstract fun isActive(value: T): Boolean
+
+    protected abstract fun render(value: T): Content
+
+    /** Invoked by the cancel action. */
+    protected abstract fun cancelAll()
+
+    /** Called for every emission before [render]; use to update derived subclass state. */
+    protected open fun onEmission(value: T) {
+        // No-op by default: only subclasses that keep derived state need this hook.
+    }
+
+    /** Only consulted for the [refreshMs] clock loop; skip re-renders when nothing is moving. */
+    protected open fun needsClockRefresh(value: T): Boolean = true
+
+    /** One-time setup once the watch loop starts (e.g. a benchmark). */
+    protected open fun onStarted() {
+        // No-op by default: only subclasses with one-time setup (e.g. a benchmark) override this.
+    }
+
+    /** How to draw the progress bar of the card. */
+    sealed interface Bar {
+        data object Indeterminate : Bar
+
+        /** A single bar filled to [fraction] in `0f..1f`. */
+        data class Determinate(
+            val fraction: Double,
+        ) : Bar
+
+        /** [total] equal segments, [done] of them filled — good for "N of M". */
+        data class Segmented(
+            val total: Int,
+            val done: Int,
+        ) : Bar
+    }
+
+    data class Content(
+        val title: String,
+        val text: String?,
+        val bar: Bar,
+    )
+
+    private val tapIntent: PendingIntent by lazy {
+        PendingIntent.getActivity(
+            this,
+            0,
+            Intent(this, MainActivity::class.java).apply {
+                addFlags(Intent.FLAG_ACTIVITY_NEW_TASK or Intent.FLAG_ACTIVITY_CLEAR_TOP)
+            },
+            PendingIntent.FLAG_IMMUTABLE or PendingIntent.FLAG_UPDATE_CURRENT,
+        )
+    }
+
+    private val cancelIntent: PendingIntent by lazy {
+        PendingIntent.getService(
+            this,
+            1,
+            Intent(this, this.javaClass).setAction(cancelAction),
+            PendingIntent.FLAG_IMMUTABLE or PendingIntent.FLAG_UPDATE_CURRENT,
+        )
+    }
+
+    override fun onBind(intent: Intent?): IBinder? = null
+
+    override fun onStartCommand(
+        intent: Intent?,
+        flags: Int,
+        startId: Int,
+    ): Int {
+        // Android's contract: every onStartCommand after startForegroundService must call
+        // startForeground promptly, even on the stop path.
+        runCatching { startForegroundCompat(state().value) }
+            .onFailure {
+                Log.w(logTag(), "startForeground failed; work continues without the service", it)
+                stopSelf()
+                return START_NOT_STICKY
+            }
+
+        if (intent?.action == cancelAction) {
+            cancelAll()
+            stopForeground(STOP_FOREGROUND_REMOVE)
+            stopSelf()
+            return START_NOT_STICKY
+        }
+
+        watch()
+        return START_NOT_STICKY
+    }
+
+    /** Foreground-service budget exhausted (shortService ~3 min; dataSync on newer OS). Exit cleanly. */
+    override fun onTimeout(startId: Int) {
+        Log.d(logTag()) { "foreground-service budget exhausted; stopping" }
+        stopForeground(STOP_FOREGROUND_REMOVE)
+        stopSelf()
+    }
+
+    override fun onDestroy() {
+        scope.cancel()
+        super.onDestroy()
+    }
+
+    private fun watch() {
+        if (watchJob != null) return
+        onStarted()
+        watchJob =
+            scope.launch {
+                state().collect { value ->
+                    onEmission(value)
+                    if (!isActive(value)) {
+                        stopForeground(STOP_FOREGROUND_REMOVE)
+                        stopSelf()
+                    } else {
+                        updateNotification(value)
+                    }
+                }
+            }
+
+        refreshMs?.let { ms ->
+            scope.launch {
+                while (true) {
+                    val v = state().value
+                    if (isActive(v) && needsClockRefresh(v)) updateNotification(v)
+                    delay(ms)
+                }
+            }
+        }
+    }
+
+    private fun startForegroundCompat(value: T) {
+        ensureChannel()
+        val notification = buildNotification(value)
+        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.UPSIDE_DOWN_CAKE) {
+            startForeground(notificationId, notification, fgsType)
+        } else {
+            startForeground(notificationId, notification)
+        }
+    }
+
+    private fun updateNotification(value: T) {
+        val manager = NotificationManagerCompat.from(this)
+        if (!manager.areNotificationsEnabled()) return
+        try {
+            manager.notify(notificationId, buildNotification(value))
+        } catch (_: SecurityException) {
+            // POST_NOTIFICATIONS revoked mid-flight; the FGS keeps running.
+        }
+    }
+
+    private fun buildNotification(value: T): Notification {
+        val content = render(value)
+        val style =
+            when (val bar = content.bar) {
+                is Bar.Indeterminate -> NotificationCompat.ProgressStyle().setProgressIndeterminate(true)
+                is Bar.Determinate ->
+                    if (bar.fraction.isFinite() && bar.fraction in 0.0..1.0) {
+                        NotificationCompat
+                            .ProgressStyle()
+                            .setProgressSegments(listOf(NotificationCompat.ProgressStyle.Segment(100)))
+                            .setProgress((bar.fraction * 100).toInt())
+                    } else {
+                        NotificationCompat.ProgressStyle().setProgressIndeterminate(true)
+                    }
+                is Bar.Segmented ->
+                    NotificationCompat
+                        .ProgressStyle()
+                        .setProgressSegments(List(bar.total.coerceAtLeast(1)) { NotificationCompat.ProgressStyle.Segment(1) })
+                        .setProgress(bar.done)
+            }
+
+        return NotificationCompat
+            .Builder(this, channelId)
+            .setSmallIcon(smallIcon)
+            .setContentTitle(content.title)
+            .setContentText(content.text)
+            .setStyle(style)
+            .setContentIntent(tapIntent)
+            .addAction(0, stringRes(this, cancelLabelRes), cancelIntent)
+            .setOngoing(true)
+            .setOnlyAlertOnce(true)
+            .setCategory(NotificationCompat.CATEGORY_PROGRESS)
+            .setPriority(NotificationCompat.PRIORITY_LOW)
+            .setForegroundServiceBehavior(NotificationCompat.FOREGROUND_SERVICE_IMMEDIATE)
+            .build()
+    }
+
+    private fun ensureChannel() {
+        val manager = getSystemService(NOTIFICATION_SERVICE) as NotificationManager
+        if (manager.getNotificationChannel(channelId) != null) return
+        manager.createNotificationChannel(
+            NotificationChannel(channelId, stringRes(this, channelNameRes), NotificationManager.IMPORTANCE_LOW).apply {
+                description = stringRes(this@FlowProgressForegroundService, channelDescRes)
+                setShowBadge(false)
+            },
+        )
+    }
+
+    protected open fun logTag(): String = this.javaClass.simpleName
+
+    companion object {
+        /**
+         * Best-effort start of a [FlowProgressForegroundService] subclass. A start from the
+         * background (e.g. a restore) may be denied — the work then proceeds unprotected and
+         * the service starts on the next foreground trigger.
+         */
+        fun start(
+            context: Context,
+            clazz: Class<out FlowProgressForegroundService<*>>,
+            tag: String,
+        ) {
+            try {
+                context.startForegroundService(Intent(context, clazz))
+            } catch (e: Exception) {
+                Log.w(tag, "Could not start foreground service (backgrounded?); work continues unprotected", e)
+            }
+        }
+    }
+}

amethyst/src/main/java/com/vitorpamplona/amethyst/service/geohash/GeohashRelays.kt

@@ -0,0 +1,54 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.service.geohash
+
+import com.vitorpamplona.amethyst.Amethyst
+import com.vitorpamplona.amethyst.commons.service.georelay.GeoRelayCsvLoader
+import com.vitorpamplona.amethyst.commons.service.georelay.GeoRelayDirectory
+import com.vitorpamplona.quartz.nip01Core.relay.normalizer.NormalizedRelayUrl
+
+/**
+ * Process-wide geohash → relay directory, shared by everything that routes
+ * geohash chat traffic (the joined-cell subscription, the chat screen). The live
+ * CSV is fetched once via [ensureLoaded]; until then [closestRelays] falls back
+ * to the small built-in list so routing works offline / on first run.
+ */
+object GeohashRelays {
+    // The process-wide directory that GeohashChatChannel.relays() also reads, so a refresh
+    // here immediately improves the relay set every geohash subscription resolves.
+    private val directory = GeoRelayDirectory.shared
+
+    @Volatile private var refreshed = false
+
+    /** Fetches the live directory once. Safe to call repeatedly; subsequent calls are no-ops. */
+    suspend fun ensureLoaded(): Boolean {
+        if (refreshed) return false
+        runCatching {
+            GeoRelayCsvLoader { Amethyst.instance.okHttpClients.getHttpClient(false) }.refresh(directory)
+        }
+        val loaded = directory.size > GeoRelayDirectory.FALLBACK.size
+        refreshed = loaded
+        return loaded
+    }
+
+    /** The relays nearest [geohash]'s center. Synchronous — uses whatever is loaded (fallback if not yet refreshed). */
+    fun closestRelays(geohash: String): List<NormalizedRelayUrl> = directory.closestRelays(geohash)
+}

amethyst/src/main/java/com/vitorpamplona/amethyst/service/location/ForwardGeolocation.kt

@@ -0,0 +1,95 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.service.location
+
+import android.content.Context
+import android.location.Address
+import android.location.Geocoder
+import android.os.Build
+import androidx.annotation.RequiresApi
+import com.vitorpamplona.quartz.utils.Log
+import java.io.IOException
+
+/**
+ * Forward geocoding: turn a free-text place query (a city, address, or landmark)
+ * into a list of candidate [Address]es so the user can jump the map there.
+ *
+ * The mirror image of [ReverseGeolocation]: on TIRAMISU+ it uses the async
+ * listener overload of [Geocoder.getFromLocationName] (the blocking one is
+ * deprecated there), and falls back to the synchronous call on older devices.
+ * Both branches funnel through [onReady]; a null result means "no backend, an
+ * error, or nothing matched" and the caller should degrade gracefully.
+ */
+@Suppress("DEPRECATION")
+class ForwardGeolocation {
+    companion object {
+        const val MAX_RESULTS = 5
+
+        fun execute(
+            query: String,
+            context: Context,
+            onReady: (List<Address>?) -> Unit,
+        ) {
+            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.TIRAMISU) {
+                executeAsync(query, context, onReady)
+            } else {
+                onReady(executeSync(query, context))
+            }
+        }
+
+        @RequiresApi(Build.VERSION_CODES.TIRAMISU)
+        fun executeAsync(
+            query: String,
+            context: Context,
+            onReady: (List<Address>?) -> Unit,
+        ) {
+            val listener =
+                object : Geocoder.GeocodeListener {
+                    override fun onGeocode(addresses: List<Address>) {
+                        Log.d("ForwardGeoLocation") { "Found ${addresses.size} addresses for $query" }
+                        onReady(addresses)
+                    }
+
+                    override fun onError(errorMessage: String?) {
+                        super.onError(errorMessage)
+                        Log.w("ForwardGeoLocation") { "Failure $errorMessage" }
+                        onReady(null)
+                    }
+                }
+
+            Log.d("ForwardGeoLocation") { "Execute Async $query" }
+            Geocoder(context).getFromLocationName(query, MAX_RESULTS, listener)
+        }
+
+        fun executeSync(
+            query: String,
+            context: Context,
+        ): List<Address>? {
+            Log.d("ForwardGeoLocation") { "Execute Sync $query" }
+            return try {
+                Geocoder(context).getFromLocationName(query, MAX_RESULTS)
+            } catch (e: IOException) {
+                Log.w("ForwardGeolocation", "IO Error", e)
+                null
+            }
+        }
+    }
+}

amethyst/src/main/java/com/vitorpamplona/amethyst/service/location/LocationState.kt

@@ -21,6 +21,7 @@
 package com.vitorpamplona.amethyst.service.location
 
 import android.content.Context
+import com.vitorpamplona.quartz.experimental.bitchat.geohash.GeohashChannelLevel
 import com.vitorpamplona.quartz.nip01Core.tags.geohash.GeoHash
 import com.vitorpamplona.quartz.nip01Core.tags.geohash.GeohashPrecision
 import com.vitorpamplona.quartz.utils.Log
@@ -60,6 +61,7 @@ class LocationState(
 
     private var hasLocationPermission = MutableStateFlow(false)
     private var latestLocation: LocationResult = LocationResult.Loading
+    private var latestPreciseLocation: LocationResult = LocationResult.Loading
 
     fun setLocationPermission(newValue: Boolean) {
         if (newValue != hasLocationPermission.value) {
@@ -98,4 +100,43 @@ class LocationState(
                 latestLocation,
             )
     }
+
+    /**
+     * Like [geohashStateFlow] but at building-level precision
+     * ([GeohashChannelLevel.BUILDING] = 8 chars). Location channels truncate this
+     * to every coarser level (a geohash is a prefix code), so one fix yields the
+     * whole region→building ladder. Kept separate so the coarser
+     * [geohashStateFlow] the "around me" feed relies on is unchanged.
+     */
+    @OptIn(ExperimentalCoroutinesApi::class)
+    val preciseGeohashStateFlow by lazy {
+        hasLocationPermission
+            .transformLatest {
+                if (it) {
+                    emit(LocationResult.Loading)
+                    val result =
+                        LocationFlow(context)
+                            .get(MIN_TIME, MIN_DISTANCE)
+                            .onStart { onListening?.invoke(true) }
+                            .onCompletion { onListening?.invoke(false) }
+                            .map {
+                                LocationResult.Success(it.toGeoHash(GeohashChannelLevel.BUILDING.chars)) as LocationResult
+                            }.onEach {
+                                latestPreciseLocation = it
+                            }.catch { e ->
+                                Log.w("GeohashStateFlow", "Exception in the precise flow", e)
+                                latestPreciseLocation = LocationResult.LackPermission
+                                emit(LocationResult.LackPermission)
+                            }
+
+                    emitAll(result)
+                } else {
+                    emit(LocationResult.LackPermission)
+                }
+            }.stateIn(
+                scope,
+                SharingStarted.WhileSubscribed(5000),
+                latestPreciseLocation,
+            )
+    }
 }

amethyst/src/main/java/com/vitorpamplona/amethyst/service/logging/Logging.kt

@@ -43,7 +43,14 @@ class Logging {
                     .detectLeakedClosableObjects()
                     .detectLeakedRegistrationObjects()
                     .detectFileUriExposure()
-                    .detectCleartextNetwork()
+                    // detectCleartextNetwork() is intentionally NOT enabled. netd enforces it
+                    // per-UID at the packet level (it flags a socket whose first bytes aren't a
+                    // TLS handshake) and there is no per-host exemption. Every relay WebSocket
+                    // tunneled over the embedded Arti Tor SOCKS proxy on 127.0.0.1:17392 opens
+                    // with a cleartext SOCKS5 greeting, so this detector fires constantly on
+                    // legitimate loopback traffic. The Network-Security-Config localhost
+                    // allowlist does NOT silence it — that flag only governs the voluntary
+                    // NetworkSecurityPolicy.isCleartextTrafficPermitted() check, not netd.
                     .detectContentUriWithoutPermission()
                     .apply {
                         if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.Q) {

amethyst/src/main/java/com/vitorpamplona/amethyst/service/notifications/AlwaysOnNotificationServiceManager.kt

@@ -22,14 +22,18 @@ package com.vitorpamplona.amethyst.service.notifications
 
 import android.content.Context
 import com.vitorpamplona.amethyst.LocalPreferences
-import com.vitorpamplona.amethyst.model.Account
 import com.vitorpamplona.amethyst.model.accountsCache.AccountCacheState
 import com.vitorpamplona.quartz.nip01Core.core.HexKey
 import com.vitorpamplona.quartz.utils.Log
 import kotlinx.coroutines.CancellationException
 import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.ExperimentalCoroutinesApi
 import kotlinx.coroutines.Job
 import kotlinx.coroutines.flow.collectLatest
+import kotlinx.coroutines.flow.combine
+import kotlinx.coroutines.flow.distinctUntilChanged
+import kotlinx.coroutines.flow.flatMapLatest
+import kotlinx.coroutines.flow.flowOf
 import kotlinx.coroutines.launch
 
 /**
@@ -41,16 +45,25 @@ import kotlinx.coroutines.launch
  * L4 - BootCompletedReceiver (restart on boot)
  * L5 - ServiceWatchdogManager (AlarmManager, 5-min health check)
  *
- * When enabled, all layers activate. When disabled, all layers deactivate.
- * The manager watches the account's alwaysOnNotificationService setting
- * and reacts to changes in real time.
+ * Two switches gate the system:
  *
- * While enabled, every saved writable account is kept loaded in
- * [AccountCacheState] so GiftWraps addressed to any of them (delivered via
- * open relay subscriptions) get unwrapped by the owning account's
- * `newNotesPreProcessor`. Without this, wraps for non-active accounts would
- * sit in [com.vitorpamplona.amethyst.model.LocalCache] with no subscriber
- * able to decrypt them.
+ * - The **global master** ([LocalPreferences.notificationServiceEnabledFlow], the
+ *   "Background notification service" toggle / Quick Settings tile). When off, every
+ *   layer is torn down and nothing restarts, regardless of any account's setting —
+ *   this is the battery-saver "airplane mode". Persisted, so an explicit off survives
+ *   restarts and crashes.
+ * - The **per-account participation** flag ([com.vitorpamplona.amethyst.model.AccountSettings.alwaysOnNotificationService],
+ *   "Keep this account active in the background") **or** its NIP-46 signer toggle
+ *   ([com.vitorpamplona.amethyst.model.AccountSettings.nip46SignerEnabled]). While the master is
+ *   on, the service runs as long as **at least one** writable account has either flag on — the
+ *   background signer relies on the same foreground service to keep answering requests.
+ *
+ * While the master is on, every saved writable account is kept loaded in
+ * [AccountCacheState] so (a) its participation flag is observable and (b) GiftWraps
+ * addressed to any of them (delivered via open relay subscriptions) get unwrapped by
+ * the owning account's `newNotesPreProcessor`. Without this, wraps for non-active
+ * accounts would sit in [com.vitorpamplona.amethyst.model.LocalCache] with no
+ * subscriber able to decrypt them.
  */
 class AlwaysOnNotificationServiceManager(
     private val context: Context,
@@ -68,22 +81,63 @@ class AlwaysOnNotificationServiceManager(
     private var wasEnabled = false
 
     /**
-     * Starts watching the given account's always-on setting.
-     * When the setting changes, all layers are started or stopped accordingly.
-     * On initial load with false, nothing happens (no-op for users who never enabled it).
+     * Starts watching the global master switch and the participation flags of every
+     * loaded writable account. The service layers run while the master is on AND at
+     * least one account participates; the master overrides everything when off.
+     *
+     * An account "participates" when either its always-on setting **or** its NIP-46
+     * signer toggle is on: the foreground service (and its restart layers) keep the
+     * process + shared relay client alive, which is exactly what the background signer
+     * needs to keep answering requests, so the signer toggle keeps the layers up too.
+     *
+     * Idempotent: safe to call again on account switch/login — it restarts the watch.
      */
-    fun watchAccount(account: Account) {
+    @OptIn(ExperimentalCoroutinesApi::class)
+    fun start() {
         watchJob?.cancel()
         wasEnabled = false
         watchJob =
             scope.launch {
-                account.settings.alwaysOnNotificationService.collectLatest { enabled ->
-                    if (enabled) {
-                        wasEnabled = true
-                        enableAllLayers()
-                    } else if (wasEnabled) {
-                        disableAllLayers()
+                localPreferences.notificationServiceEnabledFlow().collectLatest { masterEnabled ->
+                    if (!masterEnabled) {
+                        // Global airplane mode: suppress every layer regardless of
+                        // per-account participation, and stop keeping accounts loaded.
+                        if (wasEnabled) {
+                            disableServiceLayers()
+                            wasEnabled = false
+                        }
+                        stopMultiAccountPreload()
+                        return@collectLatest
                     }
+
+                    // Master on: keep every writable account loaded so its participation
+                    // flag is observable and its gift wraps can decrypt, then run the
+                    // service only while at least one account is participating. An account
+                    // participates when its always-on setting OR its NIP-46 signer toggle is
+                    // on — the background signer needs the same foreground service alive.
+                    startMultiAccountPreload()
+                    accountsCache.accounts
+                        .flatMapLatest { accounts ->
+                            val flags =
+                                accounts.values.map { account ->
+                                    account.settings.alwaysOnNotificationService
+                                        .combine(account.settings.nip46SignerEnabled) { alwaysOn, signer -> alwaysOn || signer }
+                                }
+                            if (flags.isEmpty()) {
+                                flowOf(false)
+                            } else {
+                                combine(flags) { values -> values.any { it } }
+                            }
+                        }.distinctUntilChanged()
+                        .collectLatest { anyParticipating ->
+                            if (anyParticipating) {
+                                wasEnabled = true
+                                enableServiceLayers()
+                            } else if (wasEnabled) {
+                                disableServiceLayers()
+                                wasEnabled = false
+                            }
+                        }
                 }
             }
     }
@@ -93,10 +147,15 @@ class AlwaysOnNotificationServiceManager(
         watchJob = null
         preloadJob?.cancel()
         preloadJob = null
+        // Logout/terminate: tear the layers down explicitly. Otherwise the watchdog alarm
+        // and periodic worker stay scheduled and would resurrect the service for a
+        // logged-out user (nobody participating).
+        disableServiceLayers()
+        wasEnabled = false
     }
 
-    private fun enableAllLayers() {
-        Log.d(TAG, "Enabling all notification service layers")
+    private fun enableServiceLayers() {
+        Log.d(TAG, "Enabling notification service layers")
 
         // L1: Start foreground service
         NotificationRelayService.start(context)
@@ -108,12 +167,10 @@ class AlwaysOnNotificationServiceManager(
         ServiceWatchdogManager.schedule(context)
 
         // L2 (FCM) and L4 (BOOT_COMPLETED) are always active via manifest
-
-        startMultiAccountPreload()
     }
 
-    private fun disableAllLayers() {
-        Log.d(TAG, "Disabling all notification service layers")
+    private fun disableServiceLayers() {
+        Log.d(TAG, "Disabling notification service layers")
 
         // L1: Stop foreground service
         NotificationRelayService.stop(context)
@@ -123,8 +180,6 @@ class AlwaysOnNotificationServiceManager(
 
         // L5: Cancel watchdog alarm
         ServiceWatchdogManager.cancel(context)
-
-        stopMultiAccountPreload()
     }
 
     /**
@@ -154,7 +209,7 @@ class AlwaysOnNotificationServiceManager(
 
     /**
      * Cancels the preload collector and releases every cached account except the
-     * currently active one, so users with the setting off return to single-account
+     * currently active one, so users with the master off return to single-account
      * memory/battery footprint.
      */
     private fun stopMultiAccountPreload() {

amethyst/src/main/java/com/vitorpamplona/amethyst/service/notifications/BootCompletedReceiver.kt

@@ -50,11 +50,23 @@ class BootCompletedReceiver : BroadcastReceiver() {
             "android.intent.action.QUICKBOOT_POWERON",
             Intent.ACTION_MY_PACKAGE_REPLACED,
             -> {
-                Log.d(TAG) { "Received ${intent.action}, checking if notification service should start" }
-                if (NotificationRelayService.isEnabled(context)) {
-                    Log.d(TAG, "Starting notification relay service")
-                    NotificationRelayService.start(context)
-                }
+                // isEnabled() reads plain SharedPreferences (a synchronous disk read, by
+                // design — see LocalPreferences.globalSettingsPrefs) and scans the accounts
+                // cache. onReceive runs on the main thread, so hop off it via goAsync() to
+                // avoid a StrictMode DiskReadViolation while keeping the receiver alive until
+                // the work finishes.
+                val pending = goAsync()
+                Thread {
+                    try {
+                        Log.d(TAG) { "Received ${intent.action}, checking if notification service should start" }
+                        if (NotificationRelayService.isEnabled(context)) {
+                            Log.d(TAG, "Starting notification relay service")
+                            NotificationRelayService.start(context)
+                        }
+                    } finally {
+                        pending.finish()
+                    }
+                }.start()
             }
         }
     }

amethyst/src/main/java/com/vitorpamplona/amethyst/service/notifications/NotificationChannels.kt

@@ -29,7 +29,7 @@ import com.vitorpamplona.amethyst.R
 import com.vitorpamplona.amethyst.commons.icons.symbols.MaterialSymbol
 import com.vitorpamplona.amethyst.commons.icons.symbols.MaterialSymbols
 import com.vitorpamplona.amethyst.service.call.notification.CallNotifier
-import com.vitorpamplona.amethyst.service.scheduledposts.ScheduledPostNotifier
+import com.vitorpamplona.amethyst.service.scheduledposts.AndroidScheduledPostNotifier
 import com.vitorpamplona.amethyst.ui.stringRes
 import com.vitorpamplona.quartz.utils.Log
 
@@ -104,7 +104,7 @@ object NotificationChannels {
                 nameRes = R.string.app_notification_scheduled_posts_channel_name,
                 icon = MaterialSymbols.Schedule,
                 channelId = { stringRes(it, R.string.app_notification_scheduled_posts_channel_id) },
-                ensure = { ScheduledPostNotifier.ensureChannel(it) },
+                ensure = { AndroidScheduledPostNotifier.ensureChannel(it) },
             ),
             Entry(
                 nameRes = R.string.app_notification_calls_channel_name,

amethyst/src/main/java/com/vitorpamplona/amethyst/service/notifications/NotificationRelayService.kt

@@ -37,6 +37,7 @@ import androidx.core.app.NotificationCompat
 import androidx.core.app.ServiceCompat
 import androidx.core.content.ContextCompat
 import com.vitorpamplona.amethyst.Amethyst
+import com.vitorpamplona.amethyst.LocalPreferences
 import com.vitorpamplona.amethyst.R
 import com.vitorpamplona.amethyst.ui.MainActivity
 import com.vitorpamplona.amethyst.ui.pluralStringRes
@@ -117,13 +118,20 @@ class NotificationRelayService : Service() {
             context.stopService(Intent(context, NotificationRelayService::class.java))
         }
 
+        // Gate for the restart layers (watchdog, boot, catch-up worker, onResume): the
+        // global master must be on, and — matching the manager's rule — at least one loaded
+        // writable account must be participating. An empty cache (logged out, or accounts
+        // not yet loaded) gates OFF, so the layers never resurrect the service for a
+        // logged-out user; on cold boot the account loads headlessly and the manager starts
+        // the service itself once a participant exists.
         fun isEnabled(context: Context): Boolean =
             try {
-                Amethyst.instance.sessionManager
-                    .loggedInAccount()
-                    ?.settings
-                    ?.alwaysOnNotificationService
-                    ?.value == true
+                // The service also backs the NIP-46 signer, so an account with the signer on
+                // participates just like one with always-on notifications on.
+                LocalPreferences.isNotificationServiceEnabled() &&
+                    Amethyst.instance.accountsCache.accounts.value.values.any {
+                        it.settings.alwaysOnNotificationService.value || it.settings.nip46SignerEnabled.value
+                    }
             } catch (e: Exception) {
                 false
             }

amethyst/src/main/java/com/vitorpamplona/amethyst/service/notifications/NotificationServiceTileService.kt

@@ -0,0 +1,141 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.service.notifications
+
+import android.os.Build
+import android.service.quicksettings.Tile
+import android.service.quicksettings.TileService
+import com.vitorpamplona.amethyst.Amethyst
+import com.vitorpamplona.amethyst.LocalPreferences
+import com.vitorpamplona.amethyst.R
+import com.vitorpamplona.quartz.utils.Log
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.Job
+import kotlinx.coroutines.SupervisorJob
+import kotlinx.coroutines.cancel
+import kotlinx.coroutines.flow.collectLatest
+import kotlinx.coroutines.launch
+
+/**
+ * Quick Settings tile that temporarily enables or disables the always-on background
+ * notification service — a battery-saver "airplane mode" — without digging through
+ * Settings.
+ *
+ * The tile toggles the **global master** switch ([LocalPreferences.setNotificationServiceEnabled]),
+ * not any per-account setting: when off, [AlwaysOnNotificationServiceManager] tears down
+ * every layer for all accounts; when on, each account's own "keep active in the
+ * background" flag decides who participates. The master is persisted, so an explicit off
+ * survives restarts and crashes.
+ *
+ * The switch is global, so the tile does not depend on a logged-in account. It only
+ * needs `Amethyst.instance` (main process) to reach [LocalPreferences]; during the brief
+ * cold-start window before that is built — or in the `:napplet` process, which never
+ * hosts this tile — it renders as unavailable and the next `onStartListening` recovers.
+ */
+class NotificationServiceTileService : TileService() {
+    companion object {
+        private const val TAG = "NotifServiceTile"
+    }
+
+    private var scope: CoroutineScope? = null
+    private var watchJob: Job? = null
+
+    /** True once `Amethyst.instance` (and therefore [LocalPreferences]) is reachable. */
+    private fun preferencesReady(): Boolean =
+        try {
+            Amethyst.instance
+            true
+        } catch (e: Exception) {
+            false
+        }
+
+    override fun onStartListening() {
+        super.onStartListening()
+        // onStartListening/onStopListening are balanced by the framework, but cancel
+        // any stale collector defensively so a re-entrant start can't leak a scope.
+        watchJob?.cancel()
+        scope?.cancel()
+
+        refreshTile()
+        if (!preferencesReady()) return
+
+        val newScope = CoroutineScope(Dispatchers.Main + SupervisorJob())
+        scope = newScope
+        // Keep the tile in sync when the master is flipped elsewhere (the Settings
+        // toggle) while the shade is open.
+        watchJob =
+            newScope.launch {
+                LocalPreferences.notificationServiceEnabledFlow().collectLatest {
+                    refreshTile()
+                }
+            }
+    }
+
+    override fun onStopListening() {
+        watchJob?.cancel()
+        watchJob = null
+        scope?.cancel()
+        scope = null
+        super.onStopListening()
+    }
+
+    override fun onClick() {
+        super.onClick()
+        if (!preferencesReady()) {
+            Log.w(TAG, "Preferences not ready; ignoring tile click")
+            refreshTile()
+            return
+        }
+        LocalPreferences.setNotificationServiceEnabled(!LocalPreferences.isNotificationServiceEnabled())
+        refreshTile()
+    }
+
+    private fun refreshTile() {
+        val tile = qsTile ?: return
+
+        if (!preferencesReady()) {
+            tile.state = Tile.STATE_UNAVAILABLE
+        } else {
+            val enabled = LocalPreferences.isNotificationServiceEnabled()
+            tile.state = if (enabled) Tile.STATE_ACTIVE else Tile.STATE_INACTIVE
+            tile.subtitleCompat(
+                getString(
+                    if (enabled) {
+                        R.string.always_on_notif_tile_subtitle_on
+                    } else {
+                        R.string.always_on_notif_tile_subtitle_off
+                    },
+                ),
+            )
+        }
+
+        // Label and icon come from the manifest (<service android:label/android:icon>),
+        // which is the tile's default — no need to reset them on every refresh.
+        tile.updateTile()
+    }
+
+    private fun Tile.subtitleCompat(text: CharSequence) {
+        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.Q) {
+            subtitle = text
+        }
+    }
+}

amethyst/src/main/java/com/vitorpamplona/amethyst/service/playback/PlaybackDiag.kt

@@ -0,0 +1,33 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.service.playback
+
+/**
+ * Shared logcat tag for the playback diagnostic trace (source routing, player lifecycle, error
+ * recovery, HLS liveness learning). Emitted with `Log.d`, so it appears only in a debug build
+ * (`Log.minLevel = DEBUG`) and is silent in benchmark/release (`ERROR`). To capture a playback
+ * investigation, install a debug build and run:
+ *
+ * ```
+ * adb logcat -s PlaybackDiag
+ * ```
+ */
+const val PLAYBACK_DIAG_TAG = "PlaybackDiag"

amethyst/src/main/java/com/vitorpamplona/amethyst/service/playback/composable/WatchPlaybackErrors.kt

@@ -29,7 +29,10 @@ import androidx.compose.runtime.MutableState
 import androidx.media3.common.MediaItem
 import androidx.media3.common.PlaybackException
 import androidx.media3.common.Player
+import androidx.media3.common.Tracks
 import androidx.media3.common.util.UnstableApi
+import com.vitorpamplona.amethyst.service.playback.PLAYBACK_DIAG_TAG
+import com.vitorpamplona.amethyst.service.playback.composable.controls.getVideoTrackGroup
 import com.vitorpamplona.quartz.utils.Log
 import kotlinx.coroutines.delay
 
@@ -38,6 +41,30 @@ import kotlinx.coroutines.delay
 // be told apart from a genuinely undecodable stream in a field logcat. See WatchPlaybackErrors.
 internal const val ERROR_LOG_TAG = "PlaybackError"
 
+private fun playbackStateName(state: Int): String =
+    when (state) {
+        Player.STATE_IDLE -> "IDLE"
+        Player.STATE_BUFFERING -> "BUFFERING"
+        Player.STATE_READY -> "READY"
+        Player.STATE_ENDED -> "ENDED"
+        else -> "UNKNOWN($state)"
+    }
+
+// Summarizes the currently-selected video track (codec + resolution + mime). A change in this line
+// across an #EXT-X-DISCONTINUITY is the signature of an ad-splice codec reconfig — a second, distinct
+// failure mode from BEHIND_LIVE_WINDOW.
+@OptIn(UnstableApi::class)
+private fun Tracks.selectedVideoSummary(): String {
+    val group = getVideoTrackGroup(this) ?: return "none"
+    for (i in 0 until group.length) {
+        if (group.isTrackSelected(i)) {
+            val f = group.getTrackFormat(i)
+            return "codec=${f.codecs} ${f.width}x${f.height} mime=${f.sampleMimeType} fps=${f.frameRate}"
+        }
+    }
+    return "none"
+}
+
 /**
  * Flattens a [PlaybackException] into a single line: error code, message, and the full nested
  * cause chain (e.g. `DecoderInitializationException <- MediaCodec.CodecException`). The cause
@@ -70,6 +97,32 @@ private const val STALL_MIN_BUFFER_AHEAD_MS = 2_000L
 // or two, so 8 s of fed-but-frozen buffering is unambiguous.
 private const val STALL_TIMEOUT_MS = 8_000L
 
+// A live HLS stream (a FAST channel / kind:30311 broadcast) publishes only a short sliding window
+// of segments — e.g. ~60 s — with no ENDLIST. If the playhead drifts before the start of that
+// window (the player was prepared then held off the live edge, or a rebuffer outlasted the DVR
+// depth), ExoPlayer raises ERROR_CODE_BEHIND_LIVE_WINDOW. That is not a terminal failure: the
+// documented recovery is to seek back to the default (live) position and re-prepare.
+//
+// This is the ONLY error we auto-recover. An earlier version also re-prepared on any live I/O error
+// (the 2xxx band), but that thrashed on a stream whose segments fail to parse
+// (UnexpectedLoaderException / IllegalArgumentException): each re-prepare briefly reached READY then
+// hit the same bad segment, and because the cap reset on READY it never gave up. I/O and decode
+// errors are now left terminal — ExoPlayer's own LoadErrorHandlingPolicy already retries transient
+// segment loads, and RenderPlaybackError shows the honest "open in browser" overlay for the rest.
+internal const val MAX_LIVE_STREAM_RECOVERY_ATTEMPTS = 5
+
+// The playhead must advance at least this far past the position an error was raised at before the
+// recovery budget is refilled. Reaching READY alone is not enough: a stream that flaps READY for a
+// fraction of a second at the same spot must exhaust the cap and surface, not loop forever.
+private const val RECOVERY_RESET_PROGRESS_MS = 3_000L
+
+/**
+ * Whether a terminal [PlaybackException] should be recovered by seek-to-live + re-prepare rather
+ * than surfaced. Only `ERROR_CODE_BEHIND_LIVE_WINDOW` qualifies — it is a rejoin signal, not a
+ * failure. Everything else (I/O, decode, parse) is left terminal. Pure, so it is unit-testable.
+ */
+internal fun isRecoverableLiveError(errorCode: Int): Boolean = errorCode == PlaybackException.ERROR_CODE_BEHIND_LIVE_WINDOW
+
 /**
  * Mirrors the MediaController's terminal-error state into [MediaControllerState.playbackError]
  * so [RenderPlaybackError] can show the codec-not-supported overlay with a browser fallback.
@@ -96,13 +149,46 @@ fun WatchPlaybackErrors(controllerState: MediaControllerState) {
         errorState.value = controller.playerError
         controller.playerError?.let {
             Log.w(ERROR_LOG_TAG) { "Primed with existing error on ${controller.currentMediaItem?.mediaId}: ${it.describe()}" }
+            Log.d(PLAYBACK_DIAG_TAG) { "PRIMED with existing error on ${controller.currentMediaItem?.mediaId}: ${it.describe()}" }
         }
 
+        // Re-preparations attempted for the current stream. Reset on a media-item change and once
+        // playback makes real progress past the point an error was raised (see recoveryAnchorMs),
+        // never merely on reaching READY — a sub-second READY flap must not refill the budget.
+        var liveRecoveryAttempts = 0
+        var recoveryAnchorMs = Long.MIN_VALUE
+
         val listener =
             object : Player.Listener {
                 override fun onPlayerErrorChanged(error: PlaybackException?) {
                     if (error != null) {
-                        Log.w(ERROR_LOG_TAG) { "Error raised on ${controller.currentMediaItem?.mediaId}: ${error.describe()}" }
+                        val mediaId = controller.currentMediaItem?.mediaId
+                        val recoverable = isRecoverableLiveError(error.errorCode)
+                        Log.d(PLAYBACK_DIAG_TAG) {
+                            "ERROR code=${error.errorCodeName}(${error.errorCode}) recoverable=$recoverable " +
+                                "attempts=$liveRecoveryAttempts pos=${controller.currentPosition} buffered=${controller.bufferedPosition} " +
+                                "on $mediaId :: ${error.describe()}"
+                        }
+                        Log.w(ERROR_LOG_TAG) { "Error raised on $mediaId: ${error.describe()}" }
+
+                        if (recoverable && liveRecoveryAttempts < MAX_LIVE_STREAM_RECOVERY_ATTEMPTS) {
+                            liveRecoveryAttempts++
+                            recoveryAnchorMs = controller.currentPosition
+                            Log.d(PLAYBACK_DIAG_TAG) {
+                                "RECOVER attempt $liveRecoveryAttempts/$MAX_LIVE_STREAM_RECOVERY_ATTEMPTS " +
+                                    "after ${error.errorCodeName} on $mediaId — seekToDefaultPosition + prepare"
+                            }
+                            // Rejoin the live edge and re-prepare. Leave errorState null so the
+                            // overlay never appears for a recoverable hiccup.
+                            controller.seekToDefaultPosition()
+                            controller.prepare()
+                            return
+                        }
+
+                        Log.d(PLAYBACK_DIAG_TAG) {
+                            val why = if (recoverable) "GAVE UP after $liveRecoveryAttempts attempts" else "TERMINAL (not recovering) ${error.errorCodeName}"
+                            "$why on $mediaId — overlay will show"
+                        }
                     } else if (errorState.value != null) {
                         Log.d(ERROR_LOG_TAG) { "Error cleared on ${controller.currentMediaItem?.mediaId}" }
                     }
@@ -113,6 +199,9 @@ fun WatchPlaybackErrors(controllerState: MediaControllerState) {
                     mediaItem: MediaItem?,
                     reason: Int,
                 ) {
+                    Log.d(PLAYBACK_DIAG_TAG) { "ITEM reason=$reason -> ${mediaItem?.mediaId} (mime=${mediaItem?.localConfiguration?.mimeType})" }
+                    liveRecoveryAttempts = 0
+                    recoveryAnchorMs = Long.MIN_VALUE
                     // A new item on a pooled player starts fresh; drop any error from the old one.
                     if (errorState.value != null) {
                         Log.d(ERROR_LOG_TAG) { "Error dropped on media transition (reason=$reason) -> ${mediaItem?.mediaId}" }
@@ -121,17 +210,46 @@ fun WatchPlaybackErrors(controllerState: MediaControllerState) {
                 }
 
                 override fun onPlaybackStateChanged(state: Int) {
+                    Log.d(PLAYBACK_DIAG_TAG) {
+                        "STATE=${playbackStateName(state)} playWhenReady=${controller.playWhenReady} " +
+                            "pos=${controller.currentPosition} buffered=${controller.bufferedPosition} " +
+                            "on ${controller.currentMediaItem?.mediaId}"
+                    }
                     // A successful transition to READY (the renderer produced output) is the only
                     // real recovery — clear the overlay then. We deliberately do NOT clear on
                     // STATE_BUFFERING: the synthetic decode-stall error below is raised *while*
                     // buffering, and clearing on every buffering event would wipe it instantly.
                     if (state == Player.STATE_READY) {
+                        // Refill the recovery budget only after genuine forward progress past the last
+                        // error, so a stream that re-errors at the same spot every ~1 s still hits the
+                        // cap and surfaces instead of thrashing forever.
+                        if (controller.currentPosition >= recoveryAnchorMs + RECOVERY_RESET_PROGRESS_MS) {
+                            liveRecoveryAttempts = 0
+                            recoveryAnchorMs = Long.MIN_VALUE
+                        }
                         if (errorState.value != null) {
                             Log.d(ERROR_LOG_TAG) { "Recovered (STATE_READY) on ${controller.currentMediaItem?.mediaId} — clearing overlay" }
                             errorState.value = null
                         }
                     }
                 }
+
+                override fun onPositionDiscontinuity(
+                    oldPosition: Player.PositionInfo,
+                    newPosition: Player.PositionInfo,
+                    reason: Int,
+                ) {
+                    Log.d(PLAYBACK_DIAG_TAG) {
+                        "DISCONTINUITY reason=$reason ${oldPosition.positionMs}ms -> ${newPosition.positionMs}ms " +
+                            "on ${controller.currentMediaItem?.mediaId}"
+                    }
+                }
+
+                override fun onTracksChanged(tracks: Tracks) {
+                    Log.d(PLAYBACK_DIAG_TAG) {
+                        "TRACKS video[${tracks.selectedVideoSummary()}] on ${controller.currentMediaItem?.mediaId}"
+                    }
+                }
             }
 
         controller.addListener(listener)
@@ -184,6 +302,10 @@ private suspend fun watchForDecodeStall(
                     "Synthetic decode-stall after ${STALL_TIMEOUT_MS}ms fed-but-frozen " +
                         "(pos=$position buffered=${controller.bufferedPosition}) on ${controller.currentMediaItem?.mediaId}"
                 }
+                Log.d(PLAYBACK_DIAG_TAG) {
+                    "SYNTHETIC-STALL fed-but-frozen ${STALL_TIMEOUT_MS}ms " +
+                        "(pos=$position buffered=${controller.bufferedPosition}) on ${controller.currentMediaItem?.mediaId} — likely codec reconfig/unsupported"
+                }
                 errorState.value =
                     PlaybackException(
                         "Video decoding stalled with a full buffer — likely an unsupported codec",

amethyst/src/main/java/com/vitorpamplona/amethyst/service/playback/diskCache/HlsLivenessCache.kt

@@ -0,0 +1,61 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.service.playback.diskCache
+
+import androidx.collection.LruCache
+
+/**
+ * Remembers, per media URL, whether ExoPlayer determined a stream to be live once it parsed the
+ * playlist. This is how the cache tells a live HLS FAST channel from an immutable on-demand HLS
+ * rendition — a distinction the `.m3u8` URL alone cannot make.
+ *
+ * A `.m3u8` cannot be classified before it is fetched, so the very first play of a URL is unknown
+ * and routed conservatively to the non-caching source (see CustomMediaSourceFactory). Once the
+ * timeline reports liveness (recorded by HlsLivenessRecorder), a *subsequent* play of the same URL
+ * routes correctly: a known on-demand stream is cached, a known live stream never is.
+ *
+ * A URL is permanently one or the other, and the recorder overwrites with the latest verdict on
+ * every timeline change, so a transient early value self-corrects. Backed by a bounded, thread-safe
+ * [LruCache] (same convention as [com.vitorpamplona.amethyst.model.MediaAspectRatioCache]) so a long
+ * feed session over many distinct URLs can't grow it without bound — an evicted entry just relearns
+ * on its next play, which is one uncached play, the same negligible cost as a process restart.
+ */
+object HlsLivenessCache {
+    // url -> isLive. Absent = not yet learned.
+    private val verdicts = LruCache<String, Boolean>(1000)
+
+    fun record(
+        url: String,
+        isLive: Boolean,
+    ) {
+        verdicts.put(url, isLive)
+    }
+
+    /** True only when we have positively learned this URL is on-demand (safe to cache). */
+    fun isKnownOnDemand(url: String): Boolean = verdicts.get(url) == false
+
+    /** The learned verdict, or null if this URL has not been classified yet. */
+    fun verdict(url: String): Boolean? = verdicts.get(url)
+
+    fun clear() {
+        verdicts.evictAll()
+    }
+}

amethyst/src/main/java/com/vitorpamplona/amethyst/service/playback/playerPool/CustomMediaSourceFactory.kt

@@ -27,20 +27,54 @@ import androidx.media3.exoplayer.drm.DrmSessionManagerProvider
 import androidx.media3.exoplayer.source.DefaultMediaSourceFactory
 import androidx.media3.exoplayer.source.MediaSource
 import androidx.media3.exoplayer.upstream.LoadErrorHandlingPolicy
+import com.vitorpamplona.amethyst.service.playback.PLAYBACK_DIAG_TAG
 import com.vitorpamplona.amethyst.service.playback.composable.mediaitem.MediaItemCache
+import com.vitorpamplona.amethyst.service.playback.diskCache.HlsLivenessCache
 import com.vitorpamplona.amethyst.service.playback.diskCache.VideoCache
 import com.vitorpamplona.amethyst.service.playback.diskCache.isLiveStreaming
 import com.vitorpamplona.quartz.utils.Log
 
 /**
- * True live streams (kind 30311) must not be cached. On-demand HLS
- * (e.g. multi-rendition NIP-71 videos) is cached like any other video,
- * because its segments are immutable.
+ * Whether an HLS item should bypass the disk cache. Pure so the routing is unit-testable.
  *
- * The `isLiveStream` flag is carried on [MediaItem.mediaMetadata] extras
- * and set by [MediaItemCache] from [com.vitorpamplona.amethyst.service.playback.composable.mediaitem.MediaItemData].
- * If the flag is absent (e.g. a [MediaItem] built outside the cache path),
- * we fall back to the URL-based heuristic.
+ * - **Flagged live** (kind:30311 live activity) → always bypass.
+ * - **Progressive** (mp4, …) → never bypass; cache normally.
+ * - **HLS learned on-demand** → cache. A VOD playlist has `#EXT-X-ENDLIST`, so it is static and its
+ *   segments are immutable — safe and worthwhile to cache.
+ * - **HLS live or not-yet-classified** → bypass. Caching a live playlist makes ExoPlayer reload a
+ *   stale, non-advancing playlist and throw `PlaylistStuckException`, after which playback loops on
+ *   the frozen window. Until we have positively learned a URL is on-demand (see [HlsLivenessCache]),
+ *   the safe default is to bypass.
+ */
+internal fun shouldBypassCache(
+    isFlaggedLive: Boolean,
+    isHls: Boolean,
+    isKnownOnDemand: Boolean,
+): Boolean =
+    when {
+        isFlaggedLive -> true
+        !isHls -> false
+        isKnownOnDemand -> false
+        else -> true
+    }
+
+/**
+ * Decides whether a [MediaItem] plays through the caching data source or bypasses it.
+ *
+ * The hard constraint is that a **live** HLS stream must never be cached — caching its mutating
+ * playlist makes ExoPlayer reload a stale, non-advancing manifest and throw `PlaylistStuckException`
+ * (surfaced as `ERROR_CODE_IO_UNSPECIFIED`), after which playback loops replaying the frozen window.
+ * But we also *want* to cache immutable on-demand HLS (multi-rendition NIP-71 VOD).
+ *
+ * A `.m3u8` URL cannot distinguish the two, and the `isLiveStream` metadata flag only marks
+ * kind:30311 live activities, so a live `.m3u8` shared in a plain kind:1 note arrives flagged
+ * non-live. We therefore learn liveness from ExoPlayer itself: [HlsLivenessRecorder] records the
+ * playlist's live/on-demand verdict into [HlsLivenessCache] once loaded, and the *next* play of that
+ * URL routes by it. The first (unclassified) play bypasses — the safe default — so a live stream is
+ * never cached even once; only a proven on-demand URL is cached, from its second view onward.
+ *
+ * The `isLiveStream` flag is carried on [MediaItem.mediaMetadata] extras and set by
+ * [MediaItemCache] from [com.vitorpamplona.amethyst.service.playback.composable.mediaitem.MediaItemData].
  */
 @UnstableApi
 class CustomMediaSourceFactory(
@@ -67,27 +101,33 @@ class CustomMediaSourceFactory(
     override fun getSupportedTypes(): IntArray = nonCachingFactory.supportedTypes
 
     override fun createMediaSource(mediaItem: MediaItem): MediaSource {
-        val live = isLiveStream(mediaItem)
-        val itemMime = mediaItem.localConfiguration?.mimeType
+        val id = mediaItem.mediaId
+        val flaggedLive = isFlaggedLive(mediaItem)
+        val hls = isLiveStreaming(id)
+        val knownOnDemand = HlsLivenessCache.isKnownOnDemand(id)
+        val bypassCache = shouldBypassCache(flaggedLive, hls, knownOnDemand)
+
         val source =
-            if (live) {
+            if (bypassCache) {
                 nonCachingFactory.createMediaSource(mediaItem)
             } else {
                 cachingFactory.createMediaSource(mediaItem)
             }
-        Log.d("CustomMediaSourceFactory") {
-            "createMediaSource(${if (live) "BYPASS" else "CACHE"}): id=${mediaItem.mediaId} mime=$itemMime -> ${source::class.java.simpleName}"
+        // Logs the three routing inputs directly rather than a re-derived label, so it can't drift
+        // from shouldBypassCache.
+        Log.d(PLAYBACK_DIAG_TAG) {
+            "SOURCE ${if (bypassCache) "BYPASS" else "CACHE"} flaggedLive=$flaggedLive hls=$hls knownOnDemand=$knownOnDemand " +
+                "mime=${mediaItem.localConfiguration?.mimeType} -> ${source::class.java.simpleName} id=$id"
         }
         return source
     }
 
-    private fun isLiveStream(mediaItem: MediaItem): Boolean {
+    // Only the explicit event-kind flag (kind:30311 live activities). Returns false when the flag
+    // is absent or false; the HLS URL check in createMediaSource covers everything else.
+    private fun isFlaggedLive(mediaItem: MediaItem): Boolean {
         val extras = mediaItem.mediaMetadata.extras
-        return if (extras != null && extras.containsKey(MediaItemCache.EXTRA_IS_LIVE_STREAM)) {
+        return extras != null &&
+            extras.containsKey(MediaItemCache.EXTRA_IS_LIVE_STREAM) &&
             extras.getBoolean(MediaItemCache.EXTRA_IS_LIVE_STREAM, false)
-        } else {
-            // Fallback for MediaItems that weren't built via MediaItemCache.
-            isLiveStreaming(mediaItem.mediaId)
-        }
     }
 }

amethyst/src/main/java/com/vitorpamplona/amethyst/service/playback/playerPool/ExoPlayerBuilder.kt

@@ -83,6 +83,7 @@ class ExoPlayerBuilder(
                 )
                 PcmTapRegistry.bind(currentMediaItem?.mediaId, sink)
                 addListener(AspectRatioCacher(MediaAspectRatioCache))
+                addListener(HlsLivenessRecorder(this))
                 addListener(AutoReplayLimiter(pause = ::pause))
                 addListener(KeepVideosPlaying(this))
                 addListener(CurrentPlayPositionCacher(this, VideoViewedPositionCache))

amethyst/src/main/java/com/vitorpamplona/amethyst/service/playback/playerPool/HlsLivenessRecorder.kt

@@ -0,0 +1,110 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.service.playback.playerPool
+
+import androidx.media3.common.C
+import androidx.media3.common.Player
+import androidx.media3.common.Timeline
+import com.vitorpamplona.amethyst.service.playback.PLAYBACK_DIAG_TAG
+import com.vitorpamplona.amethyst.service.playback.diskCache.HlsLivenessCache
+import com.vitorpamplona.amethyst.service.playback.diskCache.isLiveStreaming
+import com.vitorpamplona.quartz.utils.Log
+
+/**
+ * The verdict to store for an HLS URL given the player's current window, or null to store nothing.
+ *
+ * The recording is deliberately asymmetric. A wrong "live" only forgoes caching, while a wrong
+ * "on-demand" caches a live stream and breaks it (PlaylistStuck), so live is cheap to record and
+ * on-demand must be earned:
+ *
+ * - record **live** as soon as any window says so ([allowOnDemand] irrelevant), but
+ * - record **on-demand** only when [allowOnDemand] (the player reached STATE_READY, i.e. it is
+ *   actually playing, not a geo-blocked stream that served a VOD-shaped placeholder playlist and
+ *   then errored), the window is a resolved static finite seekable VOD, and the URL is not already
+ *   known live.
+ *
+ * Recording on-demand only at READY is what keeps a broken/geo-fenced live stream — which reports a
+ * static window from a timeline event but 403/404s before it can ever reach READY — from being
+ * mislearned as cacheable. Pure, so the classification is unit-testable without a [Player].
+ */
+internal fun livenessVerdictToRecord(
+    isLive: Boolean,
+    isDynamic: Boolean,
+    isSeekable: Boolean,
+    hasKnownDuration: Boolean,
+    known: Boolean?,
+    allowOnDemand: Boolean,
+): Boolean? =
+    when {
+        isLive -> true
+        !allowOnDemand -> null
+        !isDynamic && isSeekable && hasKnownDuration && known != true -> false
+        else -> null
+    }
+
+/**
+ * Records into [HlsLivenessCache] whether the current HLS item is live, so [CustomMediaSourceFactory]
+ * can cache proven on-demand HLS on the *next* play while never caching a live stream. The only
+ * reliable live/on-demand discriminator (`#EXT-X-ENDLIST`) is inside the playlist, so it is knowable
+ * only once ExoPlayer has loaded it — hence learning it here rather than from the URL.
+ *
+ * Only `.m3u8` items are considered; progressive media is unambiguous and never routed by liveness.
+ */
+class HlsLivenessRecorder(
+    private val player: Player,
+) : Player.Listener {
+    override fun onTimelineChanged(
+        timeline: Timeline,
+        reason: Int,
+    ) = maybeRecord(allowOnDemand = false)
+
+    override fun onPlaybackStateChanged(state: Int) {
+        // Only a stream that actually plays (reached READY) may be recorded on-demand; a geo-blocked
+        // stream that errors before READY must never be learned as cacheable. Live is still recorded
+        // from the timeline above the moment the window says so.
+        if (state == Player.STATE_READY) maybeRecord(allowOnDemand = true)
+    }
+
+    private fun maybeRecord(allowOnDemand: Boolean) {
+        if (player.currentTimeline.isEmpty) return
+        val url = player.currentMediaItem?.mediaId ?: return
+        if (!isLiveStreaming(url)) return
+
+        val known = HlsLivenessCache.verdict(url)
+        val toRecord =
+            livenessVerdictToRecord(
+                isLive = player.isCurrentMediaItemLive,
+                isDynamic = player.isCurrentMediaItemDynamic,
+                isSeekable = player.isCurrentMediaItemSeekable,
+                hasKnownDuration = player.contentDuration != C.TIME_UNSET,
+                known = known,
+                allowOnDemand = allowOnDemand,
+            ) ?: return
+
+        // Only write when the verdict actually changes: onTimelineChanged fires on every manifest
+        // refresh of a live stream, and the verdict is stable once learned, so re-putting the same
+        // value would take a ConcurrentHashMap bin lock on every callback for nothing.
+        if (known != toRecord) {
+            Log.d(PLAYBACK_DIAG_TAG) { "LIVENESS ${if (toRecord) "LIVE" else "ON-DEMAND"} learned for $url" }
+            HlsLivenessCache.record(url, toRecord)
+        }
+    }
+}

amethyst/src/main/java/com/vitorpamplona/amethyst/service/pow/PowJobRestorer.kt

@@ -20,11 +20,11 @@
  */
 package com.vitorpamplona.amethyst.service.pow
 
+import com.vitorpamplona.amethyst.commons.scheduledposts.ScheduledPost
+import com.vitorpamplona.amethyst.commons.scheduledposts.ScheduledPostStore
 import com.vitorpamplona.amethyst.commons.service.pow.PersistedPoWJob
 import com.vitorpamplona.amethyst.commons.service.pow.PoWPublishQueue
 import com.vitorpamplona.amethyst.model.Account
-import com.vitorpamplona.amethyst.service.scheduledposts.ScheduledPost
-import com.vitorpamplona.amethyst.service.scheduledposts.ScheduledPostStore
 import com.vitorpamplona.quartz.nip01Core.core.Event
 import com.vitorpamplona.quartz.nip01Core.relay.normalizer.NormalizedRelayUrl
 import com.vitorpamplona.quartz.nip01Core.signers.EventTemplate

amethyst/src/main/java/com/vitorpamplona/amethyst/service/pow/PowMiningForegroundService.kt

@@ -20,34 +20,17 @@
  */
 package com.vitorpamplona.amethyst.service.pow
 
-import android.app.Notification
-import android.app.NotificationChannel
-import android.app.NotificationManager
-import android.app.PendingIntent
-import android.app.Service
 import android.content.Context
-import android.content.Intent
 import android.content.pm.ServiceInfo
-import android.os.Build
-import android.os.IBinder
-import androidx.core.app.NotificationCompat
-import androidx.core.app.NotificationManagerCompat
 import com.vitorpamplona.amethyst.Amethyst
 import com.vitorpamplona.amethyst.R
 import com.vitorpamplona.amethyst.commons.service.pow.PoWEstimator
 import com.vitorpamplona.amethyst.commons.service.pow.PoWJobState
-import com.vitorpamplona.amethyst.ui.MainActivity
+import com.vitorpamplona.amethyst.service.foreground.FlowProgressForegroundService
 import com.vitorpamplona.amethyst.ui.pluralStringRes
 import com.vitorpamplona.amethyst.ui.stringRes
-import com.vitorpamplona.quartz.utils.Log
 import com.vitorpamplona.quartz.utils.TimeUtils
 import kotlinx.collections.immutable.ImmutableList
-import kotlinx.coroutines.CoroutineScope
-import kotlinx.coroutines.Dispatchers
-import kotlinx.coroutines.Job
-import kotlinx.coroutines.SupervisorJob
-import kotlinx.coroutines.cancel
-import kotlinx.coroutines.delay
 import kotlinx.coroutines.launch
 
 /**
@@ -56,161 +39,72 @@ import kotlinx.coroutines.launch
  * finish mining even after the user backgrounds the app.
  *
  * Uses the Android 14+ `shortService` type — no special permission, but a
- * hard ~3 minute budget. On [onTimeout] the service exits cleanly; every
+ * hard ~3 minute budget. On `onTimeout` the service exits cleanly; every
  * persistable job is already checkpointed by [PowJobStore], so anything still
  * unmined resumes on the next app launch. Started on every enqueue (the app
  * is necessarily in the foreground then), stops itself when the queue drains.
  *
- * The notification is a live progress card ([NotificationCompat.ProgressStyle]):
- * one track segment per post, filling as jobs complete, indeterminate while a
- * single post mines, with a cancel-all action. On Android 16+ it renders as a
- * Live Updates chip; older versions fall back to a standard progress bar.
+ * The notification card (a live [androidx.core.app.NotificationCompat.ProgressStyle]) and all the
+ * service lifecycle live in [FlowProgressForegroundService]; this subclass only maps mining state
+ * to that card.
  */
-class PowMiningForegroundService : Service() {
-    private val scope = CoroutineScope(Dispatchers.Main.immediate + SupervisorJob())
-    private var watchJob: Job? = null
+class PowMiningForegroundService : FlowProgressForegroundService<ImmutableList<PoWJobState>>() {
+    override val fgsType: Int = ServiceInfo.FOREGROUND_SERVICE_TYPE_SHORT_SERVICE
+    override val channelId = CHANNEL_ID
+    override val channelNameRes = R.string.pow_notification_channel_name
+    override val channelDescRes = R.string.pow_notification_channel_description
+    override val notificationId = NOTIFICATION_ID
+    override val cancelAction = ACTION_CANCEL_ALL
+    override val cancelLabelRes = R.string.pow_notification_cancel_all
 
-    // Session totals so the progress track can show "done / enqueued since the
-    // service started" — the queue itself only knows what is still pending.
+    // clock-driven refresh for the time-left text and bar; the shortService budget (~3 min)
+    // caps this at a handful of updates.
+    override val refreshMs: Long = PROGRESS_REFRESH_MS
+
+    // Session totals so the progress track can show "done / enqueued since the service
+    // started" — the queue itself only knows what is still pending.
     private var sessionTotal = 0
     private var lastQueueSize = 0
 
-    // Benchmarked once per service run (~250 ms, cached by the estimator);
-    // read from the notification builder to compute expected durations.
+    // Benchmarked once per service run (~250 ms, cached by the estimator).
     @Volatile
     private var hashRate: Double? = null
 
-    // Built once per service instance: the intents never change, and
-    // buildNotification runs on every queue update.
-    private val tapIntent: PendingIntent by lazy {
-        PendingIntent.getActivity(
-            this,
-            0,
-            Intent(this, MainActivity::class.java).apply {
-                addFlags(Intent.FLAG_ACTIVITY_NEW_TASK or Intent.FLAG_ACTIVITY_CLEAR_TOP)
-            },
-            PendingIntent.FLAG_IMMUTABLE or PendingIntent.FLAG_UPDATE_CURRENT,
-        )
-    }
-
-    private val cancelIntent: PendingIntent by lazy {
-        PendingIntent.getService(
-            this,
-            1,
-            Intent(this, PowMiningForegroundService::class.java).setAction(ACTION_CANCEL_ALL),
-            PendingIntent.FLAG_IMMUTABLE or PendingIntent.FLAG_UPDATE_CURRENT,
-        )
-    }
-
     override fun onCreate() {
         super.onCreate()
         running = true
     }
 
-    override fun onBind(intent: Intent?): IBinder? = null
-
-    override fun onStartCommand(
-        intent: Intent?,
-        flags: Int,
-        startId: Int,
-    ): Int {
-        // Android's contract: every onStartCommand after startForegroundService
-        // must call startForeground promptly, even on the stop path.
-        runCatching { startForegroundCompat(currentJobs()) }
-            .onFailure {
-                Log.w(TAG, "startForeground failed; mining continues without the service", it)
-                stopSelf()
-                return START_NOT_STICKY
-            }
-
-        if (intent?.action == ACTION_CANCEL_ALL) {
-            Amethyst.instance.powPublishQueue.cancelAll()
-            stopForeground(STOP_FOREGROUND_REMOVE)
-            stopSelf()
-            return START_NOT_STICKY
-        }
-
-        watchQueue()
-        return START_NOT_STICKY
-    }
-
-    /**
-     * The shortService budget (~3 min) is exhausted. Exit before the system
-     * ANRs us: persisted jobs are checkpointed and resume on next launch;
-     * in-memory jobs keep mining opportunistically until the process freezes.
-     */
-    override fun onTimeout(startId: Int) {
-        Log.d(TAG) { "shortService budget exhausted; ${currentJobs().size} job(s) left to resume later" }
-        stopForeground(STOP_FOREGROUND_REMOVE)
-        stopSelf()
-    }
-
     override fun onDestroy() {
         running = false
-        scope.cancel()
         super.onDestroy()
     }
 
-    private fun currentJobs(): ImmutableList<PoWJobState> = Amethyst.instance.powPublishQueue.jobs.value
+    override fun state() = Amethyst.instance.powPublishQueue.jobs
 
-    private fun watchQueue() {
-        if (watchJob != null) return
-        watchJob =
-            scope.launch {
-                Amethyst.instance.powPublishQueue.jobs.collect { jobs ->
-                    if (jobs.size > lastQueueSize) sessionTotal += jobs.size - lastQueueSize
-                    lastQueueSize = jobs.size
+    override fun isActive(value: ImmutableList<PoWJobState>) = value.isNotEmpty()
 
-                    if (jobs.isEmpty()) {
-                        stopForeground(STOP_FOREGROUND_REMOVE)
-                        stopSelf()
-                    } else {
-                        updateNotification(jobs)
-                    }
-                }
-            }
+    override fun cancelAll() = Amethyst.instance.powPublishQueue.cancelAll()
 
-        // the estimated-time-left figure and progress fraction only move with
-        // the clock, not with queue events: benchmark the hash rate once,
-        // then refresh the card periodically while something is mining.
-        scope.launch {
-            hashRate = PoWEstimator.hashesPerSecond()
-            while (true) {
-                val jobs = currentJobs()
-                if (jobs.any { it.isMining }) updateNotification(jobs)
-                delay(PROGRESS_REFRESH_MS)
-            }
-        }
+    override fun needsClockRefresh(value: ImmutableList<PoWJobState>) = value.any { it.isMining }
+
+    override fun onStarted() {
+        scope.launch { hashRate = PoWEstimator.hashesPerSecond() }
     }
 
-    private fun startForegroundCompat(jobs: ImmutableList<PoWJobState>) {
-        ensureChannel(this)
-        val notification = buildNotification(jobs)
-        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.UPSIDE_DOWN_CAKE) {
-            startForeground(NOTIFICATION_ID, notification, ServiceInfo.FOREGROUND_SERVICE_TYPE_SHORT_SERVICE)
-        } else {
-            startForeground(NOTIFICATION_ID, notification)
-        }
+    override fun onEmission(value: ImmutableList<PoWJobState>) {
+        if (value.size > lastQueueSize) sessionTotal += value.size - lastQueueSize
+        lastQueueSize = value.size
     }
 
-    private fun updateNotification(jobs: ImmutableList<PoWJobState>) {
-        val manager = NotificationManagerCompat.from(this)
-        if (!manager.areNotificationsEnabled()) return
-        try {
-            manager.notify(NOTIFICATION_ID, buildNotification(jobs))
-        } catch (_: SecurityException) {
-            // POST_NOTIFICATIONS revoked mid-flight; the FGS keeps running.
-        }
-    }
+    override fun render(value: ImmutableList<PoWJobState>): Content {
+        val done = (sessionTotal - value.size).coerceAtLeast(0)
+        val total = (done + value.size).coerceAtLeast(1)
 
-    private fun buildNotification(jobs: ImmutableList<PoWJobState>): Notification {
-        val done = (sessionTotal - jobs.size).coerceAtLeast(0)
-        val total = (done + jobs.size).coerceAtLeast(1)
+        val current = value.firstOrNull { it.isMining } ?: value.firstOrNull()
 
-        val current = jobs.firstOrNull { it.isMining } ?: jobs.firstOrNull()
-
-        // expected duration for the job being mined right now, so the card can
-        // say "≈ 10 minutes left" and fill its bar toward a predictable end.
+        // expected duration for the job being mined right now, so the card can say
+        // "≈ 10 minutes left" and fill its bar toward a predictable end.
         val rate = hashRate
         val startedAt = current?.miningStartedAt
         val expectedSec = if (current != null && rate != null) PoWEstimator.estimateSeconds(current.difficulty, rate) else null
@@ -229,44 +123,23 @@ class PowMiningForegroundService : Service() {
 
         val fraction = if (expectedSec != null && elapsedSec != null) elapsedSec / expectedSec else null
 
-        val progressStyle: NotificationCompat.ProgressStyle =
-            if (total <= 1) {
-                // single post: fill toward the estimated duration; past the
-                // mean the search is memoryless, so sweep instead of lying.
-                if (fraction != null && fraction < 1.0) {
-                    NotificationCompat
-                        .ProgressStyle()
-                        .setProgressSegments(listOf(NotificationCompat.ProgressStyle.Segment(100)))
-                        .setProgress((fraction * 100).toInt())
-                } else {
-                    NotificationCompat.ProgressStyle().setProgressIndeterminate(true)
-                }
+        val title =
+            if (value.size > 1) {
+                pluralStringRes(this, R.plurals.pow_mining_progress, value.size, value.size)
             } else {
-                NotificationCompat
-                    .ProgressStyle()
-                    .setProgressSegments(List(total) { NotificationCompat.ProgressStyle.Segment(1) })
-                    .setProgress(done)
+                stringRes(this, R.string.pow_mining_title)
             }
 
-        return NotificationCompat
-            .Builder(this, CHANNEL_ID)
-            .setSmallIcon(R.drawable.amethyst)
-            .setContentTitle(
-                if (jobs.size > 1) {
-                    pluralStringRes(this, R.plurals.pow_mining_progress, jobs.size, jobs.size)
-                } else {
-                    stringRes(this, R.string.pow_mining_title)
-                },
-            ).setContentText(text)
-            .setStyle(progressStyle)
-            .setContentIntent(tapIntent)
-            .addAction(0, stringRes(this, R.string.pow_notification_cancel_all), cancelIntent)
-            .setOngoing(true)
-            .setOnlyAlertOnce(true)
-            .setCategory(NotificationCompat.CATEGORY_PROGRESS)
-            .setPriority(NotificationCompat.PRIORITY_LOW)
-            .setForegroundServiceBehavior(NotificationCompat.FOREGROUND_SERVICE_IMMEDIATE)
-            .build()
+        val bar =
+            if (total <= 1) {
+                // single post: fill toward the estimated duration; past the mean the search is
+                // memoryless, so sweep instead of lying.
+                if (fraction != null && fraction < 1.0) Bar.Determinate(fraction) else Bar.Indeterminate
+            } else {
+                Bar.Segmented(total, done)
+            }
+
+        return Content(title, text, bar)
     }
 
     companion object {
@@ -275,45 +148,19 @@ class PowMiningForegroundService : Service() {
         private const val NOTIFICATION_ID = 0x504F57 // "POW"
         private const val ACTION_CANCEL_ALL = "com.vitorpamplona.amethyst.pow.CANCEL_ALL"
 
-        // clock-driven refresh cadence for the time-left text and bar; the
-        // shortService budget (~3 min) caps this at a handful of updates.
         private const val PROGRESS_REFRESH_MS = 30_000L
 
-        // Best-effort de-dup for start(): the queue calls it on EVERY enqueue,
-        // and each call otherwise round-trips through system_server. A stale
-        // false only costs one redundant startForegroundService (which Android
-        // routes to the existing instance's onStartCommand anyway).
+        // Best-effort de-dup for start(): the queue calls it on EVERY enqueue.
         @Volatile
         private var running = false
 
         /**
-         * Best-effort start: enqueue happens while the user is interacting
-         * with the app, so the foreground-start allowance normally holds. A
-         * restore during a cold background launch may be denied — mining then
-         * proceeds unprotected and the service starts on the next enqueue.
+         * Best-effort start: enqueue happens while the user is interacting with the app,
+         * so the foreground-start allowance normally holds.
          */
         fun start(context: Context) {
             if (running) return
-            try {
-                context.startForegroundService(Intent(context, PowMiningForegroundService::class.java))
-            } catch (e: Exception) {
-                Log.w(TAG, "Could not start mining foreground service (backgrounded?); mining continues unprotected", e)
-            }
-        }
-
-        private fun ensureChannel(context: Context) {
-            val manager = context.getSystemService(NOTIFICATION_SERVICE) as NotificationManager
-            if (manager.getNotificationChannel(CHANNEL_ID) != null) return
-            manager.createNotificationChannel(
-                NotificationChannel(
-                    CHANNEL_ID,
-                    stringRes(context, R.string.pow_notification_channel_name),
-                    NotificationManager.IMPORTANCE_LOW,
-                ).apply {
-                    description = stringRes(context, R.string.pow_notification_channel_description)
-                    setShowBadge(false)
-                },
-            )
+            FlowProgressForegroundService.start(context, PowMiningForegroundService::class.java, TAG)
         }
     }
 }

amethyst/src/main/java/com/vitorpamplona/amethyst/service/relayClient/RelayProxyClientConnector.kt

@@ -20,6 +20,7 @@
  */
 package com.vitorpamplona.amethyst.service.relayClient
 
+import com.vitorpamplona.amethyst.commons.tor.TorRelaySettings
 import com.vitorpamplona.amethyst.model.torState.TorRelayEvaluation
 import com.vitorpamplona.amethyst.service.connectivity.ConnectivityStatus
 import com.vitorpamplona.amethyst.ui.tor.TorServiceStatus
@@ -63,6 +64,27 @@ class RelayProxyClientConnector(
     private var lastTorConnection: OkHttpClient? = null
     private var lastClearConnection: OkHttpClient? = null
 
+    // The network we were last on. The OkHttp clients above are rebuilt off the metered
+    // bit, so they only tell us about wifi<->cellular; they say nothing about wifi A ->
+    // wifi B, a VPN coming up, or a captive portal clearing. Those all mint a new
+    // networkHandle, and after them every existing socket is bound to an interface that
+    // is gone and every accumulated backoff was earned against a network we have left.
+    private var lastNetworkId: Long? = null
+
+    // The user's Tor preferences. TorRelayEvaluation has no equals() and a fresh instance is
+    // emitted on unrelated churn, so we track the settings by value. Without this, flipping a
+    // Tor toggle while Tor is already up leaves both OkHttpClient references identical ->
+    // transportChanged=false -> a relay parked on a 5-minute backoff keeps waiting it out on
+    // a transport it is no longer using.
+    //
+    // Deliberately only [TorRelaySettings], not the trusted/DM/money relay sets that
+    // TorRelayEvaluation also carries: those churn constantly while an account's relay lists
+    // load from the network (observed firing three times during a single cold start). A relay
+    // moving between classifications can flip its transport too, but forgiving the whole
+    // pool's backoff every time any relay list updates is far more damage than making that
+    // one relay serve out its delay.
+    private var lastTorSettings: TorRelaySettings? = null
+
     @OptIn(FlowPreview::class)
     val relayServices =
         combine(
@@ -74,51 +96,8 @@ class RelayProxyClientConnector(
         ) { torSettings, torConnection, clearConnection, connectivity, torStatus ->
             RelayServiceInfra(torSettings, torConnection, clearConnection, connectivity, torStatus)
         }.debounce(100)
-            .onEach {
-                when {
-                    it.connectivity is ConnectivityStatus.StartingService -> {
-                        // ignore
-                    }
-
-                    it.connectivity is ConnectivityStatus.Off -> {
-                        Log.d("ManageRelayServices") { "Connectivity Off: Pausing Relay Services ${it.connectivity}" }
-                        if (client.isActive()) {
-                            client.disconnect()
-                        }
-                        if (it.torStatus is TorServiceStatus.Active) {
-                            Log.d("ManageRelayServices", "Connectivity off, Tor idle")
-                        }
-                    }
-
-                    it.connectivity is ConnectivityStatus.Active && !client.isActive() -> {
-                        Log.d("ManageRelayServices", "Connectivity On: Resuming Relay Services")
-
-                        if (it.torStatus is TorServiceStatus.Active) {
-                            Log.d("ManageRelayServices", "Connectivity resumed, Tor active")
-                        }
-
-                        // only calls this if the client is not active. Otherwise goes to the else below
-                        client.connect()
-                    }
-
-                    else -> {
-                        // Only skip the per-relay exponential backoff when the actual HTTP
-                        // transport changed. Otherwise (e.g. Tor still bootstrapping, the SOCKS
-                        // port not yet listening) honor each relay's backoff so we don't
-                        // reconnect-fail-reconnect on every unrelated infrastructure event.
-                        val transportChanged =
-                            it.torConnection !== lastTorConnection || it.clearConnection !== lastClearConnection
-                        lastTorConnection = it.torConnection
-                        lastClearConnection = it.clearConnection
-
-                        Log.d("ManageRelayServices") { "Relay Services have changed, reconnecting relays that need to (transportChanged=$transportChanged)" }
-                        client.reconnect(
-                            onlyIfChanged = true,
-                            ignoreRetryDelays = transportChanged,
-                        )
-                    }
-                }
-            }.onStart {
+            .onEach { apply(it) }
+            .onStart {
                 Log.d("ManageRelayServices", "Resuming Relay Services")
                 client.connect()
             }.onCompletion {
@@ -130,4 +109,101 @@ class RelayProxyClientConnector(
                 SharingStarted.WhileSubscribed(30000),
                 null,
             )
+
+    /**
+     * Decides what a change in the relay infrastructure means for the pool. Split out of the
+     * flow so the decision table can be exercised directly, without a debounce and a shared
+     * StateFlow in the way.
+     */
+    fun apply(infra: RelayServiceInfra) {
+        val networkId = (infra.connectivity as? ConnectivityStatus.Active)?.networkId
+        val torSettings = infra.evaluator.torSettings
+
+        when {
+            infra.connectivity is ConnectivityStatus.StartingService -> {
+                // ignore
+            }
+
+            infra.connectivity is ConnectivityStatus.Off -> {
+                Log.d("ManageRelayServices") { "Connectivity Off: Pausing Relay Services ${infra.connectivity}" }
+                if (client.isActive()) {
+                    client.disconnect()
+                }
+                if (infra.torStatus is TorServiceStatus.Active) {
+                    Log.d("ManageRelayServices", "Connectivity off, Tor idle")
+                }
+                // disconnect() already cleared every relay's backoff. Forget the network
+                // so the next Active is treated as a fresh start rather than a change.
+                lastNetworkId = null
+            }
+
+            infra.connectivity is ConnectivityStatus.Active && !client.isActive() -> {
+                Log.d("ManageRelayServices", "Connectivity On: Resuming Relay Services")
+
+                if (infra.torStatus is TorServiceStatus.Active) {
+                    Log.d("ManageRelayServices", "Connectivity resumed, Tor active")
+                }
+
+                // only calls this if the client is not active. Otherwise goes to the else below
+                client.connect()
+                lastNetworkId = networkId
+                lastTorSettings = torSettings
+                lastTorConnection = infra.torConnection
+                lastClearConnection = infra.clearConnection
+            }
+
+            else -> {
+                // Only skip the per-relay exponential backoff when the actual HTTP
+                // transport changed. Otherwise (e.g. Tor still bootstrapping, the SOCKS
+                // port not yet listening) honor each relay's backoff so we don't
+                // reconnect-fail-reconnect on every unrelated infrastructure event.
+                val transportChanged =
+                    infra.torConnection !== lastTorConnection || infra.clearConnection !== lastClearConnection
+
+                // A different network entirely. Every socket is bound to an interface that
+                // no longer carries traffic, and needsToReconnect() cannot see that (it only
+                // compares the proxy and the timeouts), so those sockets would otherwise sit
+                // there until OkHttp's 120s ping finally fails.
+                val networkChanged = networkId != null && lastNetworkId != null && networkId != lastNetworkId
+
+                // Same network and same OkHttp clients, but the user re-classified which
+                // relays go through Tor. The relays whose transport flipped must re-dial now.
+                val torPolicyChanged = lastTorSettings != null && torSettings != lastTorSettings
+
+                val previousNetworkId = lastNetworkId
+
+                lastTorConnection = infra.torConnection
+                lastClearConnection = infra.clearConnection
+                lastNetworkId = networkId ?: lastNetworkId
+                lastTorSettings = torSettings
+
+                if (networkChanged) {
+                    Log.d("ManageRelayServices") {
+                        "Network identity changed ($previousNetworkId -> $networkId), rebuilding every relay connection"
+                    }
+                    // Full teardown: disconnect() drops the dead sockets AND clears each
+                    // relay's backoff, so the new network starts from a clean slate.
+                    client.reconnect(onlyIfChanged = false, ignoreRetryDelays = true)
+                } else {
+                    val freshStart = transportChanged || torPolicyChanged
+                    if (freshStart) {
+                        // The failures behind the current backoffs were measured against a
+                        // transport we are no longer using. ignoreRetryDelays alone only
+                        // skips the gate once and still doubles the stored delay, so a relay
+                        // that fails this one dial would come back worse off than before.
+                        client.resetBackoff()
+                    }
+
+                    Log.d("ManageRelayServices") {
+                        "Relay Services have changed, reconnecting relays that need to " +
+                            "(transportChanged=$transportChanged torPolicyChanged=$torPolicyChanged)"
+                    }
+                    client.reconnect(
+                        onlyIfChanged = true,
+                        ignoreRetryDelays = freshStart,
+                    )
+                }
+            }
+        }
+    }
 }

amethyst/src/main/java/com/vitorpamplona/amethyst/service/relayClient/authCommand/model/AuthCoordinator.kt

@@ -26,12 +26,18 @@ import com.vitorpamplona.amethyst.commons.relayauth.RelayAuthDecision
 import com.vitorpamplona.amethyst.commons.relayauth.RelayAuthVerdict
 import com.vitorpamplona.amethyst.isDebug
 import com.vitorpamplona.amethyst.model.Account
+import com.vitorpamplona.quartz.nip01Core.core.HexKey
+import com.vitorpamplona.quartz.nip01Core.core.toHexKey
+import com.vitorpamplona.quartz.nip01Core.crypto.KeyPair
 import com.vitorpamplona.quartz.nip01Core.relay.client.INostrClient
 import com.vitorpamplona.quartz.nip01Core.relay.client.auth.RelayAuthenticator
 import com.vitorpamplona.quartz.nip01Core.relay.normalizer.NormalizedRelayUrl
+import com.vitorpamplona.quartz.nip01Core.signers.EventTemplate
+import com.vitorpamplona.quartz.nip01Core.signers.NostrSignerSync
 import com.vitorpamplona.quartz.nip42RelayAuth.RelayAuthEvent
 import com.vitorpamplona.quartz.utils.Log
 import kotlinx.coroutines.CoroutineScope
+import java.util.concurrent.ConcurrentHashMap
 
 class ScreenAuthAccount(
     val account: Account,
@@ -49,7 +55,14 @@ class AuthCoordinator(
         RelayAuthenticator(
             client,
             scope,
-            signWithAllLoggedInUsers = { relayUrl, authTemplate ->
+            signWithAllLoggedInUsers = { relayUrl, authTemplate, interactive ->
+                // Concord plane traffic is gated behind NIP-42 as the derived *stream key*, not the
+                // user: a relay serves a plane's kind-1059 wraps only to a connection authenticated
+                // as that stream key. These AUTHs expose no user identity (ephemeral derived keys)
+                // and are signed locally, so we always attach them — independent of the per-account
+                // policy below — or Concord channels/messages never load. No-op for non-Concord relays.
+                val streamAuths = signConcordStreamAuths(relayUrl, authTemplate)
+
                 // Reconstruct *why* this relay wants auth from what the shared client is doing with
                 // it. Built lazily so accounts that fail the first-party gate below don't pay for it.
                 val context by
@@ -63,7 +76,6 @@ class AuthCoordinator(
                                 ),
                         )
                     }
-
                 // One socket is shared by every logged-in account, so an AUTH challenge is not tied
                 // to any single one of them. We answer PER ACCOUNT: an account only reveals its
                 // identity to a relay it has a first-party reason to be on (its own inbox/outbox
@@ -86,8 +98,24 @@ class AuthCoordinator(
                             RelayAuthVerdict.DENY -> false
                             RelayAuthVerdict.ASK -> {
                                 // Prompt at most once per challenge; reuse the answer for any other
-                                // account that also reaches ASK on this same relay.
-                                val choice = askChoice ?: promptBus.requestDecision(relayUrl, context.purposes).also { askChoice = it }
+                                // account that also reaches ASK on this same relay. But never block the
+                                // derived stream-key AUTH behind that dialog: on a relay that hosts our
+                                // Concord planes we DISMISS the user-auth ASK (skip account auth) so the
+                                // stream AUTHs return immediately instead of waiting on a prompt.
+                                //
+                                // A non-[interactive] pass is an automatic re-auth off an `auth-required:`
+                                // CLOSED (e.g. a Concord channel-plane REQ refused because the connection
+                                // AUTHed before the control plane folded in its channel stream keys). It
+                                // must never raise a fresh dialog: DISMISS the account ASK and let only the
+                                // already-approved identities (ledger-ALLOW accounts + stream keys) re-send.
+                                val choice =
+                                    askChoice ?: (
+                                        if (streamAuths.isNotEmpty() || !interactive) {
+                                            UserAuthChoice.DISMISS
+                                        } else {
+                                            promptBus.requestDecision(relayUrl, context.purposes)
+                                        }
+                                    ).also { askChoice = it }
                                 when (choice) {
                                     UserAuthChoice.ALLOW_ONCE -> true
                                     UserAuthChoice.ALWAYS_ALLOW -> {
@@ -114,10 +142,36 @@ class AuthCoordinator(
                     }
                 }
 
-                signed
+                signed + streamAuths
             },
         )
 
+    /**
+     * Signs one kind-22242 AUTH per Concord plane stream key hosted on [relayUrl], across every
+     * watched account. Signed locally from the derived stream secret (a raw [KeyPair] via
+     * [NostrSignerSync]) — never the account signer, and never surfacing the user's identity.
+     */
+    private suspend fun signConcordStreamAuths(
+        relayUrl: NormalizedRelayUrl,
+        authTemplate: EventTemplate<RelayAuthEvent>,
+    ): List<RelayAuthEvent> {
+        val secrets = authWithAccounts.distinct().flatMap { it.concordSessions.streamAuthSecretsFor(relayUrl) }
+        if (secrets.isEmpty()) return emptyList()
+        return secrets.mapNotNull { secret ->
+            try {
+                // Cache the signer by secret so we don't re-derive the secp256k1 keypair for every
+                // plane on every relay challenge/reconnect.
+                streamSigners.getOrPut(secret.toHexKey()) { NostrSignerSync(KeyPair(privKey = secret)) }.sign(authTemplate)
+            } catch (e: Exception) {
+                Log.e("AuthCoordinator", "Failed to sign a Concord stream-key AUTH", e)
+                null
+            }
+        }
+    }
+
+    // stream secret (hex) -> its local signer. Bounded by joined communities × channels.
+    private val streamSigners = ConcurrentHashMap<HexKey, NostrSignerSync>()
+
     /**
      * True when [account] has a first-party reason to authenticate with [relayUrl] on the shared
      * client: it is publishing its own event there, a subscription there is reading its own

amethyst/src/main/java/com/vitorpamplona/amethyst/service/relayClient/chatDelivery/ChatDeliveryTracker.kt

@@ -0,0 +1,253 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.service.relayClient.chatDelivery
+
+import androidx.compose.runtime.Immutable
+import com.vitorpamplona.quartz.nip01Core.core.HexKey
+import com.vitorpamplona.quartz.nip01Core.relay.client.INostrClient
+import com.vitorpamplona.quartz.nip01Core.relay.client.accessories.RelayInsertConfirmationCollector
+import com.vitorpamplona.quartz.nip01Core.relay.normalizer.NormalizedRelayUrl
+import kotlinx.coroutines.flow.MutableStateFlow
+import kotlinx.coroutines.flow.StateFlow
+
+/** Delivery progress of one recipient's gift wrap (NIP-17 DMs). */
+@Immutable
+data class RecipientDelivery(
+    val recipient: HexKey,
+    val targetRelays: Set<NormalizedRelayUrl>,
+    val acceptedRelays: Set<NormalizedRelayUrl> = emptySet(),
+    // The sender's own self-copy wrap: shown in the delivery detail (it matters
+    // for multi-device sync) but excluded from "delivered to everyone" and the
+    // k/n count, which describe the OTHER participants.
+    val isSelf: Boolean = false,
+) {
+    val isDelivered: Boolean
+        get() = acceptedRelays.isNotEmpty()
+}
+
+/**
+ * Delivery progress of one outgoing chat message. For DMs [recipients] carries one
+ * entry per gift wrap (the sender's self-copy included); for public rooms it is
+ * null and [targetRelays]/[acceptedRelays] describe the room's relay set.
+ */
+@Immutable
+data class ChatDelivery(
+    val targetRelays: Set<NormalizedRelayUrl>,
+    val acceptedRelays: Set<NormalizedRelayUrl> = emptySet(),
+    val recipients: List<RecipientDelivery>? = null,
+) {
+    /** The other participants' wraps (self-copy excluded); null for rooms. */
+    val otherRecipients: List<RecipientDelivery>?
+        get() = recipients?.filterNot { it.isSelf }
+
+    val isFullyAccepted: Boolean
+        get() {
+            val others = otherRecipients
+            return if (others != null) {
+                others.isNotEmpty() && others.all { it.isDelivered }
+            } else {
+                targetRelays.isNotEmpty() && acceptedRelays.containsAll(targetRelays)
+            }
+        }
+}
+
+/**
+ * Remembers, per outgoing chat message, which relays were targeted at publish time
+ * and which have accepted (relay OK) since — the source for the delivery ticks on
+ * own chat bubbles.
+ *
+ * The relay pool's outbox drops its entry once an event is fully acked, and relay
+ * OKs for recipient gift wraps aggregate onto a single aliased Note, losing WHICH
+ * recipient's wrap was accepted. This tracker fills both gaps: sends register the
+ * `displayed note id -> (recipient, wrap id, target relays)` mapping while it still
+ * exists (inside the publish loop), and a persistent OK listener attributes each
+ * acceptance back to the message and, for DMs, to the recipient.
+ *
+ * State is held as one small StateFlow per tracked message, so a relay OK updates
+ * and notifies only that message's collectors instead of fanning out through a
+ * whole-map flow. In-memory only: history from before an app restart simply has no
+ * entry, and the UI falls back to the Note's seen-on relays.
+ *
+ * Owns a persistent listener on the client: [destroy] MUST be called when the
+ * owning Account is discarded (logout / account removal) or the listener leaks.
+ */
+class ChatDeliveryTracker(
+    client: INostrClient,
+) {
+    private val lock = Any()
+
+    // One flow per tracked (or queried) displayed-note id; LinkedHashMap iteration
+    // order is insertion order, used for eviction. Guarded by [lock].
+    private val deliveries = LinkedHashMap<HexKey, MutableStateFlow<ChatDelivery?>>()
+
+    // Lock-free fast-path index for the OK listener, which fires for every event
+    // the app publishes anywhere: wrap id -> (displayed note id, recipient).
+    @Volatile
+    private var wrapIndex = mapOf<HexKey, Pair<HexKey, HexKey>>()
+
+    // Lock-free fast-path set of tracked/queried note ids (see [onAccepted]).
+    @Volatile
+    private var knownIds = setOf<HexKey>()
+
+    private val okCollector =
+        RelayInsertConfirmationCollector(client) { eventId, relay ->
+            onAccepted(eventId, relay.url)
+        }
+
+    /** Registers a public room message published to the room's [targetRelays]. */
+    fun trackPublic(
+        eventId: HexKey,
+        targetRelays: Set<NormalizedRelayUrl>,
+    ) {
+        if (targetRelays.isEmpty()) return
+        synchronized(lock) {
+            flowForLocked(eventId).value = ChatDelivery(targetRelays)
+        }
+    }
+
+    /**
+     * Registers one recipient's gift wrap of the DM whose chat feed shows
+     * [displayedNoteId] (the inner rumor's id).
+     */
+    fun trackWrap(
+        displayedNoteId: HexKey,
+        recipient: HexKey,
+        wrapId: HexKey,
+        targetRelays: Set<NormalizedRelayUrl>,
+        isSelf: Boolean = false,
+    ) {
+        synchronized(lock) {
+            val flow = flowForLocked(displayedNoteId)
+            val current = flow.value
+
+            flow.value =
+                ChatDelivery(
+                    targetRelays = (current?.targetRelays ?: emptySet()) + targetRelays,
+                    acceptedRelays = current?.acceptedRelays ?: emptySet(),
+                    recipients = (current?.recipients ?: emptyList()) + RecipientDelivery(recipient, targetRelays, isSelf = isSelf),
+                )
+
+            wrapIndex = wrapIndex + (wrapId to (displayedNoteId to recipient))
+        }
+    }
+
+    /**
+     * Registers a group message that was broadcast as a single encrypted [wrapId] to
+     * the group's [targetRelays] (Concord channels: the whole channel shares one
+     * plane wrap, not a per-recipient gift wrap). Relays OK the wrap, but the feed
+     * shows the decrypted inner rumor, so [displayedNoteId] (the rumor id) is mapped
+     * through [wrapId] — like [trackPublic] (relay ticks, no per-recipient breakdown)
+     * but keyed by the wrap the relay actually acknowledges.
+     */
+    fun trackWrappedPublic(
+        displayedNoteId: HexKey,
+        wrapId: HexKey,
+        targetRelays: Set<NormalizedRelayUrl>,
+    ) {
+        if (targetRelays.isEmpty()) return
+        synchronized(lock) {
+            flowForLocked(displayedNoteId).value = ChatDelivery(targetRelays)
+            // recipient is unused for a relay-only delivery (recipients stays null, so
+            // onAccepted never matches on it); reuse the note id as a harmless value.
+            wrapIndex = wrapIndex + (wrapId to (displayedNoteId to displayedNoteId))
+        }
+    }
+
+    fun deliveryFlow(noteId: HexKey): StateFlow<ChatDelivery?> =
+        synchronized(lock) {
+            flowForLocked(noteId)
+        }
+
+    fun currentFor(noteId: HexKey): ChatDelivery? =
+        synchronized(lock) {
+            deliveries[noteId]?.value
+        }
+
+    fun destroy() {
+        okCollector.destroy()
+        synchronized(lock) {
+            deliveries.clear()
+            wrapIndex = emptyMap()
+            knownIds = emptySet()
+        }
+    }
+
+    private fun onAccepted(
+        eventId: HexKey,
+        relay: NormalizedRelayUrl,
+    ) {
+        // Lock-free negative path: OKs fire for every event the app publishes
+        // anywhere; almost all are not chat messages we track.
+        if (eventId !in wrapIndex && eventId !in knownIds) return
+
+        synchronized(lock) {
+            val wrapTarget = wrapIndex[eventId]
+            if (wrapTarget != null) {
+                val (noteId, recipient) = wrapTarget
+                val flow = deliveries[noteId] ?: return
+                val delivery = flow.value ?: return
+
+                flow.value =
+                    delivery.copy(
+                        acceptedRelays = delivery.acceptedRelays + relay,
+                        recipients =
+                            delivery.recipients?.map {
+                                if (it.recipient == recipient) {
+                                    it.copy(acceptedRelays = it.acceptedRelays + relay)
+                                } else {
+                                    it
+                                }
+                            },
+                    )
+            } else {
+                val flow = deliveries[eventId] ?: return
+                val delivery = flow.value ?: return
+                flow.value = delivery.copy(acceptedRelays = delivery.acceptedRelays + relay)
+            }
+        }
+    }
+
+    // Must run under [lock]. Also creates entries for ids queried by the UI
+    // before their send registers (compose can win that race), so both paths
+    // share the same flow instance.
+    private fun flowForLocked(noteId: HexKey): MutableStateFlow<ChatDelivery?> {
+        deliveries[noteId]?.let { return it }
+
+        val flow = MutableStateFlow<ChatDelivery?>(null)
+        deliveries[noteId] = flow
+        knownIds = knownIds + noteId
+
+        while (deliveries.size > MAX_TRACKED) {
+            val evicted = deliveries.keys.first()
+            deliveries.remove(evicted)
+            knownIds = knownIds - evicted
+            wrapIndex = wrapIndex.filterValues { it.first != evicted }
+        }
+
+        return flow
+    }
+
+    companion object {
+        // Delivery state is only rendered on recent messages; a bounded window keeps
+        // the maps from growing for the whole session.
+        private const val MAX_TRACKED = 500
+    }
+}

amethyst/src/main/java/com/vitorpamplona/amethyst/service/relayClient/diagnostics/BootRelayDiagnostics.kt

@@ -0,0 +1,261 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.service.relayClient.diagnostics
+
+import com.vitorpamplona.quartz.nip01Core.relay.client.INostrClient
+import com.vitorpamplona.quartz.nip01Core.relay.client.listeners.RelayConnectionListener
+import com.vitorpamplona.quartz.nip01Core.relay.client.single.IRelayClient
+import com.vitorpamplona.quartz.nip01Core.relay.commands.toClient.ClosedMessage
+import com.vitorpamplona.quartz.nip01Core.relay.commands.toClient.EoseMessage
+import com.vitorpamplona.quartz.nip01Core.relay.commands.toClient.EventMessage
+import com.vitorpamplona.quartz.nip01Core.relay.commands.toClient.Message
+import com.vitorpamplona.quartz.nip01Core.relay.commands.toClient.NoticeMessage
+import com.vitorpamplona.quartz.nip01Core.relay.commands.toRelay.AuthCmd
+import com.vitorpamplona.quartz.nip01Core.relay.commands.toRelay.Command
+import com.vitorpamplona.quartz.nip01Core.relay.commands.toRelay.ReqCmd
+import com.vitorpamplona.quartz.nip01Core.relay.normalizer.NormalizedRelayUrl
+import com.vitorpamplona.quartz.utils.Log
+import java.util.concurrent.ConcurrentHashMap
+import java.util.concurrent.atomic.AtomicInteger
+import java.util.concurrent.atomic.AtomicLong
+import kotlin.concurrent.thread
+
+/**
+ * Debug-only cold-start census: what every relay in the pool actually did, and why the ones
+ * that failed, failed.
+ *
+ * The existing instrumentation cannot answer this. [com.vitorpamplona.quartz.nip01Core.relay.client.stats.RelayStats]
+ * has counters but no dump path and no failure taxonomy; `RelaySpeedLogger` counts events per
+ * second but not connection outcomes; `RelayLogger` prints one line per event, which at the
+ * few-hundred-relay cardinality of the outbox model is thousands of lines to grep rather than
+ * a table to read.
+ *
+ * What this adds: connection outcome bucketed **by cause**, REQ/EOSE/CLOSED accounting per
+ * relay, and time-to-first-EOSE — so a boot can be read as "N relays served us, M were
+ * refused for reason R, K were never reachable".
+ *
+ * Attach only in debug builds; it holds one small record per relay for the process lifetime.
+ */
+class BootRelayDiagnostics(
+    val client: INostrClient,
+    val dumpAtSeconds: List<Long> = listOf(20, 45, 90),
+) {
+    companion object {
+        const val TAG = "BootRelayDiag"
+
+        /**
+         * Buckets a connection failure by what actually went wrong. The distinction that
+         * matters most here is *ours vs theirs*: a SOCKS refusal is our Tor proxy declining
+         * to open a stream and says nothing about the relay, but it reaches the relay client
+         * through the same path as a genuine relay failure and is charged to the relay.
+         */
+        fun classify(error: String): String =
+            when {
+                error.contains("SOCKS", ignoreCase = true) -> "tor-socks"
+                error.contains("127.0.0.1") -> "tor-proxy-down"
+                error.contains("UnknownHostException") -> "dns"
+                error.contains("SSLHandshakeException") || error.contains("SSLPeerUnverified") -> "tls"
+                error.contains("SocketTimeoutException") -> "timeout"
+                error.contains("Server Misconfigured") -> "http-" + (Regex("Response: (\\d+)").find(error)?.groupValues?.get(1) ?: "?")
+                error.contains("ConnectException") -> "refused"
+                error.contains("Connection reset") -> "reset"
+                else -> "other"
+            }
+    }
+
+    class RelayRecord {
+        val tentatives = AtomicInteger()
+        val opens = AtomicInteger()
+        val disconnects = AtomicInteger()
+        val reqsSent = AtomicInteger()
+        val authsSent = AtomicInteger()
+        val events = AtomicInteger()
+        val eoses = AtomicInteger()
+        val notices = AtomicInteger()
+
+        /** failure cause -> count, see [classify]. */
+        val failures = ConcurrentHashMap<String, AtomicInteger>()
+
+        /** CLOSED machine-readable prefix (or "unprefixed") -> count. */
+        val closed = ConcurrentHashMap<String, AtomicInteger>()
+
+        val firstOpenAtMs = AtomicLong(0)
+        val firstEoseAtMs = AtomicLong(0)
+
+        fun bump(
+            map: ConcurrentHashMap<String, AtomicInteger>,
+            key: String,
+        ) = map.computeIfAbsent(key) { AtomicInteger() }.incrementAndGet()
+    }
+
+    private val records = ConcurrentHashMap<NormalizedRelayUrl, RelayRecord>()
+    private val startedAtMs = System.currentTimeMillis()
+
+    private fun record(url: NormalizedRelayUrl) = records.computeIfAbsent(url) { RelayRecord() }
+
+    private fun elapsed() = System.currentTimeMillis() - startedAtMs
+
+    private val listener =
+        object : RelayConnectionListener {
+            override fun onConnecting(relay: IRelayClient) {
+                record(relay.url).tentatives.incrementAndGet()
+            }
+
+            override fun onConnected(
+                relay: IRelayClient,
+                pingMillis: Int,
+                compressed: Boolean,
+            ) {
+                val r = record(relay.url)
+                r.opens.incrementAndGet()
+                r.firstOpenAtMs.compareAndSet(0, elapsed())
+            }
+
+            override fun onCannotConnect(
+                relay: IRelayClient,
+                errorMessage: String,
+            ) {
+                val r = record(relay.url)
+                r.bump(r.failures, classify(errorMessage))
+            }
+
+            override fun onDisconnected(relay: IRelayClient) {
+                record(relay.url).disconnects.incrementAndGet()
+            }
+
+            override fun onSent(
+                relay: IRelayClient,
+                cmdStr: String,
+                cmd: Command,
+                success: Boolean,
+            ) {
+                val r = record(relay.url)
+                when (cmd) {
+                    is ReqCmd -> r.reqsSent.incrementAndGet()
+                    is AuthCmd -> r.authsSent.incrementAndGet()
+                    else -> Unit
+                }
+            }
+
+            override fun onIncomingMessage(
+                relay: IRelayClient,
+                msgStr: String,
+                msg: Message,
+            ) {
+                val r = record(relay.url)
+                when (msg) {
+                    is EventMessage -> r.events.incrementAndGet()
+                    is EoseMessage -> {
+                        r.eoses.incrementAndGet()
+                        r.firstEoseAtMs.compareAndSet(0, elapsed())
+                    }
+                    is NoticeMessage -> r.notices.incrementAndGet()
+                    is ClosedMessage -> r.bump(r.closed, prefixOf(msg.message))
+                    else -> Unit
+                }
+            }
+        }
+
+    /** First token of a NIP-01 machine-readable CLOSED/OK message, or "unprefixed". */
+    private fun prefixOf(message: String?): String {
+        val text = message?.trim().orEmpty()
+        if (text.isEmpty()) return "empty"
+        val head = text.substringBefore(':', "")
+        return if (head.isNotEmpty() && head.length < 20 && !head.contains(' ')) head else "unprefixed"
+    }
+
+    init {
+        client.addConnectionListener(listener)
+        thread(isDaemon = true, name = TAG) {
+            var last = 0L
+            dumpAtSeconds.forEach { at ->
+                Thread.sleep((at - last) * 1000)
+                last = at
+                dump(at)
+            }
+        }
+    }
+
+    fun detach() = client.removeConnectionListener(listener)
+
+    /**
+     * One line per relay plus a rollup. Kept to a single Log.w per line so the whole census
+     * survives logcat's per-tag rate limiting on a busy boot.
+     */
+    fun dump(atSeconds: Long) {
+        val snapshot = records.toMap()
+
+        val served = snapshot.filter { it.value.events.get() > 0 }
+        val opened = snapshot.filter { it.value.opens.get() > 0 }
+        val neverOpened = snapshot.filter { it.value.opens.get() == 0 }
+
+        val causeTotals = mutableMapOf<String, Int>()
+        val closedTotals = mutableMapOf<String, Int>()
+        snapshot.values.forEach { r ->
+            r.failures.forEach { (k, v) -> causeTotals[k] = (causeTotals[k] ?: 0) + v.get() }
+            r.closed.forEach { (k, v) -> closedTotals[k] = (closedTotals[k] ?: 0) + v.get() }
+        }
+
+        Log.w(TAG, "===== boot census @${atSeconds}s =====")
+        Log.w(
+            TAG,
+            "pool=${snapshot.size} opened=${opened.size} served_events=${served.size} never_opened=${neverOpened.size} " +
+                "dials=${snapshot.values.sumOf { it.tentatives.get() }} " +
+                "events=${snapshot.values.sumOf { it.events.get() }} " +
+                "reqs=${snapshot.values.sumOf { it.reqsSent.get() }} " +
+                "auths=${snapshot.values.sumOf { it.authsSent.get() }}",
+        )
+        Log.w(TAG, "failures_by_cause=" + causeTotals.entries.sortedByDescending { it.value }.joinToString { "${it.key}:${it.value}" })
+        Log.w(TAG, "closed_by_prefix=" + closedTotals.entries.sortedByDescending { it.value }.joinToString { "${it.key}:${it.value}" })
+
+        // Relays that cost us dials and gave nothing back, worst first: the wasted-effort list.
+        Log.w(TAG, "--- top wasted dials (no events received) ---")
+        snapshot
+            .filter { it.value.events.get() == 0 }
+            .entries
+            .sortedByDescending { it.value.tentatives.get() }
+            .take(25)
+            .forEach { (url, r) ->
+                Log.w(
+                    TAG,
+                    "WASTE ${url.url} dials=${r.tentatives.get()} opens=${r.opens.get()} " +
+                        "fail=[${r.failures.entries.joinToString { "${it.key}:${it.value.get()}" }}] " +
+                        "closed=[${r.closed.entries.joinToString { "${it.key}:${it.value.get()}" }}] " +
+                        "reqs=${r.reqsSent.get()} eose=${r.eoses.get()}",
+                )
+            }
+
+        // The relays actually carrying the boot, so a suppression change can be checked for
+        // coverage loss rather than just CLOSED reduction.
+        Log.w(TAG, "--- top event providers ---")
+        served.entries
+            .sortedByDescending { it.value.events.get() }
+            .take(20)
+            .forEach { (url, r) ->
+                Log.w(
+                    TAG,
+                    "SERVE ${url.url} events=${r.events.get()} reqs=${r.reqsSent.get()} eose=${r.eoses.get()} " +
+                        "openMs=${r.firstOpenAtMs.get()} eoseMs=${r.firstEoseAtMs.get()} dials=${r.tentatives.get()}",
+                )
+            }
+        Log.w(TAG, "===== end census @${atSeconds}s =====")
+    }
+}

amethyst/src/main/java/com/vitorpamplona/amethyst/service/relayClient/eoseManagers/ChatFeedToggle.kt

@@ -0,0 +1,52 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.service.relayClient.eoseManagers
+
+import com.vitorpamplona.amethyst.commons.model.chats.ChatFeedType
+import com.vitorpamplona.amethyst.model.Account
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.Job
+import kotlinx.coroutines.flow.distinctUntilChanged
+import kotlinx.coroutines.flow.drop
+import kotlinx.coroutines.flow.map
+import kotlinx.coroutines.launch
+
+/**
+ * Rebuilds a Messages-inbox subscription's filters whenever the user flips [type]'s
+ * load-toggle in Settings › Messages. A disabled type's `updateFilter` returns no filters, so a
+ * flip to off empties the live subscription and a flip back on re-arms it — no restart needed.
+ *
+ * Only the boolean for [type] is watched (via distinct + drop(1)), so unrelated toggle changes
+ * don't churn this assembler.
+ */
+fun CoroutineScope.launchChatFeedToggleObserver(
+    account: Account,
+    type: ChatFeedType,
+    onToggle: () -> Unit,
+): Job =
+    launch(Dispatchers.IO) {
+        account.settings.enabledChatFeeds
+            .map { type in it }
+            .distinctUntilChanged()
+            .drop(1)
+            .collect { onToggle() }
+    }

amethyst/src/main/java/com/vitorpamplona/amethyst/service/relayClient/reqCommand/RelaySubscriptionsCoordinator.kt

@@ -36,10 +36,16 @@ import com.vitorpamplona.amethyst.ui.screen.loggedIn.badges.datasource.BadgesFil
 import com.vitorpamplona.amethyst.ui.screen.loggedIn.badges.profile.datasource.ProfileBadgesFilterAssembler
 import com.vitorpamplona.amethyst.ui.screen.loggedIn.calendars.datasource.CalendarsFilterAssembler
 import com.vitorpamplona.amethyst.ui.screen.loggedIn.chats.privateDM.datasource.ChatroomFilterAssembler
+import com.vitorpamplona.amethyst.ui.screen.loggedIn.chats.publicChannels.concord.datasource.ConcordChannelFilterAssembler
+import com.vitorpamplona.amethyst.ui.screen.loggedIn.chats.publicChannels.concord.datasource.ConcordChannelHistoryFilterAssembler
 import com.vitorpamplona.amethyst.ui.screen.loggedIn.chats.publicChannels.datasource.ChannelFilterAssembler
-import com.vitorpamplona.amethyst.ui.screen.loggedIn.chats.publicChannels.relayGroup.datasource.RelayGroupMyJoinedGroupsFilterAssembler
-import com.vitorpamplona.amethyst.ui.screen.loggedIn.chats.publicChannels.relayGroup.datasource.RelayGroupThreadFeedFilterAssembler
-import com.vitorpamplona.amethyst.ui.screen.loggedIn.chats.publicChannels.relayGroup.datasource.RelayGroupWarmupFilterAssembler
+import com.vitorpamplona.amethyst.ui.screen.loggedIn.chats.publicChannels.relayGroup.datasource.RelayGroupCardWarmupFilterAssembler
+import com.vitorpamplona.amethyst.ui.screen.loggedIn.chats.publicChannels.relayGroup.datasource.RelayGroupJoinedChatTailFilterAssembler
+import com.vitorpamplona.amethyst.ui.screen.loggedIn.chats.publicChannels.relayGroup.datasource.RelayGroupJoinedStateFilterAssembler
+import com.vitorpamplona.amethyst.ui.screen.loggedIn.chats.publicChannels.relayGroup.datasource.RelayGroupOpenChatHistoryFilterAssembler
+import com.vitorpamplona.amethyst.ui.screen.loggedIn.chats.publicChannels.relayGroup.datasource.RelayGroupOpenChatTailFilterAssembler
+import com.vitorpamplona.amethyst.ui.screen.loggedIn.chats.publicChannels.relayGroup.datasource.RelayGroupOpenThreadsFilterAssembler
+import com.vitorpamplona.amethyst.ui.screen.loggedIn.chats.publicChannels.relayGroup.datasource.RelayGroupOpenThreadsHistoryFilterAssembler
 import com.vitorpamplona.amethyst.ui.screen.loggedIn.chats.publicChannels.relayGroup.datasource.RelayGroupsDiscoveryFilterAssembler
 import com.vitorpamplona.amethyst.ui.screen.loggedIn.chats.publicChannels.relayGroup.datasource.RelayGroupsOnRelayFilterAssembler
 import com.vitorpamplona.amethyst.ui.screen.loggedIn.chats.rooms.datasource.ChatroomListFilterAssembler
@@ -124,10 +130,26 @@ class RelaySubscriptionsCoordinator(
     // assembler above (same as NIP-28 public chats), so only the group-specific surfaces get their
     // own here.
     val relayGroupsOnRelay = RelayGroupsOnRelayFilterAssembler(client) // browsing one relay's channel list
-    val relayGroupMyJoinedGroups = RelayGroupMyJoinedGroupsFilterAssembler(client) // metadata+rosters of groups I've joined
-    val relayGroupThreadFeed = RelayGroupThreadFeedFilterAssembler(client) // a group's forum-threads tab
-    val relayGroupWarmup = RelayGroupWarmupFilterAssembler(client) // prefetching a group before it's opened
+    val relayGroupOpenThreads = RelayGroupOpenThreadsFilterAssembler(client) // a group's forum-threads tab (recent tail)
+    val relayGroupOpenThreadsHistory = RelayGroupOpenThreadsHistoryFilterAssembler(client) // the Threads tab's backward history pager
+    val relayGroupCardWarmup = RelayGroupCardWarmupFilterAssembler(client) // prefetching a group before it's opened
     val relayGroupsDiscovery = RelayGroupsDiscoveryFilterAssembler(client) // the cross-relay Discover feed
+
+    // NIP-29 chat, split state-vs-content like the DM / Concord stacks (see
+    // amethyst/plans/2026-07-18-nip29-group-chat-subscriptions.md).
+    val relayGroupJoinedState = RelayGroupJoinedStateFilterAssembler(client) // always-on: joined groups' metadata/roster/roles/pins
+    val relayGroupJoinedChatTail = RelayGroupJoinedChatTailFilterAssembler(client) // always-on: batched #h recent-tail for Messages previews
+    val relayGroupOpenChatTail = RelayGroupOpenChatTailFilterAssembler(client) // the open group's recent chat (covers non-joined)
+    val relayGroupOpenChatHistory = RelayGroupOpenChatHistoryFilterAssembler(client) // the open group's on-demand backward history pager
+
+    // Concord Channels (encrypted communities). One assembler keeps every joined community's
+    // control + channel planes live (kind-1059 by derived stream address).
+    val concordChannels = ConcordChannelFilterAssembler(client)
+
+    // On-demand backward history pager for whichever Concord Channel screen is open (older wraps by
+    // until+limit, per relay), the Concord analog of the per-conversation NIP-04 history.
+    val concordChannelHistory = ConcordChannelHistoryFilterAssembler(client)
+
     val chatroom = ChatroomFilterAssembler(client)
     val community = CommunityFilterAssembler(client)
     val gitRepository = RepositoryFilterAssembler(client)
@@ -190,10 +212,16 @@ class RelaySubscriptionsCoordinator(
     val all =
         listOf(
             relayGroupsOnRelay,
-            relayGroupMyJoinedGroups,
-            relayGroupThreadFeed,
-            relayGroupWarmup,
+            relayGroupOpenThreads,
+            relayGroupOpenThreadsHistory,
+            relayGroupCardWarmup,
             relayGroupsDiscovery,
+            relayGroupJoinedState,
+            relayGroupJoinedChatTail,
+            relayGroupOpenChatTail,
+            relayGroupOpenChatHistory,
+            concordChannels,
+            concordChannelHistory,
             account,
             accountForeground,
             home,

amethyst/src/main/java/com/vitorpamplona/amethyst/service/relayClient/reqCommand/account/AccountFilterAssembler.kt

@@ -27,6 +27,7 @@ import com.vitorpamplona.amethyst.service.relayClient.reqCommand.account.drafts.
 import com.vitorpamplona.amethyst.service.relayClient.reqCommand.account.marmot.MarmotGroupEventsEoseManager
 import com.vitorpamplona.amethyst.service.relayClient.reqCommand.account.metadata.AccountMetadataEoseManager
 import com.vitorpamplona.amethyst.service.relayClient.reqCommand.account.nip01Notifications.AccountNotificationsEoseFromInboxRelaysManager
+import com.vitorpamplona.amethyst.service.relayClient.reqCommand.account.nip01Notifications.AccountNotificationsHistoryEoseManager
 import com.vitorpamplona.amethyst.service.relayClient.reqCommand.account.nip59GiftWraps.AccountGiftWrapsEoseManager
 import com.vitorpamplona.amethyst.service.relayClient.reqCommand.account.nip59GiftWraps.AccountGiftWrapsHistoryEoseManager
 import com.vitorpamplona.amethyst.ui.screen.loggedIn.AccountFeedContentStates
@@ -56,13 +57,20 @@ class AccountFilterAssembler(
     // History: older gift wraps, loaded on demand in bounded one-shot slices.
     val giftWrapsHistory = AccountGiftWrapsHistoryEoseManager(client, ::allKeys)
 
+    // Live tail: the recent week of notifications from the inbox + group host relays.
+    val notifications = AccountNotificationsEoseFromInboxRelaysManager(client, ::allKeys)
+
+    // History: older notifications, paged backward by until+limit per relay, driven by the feed's markers.
+    val notificationsHistory = AccountNotificationsHistoryEoseManager(client, ::allKeys)
+
     val group =
         listOf(
             AccountMetadataEoseManager(client, ::allKeys),
             giftWraps,
             giftWrapsHistory,
             AccountDraftsEoseManager(client, ::allKeys),
-            AccountNotificationsEoseFromInboxRelaysManager(client, ::allKeys),
+            notifications,
+            notificationsHistory,
             MarmotGroupEventsEoseManager(client, ::allKeys),
         )
 

amethyst/src/main/java/com/vitorpamplona/amethyst/service/relayClient/reqCommand/account/marmot/MarmotGroupEventsEoseManager.kt

@@ -20,8 +20,10 @@
  */
 package com.vitorpamplona.amethyst.service.relayClient.reqCommand.account.marmot
 
+import com.vitorpamplona.amethyst.commons.model.chats.ChatFeedType
 import com.vitorpamplona.amethyst.model.User
 import com.vitorpamplona.amethyst.service.relayClient.eoseManagers.PerUserEoseManager
+import com.vitorpamplona.amethyst.service.relayClient.eoseManagers.launchChatFeedToggleObserver
 import com.vitorpamplona.amethyst.service.relayClient.reqCommand.account.AccountQueryState
 import com.vitorpamplona.amethyst.service.relays.SincePerRelayMap
 import com.vitorpamplona.quartz.nip01Core.relay.client.INostrClient
@@ -51,6 +53,7 @@ class MarmotGroupEventsEoseManager(
     ): List<RelayBasedFilter> {
         val manager = key.account.marmotManager ?: return emptyList()
         if (!key.account.isWriteable()) return emptyList()
+        if (!key.account.settings.isChatFeedEnabled(ChatFeedType.MARMOT)) return emptyList()
 
         val result = mutableListOf<RelayBasedFilter>()
         val fallbackRelays = key.account.homeRelays.flow.value
@@ -130,6 +133,7 @@ class MarmotGroupEventsEoseManager(
                         invalidateFilters()
                     }
                 },
+                key.account.scope.launchChatFeedToggleObserver(key.account, ChatFeedType.MARMOT) { invalidateFilters() },
             )
 
         return super.newSub(key)

amethyst/src/main/java/com/vitorpamplona/amethyst/service/relayClient/reqCommand/account/metadata/FilterAccountInfoAndListsFromKey.kt

@@ -22,6 +22,7 @@ package com.vitorpamplona.amethyst.service.relayClient.reqCommand.account.metada
 
 import com.vitorpamplona.amethyst.commons.relayClient.assemblers.filterContactCardsByAuthorInTheRelay
 import com.vitorpamplona.amethyst.model.nip78AppSpecific.AppSpecificState.Companion.APP_SPECIFIC_DATA_D_TAG
+import com.vitorpamplona.quartz.concord.cord02Community.ConcordCommunityListEvent
 import com.vitorpamplona.quartz.experimental.nipA3.PaymentTargetsEvent
 import com.vitorpamplona.quartz.marmot.mip00KeyPackages.KeyPackageRelayListEvent
 import com.vitorpamplona.quartz.nip01Core.core.HexKey
@@ -85,6 +86,12 @@ val AccountInfoAndListsFromKeyKinds2 =
         // Loaded up-front so "My Groups" and group memberships resolve immediately at login,
         // without waiting for the groups screen to mount its own subscription.
         SimpleGroupListEvent.KIND,
+        // Concord private joined-communities list (kind 13302, CORD-05): the self-encrypted
+        // entries carrying each community's secrets. Loaded up-front for the same reason as
+        // the NIP-29 list above — so communities joined on another device or client (e.g. the
+        // Armada reference client, sharing this key) surface in the Concord hub at login,
+        // instead of only appearing after creating/redeeming an invite in Amethyst itself.
+        ConcordCommunityListEvent.KIND,
         // NIP-60 Cashu wallet + NIP-61 nutzap info. Replaceables, always
         // useful to have available — wallet event holds the user's P2PK key
         // + mint list, nutzap info tells other clients which mints to lock

amethyst/src/main/java/com/vitorpamplona/amethyst/service/relayClient/reqCommand/account/nip01Notifications/AccountNotificationsEoseFromInboxRelaysManager.kt

@@ -28,7 +28,6 @@ import com.vitorpamplona.quartz.nip01Core.relay.client.INostrClient
 import com.vitorpamplona.quartz.nip01Core.relay.client.pool.RelayBasedFilter
 import com.vitorpamplona.quartz.nip01Core.relay.client.subscriptions.Subscription
 import com.vitorpamplona.quartz.nip01Core.relay.normalizer.RelayUrlNormalizer
-import com.vitorpamplona.quartz.utils.TimeUtils
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.FlowPreview
 import kotlinx.coroutines.Job
@@ -51,17 +50,35 @@ class AccountNotificationsEoseFromInboxRelaysManager(
         key: AccountQueryState,
         since: SincePerRelayMap?,
     ): List<RelayBasedFilter> {
+        // Backward-paging boundary: once the feed has filled a page, ask for everything older than
+        // its oldest card. It stays null until then — see the note on the missing week floor below,
+        // which is what let it stay null forever on a quiet inbox.
+        val pagingBoundary = key.feedContentStates.notifications.lastNoteCreatedAtIfFilled()
+
         val inbox =
             key.account.notificationRelays.flow.value.flatMap {
+                // No `since` floor on the first fetch. These filters are scoped by `#p` to my own
+                // key and carry a relay-side `limit`, so an all-time query costs one index scan and
+                // returns at most `limit` events, newest first — exactly what Home does (it passes
+                // `since ?: boundary`, i.e. null on a cold start).
+                //
+                // This used to fall back to `oneWeekAgo()`, which silently emptied the tab for
+                // anyone whose last mention was older than a week: EOSE `since` is in-memory only,
+                // so EVERY cold start re-pinned the window to 7 days, and the paging boundary above
+                // could never rescue it — it only arms once the feed holds a full page, and the feed
+                // could not fill because the query only ever asked for a week. A fresh install of an
+                // established account hit the same deadlock.
+                val notificationSince = since?.get(it)?.time ?: pagingBoundary
+
                 filterSummaryNotificationsToPubkey(
                     relay = it,
                     pubkey = user(key).pubkeyHex,
-                    since = since?.get(it)?.time ?: TimeUtils.oneWeekAgo(),
+                    since = notificationSince,
                 ) +
                     filterNotificationsToPubkey(
                         relay = it,
                         pubkey = user(key).pubkeyHex,
-                        since = since?.get(it)?.time ?: key.feedContentStates.notifications.lastNoteCreatedAtIfFilled() ?: TimeUtils.oneWeekAgo(),
+                        since = notificationSince,
                     )
             }
 
@@ -76,7 +93,9 @@ class AccountNotificationsEoseFromInboxRelaysManager(
                         relay = relay,
                         pubkey = user(key).pubkeyHex,
                         groupIds = groupIds.distinct(),
-                        since = since?.get(relay)?.time ?: TimeUtils.oneWeekAgo(),
+                        // Same reasoning as the inbox filters above: `#p` + `#h` + `limit = 200`
+                        // already bound this, so a week floor only hides older group activity.
+                        since = since?.get(relay)?.time ?: pagingBoundary,
                     )
                 }
 

amethyst/src/main/java/com/vitorpamplona/amethyst/service/relayClient/reqCommand/account/nip01Notifications/AccountNotificationsEoseFromRandomRelaysManager.kt

@@ -27,7 +27,6 @@ import com.vitorpamplona.amethyst.service.relays.SincePerRelayMap
 import com.vitorpamplona.quartz.nip01Core.relay.client.INostrClient
 import com.vitorpamplona.quartz.nip01Core.relay.client.pool.RelayBasedFilter
 import com.vitorpamplona.quartz.nip01Core.relay.client.subscriptions.Subscription
-import com.vitorpamplona.quartz.utils.TimeUtils
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.FlowPreview
 import kotlinx.coroutines.Job
@@ -51,8 +50,11 @@ class AccountNotificationsEoseFromRandomRelaysManager(
         key: AccountQueryState,
         since: SincePerRelayMap?,
     ): List<RelayBasedFilter> {
-        // only loads this after the feed is built
-        val defaultSince = key.feedContentStates.notifications.lastNoteCreatedAtIfFilled() ?: TimeUtils.oneWeekAgo()
+        // only loads this after the feed is built, so it stays null on a quiet inbox. No week floor
+        // behind it: this probe is `#p`-scoped to me with `limit = 20`, so relays answer with the 20
+        // newest either way — the floor only ever hid notifications older than a week, and since the
+        // boundary above needs a full page to arm, a quiet inbox could never page past it.
+        val defaultSince = key.feedContentStates.notifications.lastNoteCreatedAtIfFilled()
         return (key.account.followsPerRelay.value.keys - key.account.notificationRelays.flow.value).flatMap {
             val since = since?.get(it)?.time ?: defaultSince
             filterJustTheLatestNotificationsToPubkeyFromRandomRelays(it, user(key).pubkeyHex, since)

amethyst/src/main/java/com/vitorpamplona/amethyst/service/relayClient/reqCommand/account/nip01Notifications/AccountNotificationsHistoryEoseManager.kt

@@ -0,0 +1,222 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.service.relayClient.reqCommand.account.nip01Notifications
+
+import com.vitorpamplona.amethyst.commons.relayClient.paging.BackwardRelayPager
+import com.vitorpamplona.amethyst.commons.relayClient.paging.PagingStatus
+import com.vitorpamplona.amethyst.model.Account
+import com.vitorpamplona.amethyst.model.User
+import com.vitorpamplona.amethyst.service.relayClient.eoseManagers.PerUserEoseManager
+import com.vitorpamplona.amethyst.service.relayClient.reqCommand.account.AccountQueryState
+import com.vitorpamplona.amethyst.service.relays.SincePerRelayMap
+import com.vitorpamplona.quartz.nip01Core.core.Event
+import com.vitorpamplona.quartz.nip01Core.relay.client.INostrClient
+import com.vitorpamplona.quartz.nip01Core.relay.client.pool.RelayBasedFilter
+import com.vitorpamplona.quartz.nip01Core.relay.client.reqs.SubscriptionListener
+import com.vitorpamplona.quartz.nip01Core.relay.client.subscriptions.Subscription
+import com.vitorpamplona.quartz.nip01Core.relay.filters.Filter
+import com.vitorpamplona.quartz.nip01Core.relay.normalizer.NormalizedRelayUrl
+import com.vitorpamplona.quartz.nip01Core.relay.normalizer.RelayUrlNormalizer
+import com.vitorpamplona.quartz.utils.Log
+import com.vitorpamplona.quartz.utils.TimeUtils
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.FlowPreview
+import kotlinx.coroutines.Job
+import kotlinx.coroutines.flow.StateFlow
+import kotlinx.coroutines.flow.collectLatest
+import kotlinx.coroutines.flow.sample
+import kotlinx.coroutines.launch
+
+/**
+ * Loads the account's notification **history** — everything older than the one-week live tail
+ * ([AccountNotificationsEoseFromInboxRelaysManager]) — by **`until`+`limit` paging, per relay, on
+ * demand**, so the notifications feed can be scrolled back in time instead of being pinned to the
+ * recent week.
+ *
+ * There is no proactive walk: each relay advances exactly one page when the feed's on-screen
+ * window-limit marker for that relay asks ([advance]), then **parks** at its window limit. The markers
+ * are the drivers — a relay pages only while its marker is visible, and keeps paging as long as it
+ * stays visible (see the notifications card feed). So a spam-dense relay never floods: the user has to
+ * scroll through its notifications to pull more, and nothing is fetched while its marker is off screen.
+ *
+ * Relays paged: the same set the live inbox loader covers — the user's inbox relays (all notification
+ * kinds tagging me) plus each joined NIP-29 group's host relay (group-activity kinds scoped by `#h`).
+ * The foreground "random follows" straggler query ([AccountNotificationsEoseFromRandomRelaysManager],
+ * tiny latest-N limits) is deliberately live-tail only and is NOT paged here.
+ *
+ * The per-relay cursors live on the [Account] (so they share the account's lifetime); this class binds
+ * the single-active [BackwardRelayPager] orchestrator to them on [newSub], builds the notification REQ
+ * filters, and forwards relay callbacks into the pager. A relay is *done* once it answers an empty page;
+ * one that won't answer (auth CLOSE, unreachable, or silent) is flagged *stalled* but kept. [exhausted]
+ * flips once every relay is either done or stalled.
+ */
+class AccountNotificationsHistoryEoseManager(
+    client: INostrClient,
+    allKeys: () -> Set<AccountQueryState>,
+) : PerUserEoseManager<AccountQueryState>(client, allKeys) {
+    override fun user(key: AccountQueryState) = key.account.userProfile()
+
+    // A modest page: each marker-triggered advance pulls ~500 older notifications, digestible to render
+    // and enough to fill a scroll, rather than the gift-wrap default (a whole encrypted-blob band at once).
+    private val pager = BackwardRelayPager("notifications.history", pageLimit = 500)
+
+    val loadingMore: StateFlow<Boolean> = pager.loadingMore
+    val status: StateFlow<PagingStatus> = pager.status
+
+    // Each joined group's id, bucketed by the normalized host relay it lives on. Used both to route the
+    // group filter and (its keys) to add group host relays to the paged relay set.
+    private fun groupsByRelay(account: Account): Map<NormalizedRelayUrl, List<String>> =
+        account.relayGroupList.liveRelayGroupList.value
+            .groupBy({ RelayUrlNormalizer.normalizeOrNull(it.relayUrl) }, { it.groupId })
+            .mapNotNull { (relay, ids) -> relay?.let { it to ids.distinct() } }
+            .toMap()
+
+    // The full relay set this account pages notifications back through: inbox relays + group host relays.
+    private fun notificationRelaySet(account: Account): Set<NormalizedRelayUrl> = account.notificationRelays.flow.value + groupsByRelay(account).keys
+
+    override fun updateFilter(
+        key: AccountQueryState,
+        since: SincePerRelayMap?,
+    ): List<RelayBasedFilter> {
+        if (!key.account.isWriteable()) return emptyList()
+
+        val pubkey = user(key).pubkeyHex
+        val inbox = key.account.notificationRelays.flow.value
+        val groups = groupsByRelay(key.account)
+
+        // Only relays that have been advanced (armed) and aren't done carry a REQ. A relay that finished a
+        // page keeps the same `until` here, so re-assembly (triggered when ANOTHER relay advances) doesn't
+        // re-REQ it — it stays parked until the marker advances it again.
+        val armed = pager.armedRelays(inbox + groups.keys)
+        if (armed.isEmpty()) return emptyList()
+
+        return armed.flatMap { relay ->
+            val until = pager.requestedUntilFor(relay) ?: return@flatMap emptyList()
+            Log.d(TAG) { "[notifications.history] REQ ${relay.url} until=$until limit=${pager.pageLimit}" }
+            buildList {
+                if (relay in inbox) {
+                    addAll(filterNotificationsHistoryToPubkey(relay, pubkey, until, pager.pageLimit))
+                }
+                groups[relay]?.let { groupIds ->
+                    addAll(filterGroupNotificationsHistoryToPubkey(relay, pubkey, groupIds, until, pager.pageLimit))
+                }
+            }
+        }
+    }
+
+    /** Steps a single [relay] to its next, older page. Driven by that relay's on-screen window-limit marker. */
+    fun advance(relay: NormalizedRelayUrl) {
+        if (pager.advance(relay)) invalidateFilters()
+    }
+
+    /** Steps every not-done, not-in-flight relay one page. For the empty/initial boundary (nothing to scroll). */
+    fun advanceAll() {
+        if (pager.advanceAll()) {
+            Log.d(TAG) { "[notifications.history] advanceAll (empty-feed bootstrap)" }
+            invalidateFilters()
+        }
+    }
+
+    private val userJobMap = mutableMapOf<User, List<Job>>()
+
+    @OptIn(FlowPreview::class)
+    override fun newSub(key: AccountQueryState): Subscription {
+        // Repoint the single-active orchestrator at this account's notification cursors and the relay set
+        // it fans out to, refreshing the display flows from the restored progress.
+        pager.bind(key.account.notificationHistory, key.account.scope) { notificationRelaySet(key.account) }
+
+        val user = user(key)
+        userJobMap[user]?.forEach { it.cancel() }
+        userJobMap[user] =
+            listOf(
+                // A relay joining/leaving the paged set (inbox change, group join/leave) re-issues the REQ
+                // so a newly-added relay can be armed and a removed one drops out.
+                key.account.scope.launch(Dispatchers.IO) {
+                    key.account.notificationRelays.flow
+                        .sample(1000)
+                        .collectLatest { invalidateFilters() }
+                },
+                key.account.scope.launch(Dispatchers.IO) {
+                    key.account.relayGroupList.liveRelayGroupList
+                        .sample(1000)
+                        .collectLatest { invalidateFilters() }
+                },
+            )
+
+        return requestNewSubscription(historyListener(key))
+    }
+
+    private fun historyListener(key: AccountQueryState): SubscriptionListener {
+        // A just-backgrounded account's subscription can still deliver after the orchestrator rebinds to
+        // another account; gate the pager (single-active) on whether it's still bound to THIS account's
+        // cursors so a late callback can't move another account's cursors. newEose runs regardless.
+        val myCursors = key.account.notificationHistory
+        return object : SubscriptionListener {
+            override fun onEvent(
+                event: Event,
+                isLive: Boolean,
+                relay: NormalizedRelayUrl,
+                forFilters: List<Filter>?,
+            ) {
+                if (pager.isBoundTo(myCursors)) pager.onEvent(relay, event.createdAt)
+            }
+
+            override fun onEose(
+                relay: NormalizedRelayUrl,
+                forFilters: List<Filter>?,
+            ) {
+                if (pager.isBoundTo(myCursors) && pager.onEose(relay)) {
+                    Log.d(TAG) { "[notifications.history] ${relay.url} reached the bottom (done)" }
+                }
+                // No auto-advance: the relay parks here until its marker asks for the next page.
+                newEose(key, relay, TimeUtils.now(), forFilters)
+            }
+
+            override fun onClosed(
+                message: String,
+                relay: NormalizedRelayUrl,
+                forFilters: List<Filter>?,
+            ) {
+                if (pager.isBoundTo(myCursors)) pager.onClosed(relay, message)
+            }
+
+            override fun onCannotConnect(
+                relay: NormalizedRelayUrl,
+                message: String,
+                forFilters: List<Filter>?,
+            ) {
+                if (pager.isBoundTo(myCursors)) pager.onCannotConnect(relay, message)
+            }
+        }
+    }
+
+    override fun endSub(
+        key: User,
+        subId: String,
+    ) {
+        super.endSub(key, subId)
+        userJobMap[key]?.forEach { it.cancel() }
+    }
+
+    companion object {
+        private const val TAG = "NotificationPagination"
+    }
+}

amethyst/src/main/java/com/vitorpamplona/amethyst/service/relayClient/reqCommand/account/nip01Notifications/FilterNotificationsToPubkey.kt

@@ -124,6 +124,70 @@ val NotificationsPerKeyKinds3 =
         AttestorRecommendationEvent.KIND,
     )
 
+/**
+ * Every kind the notifications feed cares about on the user's inbox relays, flattened into one list.
+ * The live-tail query ([filterNotificationsToPubkey] / [filterSummaryNotificationsToPubkey]) splits these
+ * across several filters with different per-kind limits; backward history paging instead asks ONE filter
+ * per relay so the single until+limit cursor stays gap-proof (an empty page truly means "nothing older").
+ */
+val AllNotificationKinds =
+    (SummaryKinds + NotificationsPerKeyKinds + NotificationsPerKeyKinds2 + NotificationsPerKeyKinds3).distinct()
+
+/**
+ * One backward-paging page of notifications on an inbox relay: the N newest events tagging me
+ * ([AllNotificationKinds], `#p` = me) strictly older than [until]. A single filter (not the live query's
+ * split) so the [BackwardRelayPager][com.vitorpamplona.amethyst.commons.relayClient.paging.BackwardRelayPager]
+ * cursor tracking the oldest delivered `created_at` can't skip a band that a per-kind sub-limit capped.
+ */
+fun filterNotificationsHistoryToPubkey(
+    relay: NormalizedRelayUrl,
+    pubkey: HexKey?,
+    until: Long,
+    limit: Int,
+): List<RelayBasedFilter> {
+    if (pubkey.isNullOrEmpty()) return emptyList()
+
+    return listOf(
+        RelayBasedFilter(
+            relay = relay,
+            filter =
+                Filter(
+                    kinds = AllNotificationKinds,
+                    tags = mapOf("p" to listOf(pubkey)),
+                    limit = limit,
+                    until = until,
+                ),
+        ),
+    )
+}
+
+/**
+ * One backward-paging page of NIP-29 group-activity notifications on a group's host relay:
+ * [GroupNotificationKinds] tagging me (`#p`) inside my joined groups (`#h`), strictly older than [until].
+ */
+fun filterGroupNotificationsHistoryToPubkey(
+    relay: NormalizedRelayUrl,
+    pubkey: HexKey?,
+    groupIds: List<String>,
+    until: Long,
+    limit: Int,
+): List<RelayBasedFilter> {
+    if (pubkey.isNullOrEmpty() || groupIds.isEmpty()) return emptyList()
+
+    return listOf(
+        RelayBasedFilter(
+            relay = relay,
+            filter =
+                Filter(
+                    kinds = GroupNotificationKinds,
+                    tags = mapOf("p" to listOf(pubkey), "h" to groupIds),
+                    limit = limit,
+                    until = until,
+                ),
+        ),
+    )
+}
+
 fun filterSummaryNotificationsToPubkey(
     relay: NormalizedRelayUrl,
     pubkey: HexKey?,

amethyst/src/main/java/com/vitorpamplona/amethyst/service/relayClient/reqCommand/account/nip59GiftWraps/AccountGiftWrapsEoseManager.kt

@@ -20,6 +20,7 @@
  */
 package com.vitorpamplona.amethyst.service.relayClient.reqCommand.account.nip59GiftWraps
 
+import com.vitorpamplona.amethyst.commons.model.chats.ChatFeedType
 import com.vitorpamplona.amethyst.commons.model.privateChats.DmHistoryTuning
 import com.vitorpamplona.amethyst.commons.relayClient.nip17Dm.filterGiftWrapsToPubkey
 import com.vitorpamplona.amethyst.commons.relayClient.paging.WindowLoadTracker
@@ -27,6 +28,7 @@ import com.vitorpamplona.amethyst.commons.relayClient.paging.trackingListener
 import com.vitorpamplona.amethyst.model.User
 import com.vitorpamplona.amethyst.service.relayClient.eoseManagers.DmRelayLog
 import com.vitorpamplona.amethyst.service.relayClient.eoseManagers.PerUserEoseManager
+import com.vitorpamplona.amethyst.service.relayClient.eoseManagers.launchChatFeedToggleObserver
 import com.vitorpamplona.amethyst.service.relayClient.reqCommand.account.AccountQueryState
 import com.vitorpamplona.amethyst.service.relays.SincePerRelayMap
 import com.vitorpamplona.quartz.nip01Core.relay.client.INostrClient
@@ -63,7 +65,7 @@ class AccountGiftWrapsEoseManager(
         key: AccountQueryState,
         since: SincePerRelayMap?,
     ): List<RelayBasedFilter> {
-        if (!key.account.isWriteable()) {
+        if (!key.account.isWriteable() || !key.account.settings.isChatFeedEnabled(ChatFeedType.NIP17)) {
             windowLoad.setExpectedRelays(emptySet())
             return emptyList()
         }
@@ -90,6 +92,7 @@ class AccountGiftWrapsEoseManager(
                     key.account.dmRelays.flow
                         .collectLatest { invalidateFilters() }
                 },
+                key.account.scope.launchChatFeedToggleObserver(key.account, ChatFeedType.NIP17) { invalidateFilters() },
             )
 
         return requestNewSubscription(