perf(feed): defer animation transitions until there is something to animate

`updateTransition` and `AnimatedContent` allocate a Transition, its animation list and its seeking state on *first* composition — but first composition has nothing to animate, because target and initial state are the same value. In a feed that is waste: every card scrolled in built six of them, and during a scroll essentially none ever ran, since reaction counts and icons do not change in the second a card is on screen. `DeferredCrossfade` and `DeferredAnimatedContent` render the plain content until the target actually moves, then build the transition seeded at the *original* value via `MutableTransitionState` and immediately re-target it — so the first real change still animates exactly as before, and later changes animate through the now-live transition normally. The existing `isPerformanceMode()` branch, which genuinely drops the animation, is untouched and still takes precedence. Measured on an SM-T220 against a frozen corpus served by a local relay (a real capture: 105 notes, 68 profiles, 501 reactions, 75 boosts, 22 zaps), interleaved with the unmodified build, two runs per arm: frame duration P90 27.53 -> 26.90 -2.3% (baseline spread 0.1%) frame overrun P90 21.65 -> 17.44 -19.4% (baseline spread 6.3%) frame duration P50 -1.1% (inside a 1.7% spread) Modest at the frame level by nature: on this device the main thread sits blocked in `postAndWait` on the RenderThread for roughly two-thirds of every frame, so composition savings largely do not surface. Removing 24 flow subscriptions per card, every clickable, or every counter each moved `postAndWait` by only ~2%. `DeferredAnimationTest` drives the clock manually and asserts the outgoing and incoming content coexist mid-transition, which only a running animation does; a regression turning the deferral into a snap fails it.
feat(notifications): surface NIP-34 PR replies, merges, closes, and drafts
2026-09-14 00:55:08 +00:00 · 2026-09-01 15:41:05 -04:00 · 2026-08-31 15:53:12 -04:00 · 2026-08-31 15:38:19 -04:00 · 2026-08-31 11:38:37 -04:00 · 2026-08-31 11:36:31 -04:00
655 changed files with 68638 additions and 4650 deletions
@@ -77,6 +77,25 @@ What this means for this skill:
 2. **Source-identical entries are a small, recognizable minority.** Brand terms (`Nowhere X`), single-word loanwords (`Apps` / `Feed` / `Issues`), and bare version/format strings (`v%1$s`) are the usual cases. Skip these by inspection rather than translating them to something identical.
 3. **Don't add source-identical fallbacks.** Android falls back to `values/strings.xml` at runtime, so a key intentionally kept as English already renders correctly, and Crowdin's next sync would strip a local duplicate anyway.

+4. **A repo-side edit to a translated value only sticks where Crowdin's database
+   doesn't contradict it.** Download replaces file content with Crowdin's current
+   export; it does not diff or merge. So a hand fix to a locale file survives only
+   if Crowdin happens to hold the same value (or holds nothing for that key). If
+   Crowdin holds a *different* value — including an **empty** one — the next sync
+   silently reverts you.
+
+   Observed 2026-08-13/14 in one pass, which is what makes the rule concrete:
+   `pow_estimate_minutes[few]` (pl) **survived** the sync because Crowdin's
+   approved value matched the fix, while `nest_listener_count[many]` (pl) was
+   **reverted to empty** two commits later because Crowdin stores an empty string
+   there. Same file, same commit, opposite outcomes.
+
+   Consequences: fixing a *value* durably means entering it in the Crowdin web UI
+   — no repo commit will hold it. Changes to the **source** file are different and
+   do stick, because that file is Crowdin's input, not its output: deleting a key
+   from `values/strings.xml` removes it project-wide, and attributes declared
+   there propagate into every export.
+
 > **Historical note:** an earlier version of this skill tried to auto-filter the
 > candidate list with a git "sync-timestamp" heuristic (skip any key added before
 > the last `New Crowdin translations` commit). It was **dropped** because it
@@ -280,6 +299,64 @@ done

 For each hit, warn the user that the entry is unreachable in that locale. The fix is to **remove the `<item quantity="zero">`** and, if the UX wanted distinct wording for count=0, add a separate `<string>` plus an `if (count == 0)` branch at the call site (see "Plurals: handle with care" below).

+Also audit **format-specifier parity and empty items** across the locales you
+touched. These are a different defect class from a missing key — the key is
+present and looks translated, but the placeholder was dropped, escaped, or the
+item left blank, so the number never reaches the user:
+
+```bash
+python3 - <<'PY'
+import re, io, glob
+keyre = re.compile(r'<string name="([^"]+)"[^>]*>(.*?)</string>', re.S)
+plre  = re.compile(r'<plurals name="([^"]+)"[^>]*>(.*?)</plurals>', re.S)
+itre  = re.compile(r'<item quantity="([^"]+)"[^>]*>(.*?)</item>', re.S)
+# (?<!\\) is REQUIRED: \%2$d is an escaped literal, not a placeholder.
+phre  = re.compile(r'(?<!\\)%(?:(\d+)\$)?([sdf])')
+sig = lambda t: sorted(m.group(0) for m in phre.finditer(t))
+for base in ['amethyst/src/main/res', 'commons/src/commonMain/composeResources']:
+    d = io.open(f'{base}/values/strings.xml', encoding='utf-8').read()
+    dstr = {m.group(1): sig(m.group(2)) for m in keyre.finditer(d)}
+    dpl  = {}
+    for m in plre.finditer(d):
+        s = set()
+        for it in itre.finditer(m.group(2)): s.update(sig(it.group(2)))
+        dpl[m.group(1)] = sorted(s)
+    for p in sorted(glob.glob(f'{base}/values-*/strings.xml')):
+        if '/values-ar' in p: continue   # see caveat below
+        s = io.open(p, encoding='utf-8').read()
+        for m in keyre.finditer(s):
+            k, v = m.group(1), m.group(2)
+            if k in dstr and sig(v) != dstr[k]:
+                print(f'{p}\n    {k}  base={dstr[k]}  loc={sig(v)}')
+        for m in plre.finditer(s):
+            k = m.group(1)
+            if k not in dpl: continue
+            for it in itre.finditer(m.group(2)):
+                if sig(it.group(2)) != dpl[k]:
+                    print(f'{p}\n    {k}[{it.group(1)}]  base={dpl[k]}  loc={sig(it.group(2))}')
+PY
+
+# Empty plural items render as nothing at runtime — always a bug.
+grep -rn '<item quantity="[a-z]*"></item>' \
+  amethyst/src/main/res/values*/strings.xml \
+  commons/src/commonMain/composeResources/values*/strings.xml
+```
+
+Three things this scan taught us, all of which it now encodes:
+
+- **The `(?<!\\)` lookbehind is not optional.** Without it the scan matches
+  `%2$d` *inside* `\%2$d` and scores a broken string clean. `\%` is not a
+  recognised Android escape, but lint reads it as one, so the placeholder is
+  reported missing. (2026-08-13: `nip46_signer_relays_some_down` in sl-rSI
+  survived a "clean" sweep exactly this way.)
+- **Skip Arabic.** Its `zero`/`one`/`two` forms omit the numeral idiomatically
+  ("دقيقتان" = "two minutes"), so ~30 hits there are correct translations, not
+  defects. Everything else is worth reading.
+- **Repeated indices are legitimate.** `%1$s` appearing twice in a translation
+  where the base uses it once is normal — German repeats the name where English
+  says "They". Compare *sets*, and treat an arity difference as a question, not
+  a verdict.
+
 Quick scan over the missing keys:

 ```bash
@@ -340,6 +417,37 @@ When adding or proposing **`<plurals>`** entries, follow these rules:
      pluralStringResource(R.plurals.foo_items, count, dateLabel, count)
  }
  ```
+- **Converting an existing `<string>` to `<plurals>`: give every locale its FULL
+  category set, not just `other`.** You must convert it in every locale that
+  already had the `<string>` (aapt2 rejects a resource-type mismatch across
+  locales, and an orphaned locale `<string>` trips `ExtraTranslation`) — but
+  carrying the old text across as an `other`-only block, on the theory that
+  Crowdin backfills the rest, **fails `MissingQuantity` and breaks CI before
+  Crowdin ever gets a turn.** Supply `one`/`few`/`many` for pl, `one` for hu, and
+  so on, at conversion time.
+
+  Note this contradicts `amethyst/src/main/res/CLAUDE.md` step 3, which still
+  advises the `other`-only shortcut. That advice is wrong; prefer this.
+
+  Watch the declension when you do it: the retained text is usually the *plural*
+  form, so reusing it verbatim for `one` produces "1 odpowiedzi". (2026-08-13:
+  converting `poll_results_selections` with `other` only errored on both hu and
+  pl, and the retained pl text was the few/many form.)
+
+- **A `tools:ignore` suppression must go on the SOURCE entry in
+  `values/strings.xml`, never on a locale file.** Crowdin propagates attributes
+  declared on the source into every translation it exports; an attribute you add
+  to `values-xx/strings.xml` alone is simply absent from the next export. That is
+  why the existing `tools:ignore="Typos"` entries survive — they are declared on
+  the source, and the copies in cs/de/ar/eo/bn are the *result* of propagation,
+  not evidence that locale-file attributes stick. (2026-08-13: an
+  `ImpliedQuantity` suppression added only to `values-pt-rBR` was stripped by the
+  next sync and took `main`'s CI red.)
+
+  Before reaching for a suppression at all, check whether the key is even used —
+  a `grep -rn "<key>" --include='*.kt'` that returns nothing means deleting the
+  key is the better fix than muting the rule that objects to it.
+
 - Reference: [Android `<plurals>` docs](https://developer.android.com/guide/topics/resources/string-resource#Plurals) and [CLDR plural rules](https://unicode-org.github.io/cldr-staging/charts/latest/supplemental/language_plural_rules.html).

 **Then ask the user:** "Would you like me to translate these missing strings into [list of target locales]?"
@@ -380,6 +488,44 @@ When adding translated strings to locale files:
  #   ./gradlew :commons:convertXmlValueResourcesForCommonMain
  ```

+- **Then run Android lint. This is the gate that actually matches CI, and the
+  checks above do NOT substitute for it.** Duplicate-key + well-formedness +
+  `convertXmlValueResourcesForCommonMain` can all pass on a change that still
+  takes CI red, because the plural rules live in lint, not in the resource
+  compiler:
+
+  ```bash
+  ./gradlew :amethyst:lintPlayBenchmark     # the task CI runs (.github/workflows/build.yml)
+  ```
+
+  There is no `lint-baseline.xml` in this repo and only `MissingTranslation` is
+  disabled (`amethyst/build.gradle.kts`), so `abortOnError` bites on the first
+  error. Three rules matter for a translation pass:
+
+  | Rule | Fires when | Severity |
+  |------|-----------|----------|
+  | `MissingQuantity` | a locale's `<plurals>` omits a CLDR category that locale uses | **error** for core categories — gates CI |
+  | `ImpliedQuantity` | a `quantity` item has no format argument in a locale where that category spans more than one number | **error** — gates CI |
+  | `StringFormatCount` / `StringFormatMatches` | a translation's placeholder count/type disagrees with the base entry | warning |
+
+  (2026-08-13: a pass that cleared the duplicate/XML gate above still failed
+  `lintPlayBenchmark` with 3 errors. Compiling is not evidence — `compileDebugKotlin`
+  passed on the same change.)
+
+- **Confirm the report says zero errors, don't just trust BUILD SUCCESSFUL** of a
+  wider invocation:
+
+  ```bash
+  python3 -c "
+  import json,io,collections
+  d=json.load(io.open('amethyst/build/reports/lint-results-playBenchmark.sarif',encoding='utf-8'))
+  r=d['runs'][0]['results']
+  print(dict(collections.Counter(x.get('level','warning') for x in r)))
+  for x in r:
+      if x.get('level')=='error': print('ERROR', x['ruleId'], x['locations'][0]['physicalLocation']['artifactLocation']['uri'])
+  "
+  ```
+
 ## Common Mistakes

 - **Scanning only the amethyst tree** — there are now **two** Crowdin-managed `strings.xml` trees (`amethyst/src/main/res` and `commons/src/commonMain/composeResources`). A key extracted into `commons/` will never show up in the amethyst diff. Run the whole technique once per tree (see "Resource trees") and report each separately.
@@ -392,6 +538,12 @@ When adding translated strings to locale files:
 - **Adding source-identical fallbacks locally** — they get overwritten on the next Crowdin sync. Android falls back to `values/strings.xml` at runtime anyway, so a key intentionally kept as English already renders correctly. Skip these by inspection (brand terms, loanwords, `v%1$s`-style strings); don't translate them to an identical value.
 - **Skipping per-locale diffs when only diffing cs** — Crowdin can strip different keys in different locales (each translator's choice), so cs is not a reliable upper bound. Diff each target locale and union the results.
 - **Pasting the union set of missing keys into every locale → duplicate keys** — the union is the right set to *translate*, but the wrong set to *insert*. A key missing in only some locales, inserted into all of them, duplicates in the ones that already had it. Drive each file's insertion off its own per-locale diff (see Step 6). In `commons`, a duplicate key is build-breaking: `convertXmlValueResourcesForCommonMain` fails with `Duplicated key '…'`. **Always run the post-insertion duplicate + XML-wellformedness gate in Step 6 before declaring done.** (Happened 2026-07-21 with `ps1_save_block` / `podcast_value_for_value` / `chats_history_relays`.)
+- **Declaring the pass done without running `:amethyst:lintPlayBenchmark`** — the duplicate-key + XML + `convertXmlValueResourcesForCommonMain` gate is necessary but nowhere near sufficient. `MissingQuantity` and `ImpliedQuantity` are errors, there is no lint baseline, and `abortOnError` is on, so a change that compiles and passes every check in Step 6's first half can still take CI red. Compiling is not evidence. (Happened 2026-08-13: 3 lint errors after a clean duplicate/XML gate and a green `compileFdroidDebugKotlin`.)
+- **Converting a `<string>` to `<plurals>` with `other` only** — "Crowdin fills the rest" is false; `MissingQuantity` errors immediately and CI fails before any sync. Supply every category the locale uses at conversion time, and re-check the declension rather than reusing the old text for `one`.
+- **Putting `tools:ignore` on a locale file** — Crowdin strips it on the next export. Suppressions belong on the source entry in `values/strings.xml`, which propagates. The `tools:ignore="Typos"` copies visible in cs/de/ar/eo/bn are the *result* of that propagation, not proof that locale-file attributes survive. (Happened 2026-08-13; it broke `main`.)
+- **Suppressing a lint rule on a key nothing references** — check `grep -rn "<key>" --include='*.kt'` first. `poll_results_voters` was a bare noun with no count, zero call sites, and an unlocalizable shape; deleting it retired the problem outright where a suppression would only have muted it.
+- **Comparing placeholders without a `(?<!\\)` guard** — `\%2$d` is an escaped literal to lint, but a naive `%\d+\$[sd]` regex matches the placeholder inside it and reports the string clean. A parity sweep missing this guard will certify a broken translation. Also treat a *repeated* index (`%1$s` twice where the base has it once) as legitimate — German does this where English says "They".
+- **Reading an empty `<item quantity="…"></item>` as merely "untranslated"** — it renders as nothing at runtime, and for a category like Polish `many` (5–21, 25–31, …) that is the common case, not an edge case. Grep for them explicitly; the missing-key diff will never surface one because the key is present.
 - **Inserting strings in a specific position** — always append at the bottom; ordering is handled separately
 - **Hardcoding `"1"` in a `<plurals>` `quantity="one"` item** — always use the count placeholder; otherwise non-English `one` categories produce wrong text
 - **Copying English's `one`/`other` set into every locale** — each language must include all CLDR plural categories it uses (e.g. Czech needs `one`, `few`, `many`, `other`)
@@ -1,16 +1,17 @@
 ---
 name: find-non-lambda-logs
-description: Use when auditing or migrating Log calls — flags both interpolated Log.d/i/w/e that should use the lambda overload (allocation hygiene) and catch-block Log.w/e that interpolate ${e.message} but drop the throwable (lost stack traces)
+description: Use when auditing or migrating Log calls — flags interpolated Log.d/i/w/e that should use the lambda overload (allocation hygiene), catch-block Log.w/e that interpolate ${e.message} but drop the throwable (lost stack traces), and files still importing android.util.Log (no lambda overload, bypasses Log.minLevel)
 ---

 # Find Non-Lambda Log Calls

 ## Overview

-Two related logging hygiene issues:
+Three related logging hygiene issues:

 1. **Lambda overload missing.** `Log.d/i/w/e` calls that use string interpolation without the lambda overload waste string allocation when the log level is filtered out in release builds.
 2. **Throwable dropped in catch blocks.** `Log.w/e` calls inside `catch (e: ...)` blocks that interpolate `${e.message}` but don't pass `e` lose the stack trace, and log nothing useful when `e.message` is null (NPE, IOException with no message, etc.).
+3. **Still on `android.util.Log`.** Files importing the platform logger bypass `Log.minLevel` and the `LogSink`, and have no lambda overload — so neither fix above can be applied to them. Step 0 finds these; the last section migrates them.

 ## When to Use

@@ -39,6 +40,54 @@ Log.d("Tag", "Initialization complete")

 **Important:** Tags can be string literals (`"Tag"`) or variables (`tag`, `LOG_TAG`). Run both patterns for each step.

+**The throwable-name alternation, used by Steps 2 and 3** — define it once and reuse it, rather than writing a shorter list in one step and a longer one in another:
+
+```bash
+THROWABLE='(e|t|it|ex|err|error|throwable|cause|tr)'
+```
+
+**Filter the noise before counting**, or the totals mislead: drop `/build/`, `/androidTest/` and `/src/test/` (release filtering doesn't apply to tests), and drop lines whose first non-space character is `//` or `*` — commented-out calls and KDoc examples both match these patterns. A `grep -vE ':[0-9]+: *(//|\*)'` handles the last one.
+
+### Step 0: Find files still on `android.util.Log` (run this first)
+
+**Two patterns — the fully-qualified one alone is a false negative.** Almost nobody writes `android.util.Log.w(...)` at the call site; they `import android.util.Log` and then write `Log.w(...)`, which is indistinguishable from the wrapper by call shape. The import is the reliable signal:
+
+```bash
+# the form that actually occurs
+grep -rln --include='*.kt' '^import android\.util\.Log$' . | grep -v '/build/' | grep -v PlatformLog
+
+# the rare fully-qualified call
+grep -rnE --include='*.kt' 'android\.util\.Log\.(d|i|w|e|v)\(' . | grep -v '/build/' | grep -v PlatformLog
+```
+
+On 2026-08-28 the fully-qualified pattern reported **0** while the import pattern found **16 production files** (9 in `nappletHost`, the rest in amethyst's `favorites/` and `napplet/`). Exclude `PlatformLog.android.kt`, which is the wrapper implementation and must call `android.util.Log`.
+
+These bypass the `Log.minLevel` filter and the `LogSink` indirection entirely, and — the practical consequence for this skill — **they have no lambda overload**, so Steps 1–3 cannot be applied to them until they are migrated. Subtract these files from the Step 1–3 candidate lists, or migrate them first (see the last section).
+
+### Step 0b: The patterns are line-anchored — sweep multi-line calls separately
+
+Every `pattern:` in Steps 1–3 matches a call written on one line. A call formatted as
+
+```kotlin
+Log.d(
+    TAG,
+    "WASTE ${url.url} dials=${r.tentatives.get()} " +
+        "fail=[${r.failures.entries.joinToString { … }}]",
+)
+```
+
+is **structurally invisible** to them. That biases the audit towards short calls and away from expensive ones — the multi-line form is what long, heavily interpolated messages look like, and those are exactly the ones worth deferring. A 2026-08-28 sweep converted three one-line banner calls in `BootRelayDiagnostics.kt` while walking past two `Log.d` calls in `forEach` loops immediately below them, running 25 and 20 iterations per census with nested `joinToString` in each — strictly the larger cost, three lines away.
+
+Catch them with the open-paren-at-EOL form, then read each hit:
+
+```bash
+grep -rnE --include='*.kt' 'Log\.[diwe]\($' . | grep -v '/build/'
+# or, to see the whole call:
+rg -U --multiline --type kotlin 'Log\.[diwe]\(\n[^)]*\$\{'
+```
+
+**Prioritise call sites inside loops over one-liners.** A `Log.d` in a 25-iteration `forEach` discards 25 built strings per pass; a one-line banner discards one.
+
 ### Step 1: Find interpolated Log.d/Log.i (highest priority — filtered in release)

 ```
@@ -61,7 +110,14 @@ pattern: Log\.(w|e)\(\w+,\s*"[^"]*\$
 type: kotlin
 ```

-Then **manually exclude** lines where a throwable is passed as third argument (ending with `, e)`, `, throwable)`, etc.). Check the actual line — a catch block catching `e` doesn't mean `e` is passed to the Log call.
+Then **manually exclude** lines where a throwable is passed as third argument. Check the actual line — a catch block catching `e` doesn't mean `e` is passed to the Log call.
+
+**`it` is the name you will miss.** `Result.onFailure { ... }` is the dominant shape in this repo, so most correct calls end `, it)`, not `, e)`. Excluding only `e`/`throwable` inflates the result badly — a 2026-08-28 pass reported 23 hits where the real number was 8, because 14 of them were `.onFailure { Log.w(TAG, "...", it) }` and already correct. Also note the throwable is not always last on the line (`}.onFailure { Log.w(...) }.getOrDefault(false)`), so anchoring the exclusion to `$` misses them:
+
+```bash
+grep -rnE --include='*.kt' 'Log\.(w|e)\([^,]+,\s*"[^"]*\$' . \
+  | grep -vE ",\s*$THROWABLE\)"      # note: no $ anchor, and `it` included
+```

 ### Step 3: Find catch-block Log.w/e that drop the throwable

@@ -70,23 +126,14 @@ Among the Step 2 hits, the calls that interpolate `${e.message}` (or `${t.messag
 Quick filter:

 ```
-pattern: Log\.(w|e)\([^)]*\$\{(e|t|throwable|cause)\.message\}[^)]*\)$
+pattern: Log\.(w|e)\([^)]*\$\{(e|t|it|ex|err|throwable|cause)\.message\}
 type: kotlin
 ```

-Then for each hit, open the file and confirm the line is **inside a `catch (e: ...)` block** and **does not pass `e` (or the matching name) as a third argument**. False positives: extension functions / helpers that accept an `e: SomeError` parameter and forward it elsewhere.
+Note this deliberately omits the `\)$` anchor and includes `it` — same reasons as Step 2. Then for each hit, open the file and confirm the line is **inside a `catch (e: ...)` block** and **does not pass `e` (or the matching name) as a third argument**. False positives: extension functions / helpers that accept an `e: SomeError` parameter and forward it elsewhere.

 Both Step 2 and Step 3 may flag the same line — handle Step 3 first (different fix), then apply Step 2 to whatever remains.

-### Step 4: Verify no android.util.Log leakage
-
-```
-pattern: android\.util\.Log\.(d|i|w|e|v)\(
-type: kotlin
-```
-
-These bypass the `Log.minLevel` filter entirely. Exclude `PlatformLog.android.kt` which is the wrapper implementation.
-
 ## Fix Patterns

 ### Lambda overload (Step 1 + Step 2)
@@ -106,7 +153,7 @@ Switch to `(tag, msg, throwable)` — the lambda overload does **not** accept a
 ```kotlin
 // Before — stack trace lost, prints "...failed: null" if e.message is null
 try { groupManager.clearAllState() } catch (e: Exception) {
-    Log.w("MarmotManager") { "clearAllState failed: ${e.message}" }
+    Log.w("MarmotManager", "clearAllState failed: ${e.message}")
 }

 // After — full stack trace logged
@@ -120,6 +167,25 @@ Trade-off: the message string is allocated eagerly even when warn is filtered, b
 ## Do NOT Convert

 - **To lambda:** calls passing a `Throwable` parameter — the lambda overload `(tag) { message }` has no throwable parameter.
+- **To lambda: any call in a file that imports `android.util.Log`.** The platform `Log` has no lambda overload, so the conversion fails to compile with `None of the following candidates is applicable`. Either migrate the file first (below) or leave the call alone. (Hit on 2026-08-28: three edits in two files had to be reverted.)
 - Static string calls with no `$` interpolation — no allocation benefit.
 - Commented-out log calls.
 - Informational/intentional log of `e.message` *outside* a catch block (rare; usually means the exception was already handled and only the message is meaningful).
+
+## Migrating a file off `android.util.Log`
+
+This is what unlocks Steps 1–3 for the files Step 0 finds. It is a behaviour change, so check it rather than assuming — but in this repo the check has come out safe, and here is the reasoning to redo:
+
+1. **Which levels does the file use?** `grep -hoE 'Log\.[a-zA-Z]+' <files> | sort | uniq -c`. The wrapper has `d/i/w/e` only — **no `v`**, and no `getStackTraceString`. A `Log.v` call has no direct equivalent and needs a decision, not a rename.
+2. **Would the gate drop them?** `LogLevel { DEBUG, INFO, WARN, ERROR }`, the gate is `minLevel <= <level>`, and `Amethyst.DEFAULT_LOG_LEVEL` is INFO in debug, **WARN in release** (deliberately — so relay-protocol refusals stay visible in the field). The wrapper's own default is `DEBUG`. So `Log.w` and `Log.e` survive in every build type and in every process, including before `Amethyst.init` runs — which matters for `:napplet`. `Log.d`/`Log.i` **would** go silent in release; those need a conscious call.
+3. **Does the output move?** No. `PlatformLogSink` on Android delegates to `android.util.Log`, so lines land in logcat unchanged.
+4. **Can the module see quartz?** `nappletHost` already has `implementation(project(":quartz"))`. Check before assuming.
+
+Then: swap `import android.util.Log` → `import com.vitorpamplona.quartz.utils.Log`, run `./gradlew spotlessApply` (import order changes), and convert only the interpolated no-throwable calls to the lambda form. Calls that already pass a throwable keep the eager three-arg shape — the wrapper's `w(tag, msg, throwable)` matches exactly, so only the import moves.
+
+**Verify the throwables survived**, since a careless rewrite can drop the third argument silently:
+
+```bash
+grep -hoE 'Log\.[diwe]\([^)]*,\s*(e|it)\)' <files> | wc -l   # compare before/after
+```
+
@@ -7,7 +7,7 @@ description: Integration guide for using the Quartz Nostr KMP library in externa

 Reference for integrating `com.vitorpamplona.quartz:quartz` into external Nostr KMP projects.

-**Published artifact**: `com.vitorpamplona.quartz:quartz:1.13.1` (Maven Central)
+**Published artifact**: `com.vitorpamplona.quartz:quartz:1.14.0` (Maven Central)
 **Targets**: JVM 21+, Android (minSdk 21+), iOS (XCFramework `quartz-kmpKit`)
 **License**: MIT

@@ -19,7 +19,7 @@ Reference for integrating `com.vitorpamplona.quartz:quartz` into external Nostr

 ```toml
 [versions]
-quartz = "1.13.1"
+quartz = "1.14.0"

 [libraries]
 quartz = { module = "com.vitorpamplona.quartz:quartz", version.ref = "quartz" }
@@ -41,7 +41,7 @@ kotlin {

 ```kotlin
 dependencies {
-    implementation("com.vitorpamplona.quartz:quartz:1.13.1")
+    implementation("com.vitorpamplona.quartz:quartz:1.14.0")
 }
 ```

@@ -3,7 +3,7 @@
 ## Current version

 ```
-com.vitorpamplona.quartz:quartz:1.13.1
+com.vitorpamplona.quartz:quartz:1.14.0
 ```

 Check latest: https://central.sonatype.com/artifact/com.vitorpamplona.quartz/quartz
@@ -16,7 +16,7 @@ Check latest: https://central.sonatype.com/artifact/com.vitorpamplona.quartz/qua

 ```toml
 [versions]
-quartz = "1.13.1"
+quartz = "1.14.0"

 [libraries]
 quartz = { module = "com.vitorpamplona.quartz:quartz", version.ref = "quartz" }
@@ -55,7 +55,7 @@ kotlin {
 ```kotlin
 // build.gradle.kts (app module)
 dependencies {
-    implementation("com.vitorpamplona.quartz:quartz:1.13.1")
+    implementation("com.vitorpamplona.quartz:quartz:1.14.0")
 }
 ```

@@ -70,7 +70,7 @@ plugins {
 }

 dependencies {
-    implementation("com.vitorpamplona.quartz:quartz:1.13.1")
+    implementation("com.vitorpamplona.quartz:quartz:1.14.0")
    // JNA needed for libsodium (NIP-44) on JVM
    implementation("net.java.dev.jna:jna:5.18.1")
 }
@@ -2,9 +2,9 @@

 Every concrete `SearchableEvent` implementor in Quartz, with the exact `indexableContent()`
 expression. **Update this file in the same PR as any change to the searchable set or to an
-`indexableContent()` body** (see SKILL.md). Verified against the code 2026-08-04.
+`indexableContent()` body** (see SKILL.md). Verified against the code 2026-08-25.

-Counts: 126 concrete classes covering 129 kind values (`GitStatusEvent` spans 4 kinds;
+Counts: 130 concrete classes covering 133 kind values (`GitStatusEvent` spans 4 kinds;
 kind 30063 has a collision — see the footnote). File paths are under
 `quartz/src/commonMain/kotlin/com/vitorpamplona/quartz/`.

@@ -100,6 +100,10 @@ Separator legend: **NL** = `joinToString("\n")`, **SP** = `joinToString(" ")`.
 | 30313 | MeetingRoomEvent | nip53LiveActivities/meetingSpaces | `listOfNotNull(title(), summary())` NL |
 | 30315 | StatusEvent | nip38UserStatus | `content` |
 | 30382 | ContactCardEvent | nip85TrustedAssertions/users | `(listOfNotNull(petName(), summary()) + topics())` NL — public tags only, never the NIP-44 content |
+| 30392 | UserTrustedListEvent | experimental/trustedLists/users | inherited `TrustedListEvent`: `title() ?: ""` — the label only; `metric`/`d` are machine ids and `content` is a JSON echo of the membership |
+| 30393 | EventTrustedListEvent | experimental/trustedLists/events | inherited `TrustedListEvent`: `title() ?: ""` |
+| 30394 | AddressableTrustedListEvent | experimental/trustedLists/addressables | inherited `TrustedListEvent`: `title() ?: ""` |
+| 30395 | ExternalIdTrustedListEvent | experimental/trustedLists/externalIds | inherited `TrustedListEvent`: `title() ?: ""` |
 | 30402 | ClassifiedsEvent | nip99Classifieds | `listOfNotNull(title(), summary(), content)` NL |
 | 30617 | GitRepositoryEvent | nip34Git/repository | `listOfNotNull(name(), description(), content)` NL |
 | 30620 | WorkflowDefEvent | buzz/workflow | `listOfNotNull(name(), content)` NL |
@@ -150,6 +154,7 @@ declares `KIND = 30063` and implements `SearchableEvent` (`content`), but `Event
 | `InteractiveStoryBaseEvent` | `listOfNotNull(title(), summary(), content)` NL | 30296, 30297 |
 | `AddressableVideoEvent` | `listOfNotNull(title(), content)` NL | 34235, 34236 |
 | `RegularVideoEvent` | `listOfNotNull(title(), content)` NL | 21, 22 |
+| `TrustedListEvent` | `title() ?: ""` | 30392, 30393, 30394, 30395 |

 ## How to regenerate / verify this table

@@ -22,7 +22,7 @@ jobs:
        uses: actions/checkout@v7

      - name: Set up JDK 21
-        uses: actions/setup-java@v5.6.0
+        uses: actions/setup-java@v5.7.0
        with:
          distribution: 'temurin'
          java-version: 21
@@ -69,7 +69,7 @@ jobs:
        uses: actions/checkout@v7

      - name: Set up JDK 21
-        uses: actions/setup-java@v5.6.0
+        uses: actions/setup-java@v5.7.0
        with:
          distribution: 'temurin'
          java-version: 21
@@ -94,6 +94,39 @@ jobs:
            $CMD
          fi

+      # This job runs five test suites (:quartz, :commons, :nestsClient, :cli,
+      # :desktopApp) but, unlike test-geode / test-quartz-ios /
+      # test-and-build-android, published nothing when one of them failed. The
+      # console line names the failing test and the exception class and stops
+      # there, so the message is lost with the runner. That is how the
+      # NostrClientNegentropySyncTest failure in run 10540 became
+      # undiagnosable: NegentropySyncException carries a `detail` naming which
+      # branch fired (connect timeout / idle silence / NEG-ERR / disconnect),
+      # and nobody could read it. Same action and pin as the Android job below.
+      - name: Desktop Test Report
+        uses: mikepenz/action-junit-report@d9f48fc87bc235f7e214acf696ca5abc0a986f16 # v6.4.2
+        if: always()
+        with:
+          report_paths: '**/build/test-results/**/TEST-*.xml'
+          annotate_only: true
+          detailed_summary: true
+          fail_on_failure: true
+
+      # The HTML reports carry the full stack traces and stdout/stderr the
+      # annotations truncate. Named per-OS because the three matrix legs upload
+      # into the same run and artifact names must be unique.
+      - name: Upload Desktop Test Reports
+        uses: actions/upload-artifact@v7
+        if: failure()
+        with:
+          name: Desktop Test Reports (${{ matrix.os }})
+          path: |
+            quartz/build/reports/tests
+            commons/build/reports/tests
+            nestsClient/build/reports/tests
+            cli/build/reports/tests
+            desktopApp/build/reports/tests
+
      # jpackage pins libicu to the build host's version (libicu74 on
      # ubuntu-24.04). Rewrite the .deb so testers on other Debian/Ubuntu
      # releases can install the uploaded artifact.
@@ -126,7 +159,7 @@ jobs:
        uses: actions/checkout@v7

      - name: Set up JDK 21
-        uses: actions/setup-java@v5.6.0
+        uses: actions/setup-java@v5.7.0
        with:
          distribution: 'temurin'
          java-version: 21
@@ -136,8 +169,20 @@ jobs:
        with:
          cache-read-only: ${{ github.ref != 'refs/heads/main' }}

+      # -DsyncN shrinks MirrorSyncThroughputTest's corpus from its 1,000,000-event
+      # default. At 1M the sink cannot keep up with the in-process source, and the
+      # MirrorWorker's deliberately unbounded intake channel buffers the backlog until
+      # the runner's heap is gone: throughput collapses (13,800 -> 86 ev/s) and an
+      # OutOfMemoryError lands on a coroutine thread, where the UncaughtExceptionHandler
+      # swallows it. JUnit never sees a failure, so the JVM wedges and the job burns to
+      # the timeout with no signal rather than failing. 100k keeps a real ev/s number
+      # while bounding the worst-case backlog to a tenth of what died.
+      #
+      # Only CI is shrunk: -DsyncN is unset everywhere else, so a local or manual run
+      # still measures the full 1M — the number written up in
+      # relayBench/plans/2026-07-04-sync-throughput-1m.md.
      - name: Test geode (gradle)
-        run: ./gradlew :geode:test
+        run: ./gradlew :geode:test -DsyncN=100000

      - name: Upload geode Test Reports
        uses: actions/upload-artifact@v7
@@ -161,7 +206,7 @@ jobs:
        uses: actions/checkout@v7

      - name: Set up JDK 21
-        uses: actions/setup-java@v5.6.0
+        uses: actions/setup-java@v5.7.0
        with:
          distribution: 'temurin'
          java-version: 21
@@ -220,7 +265,7 @@ jobs:
        uses: actions/checkout@v7

      - name: Set up JDK 21
-        uses: actions/setup-java@v5.6.0
+        uses: actions/setup-java@v5.7.0
        with:
          distribution: 'temurin'
          java-version: 21
@@ -3,11 +3,11 @@ name: Bump Homebrew Formula (geode relay)
 # Sibling of bump-homebrew-formula.yml (the amy CLI). Same mechanism, different
 # artifact:
 #   - bump-homebrew-formula.yml       -> Formula `amy`   (the headless CLI)
-#   - this workflow                   -> Formula `geode` (the standalone relay)
+#   - this workflow                   -> Formula `geode-relay` (the standalone relay)
 #
 # After a stable release, download the published `geode-<version>-jvm.tar.gz`
 # bundle, compute its sha256, and open a PR that syncs
-# `geode/packaging/homebrew/geode.rb`'s url + sha256 to that release. Keeping the
+# `geode/packaging/homebrew/geode-relay.rb`'s url + sha256 to that release. Keeping the
 # in-repo reference formula accurate makes the eventual homebrew-core submission a
 # copy-paste.
 #
@@ -101,7 +101,7 @@ jobs:
      - name: Update reference formula
        run: |
          set -euo pipefail
-          FORMULA=geode/packaging/homebrew/geode.rb
+          FORMULA=geode/packaging/homebrew/geode-relay.rb
          URL="${{ steps.asset.outputs.url }}"
          SHA="${{ steps.asset.outputs.sha256 }}"
          # Rewrite the two indented lines in the formula block. Anchoring on the
@@ -119,11 +119,11 @@ jobs:
          token: ${{ secrets.GITHUB_TOKEN }}
          base: main
          branch: chore/bump-geode-formula-${{ steps.rel.outputs.tag }}
-          add-paths: geode/packaging/homebrew/geode.rb
+          add-paths: geode/packaging/homebrew/geode-relay.rb
          commit-message: 'chore: sync geode Homebrew formula to ${{ steps.rel.outputs.tag }}'
          title: 'chore: sync geode Homebrew formula to ${{ steps.rel.outputs.tag }}'
          body: |
-            Auto-synced `geode/packaging/homebrew/geode.rb` to the
+            Auto-synced `geode/packaging/homebrew/geode-relay.rb` to the
            `${{ steps.rel.outputs.tag }}` release:

            - `url`    -> `${{ steps.asset.outputs.url }}`
@@ -158,7 +158,7 @@ jobs:
                ``,
                `Recovery options:`,
                `1. Re-run the workflow once the underlying issue is fixed`,
-                `2. Manually update \`geode/packaging/homebrew/geode.rb\` (url + sha256) from the release asset`,
+                `2. Manually update \`geode/packaging/homebrew/geode-relay.rb\` (url + sha256) from the release asset`,
                `3. Check the release actually published \`geode-${tag.replace(/^v/, '')}-jvm.tar.gz\``
              ].join('\n'),
              labels: ['release-ops', 'bug']
@@ -1,7 +1,7 @@
 name: Sync Homebrew Cask Reference

 # Sibling of bump-homebrew-formula.yml (amy) and bump-homebrew-geode-formula.yml
-# (geode). Same mechanism, third artifact:
+# (geode-relay). Same mechanism, third artifact:
 #   - this workflow -> Cask `amethyst-nostr` (the desktop GUI app / DMG)
 #
 # What it does: after a stable release, download the published macOS DMG, assert
@@ -2,7 +2,7 @@ name: Sync Winget Manifest Reference

 # Fourth sibling of the three Homebrew sync workflows, same shape:
 #   bump-homebrew-formula.yml       -> Formula `amy`
-#   bump-homebrew-geode-formula.yml -> Formula `geode`
+#   bump-homebrew-geode-formula.yml -> Formula `geode-relay`
 #   bump-homebrew.yml               -> Cask    `amethyst-nostr`
 #   this workflow                   -> Winget  `VitorPamplona.Amethyst`
 #
@@ -78,7 +78,7 @@ jobs:
        uses: actions/checkout@v7

      - name: Set up JDK 21
-        uses: actions/setup-java@v5.6.0
+        uses: actions/setup-java@v5.7.0
        with:
          distribution: 'temurin'
          java-version: 21
@@ -405,7 +405,7 @@ jobs:
        uses: actions/checkout@v7

      - name: Set up JDK 21
-        uses: actions/setup-java@v5.6.0
+        uses: actions/setup-java@v5.7.0
        with:
          distribution: 'temurin'
          java-version: 21
@@ -662,7 +662,7 @@ jobs:
        uses: actions/checkout@v7

      - name: Set up JDK 21
-        uses: actions/setup-java@v5.6.0
+        uses: actions/setup-java@v5.7.0
        with:
          distribution: 'temurin'
          java-version: 21
@@ -953,7 +953,7 @@ jobs:
        uses: actions/checkout@v7

      - name: Set up JDK 21
-        uses: actions/setup-java@v5.6.0
+        uses: actions/setup-java@v5.7.0
        with:
          distribution: 'temurin'
          java-version: 21
@@ -28,7 +28,7 @@ jobs:
        uses: actions/checkout@v7

      - name: Set up JDK 21
-        uses: actions/setup-java@v5.6.0
+        uses: actions/setup-java@v5.7.0
        with:
          distribution: 'temurin'
          java-version: 21
@@ -66,7 +66,7 @@ jobs:
        uses: actions/checkout@v7

      - name: Set up JDK 21
-        uses: actions/setup-java@v5.6.0
+        uses: actions/setup-java@v5.7.0
        with:
          distribution: 'temurin'
          java-version: 21
@@ -533,7 +533,7 @@ reads an optional per-release changelog from

 ## Bootstrap runbook (one-time)

-> **Status as of v1.13.1: neither Homebrew nor Winget has been bootstrapped.**
+> **Status as of v1.14.0:** Winget has been submitted — [microsoft/winget-pkgs#422752](https://github.com/microsoft/winget-pkgs/pull/422752), pending CLA + review. Neither Homebrew package (`amethyst-nostr` cask, `amy` formula) has been submitted yet.
 > `https://formulae.brew.sh/api/cask/amethyst-nostr.json` and
 > `microsoft/winget-pkgs/manifests/v/VitorPamplona/Amethyst` both 404, so
 > **Amethyst does not currently ship through either channel.** The bump
@@ -584,7 +584,7 @@ The token then lives only in that maintainer's shell:

 ```bash
 export HOMEBREW_GITHUB_API_TOKEN=ghp_...   # classic PAT, `repo` scope
-scripts/bump-homebrew-cask.sh v1.13.2
+scripts/bump-homebrew-cask.sh v1.14.0
 ```

 Create one at
@@ -600,7 +600,7 @@ Same split, and it needs **no token at all**. `scripts/bump-winget.sh` drives
 runs fine from macOS or Linux:

 ```bash
-scripts/bump-winget.sh v1.13.2
+scripts/bump-winget.sh v1.14.0
 ```

 CI (`bump-winget.yml`, `GITHUB_TOKEN` only) does the bookkeeping: downloads the
@@ -618,15 +618,33 @@ that is needed.

 ### Homebrew cask (one-time initial PR)

+> `brew bump-cask-pr` **cannot** do this step. It *updates* an existing cask —
+> against a name that isn't in the tap yet it fails outright:
+> `Error: Cask 'amethyst-nostr' is unavailable: No Cask with this name exists.`
+> The first submission is a **new-cask** PR, which is a different flow:
+
 ```bash
-brew bump-cask-pr amethyst-nostr \
-  --version 1.12.1 \
-  --url "https://github.com/vitorpamplona/amethyst/releases/download/v1.12.1/amethyst-desktop-1.12.1-macos-arm64.dmg"
+# 1. Scaffold from the published DMG (macOS arm64 — there is no Intel DMG)
+brew create --cask \
+  https://github.com/vitorpamplona/amethyst/releases/download/v1.14.0/amethyst-desktop-1.14.0-macos-arm64.dmg \
+  --set-name amethyst-nostr
+
+# 2. Fill in the cask body, then audit as a NEW cask (stricter than a bump)
+brew audit --new --cask amethyst-nostr
+brew install --cask amethyst-nostr        # verify it actually installs
+brew uninstall --cask amethyst-nostr
+
+# 3. Open the PR against Homebrew/homebrew-cask by hand
 ```

+The DMG **must be notarized and stapled** or Homebrew will reject it; verify
+with `spctl -a -t open --context context:primary-signature -v <dmg>` before
+submitting.
+
 The cask filename is `amethyst-nostr` (not `amethyst` — that's taken by a
 tiling window manager). After the first PR is merged, `bump-homebrew.yml`
-auto-submits new version bumps on each stable release.
+auto-submits new version bumps on each stable release — *that* is where
+`brew bump-cask-pr` applies.

 > **The desktop app is already on mainline Homebrew.** `homebrew/cask` *is* the
 > mainline cask repo — GUI apps live in homebrew-**cask**, CLIs in
@@ -186,6 +186,13 @@ device. PRs that introduce any of them will be sent back.
  body only runs when the log level is enabled. Plain
  `Log.d("msg $x")` allocates the formatted string on every call,
  including in feed and scroll hot paths.
+- **Never `import android.util.Log`.** The platform logger bypasses
+  `Log.minLevel` and the `LogSink`, and it has no lambda overload, so
+  the rule above cannot be applied at those call sites. The one
+  legitimate user is `PlatformLog.android.kt`, which implements the
+  wrapper. A call that must pass a throwable uses the eager three-arg
+  form `Log.w(tag, "msg", e)` — the lambda overload takes no throwable,
+  and dropping it to keep the lambda loses the stack trace.
 - **Strip diagnostic `Log.d` calls before commit.** Logs added
  during on-device debugging — even lambda-form ones — must be
  removed from the production diff. They survive R8 stripping only
@@ -328,16 +328,16 @@ repositories {
 Add the following line to your `commonMain` dependencies:

 ```gradle
-implementation('com.vitorpamplona.quartz:quartz:1.13.1')
+implementation('com.vitorpamplona.quartz:quartz:1.14.0')
 ```

 Variations to each platform are also available:

 ```gradle
-implementation('com.vitorpamplona.quartz:quartz-android:1.13.1')
-implementation('com.vitorpamplona.quartz:quartz-jvm:1.13.1')
-implementation('com.vitorpamplona.quartz:quartz-iosarm64:1.13.1')
-implementation('com.vitorpamplona.quartz:quartz-iossimulatorarm64:1.13.1')
+implementation('com.vitorpamplona.quartz:quartz-android:1.14.0')
+implementation('com.vitorpamplona.quartz:quartz-jvm:1.14.0')
+implementation('com.vitorpamplona.quartz:quartz-iosarm64:1.14.0')
+implementation('com.vitorpamplona.quartz:quartz-iossimulatorarm64:1.14.0')
 ```

 Check versions on [MavenCentral](https://central.sonatype.com/search?q=com.vitorpamplona.quartz)
@@ -101,15 +101,20 @@ git -c credential.helper= -c credential.helper='!gh auth git-credential' push up
 ```

 When the `Create Release Assets` workflow finishes (~25–30 min) the GH Release
-holds **31 assets**, per the asset-name contract:
+holds **47 assets**, per the asset-name contract:

 - **Android (13):** 5 Google Play APKs + 5 F-Droid APKs + 2 AABs + the F-Droid
  `.apks` set for Accrescent
  (`amethyst-googleplay-*-v…apk` / `.aab`, `amethyst-fdroid-*-v…apk` / `.aab` / `.apks`)
- **Desktop (8):** DMG (macOS **arm64 only** — there is no Intel DMG),
-  MSI + zip, DEB, RPM, AppImage, flatpak, tar.gz
- **CLI (5):** the `amy` artifacts
- **Relay (5):** the `geode` artifacts, plus the geode Docker image
+- **Desktop (14):** macOS DMG (**arm64 only** — there is no Intel DMG), Windows
+  MSI (x64 only — **no arm64 MSI**) + portable zip (x64, arm64), and Linux
+  DEB/RPM/AppImage/flatpak/tar.gz in both x64 and arm64. BUILDING.md § Release
+  runbook has the per-leg breakdown and why the two gaps exist.
+- **CLI (10):** the `amy` artifacts — the no-JRE `jvm.tar.gz`, macOS arm64,
+  Windows x64 + arm64, and Linux DEB/RPM/tar.gz in both x64 and arm64
+- **Relay (10):** the `geode` artifacts, same matrix as `amy`. The geode Docker
+  image is **not** a release asset — it goes to the registry, so don't count it
+  here.
 - **Maven Central:** `com.vitorpamplona.quartz:quartz:<version>` published.
  `repo1.maven.org` lags the publish by tens of minutes — a 404 right after the
  run is normal. Confirm the step's log says "Deployment is being published to
@@ -121,8 +126,9 @@ holds **31 assets**, per the asset-name contract:
 ## 3. Per-channel shipping

 ### GitHub Releases — automatic
-Nothing to do beyond pushing the tag. Verify the asset count and that Intel +
-ARM DMGs are both present (BUILDING.md § Verify).
+Nothing to do beyond pushing the tag. Verify the asset count (BUILDING.md
+§ Verify). macOS is **arm64-only** — there is no Intel DMG, so a single
+`amethyst-desktop-<version>-macos-arm64.dmg` is the expected, correct result.

 ### Google Play — manual upload
 1. Download `amethyst-googleplay-<version>.aab` from the GH Release.
@@ -177,7 +183,7 @@ when unset. To fan the release event out to more relays for discoverability,
 set `RELAY_URLS` for the run:

 ```bash
-RELAY_URLS="wss://relay.zapstore.dev,wss://relay.damus.io,wss://nos.lol,wss://vitor.nostr1.com" \
+RELAY_URLS="wss://relay.zapstore.dev,wss://nos.lol,wss://nostr.mom,wss://vitor.nostr1.com" \
  SIGN_WITH=<amethyst-nsec> zsp publish
 ```

@@ -188,10 +194,22 @@ itself reads from.

 `bump-homebrew.yml` and `bump-winget.yml` are wired to open PRs against
 `Homebrew/homebrew-cask` (cask `amethyst-nostr`) and `microsoft/winget-pkgs`
-(`VitorPamplona.Amethyst`) — but **neither package has ever been submitted
-upstream**, so both workflows detect that and skip with a `::warning::`. As of
-**v1.13.1** these two channels deliver nothing; macOS and Windows users get the
-desktop app from GitHub Releases only.
+(`VitorPamplona.Amethyst`). Both can only *update* a package that already
+exists upstream, so until the one-time bootstrap lands they detect the absence
+and skip with a `::warning::`.
+
+Bootstrap status:
+
+| Channel | Upstream package | State |
+|---|---|---|
+| **Winget** | `microsoft/winget-pkgs` → `VitorPamplona.Amethyst` | **Submitted at v1.14.0** — [PR #422752](https://github.com/microsoft/winget-pkgs/pull/422752), pending CLA + review |
+| **Homebrew cask** | `Homebrew/homebrew-cask` → `amethyst-nostr` | Not submitted |
+| **Homebrew formula** | `Homebrew/homebrew-core` → `amy` | Not submitted |
+
+Until each lands, that channel delivers nothing and macOS/Windows users get the
+desktop app from GitHub Releases only. Re-check before assuming — the state
+above is a snapshot, and `gh api repos/microsoft/winget-pkgs/contents/manifests/v/VitorPamplona`
+(404 = still absent) answers it in one call.

 Two separate faults kept this invisible until v1.13.1, both now fixed:

@@ -219,9 +237,9 @@ readable by anyone with push access here), so a maintainer runs the last step:
 ```bash
 # after merging the sync PRs
 export HOMEBREW_GITHUB_API_TOKEN=ghp_...     # classic PAT, `repo` scope
-scripts/bump-homebrew-cask.sh v1.13.2
+scripts/bump-homebrew-cask.sh v1.14.0

-scripts/bump-winget.sh v1.13.2               # no token — uses your `gh` auth
+scripts/bump-winget.sh v1.14.0               # no token — uses your `gh` auth
 ```

 Both scripts re-verify the published artifact's sha256 before submitting, and
@@ -283,7 +301,7 @@ Owner assignments and rotation reminders live with the team (issue tracker).

 ## 6. Post-release verification

- [ ] GH Release: 31 assets, sizes sane, and the asset-name set matches the
+- [ ] GH Release: 47 assets, sizes sane, and the asset-name set matches the
      previous release (see the `diff` one-liner in BUILDING.md § Release
      runbook). macOS is arm64-only — do **not** look for an Intel DMG.
 - [ ] Maven Central: `quartz:<version>` resolves (allow tens of minutes of
@@ -9,6 +9,7 @@ plugins {
    alias(libs.plugins.jetbrainsComposeCompiler)
    alias(libs.plugins.serialization)
    alias(libs.plugins.googleKsp)
+    alias(libs.plugins.androidxBaselineProfile)
 }

 fun getCurrentBranch(workingDir: java.io.File): String =
@@ -84,7 +85,7 @@ android {
                .get()
                .toInt()
        versionName = generateVersionName(libs.versions.app.get(), rootDir)
-        buildConfigField("String", "RELEASE_NOTES_ID", "\"f54843af6397f78e39fa75dbe3b7f7de14eb18c4f9c56e60e7825a2c6715719b\"")
+        buildConfigField("String", "RELEASE_NOTES_ID", "\"00d306e01792e48b93638b73b57a7eb8b89622a338b1b4f529622150d46cd710\"")

        testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
        vectorDrawables {
@@ -330,7 +331,7 @@ ksp {

 // TODO: until google merges and unifiedpush updates https://github.com/tink-crypto/tink-java-apps/pull/5
 configurations.all {
-    val tink = "com.google.crypto.tink:tink-android:1.17.0"
+    val tink = "com.google.crypto.tink:tink-android:1.23.0"
    resolutionStrategy {
        force(tink)
        dependencySubstitution {
@@ -374,6 +375,17 @@ composeCompiler {
    metricsDestination = layout.buildDirectory.dir("compose_compiler")
 }

+baselineProfile {
+    // One profile for the whole app rather than per-flavour: the ingest path being
+    // captured is identical in play and fdroid, and a shared profile is what the
+    // fdroid build needs — it never receives Play Cloud Profiles.
+    mergeIntoMain = true
+
+    // Keep the generated profile in source control so release builds do not depend on
+    // a device being attached at build time.
+    saveInSrc = true
+}
+
 dependencies {
    implementation(platform(libs.androidx.compose.bom))

@@ -384,8 +396,8 @@ dependencies {
    //   adb shell am broadcast -a androidx.tracing.perfetto.action.ENABLE_TRACING \
    //     -n com.vitorpamplona.amethyst.debug/androidx.tracing.perfetto.TracingReceiver
    debugImplementation("androidx.compose.runtime:runtime-tracing")
-    debugImplementation("androidx.tracing:tracing-perfetto:1.0.0")
-    debugImplementation("androidx.tracing:tracing-perfetto-binary:1.0.0")
+    debugImplementation("androidx.tracing:tracing-perfetto:1.0.1")
+    debugImplementation("androidx.tracing:tracing-perfetto-binary:1.0.1")

    implementation(project(":quartz"))
    implementation(project(":commons"))
@@ -402,6 +414,9 @@ dependencies {
    // and no Cloud Profiles at all — there, this library is the only thing that gets
    // the shipped baseline profile into ART.
    implementation(libs.androidx.profileinstaller)
+
+    // Profile produced by :baselineprofile from a real cold-start + ingest journey.
+    baselineProfile(project(":baselineprofile"))
    implementation(libs.androidx.activity.compose)

    // Hardened WebView host for sandboxed napplet/nsite rendering (origin-restricted message bridge).
@@ -51,6 +51,12 @@ Shipped as designed. Where it diverged or went further:
  connection forever. A second challenge for the same (relay, account) rides along
  on the owner's answer with no deadline of its own — running one would let it
  resolve the shared deferred and tear down a dialog mid-read.
+- **Corrected later:** this plan left the decision model alone, including the
+  blanket `isFirstParty` gate on `CUSTOM`. That gate turned out to make
+  `readFollows` ("…I'm reading someone I follow") unreachable — a follow's outbox
+  relay is theirs, so it is never first-party for us, and every follow produced a
+  prompt with the toggle explicitly on. `RelayAuthResolver.customAllows` now
+  checks that one category ahead of the gate; the other three still require it.
 - **Still not done:** what a timeout should *look like*. It is now an honest 60s of
  visible time rather than a clock the user never saw, but it is still a dialog
  that vanishes and an event left pending in the outbox with no feedback. That
@@ -0,0 +1,379 @@
+# Upstream issue draft — Compose `WindowInsets.ime` permanently wedges after a cancelled IME animation
+
+Target: Google IssueTracker → **component 612128 (Jetpack Compose)**.
+The library-specific component the docs link to (856989, from the "Create a new issue" button on
+the Compose Foundation release notes) does not grant public Create Issues permission, so this is
+filed one level up with a routing request at the top of the body.
+
+Status: **FILED as https://issuetracker.google.com/issues/552500419 (b/552500419)** on 2026-08-25,
+against component 612128 with a routing request. Remaining open item: the AOSP commit that introduced `runningAnimation`
+between 1.3.0 and 1.4.0-alpha01 has not been identified (android.googlesource.com returned 403
+to automated fetch). Adding the commit link before filing would help triage.
+
+---
+
+## Title
+
+`WindowInsets.ime` stops updating permanently when an IME animation is cancelled without `onEnd` (regression in 1.4.0, still present in 1.13.0-alpha01)
+
+## Routing
+
+Please reassign to the owner of **`androidx.compose.foundation` / `foundation-layout`**
+(WindowInsets). Filing here because component 856989 — the target of the "Create a new issue"
+button on the [Compose Foundation release notes](https://developer.android.com/jetpack/androidx/releases/compose-foundation)
+— does not grant Create Issues permission to external accounts. That documented path being
+unusable by the public is arguably a separate docs bug worth fixing.
+
+## Affected versions
+
+* **Broken:** `androidx.compose.foundation:foundation-layout` **1.4.0 → 1.12.0 (current stable) and 1.13.0-alpha01**
+* **Not broken:** 1.3.0 and earlier
+* Verified by inspecting published `-sources.jar` for 1.2.0, 1.3.0, 1.4.0-alpha01…rc01, 1.4.0,
+  1.5.0, 1.6.0, 1.7.0, 1.8.0, 1.9.0, 1.10.0, 1.11.0, 1.12.0, 1.13.0-alpha01.
+  `runningAnimation` and its guard are absent in 1.3.0 and present from 1.4.0-alpha01 onward,
+  textually unchanged since.
+* Reproduced on a Pixel 8, Android 17 (API 37). The API-30-only self-heal (below) means API 31+
+  has no recovery path at all.
+
+## Summary
+
+If a `WindowInsetsAnimation` is prepared and started but never ended — what a cancelled IME
+animation looks like — `InsetsListener.runningAnimation` stays `true` forever. From that point
+`onApplyWindowInsets` matches neither of its two branches, so `composeInsets.update()` is never
+called again and **`WindowInsets.ime` is frozen for the remaining life of the window**.
+
+Every `Modifier.imePadding()` in the app then holds a keyboard-height gap open with no keyboard
+on screen, permanently. `WindowInsets.imeAnimationTarget` keeps reporting correctly, because
+`updateImeAnimationTarget()` is called outside the guard — that asymmetry is the only reason a
+workaround is possible at all.
+
+## Reproduction
+
+Deterministic instrumented test, ~3s, no gestures and no timing dependence. It drives Compose's
+own listener through the cancelled-animation sequence using **public** interfaces
+(`WindowInsetsAnimationCompat.Callback`, `OnApplyWindowInsetsListener`); reflection is used only
+to obtain the listener instance for the view. Inside the androidx codebase `InsetsListener` is
+directly accessible, so `listenerFor()` can be deleted and the rest of the test used verbatim.
+
+```
+FAIL  aCancelledImeAnimationMustNotWedgeTheAnimatedInset
+      expected:<0> but was:<957>
+PASS  theAnimationTargetSurvivesTheWedge
+```
+
+The second test is expected to pass and is included on purpose: it pins the asymmetry between the
+two readings, and would catch a "fix" that broke `imeAnimationTarget` instead.
+
+The full test source is attached below.
+
+## Root cause
+
+`compose/foundation/foundation-layout/src/androidMain/kotlin/androidx/compose/foundation/layout/WindowInsets.android.kt`
+
+```kotlin
+override fun onPrepare(animation: WindowInsetsAnimationCompat) {
+    prepared = true
+    runningAnimation = true          // set here…
+}
+
+override fun onStart(animation, bounds): BoundsCompat {
+    prepared = false                 // …prepared cleared, runningAnimation left set
+    return super.onStart(animation, bounds)
+}
+
+override fun onEnd(animation: WindowInsetsAnimationCompat) {
+    prepared = false
+    runningAnimation = false         // …cleared ONLY here
+    …
+}
+
+override fun onApplyWindowInsets(view: View, insets: WindowInsetsCompat): WindowInsetsCompat {
+    savedInsets = insets
+    composeInsets.updateImeAnimationTarget(insets)   // unconditional — stays correct
+    if (prepared) {
+        if (Build.VERSION.SDK_INT == Build.VERSION_CODES.R) {
+            view.post(this)                          // self-heal, API 30 ONLY
+        }
+    } else if (!runningAnimation) {
+        composeInsets.updateImeAnimationSource(insets)
+        composeInsets.update(insets)                 // the animated inset — never reached when wedged
+    }
+    …
+}
+```
+
+After a cancelled animation: `prepared == false` (cleared by `onStart`) and
+`runningAnimation == true` (never cleared, because `onEnd` never came). Neither branch runs.
+`composeInsets.update()` is dead.
+
+### Why the existing self-heal does not help
+
+`run()` exists precisely to handle a cancelled animation, but:
+
+1. it is gated to `Build.VERSION.SDK_INT == Build.VERSION_CODES.R` (API 30 only), and
+2. it is posted only from the `if (prepared)` branch, and returns early unless `prepared` is still
+   `true` — which `onStart` has already cleared.
+
+So it covers "cancelled between `onPrepare` and `onStart`, on API 30". It does not cover
+"cancelled after `onStart`", on any API level.
+
+### Why applications cannot recover
+
+The only reset is `insetsListener.resetState()`, called from `WindowInsetsHolder.incrementAccessors()`
+when `accessCount` transitions `0 → 1`. `accessCount` is driven by `WindowInsetsHolder.current()`'s
+`DisposableEffect`, so it only reaches 0 when *every* insets consumer leaves composition
+simultaneously.
+
+In a single-Activity app whose shell (scaffold / bottom bar / drawer) always reads insets, that
+never happens — the holder is created once and lives for the whole process. There is no public API
+to force the reset. `WindowInsetsHolder` is `internal`.
+
+Multi-Activity apps mask this: a new Activity means a new `View`, a new holder, and fresh state, so
+the wedge dies with the Activity and reads as a transient glitch.
+
+### Regression point
+
+1.3.0's `onApplyWindowInsets` had no such gate and could not wedge:
+
+```kotlin
+override fun onApplyWindowInsets(view: View, insets: WindowInsetsCompat): WindowInsetsCompat {
+    if (prepared) {
+        savedInsets = insets
+        if (Build.VERSION.SDK_INT == Build.VERSION_CODES.R) view.post(this)
+        return insets
+    }
+    composeInsets.update(insets)      // unconditional once onStart cleared `prepared`
+    return …
+}
+```
+
+1.4.0 introduced `runningAnimation` and the `else if (!runningAnimation)` guard. Its own comment
+states the intent:
+
+> `// If an animation is running, rely on onProgress() to update the insets`
+> `// On APIs less than 30 where the IME animation is backported, this avoids reporting`
+> `// the final insets for a frame while the animation is running.`
+
+i.e. a **one-frame** cosmetic flash on **API < 30** was fixed by making the update path conditional
+on a flag that only `onEnd` clears — trading a single wrong frame on old devices for permanent
+state corruption on all of them. The compensating recovery was never widened past `SDK_INT == R`.
+
+## Real-world impact
+
+Observed in a production Compose app (Amethyst, a Nostr client; single-Activity, `NavHost`,
+77 `imePadding()` sites):
+
+* On a Pixel 8 / Android 17, after ordinary manual use, `WindowInsets.ime` pinned at 957px while
+  the window reported `ime frame=[0,0][0,0]` — keyboard gone — and stayed pinned for 85+ seconds
+  until the process was restarted. Nothing in the app cleared it.
+* Instrumented `WindowInsets.ime` vs `WindowInsets.imeAnimationTarget` across the failure:
+
+  ```
+  17:12:58.803  animated=882  target=957   ← healthy open, 13 intermediate frames
+  17:12:58.902  animated=957  target=957
+  17:13:00.584  animated=957  target=0     ← dismissed; animated frozen
+  17:13:02.430  animated=0    target=957   ← reopened; snaps, no intermediate frames
+  17:13:03.479  animated=957  target=0     ← dismissed; frozen permanently
+  ```
+
+  Note the loss of per-frame updates after the wedge: healthy transitions carry ~13 intermediate
+  values over ~264ms; post-wedge transitions carry none.
+* Because the app never navigates away from its single Activity and its shell always reads insets,
+  `accessCount` never returns to 0, so the wedge is permanent for the session. Sessions in this app
+  routinely run for days.
+
+The trigger for the underlying cancellation was not isolated — it is infrequent and required
+extended manual use to hit. The defect being reported is not the cancellation itself but that
+Compose enters a state it can never leave when one occurs. The attached test reproduces that state
+directly and deterministically.
+
+## Suggested fixes
+
+Roughly in order of how targeted they are:
+
+1. **Generalise the existing self-heal.** Post the `run()` reconciliation on all API levels, and
+   arm it after `onStart` as well as after `onPrepare`, so that an `onApplyWindowInsets` that
+   arrives with no intervening `onProgress` clears `runningAnimation` and applies `savedInsets`.
+   This preserves the API<30 one-frame behaviour the guard was added for, while bounding the
+   failure to a frame rather than forever.
+2. **Reconcile on dispatch.** In `onApplyWindowInsets`, if `runningAnimation` is set but no
+   `onProgress` has been received since `onStart`, treat the animation as finished and update.
+3. **Expose a reset.** A public way to reach `WindowInsetsHolder.resetState()` (or a documented
+   condition under which it runs) would at least let applications self-heal. Today they cannot,
+   short of reflection into an `internal` class — which R8 can rename or strip in exactly the
+   release builds where this occurs.
+
+(1) or (2) is preferable: (3) only makes the bug survivable rather than fixing it.
+
+## Environment
+
+* `androidx.compose.foundation:foundation-layout` 1.12.0 (Compose BOM 2026.08.00)
+* Pixel 8 (`shiba`), Android 17 / API 37, gesture navigation, Gboard, 120Hz
+* Also inspected: 1.13.0-alpha01 — identical listener code
+
+---
+
+## Attachment — the failing test
+
+```kotlin
+package com.vitorpamplona.amethyst.ui.insets
+
+import android.view.View
+import android.view.animation.LinearInterpolator
+import androidx.compose.foundation.layout.ExperimentalLayoutApi
+import androidx.compose.foundation.layout.WindowInsets
+import androidx.compose.foundation.layout.ime
+import androidx.compose.foundation.layout.imeAnimationTarget
+import androidx.compose.runtime.getValue
+import androidx.compose.runtime.mutableIntStateOf
+import androidx.compose.runtime.setValue
+import androidx.compose.ui.platform.LocalDensity
+import androidx.compose.ui.platform.LocalView
+import androidx.compose.ui.test.junit4.createComposeRule
+import androidx.core.graphics.Insets
+import androidx.core.view.OnApplyWindowInsetsListener
+import androidx.core.view.WindowInsetsAnimationCompat
+import androidx.core.view.WindowInsetsCompat
+import org.junit.Assert.assertEquals
+import org.junit.Rule
+import org.junit.Test
+
+/**
+ * Upstream regression test for androidx.compose.foundation:foundation-layout.
+ *
+ * A `WindowInsetsAnimation` that is prepared and started but never ended — which is what a
+ * cancelled IME animation looks like — leaves `InsetsListener.runningAnimation` set forever.
+ * `onApplyWindowInsets` then matches neither of its two branches, so `composeInsets.update()`
+ * is never called again and `WindowInsets.ime` is dead for the life of the window.
+ *
+ * Introduced in 1.4.0 (absent in 1.3.0, where `onApplyWindowInsets` updated unconditionally
+ * once `onStart` had cleared `prepared`). Still present in 1.12.0 and 1.13.0-alpha01. The
+ * compensating self-heal (`view.post(this)` -> `run()`) is scoped to `SDK_INT == R`, so on
+ * API 31+ nothing clears the flag; `WindowInsetsHolder.resetState()` only runs when the
+ * holder's accessCount transitions 0 -> 1, which never happens in an app whose shell always
+ * reads insets.
+ *
+ * [aCancelledImeAnimationMustNotWedgeTheAnimatedInset] FAILS on every version from 1.4.0 on.
+ * [theAnimationTargetSurvivesTheWedge] documents the asymmetry that makes a workaround possible
+ * and is expected to PASS — `updateImeAnimationTarget` is called outside the guard.
+ */
+class ComposeImeInsetWedgeTest {
+    @get:Rule val rule = createComposeRule()
+
+    private val keyboardHeight = 957
+
+    private fun imeInsets(bottom: Int): WindowInsetsCompat =
+        WindowInsetsCompat
+            .Builder()
+            .setInsets(WindowInsetsCompat.Type.ime(), Insets.of(0, 0, 0, bottom))
+            .setVisible(WindowInsetsCompat.Type.ime(), bottom > 0)
+            .build()
+
+    /** Compose's own listener for this view. Private class, but both interfaces it exposes are public. */
+    private fun listenerFor(view: View): Any {
+        val holderClass = Class.forName("androidx.compose.foundation.layout.WindowInsetsHolder")
+        val companion =
+            holderClass.getDeclaredField("Companion").run {
+                isAccessible = true
+                get(null)
+            }
+        val holder =
+            companion.javaClass
+                .getDeclaredMethod("getOrCreateFor", View::class.java)
+                .run {
+                    isAccessible = true
+                    invoke(companion, view)
+                }
+        return holderClass.getDeclaredField("insetsListener").run {
+            isAccessible = true
+            get(holder)!!
+        }
+    }
+
+    private fun anim() = WindowInsetsAnimationCompat(WindowInsetsCompat.Type.ime(), LinearInterpolator(), 250L)
+
+    private fun bounds() =
+        WindowInsetsAnimationCompat.BoundsCompat(
+            Insets.NONE,
+            Insets.of(0, 0, 0, keyboardHeight),
+        )
+
+    @OptIn(ExperimentalLayoutApi::class)
+    @Test
+    fun aCancelledImeAnimationMustNotWedgeTheAnimatedInset() {
+        var animated by mutableIntStateOf(-1)
+        lateinit var view: View
+
+        rule.setContent {
+            view = LocalView.current
+            val density = LocalDensity.current
+            animated = WindowInsets.ime.getBottom(density)
+        }
+        rule.waitForIdle()
+
+        val listener = listenerFor(view)
+        val onApply = listener as OnApplyWindowInsetsListener
+        val callback = listener as WindowInsetsAnimationCompat.Callback
+
+        // Baseline: with no animation in flight the inset tracks normally.
+        rule.runOnUiThread { onApply.onApplyWindowInsets(view, imeInsets(keyboardHeight)) }
+        rule.waitForIdle()
+        assertEquals("baseline: the inset must follow a plain dispatch", keyboardHeight, animated)
+
+        // A cancelled animation: prepared and started, but onEnd never arrives.
+        rule.runOnUiThread {
+            callback.onPrepare(anim())
+            callback.onStart(anim(), bounds())
+        }
+        rule.waitForIdle()
+
+        // The keyboard is gone and the window says so. The animated inset must follow.
+        rule.runOnUiThread { onApply.onApplyWindowInsets(view, imeInsets(0)) }
+        rule.waitForIdle()
+
+        assertEquals(
+            "WindowInsets.ime must still track the window after an animation was cancelled " +
+                "without onEnd; it is instead frozen at the keyboard height forever",
+            0,
+            animated,
+        )
+    }
+
+    @OptIn(ExperimentalLayoutApi::class)
+    @Test
+    fun theAnimationTargetSurvivesTheWedge() {
+        var target by mutableIntStateOf(-1)
+        lateinit var view: View
+
+        rule.setContent {
+            view = LocalView.current
+            val density = LocalDensity.current
+            target = WindowInsets.imeAnimationTarget.getBottom(density)
+        }
+        rule.waitForIdle()
+
+        val listener = listenerFor(view)
+        val onApply = listener as OnApplyWindowInsetsListener
+        val callback = listener as WindowInsetsAnimationCompat.Callback
+
+        rule.runOnUiThread { onApply.onApplyWindowInsets(view, imeInsets(keyboardHeight)) }
+        rule.waitForIdle()
+        assertEquals(keyboardHeight, target)
+
+        rule.runOnUiThread {
+            callback.onPrepare(anim())
+            callback.onStart(anim(), bounds())
+        }
+        rule.waitForIdle()
+
+        rule.runOnUiThread { onApply.onApplyWindowInsets(view, imeInsets(0)) }
+        rule.waitForIdle()
+
+        assertEquals(
+            "updateImeAnimationTarget is called outside the guard, so this reading stays truthful",
+            0,
+            target,
+        )
+    }
+}
+```
@@ -0,0 +1,182 @@
+# Defaults stand in for the user's relay lists only while we have no event
+
+**Status:** proposal — not implemented
+**Goal:** first-login startup on a Tor-enabled install
+**Related:** `fix/tor-bootstrap-stall-and-ondemand`, `[[fresh-install-routes-everything-via-tor]]`
+
+## The rule
+
+Three states, currently collapsed into two:
+
+| we have | effective list | today |
+|---|---|---|
+| **no event** for the user | app defaults | defaults ✅ |
+| event, **empty** list | **empty** — the user chose nothing | defaults ❌ |
+| event with relays | those relays | those relays ✅ |
+
+Everything below follows from separating "we don't know" from "we know, and it's nothing".
+
+## Why the first login is slow
+
+On a fresh install **100% of relay traffic is Tor-routed by construction**.
+`TorRelayState.trustedRelays` is empty, so `TorRelayEvaluation.useTor()` falls through to
+`newRelaysViaTor` (**default true**) for every URL — and the kind-10002 that would populate it can
+only be fetched over Tor. Measured (SM-T220, same account, same ~app+8-10s login, fresh install
+each; the Tor-OFF arm sets the pref, force-stops, then starts the timed run so Arti never boots):
+
+| @20s census | Tor ON | Tor OFF |
+|---|---|---|
+| feed on screen | login+18s | **login+11s** |
+| relays opened | 18/40 | **32/41** |
+| relays serving events | 9 | **22** |
+| events ingested | 2,830 | **6,134 / 7,641** |
+
+≈7s of first paint and half the relay coverage.
+
+## Finding 1 — every `WithBackup` helper keys on emptiness, not absence
+
+This is a pre-existing bug against the rule above, and it must be fixed first because the whole
+feature depends on the distinction being real.
+
+```kotlin
+// AdvertisedRelayListEvent
+fun relays()         = tags.mapNotNull(AdvertisedRelayInfo::parse)                    // [] when none
+fun readRelaysNorm() = tags.mapNotNull(AdvertisedRelayInfo::parseReadNorm).ifEmpty { null }   // null!
+fun writeRelaysNorm()= tags.mapNotNull(AdvertisedRelayInfo::parseWriteNorm).ifEmpty { null }  // null!
+```
+
+| helper | fallback fires when | correct |
+|---|---|---|
+| `normalizeNIP65AllRelayListWithBackup` | event absent only | ✅ (by accident — `relays()` has no `ifEmpty`) |
+| `normalizeNIP65Read/WriteRelayListWithBackup` | event absent **or list empty** | ❌ |
+| `normalizeIndexerRelayListWithBackup` | `?.ifEmpty { null } ?: DefaultIndexerRelayList` | ❌ |
+| `normalizeSearchRelayListWithBackup` | `?.ifEmpty { null } ?: DefaultSearchRelayList` | ❌ |
+
+Consequence today: **a user who publishes a kind-10002 with only write relays gets
+`Constants.bootstrapInbox` silently substituted as their inbox list.** Same for a deliberately empty
+search or indexer list. The app overrides an explicit choice.
+
+The mirror problem sinks the obvious implementation: the `NoDefaults` variants return `emptySet()`
+for *both* "no event" and "empty event", so `trustedRelays.isEmpty()` cannot be used as the
+"do we have data yet" signal.
+
+**Fix:** make presence explicit, and never infer it from emptiness.
+
+```kotlin
+// absent -> defaults; present -> whatever it says, including nothing
+fun readRelayList(note: Note): Set<NormalizedRelayUrl> =
+    nip65Event(note)?.let { it.readRelaysNorm()?.toSet() ?: emptySet() } ?: Constants.bootstrapInbox
+```
+
+Same shape for write/all, and drop the `?.ifEmpty { null }` from the indexer and search helpers.
+Worth doing on its own merits even if the rest of this plan is dropped.
+
+**This removes the need for any window or timeout.** The fallback becomes a pure function of "do we
+have the event", so it ends the instant one arrives — even an empty one. No per-account bookkeeping,
+no 30s backstop, no race to close.
+
+## Finding 2 — do NOT put defaults into `TrustedRelayListsState`
+
+Tempting (it already merges all nine lists) but wrong: `account.trustedRelays.flow` feeds
+`Account.kt:454`
+
+```kotlin
+isInMyRelayList = { relayUrl -> ... it in trustedRelays.flow.value }
+```
+
+which feeds `RelayAuthPermissionLedger` -> `RelayAuthResolver` -> **the NIP-42 AUTH decision**.
+Adding defaults there would make the app **auto-AUTH to the six hardcoded bootstrap relays as if
+they were the user's own** — signing a challenge with the user's key and revealing the pubkey — at
+exactly the moment we are also going clearnet. That converts a modest timing leak into a signed
+identity assertion. See `[[relay-auth-always-was-gated]]` and `[[inbox-wine-notify-auth-billing]]`
+for why AUTH is the sensitive edge.
+
+(The `saveTrustedRelayList(trustedRelays + relay)` write path in `RelayGroupChannelListScreen:449`
+is **not** a hazard — it reads `account.trustedRelayList` (the NIP-51 list), not the merged
+`trustedRelays`. Checked.)
+
+**Instead:** add a separate, purpose-named flow consumed only by Tor evaluation, e.g.
+`Account.relaysAssumedWhileUnknown` — the union of the with-defaults views, non-empty only while the
+corresponding events are absent. `AccountsTorStateConnector` feeds it into a new
+`TorRelayState.assumedRelays`. Nothing else reads it.
+
+## Where the check goes in `useTor()`
+
+```
+torType == OFF        -> false
+isLocalHost           -> false
+isOverlayNetwork      -> false
+isOnion               -> onionRelaysViaTor
+in moneyOpRelayList   -> moneyOperationsViaTor
+in dmRelayList        -> dmRelaysViaTor
+in trustedRelayList   -> trustedRelaysViaTor
+in assumedRelayList   -> trustedRelaysViaTor      <-- new, immediately above the fallback
+else                  -> newRelaysViaTor
+```
+
+Landing immediately above the fallback means **.onion, money-operation and DM relays keep their own
+policy for free** — the change can only ever affect URLs that would have been treated as "new".
+
+Resolve to `trustedRelaysViaTor`, **not** a hardcoded `false`:
+
+- default user (`false`) -> clearnet -> fast start;
+- hardened user (`true`) -> stays on Tor, automatically, with no new setting to discover.
+
+That is the difference between "the app overrides you" and "the app treats its stand-in list the way
+you asked your own list to be treated".
+
+## Privacy, for the PR body
+
+The window correlates the user's **IP with their pubkey** at ~6 hardcoded relays, because the REQ
+asks those relays for that pubkey's events. A first login is the most sensitive moment there is.
+
+What makes it defensible: **`trustedRelaysViaTor` already defaults to false**, so the moment
+kind-10002 lands the user's own relays are dialled over clearnet anyway. This moves an existing
+disclosure slightly earlier, to a different well-known set. It is not a new class of exposure for
+the default configuration — and it is *not* an AUTH disclosure, provided Finding 2 is respected.
+
+If `trustedRelaysViaTor` ever becomes default-true, **this feature must be revisited in the same
+commit** — its justification disappears. Leave a comment at the default linking the two.
+
+Residual, worth verifying rather than assuming: `useTor()` is keyed by relay **URL**, and the pool
+multiplexes every subscription for a URL over one socket. During the window, anything addressed to a
+default relay rides that clearnet socket — including a kind-1059 giftwrap subscription, since the DM
+list is also absent. Measure it (below) before deciding it is acceptable.
+
+## Testing
+
+Unit — the rule itself, per list type: absent event -> defaults; present-but-empty -> **empty**;
+present-with-values -> values. The middle case is the regression guard and the one that fails today.
+
+Unit (`TorRelayEvaluationTest`): an assumed relay resolves to `trustedRelaysViaTor` (both values);
+.onion / money-op / DM keep their own policy while also listed as assumed; a non-assumed "new" relay
+still resolves to `newRelaysViaTor`; an empty assumed set is byte-for-byte today's behaviour.
+
+Unit: `isInMyRelayList` does **not** see assumed relays (guards Finding 2 permanently).
+
+Device — the number that justifies the change. `relaytiming.sh` + `BootRelayDiag` census,
+`VERBOSE_LOGS=true` benchmark build, fresh install each, counterbalanced, n>=3:
+- primary: login -> first note; login -> own profile + follow list;
+- secondary: relays opened / serving / events at the 20s census;
+- guard: grep the verbose log for any request to a default relay during the window that is not for
+  the account's own pubkey, and for any AUTH sent to one.
+
+Harness traps (all in `[[fresh-install-routes-everything-via-tor]]`): the tablet raises its lock
+screen during long waits (`wm dismiss-keyguard`, not just `KEYCODE_WAKEUP`); the login layout shifts
+when the IME opens, so dismiss it before tapping fixed coordinates; `BACK` on the home screen exits
+the app; always assert the run left the login screen before trusting its timing.
+
+## Expected outcome
+
+Approach the Tor-OFF column: ≈**-7s to first paint, ~2x relay coverage** in the first 20s, with
+everything after the first event behaving exactly as today.
+
+If the gain is materially smaller, the likely cause is that the feed is gated on outbox-discovered
+relays (which stay "new", hence Tor) rather than the user's own list — in which case the win is
+limited to profile and follows, and may not be worth the privacy cost. Decide on the numbers.
+
+## Order of work
+
+1. Fix the absent-vs-empty bug in the four helpers + tests. Independently correct; ship separately.
+2. Add `relaysAssumedWhileUnknown` + `TorRelayState.assumedRelays` + the `useTor()` branch.
+3. Device A/B. Keep only if it earns its keep.
@@ -25,7 +25,10 @@ import androidx.test.filters.LargeTest
 import androidx.test.platform.app.InstrumentationRegistry
 import com.vitorpamplona.amethyst.ui.tor.TorService
 import com.vitorpamplona.amethyst.ui.tor.TorServiceStatus
+import kotlinx.coroutines.CoroutineScope
 import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.SupervisorJob
+import kotlinx.coroutines.cancel
 import kotlinx.coroutines.flow.first
 import kotlinx.coroutines.runBlocking
 import kotlinx.coroutines.withTimeout
@@ -58,7 +61,7 @@ import kotlin.system.measureTimeMillis
 *   3. `./gradlew :amethyst:connectedPlayDebugAndroidTest -P android.testInstrumentationRunnerArguments.class=com.vitorpamplona.amethyst.tor.TorBootstrapInstrumentedTest`
 *
 * **What it covers that [TorManagerTest] does not:**
- *   - Real `ArtiNative.initialize` → `create_bootstrapped` → SOCKS listener bind.
+ *   - Real `ArtiNative.initialize` → `create_unbootstrapped_async` → SOCKS listener bind.
 *   - Real rustls `CryptoProvider` install (regression check after the arti-v2.3.0 bump).
 *   - Real `destroy()` releasing the state file lock so a second `initialize()` succeeds.
 *   - OkHttp routing traffic through the SOCKS port and Arti exiting through the
@@ -73,7 +76,14 @@ import kotlin.system.measureTimeMillis
@Ignore("Tier-3 integration test — requires on-device network access to Tor. See class kdoc to enable.")
 class TorBootstrapInstrumentedTest {
    private val context = InstrumentationRegistry.getInstrumentation().targetContext
-    private val torService = TorService(context)
+
+    /**
+     * [TorService] promotes Bootstrapping -> Active from a coroutine on this scope, so the test
+     * must own one and cancel it — without a live scope `status` would never reach Active and every
+     * assertion below would hang until its timeout.
+     */
+    private val scope = CoroutineScope(SupervisorJob() + Dispatchers.IO)
+    private val torService = TorService(context, scope)

    @After
    fun tearDown() =
@@ -81,11 +91,12 @@ class TorBootstrapInstrumentedTest {
            // Drop the native client so this test's state file lock doesn't bleed into
            // the next instrumented run on the same device.
            torService.reset()
+            scope.cancel()
        }

    /**
     * Cold-start bootstrap. The whole point of the custom Arti build is that this
-     * works at all — if create_bootstrapped panics (e.g., because we forgot to install
+     * works at all — if client creation panics (e.g., because we forgot to install
     * a rustls CryptoProvider after an arti bump) the test catches it.
     */
    @Test
@@ -0,0 +1,66 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.ui.actions
+
+import android.content.Context
+import kotlinx.coroutines.runBlocking
+import org.junit.Assert.assertNull
+import org.junit.Assert.assertTrue
+import java.io.File
+import java.util.UUID
+
+/**
+ * Shared harness for the MediaSaverToDisk instrumented tests: writes a small payload
+ * file, drives [MediaSaverToDisk.save] with the given MIME type, and asserts the save
+ * reported success. Package-level support object per the AvifInstrumentedTestSupport
+ * precedent.
+ */
+object MediaSaverTestSupport {
+    /** Drives one save and fails the test if it reported an error or never succeeded. */
+    fun saveAndAssertSuccess(
+        context: Context,
+        mimeType: String,
+    ) {
+        val localFile = File(context.cacheDir, "media-saver-${UUID.randomUUID()}.bin")
+        localFile.writeBytes(ByteArray(2048) { it.toByte() })
+
+        var failure: Throwable? = null
+        var succeeded = false
+
+        try {
+            runBlocking {
+                MediaSaverToDisk.save(
+                    localFile = localFile,
+                    mimeType = mimeType,
+                    context = context,
+                    onSuccess = { succeeded = true },
+                    onError = { failure = it },
+                )
+            }
+        } finally {
+            localFile.delete()
+        }
+
+        // Surfaces e.g. the #4009 IllegalArgumentException as the test failure message.
+        assertNull("save() reported an error: ${failure?.message}", failure)
+        assertTrue("save() never reported success", succeeded)
+    }
+}
@@ -0,0 +1,155 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.ui.actions
+
+import android.Manifest
+import android.content.pm.PackageManager
+import android.os.Build
+import android.os.Environment
+import android.os.ParcelFileDescriptor
+import androidx.test.ext.junit.runners.AndroidJUnit4
+import androidx.test.platform.app.InstrumentationRegistry
+import org.junit.After
+import org.junit.Assert.assertEquals
+import org.junit.Assume.assumeTrue
+import org.junit.Before
+import org.junit.Test
+import org.junit.runner.RunWith
+import java.io.File
+import java.io.IOException
+
+/**
+ * Covers the pre-Q writer, which MediaStore never sees: below API 29 saveContentDefault
+ * writes straight to a public directory and lets the media scanner index it.
+ *
+ * That path used to hardcode Pictures for every content type, so videos, audio and PDFs
+ * were all filed under Pictures/Amethyst. It now routes through the same MediaStoreTarget
+ * as the MediaStore path. minSdk is 26, so this range ships.
+ *
+ * There is no JVM coverage of any of this: Build.VERSION.SDK_INT is 0 under
+ * returnDefaultValues, so unit tests can only reach the routing function, never the writer.
+ *
+ * **Running this suite:** below Q the storage grant must exist before the app process
+ * forks (external storage is mounted at fork time), and Gradle's connectedAndroidTest
+ * installs and instruments with no window to grant in between - so these tests skip
+ * under it. Drive them manually on an API 26-28 device:
+ * ```
+ * ./gradlew :amethyst:assemblePlayDebug :amethyst:assemblePlayDebugAndroidTest
+ * adb install -r -g amethyst/build/outputs/apk/play/debug/amethyst-play-arm64-v8a-debug.apk
+ * adb install -r -g amethyst/build/outputs/apk/androidTest/play/debug/amethyst-play-debug-androidTest.apk
+ * adb shell am instrument -w -e class com.vitorpamplona.amethyst.ui.actions.MediaSaverToDiskLegacyStorageTest \
+ *     com.vitorpamplona.amethyst.debug.test/androidx.test.runner.AndroidJUnitRunner
+ * ```
+ */
+@RunWith(AndroidJUnit4::class)
+class MediaSaverToDiskLegacyStorageTest {
+    private val context get() = InstrumentationRegistry.getInstrumentation().targetContext
+
+    /** Every directory production can write to, straight from the routing table. */
+    private val watchedDirs = MediaSaverToDisk.MediaStoreTarget.entries.map { it.relativeDirectory }
+    private val createdFiles = mutableListOf<File>()
+
+    @Before
+    fun onlyBelowScopedStorage() {
+        assumeTrue("saveContentDefault only runs below API 29", Build.VERSION.SDK_INT < Build.VERSION_CODES.Q)
+
+        // The legacy writer needs the runtime permission; no androidx.test:rules on the
+        // classpath, so grant it through the instrumentation shell instead. The output has
+        // to be drained: executeShellCommand runs asynchronously and closing the descriptor
+        // early kills the command before it applies.
+        val fd =
+            InstrumentationRegistry
+                .getInstrumentation()
+                .uiAutomation
+                .executeShellCommand(
+                    "pm grant ${context.packageName} android.permission.WRITE_EXTERNAL_STORAGE",
+                )
+        ParcelFileDescriptor.AutoCloseInputStream(fd).use { it.readBytes() }
+
+        assertEquals(
+            "WRITE_EXTERNAL_STORAGE was not granted; the legacy writer cannot be exercised",
+            PackageManager.PERMISSION_GRANTED,
+            context.checkSelfPermission(Manifest.permission.WRITE_EXTERNAL_STORAGE),
+        )
+
+        // Holding the permission is not enough below Q: external storage is mounted into
+        // the process when it forks, so a grant to an already-running process never
+        // reaches it and every write fails with EACCES. Probe for real writability and
+        // skip rather than report a routing failure that is really a harness problem.
+        assumeTrue(
+            "External storage is not writable by this process; below API 29 the grant must " +
+                "exist at install time. See this class's KDoc for the exact run recipe.",
+            canWriteToPublicStorage(),
+        )
+    }
+
+    private fun canWriteToPublicStorage(): Boolean =
+        try {
+            val dir = amethystDir("Movies").apply { if (!exists()) mkdirs() }
+            val probe = File(dir, ".write-probe-${System.nanoTime()}")
+            val writable = probe.createNewFile()
+            probe.delete()
+            writable
+        } catch (e: IOException) {
+            false
+        }
+
+    @After
+    fun cleanUp() {
+        createdFiles.forEach { it.delete() }
+    }
+
+    @Test
+    fun videoGoesToMovies() = assertRoutes("video/mp4", "Movies")
+
+    @Test
+    fun imageGoesToPictures() = assertRoutes("image/jpeg", "Pictures")
+
+    @Test
+    fun audioGoesToMusic() = assertRoutes("audio/mpeg", "Music")
+
+    @Test
+    fun pdfGoesToDownloads() = assertRoutes("application/pdf", "Download")
+
+    /**
+     * Saves one file and asserts it appeared under [expectedDir]/Amethyst and nowhere else.
+     * Checking the other directories is the point: the bug was everything landing in Pictures.
+     */
+    private fun assertRoutes(
+        mimeType: String,
+        expectedDir: String,
+    ) {
+        val before = snapshot()
+
+        MediaSaverTestSupport.saveAndAssertSuccess(context, mimeType)
+
+        val added = snapshot().mapValues { (dir, names) -> names - before.getValue(dir) }
+        added.forEach { (dir, names) -> names.forEach { createdFiles.add(File(amethystDir(dir), it)) } }
+
+        val dirsThatGrew = added.filterValues { it.isNotEmpty() }.keys
+        assertEquals("$mimeType should land only in $expectedDir/Amethyst", setOf(expectedDir), dirsThatGrew)
+        assertEquals("expected exactly one new file", 1, added.getValue(expectedDir).size)
+    }
+
+    private fun amethystDir(publicDir: String) = File(Environment.getExternalStoragePublicDirectory(publicDir), "Amethyst")
+
+    private fun snapshot(): Map<String, Set<String>> = watchedDirs.associateWith { amethystDir(it).list()?.toSet() ?: emptySet() }
+}
@@ -0,0 +1,117 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.ui.actions
+
+import android.content.ContentResolver
+import android.content.ContentUris
+import android.net.Uri
+import android.os.Build
+import android.provider.MediaStore
+import androidx.test.ext.junit.runners.AndroidJUnit4
+import androidx.test.platform.app.InstrumentationRegistry
+import org.junit.After
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertTrue
+import org.junit.Assume.assumeTrue
+import org.junit.Before
+import org.junit.Test
+import org.junit.runner.RunWith
+
+/**
+ * End-to-end regression test for issue #4009: drives the real ContentResolver, so it
+ * catches both symptoms of a collection/directory mismatch - Android 10 rejects the
+ * insert outright (the quoted rejection lives in [MediaSaverToDisk.MediaStoreTarget]'s
+ * KDoc), and later releases accept it and silently misfile the video.
+ */
+@RunWith(AndroidJUnit4::class)
+class MediaSaverToDiskMediaStoreTest {
+    private val context get() = InstrumentationRegistry.getInstrumentation().targetContext
+    private val resolver: ContentResolver get() = context.contentResolver
+
+    /** Only rows this test inserted, as item Uris in the collection they went into. */
+    private val created = mutableListOf<Uri>()
+
+    @Before
+    fun requiresScopedStorage() {
+        assumeTrue("saveContentQ only runs on API 29+", Build.VERSION.SDK_INT >= Build.VERSION_CODES.Q)
+    }
+
+    @After
+    fun cleanUp() {
+        created.forEach { resolver.delete(it, null, null) }
+    }
+
+    @Test
+    fun savingAVideoLandsInMoviesAndNotPictures() {
+        val relativePath = saveAndReadBackRelativePath("video/mp4", MediaStore.Video.Media.EXTERNAL_CONTENT_URI)
+
+        assertEquals("Movies/Amethyst/", relativePath)
+    }
+
+    @Test
+    fun savingAnImageStillLandsInPictures() {
+        val relativePath = saveAndReadBackRelativePath("image/jpeg", MediaStore.Images.Media.EXTERNAL_CONTENT_URI)
+
+        assertEquals("Pictures/Amethyst/", relativePath)
+    }
+
+    private fun saveAndReadBackRelativePath(
+        mimeType: String,
+        collection: Uri,
+    ): String? {
+        // Anything at or below this id predates the test and must never be read or deleted:
+        // this suite is meant to be runnable on a real device holding real media.
+        val highWaterMark = maxIdIn(collection)
+
+        MediaSaverTestSupport.saveAndAssertSuccess(context, mimeType)
+
+        return rowInsertedAfter(collection, highWaterMark)
+    }
+
+    private fun maxIdIn(collection: Uri): Long {
+        resolver
+            .query(collection, arrayOf(MediaStore.MediaColumns._ID), null, null, "${MediaStore.MediaColumns._ID} DESC")
+            ?.use { cursor ->
+                if (cursor.moveToFirst()) return cursor.getLong(0)
+            }
+        return -1L
+    }
+
+    /** Reads back the row the save just inserted and records it for cleanup. */
+    private fun rowInsertedAfter(
+        collection: Uri,
+        highWaterMark: Long,
+    ): String? {
+        resolver
+            .query(
+                collection,
+                arrayOf(MediaStore.MediaColumns._ID, MediaStore.MediaColumns.RELATIVE_PATH),
+                "${MediaStore.MediaColumns._ID} > ?",
+                arrayOf(highWaterMark.toString()),
+                "${MediaStore.MediaColumns._ID} ASC",
+            )?.use { cursor ->
+                assertTrue("save() reported success but inserted no row into $collection", cursor.moveToFirst())
+                created.add(ContentUris.withAppendedId(collection, cursor.getLong(0)))
+                return cursor.getString(1)
+            }
+        return null
+    }
+}
@@ -0,0 +1,45 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.ui.actions
+
+import android.os.Environment
+import androidx.test.ext.junit.runners.AndroidJUnit4
+import com.vitorpamplona.amethyst.ui.actions.MediaSaverToDisk.MediaStoreTarget
+import org.junit.Assert.assertEquals
+import org.junit.Test
+import org.junit.runner.RunWith
+
+/**
+ * [MediaStoreTarget] spells its directories out as literals because Environment's
+ * DIRECTORY_* fields are plain statics that the unit-test android.jar leaves null.
+ * This is the other half of that trade: on a real device the literals are checked
+ * against the platform constants they stand in for.
+ */
+@RunWith(AndroidJUnit4::class)
+class MediaStoreTargetInstrumentedTest {
+    @Test
+    fun directoriesMatchThePlatformConstants() {
+        assertEquals(Environment.DIRECTORY_PICTURES, MediaStoreTarget.IMAGES.relativeDirectory)
+        assertEquals(Environment.DIRECTORY_MUSIC, MediaStoreTarget.AUDIO.relativeDirectory)
+        assertEquals(Environment.DIRECTORY_MOVIES, MediaStoreTarget.VIDEO.relativeDirectory)
+        assertEquals(Environment.DIRECTORY_DOWNLOADS, MediaStoreTarget.DOWNLOADS.relativeDirectory)
+    }
+}
@@ -0,0 +1,84 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.ui.actions.uploads
+
+import android.os.Environment
+import androidx.core.content.FileProvider
+import androidx.test.ext.junit.runners.AndroidJUnit4
+import androidx.test.platform.app.InstrumentationRegistry
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertTrue
+import org.junit.Assert.fail
+import org.junit.Test
+import org.junit.runner.RunWith
+import java.io.File
+
+/**
+ * Pins what `res/xml/file_paths.xml` is allowed to hand out.
+ *
+ * The provider root used to be `<external-path path=".">`, i.e. the whole of
+ * `Environment.getExternalStorageDirectory()`. It is now the app-specific
+ * `<external-files-path>`, which is the only external location Amethyst ever
+ * shares from (camera/video capture). These tests fail if either half of that
+ * regresses: the capture paths must still resolve, and the external-storage
+ * root must not.
+ */
+@RunWith(AndroidJUnit4::class)
+class FileProviderPathsTest {
+    private val context = InstrumentationRegistry.getInstrumentation().targetContext
+    private val authority = "${context.packageName}.provider"
+
+    @Test
+    fun photoCaptureUriResolves() {
+        val uri = getPhotoUri(context)
+        assertEquals("content", uri.scheme)
+        assertEquals(authority, uri.authority)
+        assertTrue("expected the external_files root, got $uri", uri.path!!.startsWith("/external_files/"))
+    }
+
+    @Test
+    fun videoCaptureUriResolves() {
+        val uri = getVideoUri(context)
+        assertEquals("content", uri.scheme)
+        assertEquals(authority, uri.authority)
+        assertTrue("expected the external_files root, got $uri", uri.path!!.startsWith("/external_files/"))
+    }
+
+    @Test
+    fun cacheDirStillResolves() {
+        val file = File(context.cacheDir, "amethyst_share_probe.png")
+        val uri = FileProvider.getUriForFile(context, authority, file)
+        assertEquals(authority, uri.authority)
+        assertTrue("expected the cache root, got $uri", uri.path!!.startsWith("/cache/"))
+    }
+
+    @Test
+    fun externalStorageRootIsNoLongerShareable() {
+        @Suppress("DEPRECATION")
+        val outside = File(Environment.getExternalStorageDirectory(), "Download/not-ours.pdf")
+        try {
+            val uri = FileProvider.getUriForFile(context, authority, outside)
+            fail("FileProvider should not map $outside, but produced $uri")
+        } catch (expected: IllegalArgumentException) {
+            // Correct: no configured root contains it.
+        }
+    }
+}
@@ -0,0 +1,191 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.ui.insets
+
+import android.view.View
+import android.view.animation.LinearInterpolator
+import androidx.compose.foundation.layout.ExperimentalLayoutApi
+import androidx.compose.foundation.layout.WindowInsets
+import androidx.compose.foundation.layout.ime
+import androidx.compose.foundation.layout.imeAnimationTarget
+import androidx.compose.runtime.getValue
+import androidx.compose.runtime.mutableIntStateOf
+import androidx.compose.runtime.setValue
+import androidx.compose.ui.platform.LocalDensity
+import androidx.compose.ui.platform.LocalView
+import androidx.compose.ui.test.junit4.createComposeRule
+import androidx.core.graphics.Insets
+import androidx.core.view.OnApplyWindowInsetsListener
+import androidx.core.view.WindowInsetsAnimationCompat
+import androidx.core.view.WindowInsetsCompat
+import org.junit.Assert.assertEquals
+import org.junit.Ignore
+import org.junit.Rule
+import org.junit.Test
+
+/**
+ * Upstream regression test for androidx.compose.foundation:foundation-layout.
+ *
+ * A `WindowInsetsAnimation` that is prepared and started but never ended — which is what a
+ * cancelled IME animation looks like — leaves `InsetsListener.runningAnimation` set forever.
+ * `onApplyWindowInsets` then matches neither of its two branches, so `composeInsets.update()`
+ * is never called again and `WindowInsets.ime` is dead for the life of the window.
+ *
+ * Introduced in 1.4.0 (absent in 1.3.0, where `onApplyWindowInsets` updated unconditionally
+ * once `onStart` had cleared `prepared`). Still present in 1.12.0 and 1.13.0-alpha01. The
+ * compensating self-heal (`view.post(this)` -> `run()`) is scoped to `SDK_INT == R`, so on
+ * API 31+ nothing clears the flag; `WindowInsetsHolder.resetState()` only runs when the
+ * holder's accessCount transitions 0 -> 1, which never happens in an app whose shell always
+ * reads insets.
+ *
+ * Filed upstream as b/552500419.
+ *
+ * [aCancelledImeAnimationMustNotWedgeTheAnimatedInset] FAILS on every version from 1.4.0 on, so it
+ * is [Ignore]d to keep CI green. It is not a test of Amethyst code — it is the upstream repro we
+ * attached to the bug. **Re-run it by hand after every Compose upgrade**: when it passes, the
+ * upstream fix has landed and [com.vitorpamplona.amethyst.ui.insets.SafeImeInsets] can be retired.
+ *
+ * [theAnimationTargetSurvivesTheWedge] documents the asymmetry that makes a workaround possible
+ * and is expected to PASS — `updateImeAnimationTarget` is called outside the guard. It stays
+ * enabled, because it guards the premise [com.vitorpamplona.amethyst.ui.insets.SafeImeInsets]
+ * depends on: if a future Compose release stopped keeping `imeAnimationTarget` current, our
+ * fallback would silently start reading a dead value too.
+ */
+class ComposeImeInsetWedgeTest {
+    @get:Rule val rule = createComposeRule()
+
+    private val keyboardHeight = 957
+
+    private fun imeInsets(bottom: Int): WindowInsetsCompat =
+        WindowInsetsCompat
+            .Builder()
+            .setInsets(WindowInsetsCompat.Type.ime(), Insets.of(0, 0, 0, bottom))
+            .setVisible(WindowInsetsCompat.Type.ime(), bottom > 0)
+            .build()
+
+    /** Compose's own listener for this view. Private class, but both interfaces it exposes are public. */
+    private fun listenerFor(view: View): Any {
+        val holderClass = Class.forName("androidx.compose.foundation.layout.WindowInsetsHolder")
+        val companion =
+            holderClass.getDeclaredField("Companion").run {
+                isAccessible = true
+                get(null)
+            }
+        val holder =
+            companion.javaClass
+                .getDeclaredMethod("getOrCreateFor", View::class.java)
+                .run {
+                    isAccessible = true
+                    invoke(companion, view)
+                }
+        return holderClass.getDeclaredField("insetsListener").run {
+            isAccessible = true
+            get(holder)!!
+        }
+    }
+
+    private fun anim() = WindowInsetsAnimationCompat(WindowInsetsCompat.Type.ime(), LinearInterpolator(), 250L)
+
+    private fun bounds() =
+        WindowInsetsAnimationCompat.BoundsCompat(
+            Insets.NONE,
+            Insets.of(0, 0, 0, keyboardHeight),
+        )
+
+    @OptIn(ExperimentalLayoutApi::class)
+    @Test
+    @Ignore("Fails by design until upstream fixes b/552500419 — re-run by hand on every Compose upgrade")
+    fun aCancelledImeAnimationMustNotWedgeTheAnimatedInset() {
+        var animated by mutableIntStateOf(-1)
+        lateinit var view: View
+
+        rule.setContent {
+            view = LocalView.current
+            val density = LocalDensity.current
+            animated = WindowInsets.ime.getBottom(density)
+        }
+        rule.waitForIdle()
+
+        val listener = listenerFor(view)
+        val onApply = listener as OnApplyWindowInsetsListener
+        val callback = listener as WindowInsetsAnimationCompat.Callback
+
+        // Baseline: with no animation in flight the inset tracks normally.
+        rule.runOnUiThread { onApply.onApplyWindowInsets(view, imeInsets(keyboardHeight)) }
+        rule.waitForIdle()
+        assertEquals("baseline: the inset must follow a plain dispatch", keyboardHeight, animated)
+
+        // A cancelled animation: prepared and started, but onEnd never arrives.
+        rule.runOnUiThread {
+            callback.onPrepare(anim())
+            callback.onStart(anim(), bounds())
+        }
+        rule.waitForIdle()
+
+        // The keyboard is gone and the window says so. The animated inset must follow.
+        rule.runOnUiThread { onApply.onApplyWindowInsets(view, imeInsets(0)) }
+        rule.waitForIdle()
+
+        assertEquals(
+            "WindowInsets.ime must still track the window after an animation was cancelled " +
+                "without onEnd; it is instead frozen at the keyboard height forever",
+            0,
+            animated,
+        )
+    }
+
+    @OptIn(ExperimentalLayoutApi::class)
+    @Test
+    fun theAnimationTargetSurvivesTheWedge() {
+        var target by mutableIntStateOf(-1)
+        lateinit var view: View
+
+        rule.setContent {
+            view = LocalView.current
+            val density = LocalDensity.current
+            target = WindowInsets.imeAnimationTarget.getBottom(density)
+        }
+        rule.waitForIdle()
+
+        val listener = listenerFor(view)
+        val onApply = listener as OnApplyWindowInsetsListener
+        val callback = listener as WindowInsetsAnimationCompat.Callback
+
+        rule.runOnUiThread { onApply.onApplyWindowInsets(view, imeInsets(keyboardHeight)) }
+        rule.waitForIdle()
+        assertEquals(keyboardHeight, target)
+
+        rule.runOnUiThread {
+            callback.onPrepare(anim())
+            callback.onStart(anim(), bounds())
+        }
+        rule.waitForIdle()
+
+        rule.runOnUiThread { onApply.onApplyWindowInsets(view, imeInsets(0)) }
+        rule.waitForIdle()
+
+        assertEquals(
+            "updateImeAnimationTarget is called outside the guard, so this reading stays truthful",
+            0,
+            target,
+        )
+    }
+}
@@ -0,0 +1,91 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.ui.note
+
+import androidx.compose.animation.core.tween
+import androidx.compose.material3.Text
+import androidx.compose.runtime.mutableStateOf
+import androidx.compose.ui.Alignment
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.platform.testTag
+import androidx.compose.ui.test.assertIsDisplayed
+import androidx.compose.ui.test.junit4.createComposeRule
+import androidx.compose.ui.test.onNodeWithTag
+import androidx.test.ext.junit.runners.AndroidJUnit4
+import com.vitorpamplona.amethyst.ui.actions.DeferredCrossfade
+import org.junit.Rule
+import org.junit.Test
+import org.junit.runner.RunWith
+
+/**
+ * The feed's animated elements defer building their `Transition` until a value actually changes,
+ * because first composition has nothing to animate and building one per card per scroll is pure
+ * waste (measured: roughly half the composition cost of every reaction-row button).
+ *
+ * The whole point of deferring rather than removing is that the animation must still play. These
+ * tests pin that: they drive the clock manually and assert that the **first** change — the one that
+ * happens right after the transition is lazily created — still shows outgoing and incoming content
+ * simultaneously, which only a running animation does. A regression that turned the deferral into a
+ * plain snap would show exactly one of them and fail here.
+ */
+@RunWith(AndroidJUnit4::class)
+class DeferredAnimationTest {
+    @get:Rule
+    val rule = createComposeRule()
+
+    @Test
+    fun deferredCrossfadeStillAnimatesTheFirstChange() {
+        val state = mutableStateOf("A")
+        rule.mainClock.autoAdvance = false
+
+        rule.setContent {
+            DeferredCrossfade(
+                targetState = state.value,
+                modifier = Modifier,
+                contentAlignment = Alignment.TopStart,
+                animationSpec = tween(DURATION_MS),
+                label = "test",
+            ) { value ->
+                Text(value, modifier = Modifier.testTag("text_$value"))
+            }
+        }
+
+        // Before any change the transition has not been built, and only the current value renders.
+        rule.onNodeWithTag("text_A").assertIsDisplayed()
+        rule.onNodeWithTag("text_B").assertDoesNotExist()
+
+        state.value = "B"
+        rule.mainClock.advanceTimeByFrame()
+        rule.mainClock.advanceTimeBy(DURATION_MS / 3L)
+
+        // Mid-crossfade both are in the tree. This is the assertion that a snap would fail.
+        rule.onNodeWithTag("text_A").assertExists()
+        rule.onNodeWithTag("text_B").assertExists()
+
+        rule.mainClock.advanceTimeBy(DURATION_MS * 3L)
+        rule.onNodeWithTag("text_B").assertIsDisplayed()
+        rule.onNodeWithTag("text_A").assertDoesNotExist()
+    }
+
+    companion object {
+        const val DURATION_MS = 300
+    }
+}
@@ -23,6 +23,8 @@ package com.vitorpamplona.amethyst.service.ai
 class NoOpWritingAssistant : WritingAssistant {
    override suspend fun checkAvailability(): WritingAssistantStatus = WritingAssistantStatus.Unavailable

+    override suspend fun requestDownload(): WritingAssistantStatus = WritingAssistantStatus.Unavailable
+
    override suspend fun transform(
        text: String,
        tone: WritingTone,
@@ -23,6 +23,9 @@ package com.vitorpamplona.amethyst.service.ai
 import android.content.Context

 object WritingAssistantFactory {
+    /** Whether this flavor ships a real assistant. Drives the Settings tile. */
+    const val IS_SUPPORTED = false
+
    @Suppress("UNUSED_PARAMETER")
    fun create(context: Context): WritingAssistant = NoOpWritingAssistant()
 }
@@ -52,6 +52,7 @@
    <uses-permission android:name="android.permission.FOREGROUND_SERVICE_MEDIA_PLAYBACK" />
    <uses-permission android:name="android.permission.FOREGROUND_SERVICE_MICROPHONE" />
    <uses-permission android:name="android.permission.FOREGROUND_SERVICE_CAMERA" />
+    <uses-permission android:name="android.permission.FOREGROUND_SERVICE_MEDIA_PROJECTION" />
    <uses-permission android:name="android.permission.FOREGROUND_SERVICE_PHONE_CALL" />
    <uses-permission android:name="android.permission.FOREGROUND_SERVICE_SPECIAL_USE" />
    <uses-permission android:name="android.permission.FOREGROUND_SERVICE_DATA_SYNC" />
@@ -115,7 +116,7 @@
            android:exported="true"
            android:launchMode="singleInstance"
            android:windowSoftInputMode="adjustResize"
-            android:configChanges="orientation|screenSize|screenLayout|smallestScreenSize"
+            android:configChanges="orientation|screenSize|screenLayout|smallestScreenSize|keyboardHidden|keyboard|navigation|uiMode|fontScale|density"
            android:supportsPictureInPicture="true"
            android:theme="@style/Theme.Amethyst">

@@ -453,7 +454,7 @@

        <service
            android:name=".service.call.CallForegroundService"
-            android:foregroundServiceType="microphone|camera|phoneCall"
+            android:foregroundServiceType="microphone|camera|phoneCall|mediaProjection"
            android:stopWithTask="false"
            android:exported="false" />

@@ -559,7 +560,9 @@

        <!-- Direct-WebView browser for a single web client. Runs in the isolated, keyless `:napplet`
             process and hosts the WebView directly (not a streamed surface), so scroll/zoom/keyboard work
-             natively. adjustResize shrinks the window for the soft keyboard. Its own task/recents entry. -->
+             natively. The activity insets its own content for the soft keyboard (adjustResize only still
+             applies below Android 15, where the window is not forced edge-to-edge). Its own task/recents
+             entry. -->
        <activity
            android:name="com.vitorpamplona.amethyst.napplethost.NappletBrowserActivity"
            android:process=":napplet"
@@ -577,6 +580,17 @@
            android:excludeFromRecents="true"
            android:launchMode="singleTop"
            android:theme="@android:style/Theme.Translucent.NoTitleBar" />
+        <!-- Invisible host that runs the system file picker for an embedded WebView surface. The
+             `:napplet` providers are windowless services with no Activity of their own, so the main
+             process collects the pick and relays the URIs back to the sandbox. -->
+        <!-- Standard launch mode on purpose: two embedded surfaces can each have a pick in flight, and
+             singleTop would collapse the second onto the first and strand its page's file input. -->
+        <activity
+            android:name=".napplet.WebFileChooserActivity"
+            android:exported="false"
+            android:excludeFromRecents="true"
+            android:configChanges="orientation|screenSize|screenLayout|smallestScreenSize|keyboardHidden|keyboard|uiMode|navigation|fontScale|density"
+            android:theme="@android:style/Theme.Translucent.NoTitleBar" />
        <!-- First-connect "Connect to Nostr" dialog. -->
        <activity
            android:name=".connectedApps.consent.SignerConnectActivity"
@@ -24,39 +24,48 @@
 # strictly better — it would carry call counts and startup/post-startup flags
 # that reflect real behaviour instead of whole-package guesses.
 #
-# Flags: H = hot, S = startup, P = post-startup.
+# Flags: HP = hot + post-startup, deliberately WITHOUT S (startup).
+#
+# S drives DEX layout: startup-flagged classes are grouped into classes.dex for
+# locality, and Android's docs warn that if startup code does not fit there it
+# "will overflow into the next DEX files". These are whole-package wildcards for
+# ingest, which runs AFTER startup — flagging them S would claim thousands of
+# methods are startup-critical and could push genuinely startup-critical code out
+# of the first DEX, hurting the thing it is meant to help. For comparison, the
+# generated profile marks 32 of its 31,497 rules HSPL; this file should not claim
+# more than that about startup. Startup layout is left to the generated profile.

 # --- Quartz: protocol core, relay client, crypto, event kinds ---
-HSPLcom/vitorpamplona/quartz/nip01Core/**->**(**)**
-HSPLcom/vitorpamplona/quartz/nip10Notes/**->**(**)**
-HSPLcom/vitorpamplona/quartz/nip19Bech32/**->**(**)**
-HSPLcom/vitorpamplona/quartz/nip17Dm/**->**(**)**
-HSPLcom/vitorpamplona/quartz/nip22Comments/**->**(**)**
-HSPLcom/vitorpamplona/quartz/nip25Reactions/**->**(**)**
-HSPLcom/vitorpamplona/quartz/nip18Reposts/**->**(**)**
-HSPLcom/vitorpamplona/quartz/nip57Zaps/**->**(**)**
-HSPLcom/vitorpamplona/quartz/nip65RelayList/**->**(**)**
-HSPLcom/vitorpamplona/quartz/utils/**->**(**)**
-HSPLcom/vitorpamplona/quartz/experimental/**->**(**)**
+HPLcom/vitorpamplona/quartz/nip01Core/**->**(**)**
+HPLcom/vitorpamplona/quartz/nip10Notes/**->**(**)**
+HPLcom/vitorpamplona/quartz/nip19Bech32/**->**(**)**
+HPLcom/vitorpamplona/quartz/nip17Dm/**->**(**)**
+HPLcom/vitorpamplona/quartz/nip22Comments/**->**(**)**
+HPLcom/vitorpamplona/quartz/nip25Reactions/**->**(**)**
+HPLcom/vitorpamplona/quartz/nip18Reposts/**->**(**)**
+HPLcom/vitorpamplona/quartz/nip57Zaps/**->**(**)**
+HPLcom/vitorpamplona/quartz/nip65RelayList/**->**(**)**
+HPLcom/vitorpamplona/quartz/utils/**->**(**)**
+HPLcom/vitorpamplona/quartz/experimental/**->**(**)**

 # --- Amethyst: the in-memory store and the relay wiring around it ---
-HSPLcom/vitorpamplona/amethyst/model/**->**(**)**
-HSPLcom/vitorpamplona/amethyst/service/relayClient/**->**(**)**
-HSPLcom/vitorpamplona/amethyst/service/okhttp/**->**(**)**
-HSPLcom/vitorpamplona/amethyst/commons/model/**->**(**)**
-HSPLcom/vitorpamplona/amethyst/commons/richtext/**->**(**)**
+HPLcom/vitorpamplona/amethyst/model/**->**(**)**
+HPLcom/vitorpamplona/amethyst/service/relayClient/**->**(**)**
+HPLcom/vitorpamplona/amethyst/service/okhttp/**->**(**)**
+HPLcom/vitorpamplona/amethyst/commons/model/**->**(**)**
+HPLcom/vitorpamplona/amethyst/commons/richtext/**->**(**)**

 # --- JSON: every frame is parsed through Jackson ---
-HSPLcom/fasterxml/jackson/core/**->**(**)**
-HSPLcom/fasterxml/jackson/databind/**->**(**)**
-HSPLcom/fasterxml/jackson/module/kotlin/**->**(**)**
+HPLcom/fasterxml/jackson/core/**->**(**)**
+HPLcom/fasterxml/jackson/databind/**->**(**)**
+HPLcom/fasterxml/jackson/module/kotlin/**->**(**)**

 # --- Transport: the socket read path under the relay client ---
-HSPLokhttp3/internal/ws/**->**(**)**
-HSPLokhttp3/internal/connection/**->**(**)**
-HSPLokio/**->**(**)**
+HPLokhttp3/internal/ws/**->**(**)**
+HPLokhttp3/internal/connection/**->**(**)**
+HPLokio/**->**(**)**

 # --- Coroutines: every ingested event crosses the dispatcher ---
-HSPLkotlinx/coroutines/scheduling/**->**(**)**
-HSPLkotlinx/coroutines/channels/**->**(**)**
-HSPLkotlinx/coroutines/flow/**->**(**)**
+HPLkotlinx/coroutines/scheduling/**->**(**)**
+HPLkotlinx/coroutines/channels/**->**(**)**
+HPLkotlinx/coroutines/flow/**->**(**)**
@@ -29,6 +29,7 @@ import com.vitorpamplona.amethyst.favorites.FavoriteAppsRegistry
 import com.vitorpamplona.amethyst.napplet.WebAppNetworkRegistry
 import com.vitorpamplona.amethyst.service.logging.Logging
 import com.vitorpamplona.amethyst.service.nests.AppForegroundRecycleHook
+import com.vitorpamplona.amethyst.service.priority.WorkerThreadPriorityGovernor
 import com.vitorpamplona.amethyst.ui.screen.loggedIn.embed.EmbeddedTabHost
 import com.vitorpamplona.quartz.utils.Log
 import com.vitorpamplona.quartz.utils.LogLevel
@@ -56,6 +57,9 @@ import java.io.File
 */
 class Amethyst : Application() {
    init {
+        // Deliberately in init, not onCreate: this runs in EVERY process, including the
+        // :napplet sandbox, whose onCreate early-returns. Moving it would leave that
+        // process on the wrapper's DEBUG default.
        Log.minLevel = DEFAULT_LOG_LEVEL
        Log.d("AmethystApp") { "Creating App $this" }
    }
@@ -81,9 +85,14 @@ class Amethyst : Application() {
         */
        val DEFAULT_LOG_LEVEL: LogLevel =
            when {
-                !BuildConfig.DEBUG -> LogLevel.WARN
-                VERBOSE_LOGS -> LogLevel.DEBUG
-                else -> LogLevel.INFO
+                // `isDebug` also covers the `benchmark` build type — a release build (R8 + AOT)
+                // that exists purely to be measured and is never shipped. Treating it as a release
+                // build left it at WARN, which drops every INFO milestone the boot narrative is
+                // made of (account load timings, Tor status transitions, the relay census), so the
+                // one variant whose numbers are trustworthy was also the one we could not read.
+                VERBOSE_LOGS && isDebug -> LogLevel.DEBUG
+                isDebug -> LogLevel.INFO
+                else -> LogLevel.WARN
            }

        lateinit var instance: AppModules
@@ -119,6 +128,11 @@ class Amethyst : Application() {

        instance = AppModules(this)

+        // Keeps the ~650 relay/ingest worker threads a cold start spawns from starving the UI
+        // thread out of its frames — worth ~45% off time-to-first-paint on a release build.
+        // Override or disable with the `amethyst_worker_nice` global setting.
+        WorkerThreadPriorityGovernor.start(this)
+
        // Hydrate the device-local favorite-apps list (main process only; the sandbox never reads it).
        FavoriteAppsRegistry.init(this)

@@ -23,6 +23,7 @@ package com.vitorpamplona.amethyst
 import android.content.ComponentCallbacks2
 import android.content.Context
 import android.os.BatteryManager
+import android.os.SystemClock
 import androidx.security.crypto.EncryptedSharedPreferences
 import coil3.disk.DiskCache
 import coil3.memory.MemoryCache
@@ -49,11 +50,13 @@ import com.vitorpamplona.amethyst.model.nip11RelayInfo.Nip11CachedRetriever
 import com.vitorpamplona.amethyst.model.preferences.BuzzAttestationPreferences
 import com.vitorpamplona.amethyst.model.preferences.BuzzChannelStarPreferences
 import com.vitorpamplona.amethyst.model.preferences.BuzzWorkspacePreferences
+import com.vitorpamplona.amethyst.model.preferences.DrawerSectionCollapsePreferences
 import com.vitorpamplona.amethyst.model.preferences.NamecoinSharedPreferences
 import com.vitorpamplona.amethyst.model.preferences.OtsSharedPreferences
 import com.vitorpamplona.amethyst.model.preferences.RelayGroupDeletionPreferences
 import com.vitorpamplona.amethyst.model.preferences.TorSharedPreferences
 import com.vitorpamplona.amethyst.model.preferences.UiSharedPreferences
+import com.vitorpamplona.amethyst.model.preferences.sharedPreferencesDataStore
 import com.vitorpamplona.amethyst.model.privacyOptions.RoleBasedHttpClientBuilder
 import com.vitorpamplona.amethyst.model.torState.AccountsTorStateConnector
 import com.vitorpamplona.amethyst.model.torState.TorRelayState
@@ -129,7 +132,6 @@ import com.vitorpamplona.amethyst.ui.screen.AccountState
 import com.vitorpamplona.amethyst.ui.screen.UiSettingsState
 import com.vitorpamplona.amethyst.ui.tor.TorManager
 import com.vitorpamplona.amethyst.ui.tor.TorService
-import com.vitorpamplona.amethyst.ui.tor.TorServiceStatus
 import com.vitorpamplona.quartz.nip01Core.core.Address
 import com.vitorpamplona.quartz.nip01Core.core.Event
 import com.vitorpamplona.quartz.nip01Core.relay.client.INostrClient
@@ -189,6 +191,7 @@ import kotlinx.coroutines.flow.merge
 import kotlinx.coroutines.flow.onCompletion
 import kotlinx.coroutines.flow.onStart
 import kotlinx.coroutines.flow.transform
+import kotlinx.coroutines.isActive
 import kotlinx.coroutines.launch
 import kotlinx.coroutines.runBlocking
 import java.io.File
@@ -206,6 +209,19 @@ class AppModules(

    val applicationIOScope = CoroutineScope(Dispatchers.IO + SupervisorJob() + exceptionHandler)

+    /**
+     * Mints and caches BUD-01 read-auth tokens for auth-gated Blossom hosts.
+     * Shared by the OkHttp interceptor (which only reads the cache) and Coil's
+     * [com.vitorpamplona.amethyst.service.images.BlossomReadAuthFetcher] (which
+     * awaits a signature), so both see one token and one in-flight signature per
+     * host. Signing runs on [applicationIOScope], never on an OkHttp thread.
+     */
+    val blossomReadAuthTokens =
+        BlossomReadAuthTokenProvider(
+            signerProvider = { sessionManager.loggedInAccount()?.signer },
+            scope = applicationIOScope,
+        )
+
    private val _trimLevelEvents = MutableSharedFlow<Int>(extraBufferCapacity = 1, onBufferOverflow = BufferOverflow.DROP_OLDEST)
    val trimLevelEvents = _trimLevelEvents.asSharedFlow()

@@ -267,7 +283,7 @@ class AppModules(
        UiSettingsState(uiPrefs.value, connManager.isMobileOrFalse, applicationIOScope)
    }

-    private val torService = TorService(appContext)
+    private val torService = TorService(appContext, applicationIOScope)
    val torManager = TorManager(torPrefs, torService, applicationIOScope)

    // Network identity change (wifi↔cellular, regained from offline, captive portal
@@ -285,23 +301,16 @@ class AppModules(
        }
    }

-    // Restore + persist held NIP-OA attestations across restarts (device-global). Eager (not
-    // lazy) so it loads before the first Buzz-relay AUTH and mirrors later changes to disk.
-    val buzzAttestationPrefs = BuzzAttestationPreferences(appContext, applicationIOScope)
-
-    // Restore + persist the joined Buzz workspace relays across restarts (device-global). Eager so
-    // the app knows which relays to sync as workspaces on cold start (Buzz membership is
-    // server-side; there is no join event to rebuild the set from).
-    val buzzWorkspacePrefs = BuzzWorkspacePreferences(appContext, applicationIOScope)
-
-    // Restore + persist the user's starred Buzz workspace channels across restarts (device-global).
-    val buzzChannelStarPrefs = BuzzChannelStarPreferences(appContext, applicationIOScope)
-
    // Restore + persist the set of relay-group channels deleted (kind-9008) on this device, so a
    // deleted channel stays hidden across a restart even if the host relay re-announces a stale
    // kind-44100 for it (device-global; a delete is authoritative and terminal for everyone).
    val relayGroupDeletionPrefs = RelayGroupDeletionPreferences(appContext, applicationIOScope)

+    // Restore + persist which drawer section headings the user has folded away, so the side menu
+    // opens the way they left it (device-global: a collapsed heading is a per-device view choice,
+    // not an account setting worth syncing, unlike the hidden rows beside it in the drawer).
+    val drawerSectionCollapsePrefs = DrawerSectionCollapsePreferences(appContext.sharedPreferencesDataStore, applicationIOScope)
+
    // Service that will run at all times to receive events from Pokey
    val pokeyReceiver = PokeyReceiver()

@@ -335,6 +344,12 @@ class AppModules(
        }
    }

+    // Runs for the whole process lifetime (main process only — the sandbox never builds AppModules).
+    // See [startHeapPressureWatchdog] for why the OS trim callbacks cannot be relied on.
+    init {
+        startHeapPressureWatchdog()
+    }
+
    // Shared cache populated by OnionLocationInterceptor from any HTTP/WebSocket
    // response carrying an Onion-Location header. Consulted by OnionUrlRewriteInterceptor
    // on Tor-enabled clients to transparently redirect to .onion addresses.
@@ -405,7 +420,11 @@ class AppModules(
    init {
        applicationIOScope.launch {
            torService.status
-                .map { it is TorServiceStatus.Active }
+                // Battery ledger: Tor is doing work from the moment the client exists — the
+                // directory download is the most expensive part of a launch — so this tracks
+                // "running", not "bootstrapped". Keying it on Active alone would silently omit the
+                // 12-34s download from every cold start.
+                .map { it.socksPort != null }
                .distinctUntilChanged()
                .collect { torSession.setActive(it) }
        }
@@ -452,9 +471,8 @@ class AppModules(
            // tracks the logged-in account.
            blossomReadAuth =
                BlossomReadAuthInterceptor(
-                    BlossomReadAuthTokenProvider(
-                        signerProvider = { sessionManager.loggedInAccount()?.signer },
-                    )::authHeader,
+                    cachedHeaderProvider = blossomReadAuthTokens::cachedHeader,
+                    onAuthRequired = blossomReadAuthTokens::warm,
                ),
        )

@@ -639,7 +657,7 @@ class AppModules(
            // proxy during bootstrap. RelayProxyClientConnector reconnects them (with
            // ignoreRetryDelays=true) the instant Tor flips to Active.
            canDial = { url ->
-                !torEvaluatorFlow.shouldUseTorForRelay(url) || torManager.isSocksReady()
+                !torEvaluatorFlow.shouldUseTorForRelay(url) || torManager.isTorReady()
            },
        )

@@ -708,7 +726,7 @@ class AppModules(
        TorCircuitHealthTracker(
            client = client,
            isTorRouted = { torEvaluatorFlow.shouldUseTorForRelay(it) },
-            isTorActive = { torManager.isSocksReady() },
+            isTorActive = { torManager.isTorReady() },
            isConnectivityActive = { connManager.status.value is ConnectivityStatus.Active },
            onCircuitsDead = { torManager.onTorCircuitsDead() },
        ).also { it.register() }
@@ -897,6 +915,17 @@ class AppModules(
            meterSigner = { MeteringNostrSigner(it, resourceUsage) },
            signerPermissionStore = signerPermissionStore,
            nip46ClientStore = nip46ClientStore,
+            // Restore + persist the Buzz bookkeeping that has no Nostr event to rebuild from: the
+            // joined workspace relays (so the app knows which relays to sync as workspaces on cold
+            // start — Buzz membership is server-side) and the starred channels. Per account: the
+            // joined set makes a relay first-party for NIP-42, and a star is personal.
+            startBuzzPersistence = { account ->
+                BuzzWorkspacePreferences(appContext, account.scope, account.pubKey, account.buzzWorkspaces)
+                BuzzChannelStarPreferences(appContext, account.scope, account.pubKey, account.buzzChannelStars)
+                // Eager like the rest, so a held NIP-OA attestation is loaded before this account's
+                // first Buzz-relay AUTH rather than after it.
+                BuzzAttestationPreferences(appContext, account.scope, account.pubKey, account.buzzAttestation)
+            },
        )

    val sessionManager =
@@ -1076,6 +1105,7 @@ class AppModules(
            callFactory = { roleBasedHttpClientBuilder.okHttpClientForImage(it) },
            thumbnailCache = thumbnailDiskCache,
            backgroundScope = applicationIOScope,
+            readAuth = blossomReadAuthTokens,
        )
    }

@@ -1303,6 +1333,53 @@ class AppModules(
        accountsCache.clear()
    }

+    /**
+     * Self-triggered reclaim, because the OS-driven path cannot fire when we need it most.
+     *
+     * `onTrimMemory` is the ONLY caller of [trim], and since API 34 the OS delivers just two levels,
+     * both of which require the app to be backgrounded:
+     *  - `UI_HIDDEN(20)` — activities stopped. Only trims images; never touches [LocalCache].
+     *  - `BACKGROUND(40)` — the process is on the system LRU list, which is what gates every bulk
+     *    reclaim we have (Tier 2 pruning, feed trimming, the hard cache trims).
+     *
+     * Two independent situations therefore get NO reclaim at all:
+     *  1. **Foreground use.** The deprecated `RUNNING_*` levels are never delivered, so a long session
+     *     simply grows until the heap is full.
+     *  2. **The always-on notification service.** A process hosting a foreground service can never enter
+     *     the cached state, so `BACKGROUND` is unreachable *even while backgrounded* — ActivityManager
+     *     refuses it outright ("Unable to set a background trim level on a foreground process").
+     *
+     * Measured consequence: a 3.4-day session sat at 492 MB of a 512 MB heap (3% free), paying 685 ms
+     * mark-compact GCs every ~10 s with dozens of threads blocked in `WaitForGcToComplete`, until an
+     * input-dispatch ANR. Reproduced independently on a second device with no foreground service at all.
+     *
+     * So we watch our own occupancy instead of waiting to be told. Above [HEAP_HIGH_WATER] we run the
+     * app's existing `BACKGROUND` reclaim — deliberately the same path, not a parallel policy, because at
+     * this occupancy "real reclaim pressure" is simply true. [MIN_RECLAIM_INTERVAL_MS] keeps a prune that
+     * frees little from spinning.
+     */
+    private fun startHeapPressureWatchdog() {
+        applicationIOScope.launch {
+            var lastRunAt = 0L
+            while (isActive) {
+                delay(HEAP_CHECK_INTERVAL_MS)
+                val runtime = Runtime.getRuntime()
+                val max = runtime.maxMemory()
+                val used = runtime.totalMemory() - runtime.freeMemory()
+                val ratio = used.toDouble() / max
+                val now = SystemClock.elapsedRealtime()
+                if (ratio >= HEAP_HIGH_WATER && now - lastRunAt >= MIN_RECLAIM_INTERVAL_MS) {
+                    lastRunAt = now
+                    Log.w("AppModules") {
+                        "Heap at ${(ratio * 100).toInt()}% (${used / (1024 * 1024)}MB of ${max / (1024 * 1024)}MB) — " +
+                            "self-triggering BACKGROUND reclaim; the OS will not deliver one here."
+                    }
+                    trim(ComponentCallbacks2.TRIM_MEMORY_BACKGROUND)
+                }
+            }
+        }
+    }
+
    fun trim(level: Int) {
        _trimLevelEvents.tryEmit(level)
        // Backgrounding is a natural moment to flush the usage ledger too.
@@ -1347,4 +1424,23 @@ class AppModules(
            }
        }
    }
+
+    companion object {
+        /**
+         * Fraction of `Runtime.maxMemory()` above which we stop waiting for an OS trim that is never
+         * coming and reclaim ourselves. 70% leaves real headroom: the ANR-producing session was pinned at
+         * 96% (492 MB of 512 MB, 3% free), where every allocation already stalls behind a GC.
+         */
+        private const val HEAP_HIGH_WATER = 0.70
+
+        /** Three `Runtime` reads; cheap enough to run often, slow enough to be invisible. */
+        private const val HEAP_CHECK_INTERVAL_MS = 60_000L
+
+        /**
+         * Floor between self-triggered reclaims. Pruning cannot free events the UI still holds, so a busy
+         * screen can sit above the high-water mark for a while; without this we would re-prune every
+         * check and burn CPU on a heap that has nothing left to give.
+         */
+        private const val MIN_RECLAIM_INTERVAL_MS = 120_000L
+    }
 }
@@ -214,6 +214,7 @@ private object PrefKeys {
    const val HAS_DONATED_IN_VERSION = "has_donated_in_version"
    const val DISMISSED_POLL_NOTE_IDS = "dismissed_poll_note_ids"
    const val DISMISSED_CHANNEL_INVITES = "dismissed_channel_invites"
+    const val MUTED_PUBLIC_CHATS = "muted_public_chats"
    const val VIEWED_POLL_RESULT_NOTE_IDS = "viewed_poll_result_note_ids"
    const val PENDING_ATTESTATIONS = "pending_attestations"

@@ -650,6 +651,7 @@ object LocalPreferences {
                    putStringSet(PrefKeys.HAS_DONATED_IN_VERSION, settings.hasDonatedInVersion.value)
                    putStringSet(PrefKeys.DISMISSED_POLL_NOTE_IDS, settings.dismissedPollNoteIds.value)
                    putStringSet(PrefKeys.DISMISSED_CHANNEL_INVITES, settings.dismissedChannelInvites.value)
+                    putStringSet(PrefKeys.MUTED_PUBLIC_CHATS, settings.mutedPublicChats.value)
                    putString(
                        PrefKeys.VIEWED_POLL_RESULT_NOTE_IDS,
                        JsonMapper.toJson(settings.viewedPollResultNoteIds.value),
@@ -789,6 +791,7 @@ object LocalPreferences {
                    val hasDonatedInVersion = getStringSet(PrefKeys.HAS_DONATED_IN_VERSION, null) ?: setOf()
                    val dismissedPollNoteIds = getStringSet(PrefKeys.DISMISSED_POLL_NOTE_IDS, null) ?: setOf()
                    val dismissedChannelInvites = getStringSet(PrefKeys.DISMISSED_CHANNEL_INVITES, null) ?: setOf()
+                    val mutedPublicChats = getStringSet(PrefKeys.MUTED_PUBLIC_CHATS, null) ?: setOf()
                    val viewedPollResultNoteIdsStr = getString(PrefKeys.VIEWED_POLL_RESULT_NOTE_IDS, null)
                    val localRelayServers = getStringSet(PrefKeys.LOCAL_RELAY_SERVERS, null) ?: setOf()

@@ -1048,6 +1051,7 @@ object LocalPreferences {
                        hasDonatedInVersion = MutableStateFlow(hasDonatedInVersion),
                        dismissedPollNoteIds = MutableStateFlow(dismissedPollNoteIds),
                        dismissedChannelInvites = MutableStateFlow(dismissedChannelInvites),
+                        mutedPublicChats = MutableStateFlow(mutedPublicChats),
                        viewedPollResultNoteIds = MutableStateFlow(viewedPollResultNoteIdsResolved),
                        pendingAttestations = MutableStateFlow(pendingAttestationsResolved),
                        backupNipA3PaymentTargets = latestPaymentTargetsResolved,
@@ -1254,6 +1258,8 @@ private class InboxPrefs(

 private fun SharedPreferences.readInboxPrefs() =
    InboxPrefs(
+        // Missing key = an account saved before this setting existed. Those keep CUSTOM; only
+        // brand-new logins get the ALWAYS default from AccountSettings' constructor.
        defaultRelayAuthPolicy =
            getString(PrefKeys.DEFAULT_RELAY_AUTH_POLICY, null)
                ?.let { runCatching { RelayAuthPolicy.valueOf(it) }.getOrNull() }
@@ -21,12 +21,12 @@
 package com.vitorpamplona.amethyst.favorites

 import android.content.Context
-import android.util.Log
 import androidx.datastore.preferences.core.edit
 import androidx.datastore.preferences.core.stringPreferencesKey
 import androidx.datastore.preferences.preferencesDataStore
 import com.vitorpamplona.amethyst.commons.browser.OmniboxInput
 import com.vitorpamplona.quartz.nip01Core.core.JsonMapper
+import com.vitorpamplona.quartz.utils.Log
 import kotlinx.coroutines.CoroutineScope
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.SupervisorJob
@@ -21,7 +21,7 @@
 package com.vitorpamplona.amethyst.favorites

 import android.content.Context
-import android.util.Log
+import com.vitorpamplona.quartz.utils.Log
 import kotlinx.coroutines.CoroutineScope
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.SupervisorJob
@@ -24,7 +24,6 @@ import android.app.Activity
 import android.content.Context
 import android.content.res.Configuration
 import android.os.Bundle
-import android.util.Log
 import android.widget.Toast
 import com.vitorpamplona.amethyst.Amethyst
 import com.vitorpamplona.amethyst.R
@@ -41,6 +40,7 @@ import com.vitorpamplona.quartz.nip5aStaticWebsites.NamedSiteEvent
 import com.vitorpamplona.quartz.nip5aStaticWebsites.RootSiteEvent
 import com.vitorpamplona.quartz.nip5dNapplets.NamedNappletEvent
 import com.vitorpamplona.quartz.nip5dNapplets.RootNappletEvent
+import com.vitorpamplona.quartz.utils.Log

 /**
 * Turns a [FavoriteApp] back into a running app. The two cases map to the two launch paths in the
@@ -145,7 +145,7 @@ object FavoriteAppLauncher {
                    profile = HostProfile.WEBSITE,
                )
            else -> {
-                Log.w("FavoriteAppLauncher", "Favorited app not resolvable yet: $coordinate")
+                Log.w("FavoriteAppLauncher") { "Favorited app not resolvable yet: $coordinate" }
                Toast.makeText(context, R.string.favorite_app_still_loading, Toast.LENGTH_SHORT).show()
            }
        }
@@ -21,12 +21,12 @@
 package com.vitorpamplona.amethyst.favorites

 import android.content.Context
-import android.util.Log
 import androidx.datastore.preferences.core.edit
 import androidx.datastore.preferences.core.stringPreferencesKey
 import androidx.datastore.preferences.preferencesDataStore
 import com.vitorpamplona.amethyst.commons.favorites.FavoriteApp
 import com.vitorpamplona.quartz.nip01Core.core.JsonMapper
+import com.vitorpamplona.quartz.utils.Log
 import kotlinx.coroutines.CoroutineScope
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.SupervisorJob
@@ -31,10 +31,12 @@ import com.vitorpamplona.amethyst.commons.connectedApps.signers.InMemoryNostrSig
 import com.vitorpamplona.amethyst.commons.connectedApps.signers.NostrSignerPermissionLedger
 import com.vitorpamplona.amethyst.commons.connectedApps.signers.NostrSignerPermissionStore
 import com.vitorpamplona.amethyst.commons.defaults.Constants
-import com.vitorpamplona.amethyst.commons.defaults.DefaultIndexerRelayList
 import com.vitorpamplona.amethyst.commons.marmot.MarmotManager
 import com.vitorpamplona.amethyst.commons.model.IAccount
+import com.vitorpamplona.amethyst.commons.model.buzz.BuzzChannelStars
+import com.vitorpamplona.amethyst.commons.model.buzz.BuzzHeldAttestations
 import com.vitorpamplona.amethyst.commons.model.buzz.BuzzRelayDialect
+import com.vitorpamplona.amethyst.commons.model.buzz.BuzzWorkspaces
 import com.vitorpamplona.amethyst.commons.model.concord.ConcordChannel
 import com.vitorpamplona.amethyst.commons.model.concord.ConcordChannelListState
 import com.vitorpamplona.amethyst.commons.model.concord.ConcordSessionManager
@@ -61,9 +63,11 @@ import com.vitorpamplona.amethyst.commons.model.nip85TrustedAssertions.ContactCa
 import com.vitorpamplona.amethyst.commons.model.nip85TrustedAssertions.ContactCardsState
 import com.vitorpamplona.amethyst.commons.model.nip85TrustedAssertions.TrustProviderListDecryptionCache
 import com.vitorpamplona.amethyst.commons.model.privateChats.hasEncryptedContent
+import com.vitorpamplona.amethyst.commons.nipACWebRtcCalls.CallManager
 import com.vitorpamplona.amethyst.commons.relayClient.user.UserFinderAccount
 import com.vitorpamplona.amethyst.commons.relayauth.RelayAuthCustomToggles
 import com.vitorpamplona.amethyst.commons.relayauth.RelayAuthPermissionStore
+import com.vitorpamplona.amethyst.commons.relayauth.RelayAuthPolicy
 import com.vitorpamplona.amethyst.commons.richtext.RichTextParser
 import com.vitorpamplona.amethyst.commons.service.pow.PersistedPoWJob
 import com.vitorpamplona.amethyst.commons.service.pow.PoWCategory
@@ -74,6 +78,7 @@ import com.vitorpamplona.amethyst.commons.viewmodels.ReplyMode
 import com.vitorpamplona.amethyst.logTime
 import com.vitorpamplona.amethyst.model.algoFeeds.FavoriteAlgoFeedsOrchestrator
 import com.vitorpamplona.amethyst.model.bolt12Offers.Bolt12OfferListState
+import com.vitorpamplona.amethyst.model.buzz.ChannelInvitesState
 import com.vitorpamplona.amethyst.model.edits.PrivateStorageRelayListDecryptionCache
 import com.vitorpamplona.amethyst.model.edits.PrivateStorageRelayListState
 import com.vitorpamplona.amethyst.model.localRelays.ForwardKind0ToLocalRelayState
@@ -133,6 +138,7 @@ import com.vitorpamplona.amethyst.model.nip78AppSpecific.AppSpecificState
 import com.vitorpamplona.amethyst.model.nip89AppHandlers.AppRecommendationsState
 import com.vitorpamplona.amethyst.model.nipA3PaymentTargets.NipA3PaymentTargetsState
 import com.vitorpamplona.amethyst.model.nipB7Blossom.BlossomServerListState
+import com.vitorpamplona.amethyst.model.serverList.AssumedRelayListsState
 import com.vitorpamplona.amethyst.model.serverList.MergedFollowListsState
 import com.vitorpamplona.amethyst.model.serverList.MergedFollowPlusMineRelayListsState
 import com.vitorpamplona.amethyst.model.serverList.MergedFollowPlusMineWithIndexRelayListsState
@@ -147,6 +153,7 @@ import com.vitorpamplona.amethyst.service.location.LocationState
 import com.vitorpamplona.amethyst.service.relayClient.authCommand.model.InMemoryRelayAuthPermissionStore
 import com.vitorpamplona.amethyst.service.relayClient.authCommand.model.RelayAuthPermissionCache
 import com.vitorpamplona.amethyst.service.relayClient.authCommand.model.RelayAuthPermissionLedger
+import com.vitorpamplona.amethyst.service.relayClient.authCommand.model.RelayAuthSessionGrants
 import com.vitorpamplona.amethyst.service.relayClient.authCommand.model.RelayAuthVenues
 import com.vitorpamplona.amethyst.service.relayClient.chatDelivery.ChatDeliveryTracker
 import com.vitorpamplona.amethyst.service.relayClient.notifyCommand.model.NotifyRequestsCache
@@ -378,12 +385,16 @@ class Account(
    // doubles as the attribution pubkey for ExplainedFilter.accountPubKeys.
    override val userFinderPubkeyHex: HexKey get() = userProfile().pubkeyHex

-    override fun indexRelays(): Set<NormalizedRelayUrl> = indexerRelayList.flow.value.ifEmpty { DefaultIndexerRelayList }
+    // No ifEmpty here on purpose: an empty kind:10086 is the user asking for no indexers, and
+    // IndexerRelayListState already substitutes the defaults for the only case we may override —
+    // never having seen the event. Re-substituting here would undo that choice.
+    override fun indexRelays(): Set<NormalizedRelayUrl> = indexerRelayList.flow.value

    override fun outboxHomeRelays(): Set<NormalizedRelayUrl> = nip65RelayList.allFlowNoDefaults.value + privateStorageRelayList.flow.value + localRelayList.flow.value

-    // searchRelayList.flow already applies the DefaultSearchRelayList fallback internally
-    // (SearchRelayListState.normalizeSearchRelayListWithBackup), so no ifEmpty needed here.
+    // searchRelayList.flow applies DefaultSearchRelayList internally when no kind:10007 has ever
+    // been seen (SearchRelayListState.normalizeSearchRelayListWithBackup); an empty published list
+    // stays empty. No ifEmpty here either way.
    override fun searchRelays(): Set<NormalizedRelayUrl> = (trustedRelayList.flow.value + searchRelayList.flow.value).toSet()

    override fun searchOnlyRelays(): Set<NormalizedRelayUrl> = searchRelayList.flow.value
@@ -406,6 +417,28 @@ class Account(
    // answered without a disk read. Backed by a per-account file (see AccountCacheState).
    val relayAuthPermissions = RelayAuthPermissionCache(relayAuthPermissionStore, scope)

+    // The `block/buzz` workspaces THIS account joined. Per account, not per device: the invite was
+    // redeemed by this key and the relay grants membership to it alone — and this set makes the
+    // relay first-party for NIP-42 (see AuthCoordinator.isFirstParty), so a device-global set would
+    // hand every other logged-in account an automatic login on a workspace it never joined.
+    // Restored/persisted per account by BuzzWorkspacePreferences (see AccountCacheState).
+    val buzzWorkspaces = BuzzWorkspaces()
+
+    // The Buzz channels THIS account pinned. A star says which channels this user wants at the top
+    // of the community view, so a shared set let one account reorder and badge every other one's
+    // channel list. Restored/persisted per account by BuzzChannelStarPreferences.
+    val buzzChannelStars = BuzzChannelStars()
+
+    // The NIP-OA attestation an owner issued to THIS account's key, attached to its Buzz-relay
+    // AUTH so the relay grants virtual membership. Restored/persisted per account by
+    // BuzzAttestationPreferences.
+    val buzzAttestation = BuzzHeldAttestations(pubKey)
+
+    // The relays this account approved by answering the NIP-42 prompt *without* the "remember"
+    // switch. Deliberately in-memory only: it dies with this Account (i.e. with the process, or at
+    // logout), which is what makes it a session grant rather than a stored ALLOW.
+    val relayAuthSessionGrants = RelayAuthSessionGrants()
+
    // Per-account NIP-42 policy evaluator (blocked → per-relay override → global policy → prompt),
    // reading THIS account's own toggles, relay lists and follow graph. Cached here so every AUTH
    // path (foreground screen + background notification consumer) shares one instance, and so an
@@ -414,6 +447,7 @@ class Account(
        RelayAuthPermissionLedger(
            store = relayAuthPermissions,
            globalPolicy = { settings.defaultRelayAuthPolicy.value },
+            sessionGrants = relayAuthSessionGrants,
            customToggles = {
                RelayAuthCustomToggles(
                    myRelaysAndVenues = settings.relayAuthTrustMyRelaysAndVenues.value,
@@ -434,6 +468,27 @@ class Account(
            isVenueHostRelay = { relayUrl -> relayUrl.normalizeRelayUrlOrNull()?.let { it in venueHostRelays() } ?: false },
        )

+    /**
+     * Sets the global NIP-42 policy, dropping every session grant when it becomes
+     * [RelayAuthPolicy.NEVER].
+     *
+     * The two halves belong together, which is why they live here instead of in the settings screen
+     * that used to pair them: a session grant outranks the policy (see
+     * [com.vitorpamplona.amethyst.commons.relayauth.RelayAuthResolver]), so "never log in" only
+     * means what it says if the casual one-tap answers go with it. As a composable's `onClick` that
+     * was a property of one screen rather than of the account, and any other caller of
+     * [AccountSettings.changeDefaultRelayAuthPolicy] silently reintroduced grants that outlive the
+     * switch-it-all-off answer.
+     *
+     * Stored Always/Never exceptions are deliberately left alone: those outrank the policy by
+     * design, and the settings screen lists them, so they are a standing answer rather than a
+     * casual one.
+     */
+    fun changeDefaultRelayAuthPolicy(policy: RelayAuthPolicy) {
+        settings.changeDefaultRelayAuthPolicy(policy)
+        if (policy == RelayAuthPolicy.NEVER) relayAuthSessionGrants.clear()
+    }
+
    /**
     * Relays that exist here because *this account* joined a room on them: the host of every NIP-29
     * relay group on its kind-10009 list, plus the relays of every Concord community on its
@@ -552,6 +607,21 @@ class Account(
    val relayGroupListDecryptionCache = RelayGroupListDecryptionCache(signer)
    val relayGroupList = RelayGroupListState(signer, cache, relayGroupListDecryptionCache, scope, settings)

+    /**
+     * Buzz channels somebody else added me to that I haven't answered yet, projected from the cached
+     * kind-44100/44101 verdicts. Account state rather than screen state because the notifications DAL
+     * reads it to decide whether a cached 44100 is still a live question.
+     */
+    val channelInvites =
+        ChannelInvitesState(
+            me = signer.pubKey,
+            cache = cache,
+            buzzWorkspaces = buzzWorkspaces,
+            relayGroupList = relayGroupList,
+            dismissed = settings.dismissedChannelInvites,
+            scope = scope,
+        )
+
    val concordChannelList = ConcordChannelListState(signer, cache, scope, settings)

    /**
@@ -704,11 +774,18 @@ class Account(
    // the history loader ([AccountNotificationsHistoryEoseManager]) binds its orchestrator to these.
    val notificationHistory = RelayLoadingCursors()

+    // Per-relay backward-paging cursors for the NIP-60 spending history (kind:7376): how far back each
+    // outbox relay has been paged by until+limit. Same lifetime rule as notificationHistory — held here
+    // so paging progress survives leaving and re-entering the wallet screen; the history loader
+    // ([CashuWalletHistoryEoseManager]) binds its orchestrator to these.
+    val cashuHistory = RelayLoadingCursors()
+
    val cashuWalletState =
        com.vitorpamplona.amethyst.model.nip60Cashu.CashuWalletState(
            pubKey = signer.pubKey,
            signer = signer,
            cache = cache,
+            client = client,
            scope = scope,
            outboxRelaysFlow = outboxRelays.flow,
            inboxRelaysFlow = notificationRelays.flow,
@@ -737,6 +814,9 @@ class Account(

    val trustedRelays = TrustedRelayListsState(nip65RelayList, privateStorageRelayList, localRelayList, dmRelayList, searchRelayList, indexerRelayList, proxyRelayList, trustedRelayList, broadcastRelayList, scope)

+    /** Relays guessed on the user's behalf until their own lists arrive. Read only by Tor routing. */
+    val assumedRelays = AssumedRelayListsState(nip65RelayList, searchRelayList, indexerRelayList, scope)
+
    // Follows Relays
    val followOutboxesOrProxy = FollowListOutboxOrProxyRelays(kind3FollowList, blockedRelayList, proxyRelayList, cache, scope)

@@ -768,6 +848,30 @@ class Account(

    val newNotesPreProcessor = EventProcessor(this, cache)

+    /**
+     * Owns the WebRTC call state machine.
+     *
+     * Account-scoped on purpose: a call outlives the main UI. It runs in its own
+     * [com.vitorpamplona.amethyst.ui.call.CallActivity] (a separate task, since MainActivity is
+     * `singleInstance`) backed by a foreground service, so Android is free to destroy the
+     * backgrounded MainActivity while the call is up — which it does routinely, e.g. a few hundred
+     * milliseconds after CallActivity enters picture-in-picture on HOME. While this lived on
+     * `AccountViewModel` (and ran on `viewModelScope`), that destruction cleared the ViewModel and
+     * reset the call to Idle, hanging up mid-conversation.
+     *
+     * Torn down with the account: [scope] is cancelled by
+     * `AccountCacheState.removeAccount`, which also calls [CallManager.dispose] for the
+     * independent watchdog scope.
+     */
+    val callManager =
+        CallManager(
+            signer = signer,
+            scope = scope,
+            isFollowing = { isFollowing(it) },
+            publishEvent = { wrap -> scope.launch { publishCallSignaling(wrap) } },
+            isCallsEnabled = { settings.callsEnabled.value },
+        )
+
    // Per-message publish acceptance (relay OKs), feeding the delivery ticks on
    // own chat bubbles.
    val chatDeliveryTracker = ChatDeliveryTracker(client)
@@ -1034,6 +1138,15 @@ class Account(
        sendNewAppSpecificData()
    }

+    /**
+     * Local state first, then publish. The local write is what every suppression point
+     * reads, so it must not wait on the signer — publishing is best-effort sync.
+     */
+    suspend fun toggleMutedPublicChat(channelId: String) {
+        settings.toggleMutedPublicChat(channelId)
+        sendNewAppSpecificData()
+    }
+
    suspend fun updateZapAmounts(
        amountSet: List<Long>,
        selectedZapType: LnZapEvent.ZapType,
@@ -3543,6 +3656,24 @@ class Account(
    init {
        Log.d("AccountRegisterObservers", "Init")

+        // Route incoming call signaling into the state machine as soon as the account exists, so
+        // offers are not missed while no UI is mounted.
+        newNotesPreProcessor.callManager = callManager
+
+        // Blocking a relay has to forget any "just for now" login to it, or unblocking later would
+        // silently resume authenticating off an answer given before the block. Blocking is the
+        // strongest signal available here — the weaker "never allow" already drops the grant via
+        // RelayAuthPermissionLedger.setDecision, so it would be odd for the stronger one not to.
+        //
+        // Observed rather than hooked onto the local block action because the kind-10006 list is
+        // shared: a block published by another client arrives as a flow update with no call of ours
+        // behind it.
+        scope.launch {
+            blockedRelayList.flow.collect { blocked ->
+                relayAuthLedger.revokeSessionGrantsFor(blocked.map { it.url })
+            }
+        }
+
        // Start the Cashu wallet state observers AFTER all field initializers
        // complete — auto-redeem can fire as soon as start() returns, and it
        // calls back into sendLiterallyEverywhere which depends on
@@ -1381,7 +1381,7 @@ class AccountConcordActions(
            val bannedHere = authority.isBanned(account.signer.pubKey)
            val merged = ConcordActions.recoverStranded(entry, bundle, bannedHere) ?: continue
            if (!adoptedConcordRotations.add("${entry.id}:${merged.rootEpoch}")) continue
-            Log.i("Concord", "Stranded recovery: ${entry.id} ${entry.rootEpoch} -> ${merged.rootEpoch}")
+            Log.i("Concord") { "Stranded recovery: ${entry.id} ${entry.rootEpoch} -> ${merged.rootEpoch}" }
            account.sendMyPublicAndPrivateOutbox(account.concordChannelList.follow(merged))
            announceConcordGuestbookJoin(merged, inviteCreator = null, inviteLabel = null)
        }
@@ -1521,11 +1521,10 @@ class AccountConcordActions(
        val events = account.client.fetchAll(filters = relays.associateWith { listOf(filter) }, idleTimeoutMs = 30_000L)
        val newest = events.filterIsInstance<ConcordCommunityListEvent>().maxByOrNull { it.createdAt }
        val entryCount = newest?.let { runCatching { it.decrypt(account.signer).size }.getOrElse { -1 } } ?: 0
-        Log.d(
-            "Concord",
+        Log.d("Concord") {
            "importConcordCommunities: queried ${relays.size} relays, fetched ${events.size} 13302 event(s), " +
-                "newest=${newest?.id?.take(8)}@${newest?.createdAt}, decoded $entryCount entr${if (entryCount == 1) "y" else "ies"}",
-        )
+                "newest=${newest?.id?.take(8)}@${newest?.createdAt}, decoded $entryCount entr${if (entryCount == 1) "y" else "ies"}"
+        }
        newest?.let { account.cache.justConsumeMyOwnEvent(it) }
    }

@@ -1600,6 +1599,6 @@ class AccountConcordActions(
        val byRelay = authorsByRelay.mapValues { (_, authors) -> listOf(ConcordActions.planeFilterFor(authors.toList())) }
        var drained = 0
        account.client.fetchAllPagesFromPool(filters = byRelay) { _, _ -> drained++ }
-        Log.d("Concord", "syncConcordControlPlanes: paged ${authorsByRelay.size} relay(s), drained $drained control wrap(s)")
+        Log.d("Concord") { "syncConcordControlPlanes: paged ${authorsByRelay.size} relay(s), drained $drained control wrap(s)" }
    }
 }
@@ -330,6 +330,14 @@ class AccountSettings(
     * still lists you, and Leave (kind 9022) is the separate action that actually removes you.
     */
    val dismissedChannelInvites: MutableStateFlow<Set<String>> = MutableStateFlow(setOf()),
+    /**
+     * NIP-28 channel ids the user has silenced. Local device state ON PURPOSE, even
+     * though it also syncs via NIP-78: the push dispatcher must answer "is this muted?"
+     * during a cold start, before (or without) the settings blob having been decrypted —
+     * for a NIP-55 account that decrypt is an Amber IPC round-trip that may never
+     * complete in the background. See AppSpecificState.kt:70-75.
+     */
+    val mutedPublicChats: MutableStateFlow<Set<String>> = MutableStateFlow(setOf()),
    val viewedPollResultNoteIds: MutableStateFlow<Map<String, Long>> = MutableStateFlow(mapOf()),
    val pendingAttestations: MutableStateFlow<Map<HexKey, String>> = MutableStateFlow(mapOf()),
    var backupNipA3PaymentTargets: PaymentTargetsEvent? = null,
@@ -338,7 +346,9 @@ class AccountSettings(
    var callVideoResolution: CallVideoResolution = CallVideoResolution.HD_720,
    var callMaxBitrateBps: Int = 1_500_000,
    val callsEnabled: MutableStateFlow<Boolean> = MutableStateFlow(true),
-    val defaultRelayAuthPolicy: MutableStateFlow<RelayAuthPolicy> = MutableStateFlow(RelayAuthPolicy.CUSTOM),
+    // New accounts authenticate with every relay that asks. Existing accounts keep whatever they
+    // had saved (LocalPreferences falls back to CUSTOM for prefs written before this key existed).
+    val defaultRelayAuthPolicy: MutableStateFlow<RelayAuthPolicy> = MutableStateFlow(RelayAuthPolicy.ALWAYS),
    val relayGroupViewMode: MutableStateFlow<RelayGroupViewMode> = MutableStateFlow(RelayGroupViewMode.DEFAULT),
    val concordViewMode: MutableStateFlow<ConcordViewMode> = MutableStateFlow(ConcordViewMode.DEFAULT),
    // Which conversation protocols the Messages inbox loads and shows. A disabled type is both hidden
@@ -778,6 +788,62 @@ class AccountSettings(
    // list names
    // ---

+    /**
+     * All per-screen persisted feed filters paired with their factory default.
+     * Deleting a list (NIP-51 people list / follow pack) must reset any screen whose
+     * filter still points at the deleted address — otherwise the screen keeps a
+     * dangling [TopFilter.PeopleList] that re-creates an empty AddressableNote shell
+     * on every start and shows the list's dTag/UUID in the top bar instead of a name.
+     */
+    private val feedFiltersWithDefaults: List<Pair<MutableStateFlow<TopFilter>, TopFilter>> =
+        listOf(
+            defaultHomeFollowList to TopFilter.AllFollows,
+            defaultStoriesFollowList to TopFilter.Global,
+            defaultNotificationFollowList to TopFilter.Selected,
+            defaultDiscoveryFollowList to TopFilter.Global,
+            defaultPollsFollowList to TopFilter.Global,
+            defaultPicturesFollowList to TopFilter.Global,
+            defaultNappletsFollowList to TopFilter.Global,
+            defaultNsitesFollowList to TopFilter.Global,
+            defaultWorkoutsFollowList to TopFilter.Global,
+            defaultGitRepositoriesFollowList to TopFilter.Global,
+            defaultHighlightsFollowList to TopFilter.Global,
+            defaultCalendarsFollowList to TopFilter.Global,
+            defaultProductsFollowList to TopFilter.AroundMe,
+            defaultShortsFollowList to TopFilter.Global,
+            defaultPublicChatsFollowList to TopFilter.Global,
+            defaultLiveStreamsFollowList to TopFilter.Global,
+            defaultNestsFollowList to TopFilter.Global,
+            defaultLongsFollowList to TopFilter.Global,
+            defaultArticlesFollowList to TopFilter.AllFollows,
+            defaultMusicTracksFollowList to TopFilter.Global,
+            defaultMusicPlaylistsFollowList to TopFilter.Global,
+            defaultPodcastEpisodesFollowList to TopFilter.Global,
+            defaultPodcastsFollowList to TopFilter.Global,
+            defaultSoftwareAppsFollowList to TopFilter.Global,
+            defaultBadgesFollowList to TopFilter.Mine,
+            defaultBrowseEmojiSetsFollowList to TopFilter.Global,
+            defaultCommunitiesFollowList to TopFilter.AllFollows,
+            defaultFollowPacksFollowList to TopFilter.Global,
+            defaultAppRecommendationsFollowList to TopFilter.Global,
+            defaultRelayGroupsDiscoveryFollowList to TopFilter.Mine,
+        )
+
+    /** Resets every persisted feed filter that points at the deleted list's address. */
+    fun resetFeedFiltersPointingTo(address: Address) {
+        var changed = false
+
+        feedFiltersWithDefaults.forEach { (flow, default) ->
+            val current = flow.value
+            if (current is TopFilter.AddressableTopFilter && current.address == address) {
+                flow.tryEmit(default)
+                changed = true
+            }
+        }
+
+        if (changed) saveAccountSettings()
+    }
+
    fun changeDefaultHomeFollowList(name: FeedDefinition) {
        changeDefaultHomeFollowList(name.code)
    }
@@ -1513,6 +1579,14 @@ class AccountSettings(
            backupAppSpecificData = appSettings
            syncedSettings.updateFrom(newSyncedSettings)

+            // Null means an older client rewrote the blob without this key — leave the
+            // local set alone rather than treating "absent" as "unmute everything".
+            // The decision lives in mergeMutedPublicChats so it is unit-testable; this
+            // class cannot be constructed in a JVM test.
+            mutedPublicChats.tryEmit(
+                mergeMutedPublicChats(mutedPublicChats.value, newSyncedSettings.chats.mutedPublicChats),
+            )
+
            saveAccountSettings()
        }
    }
@@ -1612,6 +1686,17 @@ class AccountSettings(
        saveAccountSettings()
    }

+    // ---
+    // muted public chats
+    // ---
+
+    fun toggleMutedPublicChat(channelId: String) {
+        mutedPublicChats.update {
+            if (channelId in it) it - channelId else it + channelId
+        }
+        saveAccountSettings()
+    }
+
    // ---
    // viewed poll results
    // ---
@@ -90,7 +90,7 @@ class AccountSyncedSettings(
            MutableStateFlow(DrawerItemVisibility.sanitize(navBarItemsFromNames(internalSettings.navigation.hiddenDrawerItems))),
        )

-    fun toInternal(): AccountSyncedSettingsInternal =
+    fun toInternal(mutedPublicChats: Set<String>): AccountSyncedSettingsInternal =
        AccountSyncedSettingsInternal(
            reactions = AccountReactionPreferencesInternal(reactions.reactionChoices.value, reactions.reactionRowItems.value),
            zaps =
@@ -120,7 +120,12 @@ class AccountSyncedSettings(
                ),
            videoPlayer = AccountVideoPlayerPreferencesInternal(videoPlayer.buttonItems.value),
            media = AccountMediaPreferencesInternal(media.audioVisualizer.value.name),
-            chats = AccountChatPreferencesInternal(chats.pinnedChatrooms.value.map { it.users.sorted() }),
+            chats =
+                AccountChatPreferencesInternal(
+                    chats.pinnedChatrooms.value.map { it.users.sorted() },
+                    // sorted so the serialized form is deterministic
+                    mutedPublicChats.sorted(),
+                ),
            proofOfWork =
                AccountPoWPreferencesInternal(
                    proofOfWork.difficulty.value,
@@ -242,4 +242,14 @@ class AccountChatPreferencesInternal(
    // pubkeys (hex) sorted ascending, so the serialized form is deterministic
    // regardless of set iteration order.
    var pinnedRooms: List<List<String>> = emptyList(),
+    // NIP-28 channel ids (hex) whose notifications are silenced, sorted ascending
+    // for the same determinism reason as pinnedRooms.
+    //
+    // NULLABLE ON PURPOSE. The default has to tell two cases apart:
+    //   null = key absent — an older client rewrote the blob and dropped it, so
+    //          the local mute set must be left alone.
+    //   []   = an explicit "unmute everything" from a client that knows the field.
+    // A non-null default would collapse them and let an old client silently erase
+    // the user's mutes on every launch. See updateAppSpecificData.
+    var mutedPublicChats: List<String>? = null,
 )
@@ -72,7 +72,15 @@ class AccountZapActions(
        lnurl: String? = null,
    ) = LnZapRequestEvent.create(
        zappedEvent = event,
-        relays = account.nip65RelayList.inboxFlow.value + (additionalRelays ?: emptySet()),
+        // Where the provider should publish the receipt. Zapping group content pins that to the room's
+        // host relay: the receipt belongs where the message it pays for lives, so the room can show it
+        // and the recipient's group query can find it — and, for a private or closed group, so a
+        // kind-9735 naming the room never lands on a relay outside it. Everything else keeps the
+        // ordinary NIP-65 inbox routing.
+        relays =
+            account.cache.relayGroupHostsFor(event).ifEmpty {
+                account.nip65RelayList.inboxFlow.value
+            } + (additionalRelays ?: emptySet()),
        signer = account.signer,
        pollOption = pollOption,
        message = message,
@@ -91,18 +99,20 @@ class AccountZapActions(

    suspend fun sendNwcRequest(
        request: Request,
+        onTimeout: () -> Unit = {},
        onResponse: (Response?) -> Unit,
    ) {
-        val (event, relay) = account.nip47SignerState.sendNwcRequest(request, onResponse)
+        val (event, relay) = account.nip47SignerState.sendNwcRequest(request, onTimeout, onResponse)
        account.client.publish(event, setOf(relay))
    }

    suspend fun sendNwcRequestToWallet(
        walletUri: Nip47WalletConnect.Nip47URINorm,
        request: Request,
+        onTimeout: () -> Unit = {},
        onResponse: (Response?) -> Unit,
    ): HexKey {
-        val (event, relay) = account.nip47SignerState.sendNwcRequestToWallet(walletUri, request, onResponse)
+        val (event, relay) = account.nip47SignerState.sendNwcRequestToWallet(walletUri, request, onTimeout, onResponse)
        account.client.publish(event, setOf(relay))
        return event.id
    }
@@ -119,12 +129,20 @@ class AccountZapActions(
     */
    fun cleanupNwcRequest(requestId: HexKey) = LocalCache.paymentTracker.cleanup(requestId)

+    /**
+     * @param onTimeout invoked when no kind-23195 reply arrives before
+     *   [NwcSignerState.NWC_RESPONSE_TIMEOUT_MS]. Pass one on any path with a user
+     *   watching: without it a response lost in transit is indistinguishable from
+     *   the action never having happened.
+     */
    suspend fun sendZapPaymentRequestFor(
        bolt11: String,
        zappedNote: Note?,
+        onTimeout: () -> Unit = {},
+        metadata: Map<String, Any?>? = null,
        onResponse: (Response?) -> Unit,
    ) {
-        val (event, relay) = account.nip47SignerState.sendZapPaymentRequestFor(bolt11, zappedNote, onResponse)
+        val (event, relay) = account.nip47SignerState.sendZapPaymentRequestFor(bolt11, zappedNote, onTimeout, metadata, onResponse)
        account.client.publish(event, setOf(relay))
    }

@@ -35,6 +35,7 @@ import com.vitorpamplona.quartz.nip01Core.signers.EventTemplate
 import com.vitorpamplona.quartz.nip01Core.signers.NostrSigner
 import com.vitorpamplona.quartz.nip01Core.signers.NostrSignerInternal
 import com.vitorpamplona.quartz.nip17Dm.base.BaseDMGroupEvent
+import com.vitorpamplona.quartz.nip29RelayGroups.isGroupScoped
 import com.vitorpamplona.quartz.nip37Drafts.DraftWrapEvent
 import com.vitorpamplona.quartz.nip51Lists.bookmarkList.BookmarkListEvent
 import com.vitorpamplona.quartz.nip51Lists.bookmarkList.OldBookmarkListEvent
@@ -111,6 +112,11 @@ class EventBroadcaster(
        val channelRelays = account.cache.getAnyChannel(event)?.relays()
        if (channelRelays != null && channelRelays.isNotEmpty()) return false

+        // A group-scoped event whose room this cache doesn't know yet: it still must not go to the
+        // broadcast list. Its `h` tag names a room only its host can serve, so broadcasting it says
+        // "I am in this group" to relays that can do nothing with the content.
+        if (event.isGroupScoped()) return false
+
        return true
    }

@@ -143,6 +149,16 @@ class EventBroadcaster(
            return emptySet()
        }

+        // NIP-29 group content, and everything that refers to it — a kind-9 message, a kind-1111 comment,
+        // a like, a zap request — exists in a room on a host relay and nowhere else. The room's members
+        // read it there; the author's outbox and the broadcast list can neither serve it to them nor do
+        // anything else useful with it, and for a private or closed group publishing it there advertises
+        // who is in which room. So the host wins outright rather than being one more relay in the union.
+        // Same rule the group reply composer already applies (CommentPostViewModel), applied to every
+        // group-scoped event instead of just that one path.
+        val groupHosts = account.cache.relayGroupHostsFor(event)
+        if (groupHosts.isNotEmpty()) return groupHosts
+
        val includeBroadcast = wantsBroadcastRelays(event)
        val broadcastRelays = if (includeBroadcast) account.broadcastRelayList.flow.value else emptySet()

@@ -27,7 +27,6 @@ import com.vitorpamplona.amethyst.Amethyst
 import com.vitorpamplona.amethyst.commons.cashu.MintDirectoryIndex
 import com.vitorpamplona.amethyst.commons.model.Channel
 import com.vitorpamplona.amethyst.commons.model.OnchainZapStatus
-import com.vitorpamplona.amethyst.commons.model.buzz.BuzzChannelInvites
 import com.vitorpamplona.amethyst.commons.model.buzz.BuzzCommunityMembership
 import com.vitorpamplona.amethyst.commons.model.buzz.BuzzDmRegistry
 import com.vitorpamplona.amethyst.commons.model.buzz.BuzzPresenceState
@@ -750,6 +749,21 @@ object LocalCache : ILocalCache, ICacheProvider, Dao {
        return relayGroupChannels.filter { key, _ -> key.id == groupId }.singleOrNull()
    }

+    /**
+     * Every host relay of the NIP-29 group [event] is scoped to (its `h` tag), or an empty set when the
+     * event carries no group scope or the group is unknown to this cache.
+     *
+     * Keyed by group id alone rather than by [GroupId]: an event about to be *sent* (a reaction, a zap
+     * request, a comment) knows which room it belongs to but not which relay hosts it — that is exactly
+     * what this resolves. Group ids are relay-minted UUIDs, so the same id on two hosts is a
+     * theoretical case, and answering with both is the safe reading of it: the content reaches every
+     * host that claims the room, and none that don't.
+     */
+    fun relayGroupHostsFor(event: Event): Set<NormalizedRelayUrl> {
+        val groupId = event.groupId() ?: return emptySet()
+        return relayGroupChannels.filter { key, _ -> key.id == groupId }.mapTo(mutableSetOf()) { it.groupId.relayUrl }
+    }
+
    fun getLiveActivityChannelIfExists(key: Address): LiveActivitiesChannel? = liveChatChannels.get(key)

    fun getNoteIfExists(event: Event): Note? =
@@ -811,6 +825,12 @@ object LocalCache : ILocalCache, ICacheProvider, Dao {
            false
        }

+    /**
+     * Checks if a kind-5 event from the addressable's own author has deleted this
+     * address. Works for empty addressable shells whose event is not loaded yet.
+     */
+    fun hasBeenDeleted(address: Address): Boolean = deletionIndex.hasBeenDeleted(address, address.pubKeyHex)
+
    fun getOrAddAliasNote(
        idHex: String,
        note: Note,
@@ -1258,6 +1278,22 @@ object LocalCache : ILocalCache, ICacheProvider, Dao {
                event.tagsWithoutCitations().filter { it != event.repository()?.toTag() }.mapNotNull { checkGetOrCreateNote(it) }
            }

+            is GitPullRequestUpdateEvent -> {
+                // Link the update to its parent PR so it lands in the PR's
+                // replies collection (and picks up its target for threading).
+                // The repository ATag isn't a reply target — skip it.
+                listOfNotNull(event.parentPullRequestId()?.let { checkGetOrCreateNote(it) })
+            }
+
+            is GitStatusEvent -> {
+                // A status event roots itself at a patch/PR/issue via a
+                // marked-`root` `e` tag; link only that so the transition
+                // appears in the target's replies (GitStatusIndex reduces the
+                // observed stream separately and doesn't need this wiring, but
+                // ThreadFeedView and the notifications-tab reply chain do).
+                listOfNotNull(event.rootEventId()?.let { checkGetOrCreateNote(it) })
+            }
+
            is TextNoteEvent -> {
                event.tagsWithoutCitations().mapNotNull { checkGetOrCreateNote(it) }
            }
@@ -2327,20 +2363,19 @@ object LocalCache : ILocalCache, ICacheProvider, Dao {
        }

    /**
-     * A kind-44101 "you were removed from a channel". Consumed like any other Buzz event, then used to
-     * withdraw any pending add-prompt for that channel: once the relay has taken the membership away
-     * there is nothing left to accept, so leaving the card up would offer an action that cannot succeed.
+     * A kind-44101 "you were removed from a channel". Stored like any other Buzz event and nothing more:
+     * withdrawing the matching add-prompt is not a side effect of ingest but a consequence of the stored
+     * event, since
+     * [com.vitorpamplona.amethyst.commons.model.buzz.BuzzChannelInvites.pendingInvites] resolves each
+     * channel to its newest verdict. That ordering is what makes the two kinds arriving out of order —
+     * routine on a re-subscribe, where the relay replays the whole history — produce the same answer as
+     * them arriving in order.
     */
    private fun consume(
        event: MemberRemovedNotificationEvent,
        relay: NormalizedRelayUrl?,
        wasVerified: Boolean,
-    ): Boolean =
-        consumeBuzzRegularEvent(event, relay, wasVerified).also {
-            val target = event.target() ?: return@also
-            val channelId = event.channel() ?: return@also
-            BuzzChannelInvites.remove(target, channelId)
-        }
+    ): Boolean = consumeBuzzRegularEvent(event, relay, wasVerified)

    /**
     * Attach a group-scoped content event (a kind-9 chat, kind-1068 poll, …
@@ -3089,6 +3124,16 @@ object LocalCache : ILocalCache, ICacheProvider, Dao {
        wasVerified: Boolean,
    ): Boolean {
        val requestId = event.requestId()
+
+        // Duplicate delivery, checked before the tracker so the warnings below mean one
+        // thing each. Some NWC relays replay every cached kind-23195 whenever the REQ
+        // filter changes (see NWCPaymentFilterAssembler), so an already-answered response
+        // arrives again and again. Its first copy consumed the pending request, so the
+        // replays would otherwise be reported as "no pending request is registered" —
+        // the same line a genuinely late response produces, which made the two
+        // indistinguishable in the field.
+        if (getNoteIfExists(event.id)?.event != null) return false
+
        val pending =
            when (val match = paymentTracker.onResponseReceived(requestId, event.pubKey)) {
                is NwcPaymentTracker.MatchResult.Matched -> {
@@ -3108,9 +3153,12 @@ object LocalCache : ILocalCache, ICacheProvider, Dao {
                }

                NwcPaymentTracker.MatchResult.NoMatch -> {
+                    // Not a replay — those are filtered above — so this is the first time we
+                    // have seen this response and nothing is waiting for it.
                    Log.w("LocalCache") {
                        "NWC response ${event.id} from ${event.pubKey} references request e=$requestId but no pending request is registered. " +
-                            "The response was either delivered after timeout, the user holds a stale subscription, or the wallet service set the wrong e tag."
+                            "The response arrived after the client gave up waiting, the user holds a stale subscription, " +
+                            "or the wallet service set the wrong e tag."
                    }
                    return false
                }
@@ -3124,7 +3172,8 @@ object LocalCache : ILocalCache, ICacheProvider, Dao {
        val note = getOrCreateNote(event.id)
        val author = getOrCreateUser(event.pubKey)

-        // Already processed this event.
+        // Backstop for a concurrent delivery that loaded the event between the replay
+        // check above and here. Same outcome, no warning: it is not a protocol problem.
        if (note.event != null) return false

        if (wasVerified || justVerify(event)) {
@@ -0,0 +1,81 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.model
+
+import com.vitorpamplona.quartz.nip01Core.core.Event
+import com.vitorpamplona.quartz.nip01Core.core.HexKey
+import com.vitorpamplona.quartz.nip28PublicChat.admin.ChannelCreateEvent
+import com.vitorpamplona.quartz.nip28PublicChat.admin.ChannelMetadataEvent
+import com.vitorpamplona.quartz.nip28PublicChat.message.ChannelMessageEvent
+
+/**
+ * The NIP-28 channel an event belongs to, or null when [event] is not one of the three
+ * public-chat event types a channel row's newest event can be.
+ *
+ * This is THE definition of "which event identifies a public-chat room" — the row dispatch
+ * (ChatroomHeaderCompose), the last-read route (ChatroomRowUnread.rowLastReadRoute), the
+ * feed's row de-duplication (ChatroomListKnownFeedFilter) and the mute predicate below all
+ * call it. It used to be copied into each of those by hand, and the copies drifted: one of
+ * them matched only [ChannelMessageEvent], so a channel whose latest activity was a topic
+ * edit silently lost its unread dot. Keep it a single function.
+ *
+ * Deliberately NOT `threadRootIdOrSelf()`. That returns the same channel id here — a
+ * NIP-28 message's NIP-10 root marker IS its channel — but it means something else
+ * (the NIP-51 "muted thread" key, which HIDES content). Keeping the two apart is what
+ * stops "mute notifications" and "mute thread" from bleeding into each other.
+ *
+ * Matched on concrete types rather than the IsInPublicChatChannel interface, which the
+ * channel-admin events ChannelHideMessageEvent/ChannelMuteUserEvent also implement: those
+ * must fall through to null rather than be treated as room activity.
+ */
+fun publicChatChannelIdOf(event: Event?): HexKey? =
+    when (event) {
+        is ChannelMessageEvent, is ChannelMetadataEvent -> event.channelId()
+        is ChannelCreateEvent -> event.id
+        else -> null
+    }
+
+/** True when [event] is a public-chat message in a channel the user has silenced. */
+fun isMutedPublicChatMessage(
+    event: Event?,
+    mutedChannels: Set<HexKey>,
+): Boolean {
+    if (mutedChannels.isEmpty()) return false
+    val channelId = publicChatChannelIdOf(event) ?: return false
+    return channelId in mutedChannels
+}
+
+/**
+ * The inbound-sync decision for the mute set, kept separate from [AccountSettings] so it can be
+ * tested: [AccountSettings] builds a default `AccountSyncedSettingsInternal`, whose language
+ * preferences call `Resources.getSystem()`, so it cannot be constructed in a JVM unit test.
+ *
+ * [remote] is `null` when an older client rewrote the NIP-78 blob without the key. The local set
+ * must survive that — and because `AppSpecificState` replays the cached backup event on every app
+ * start, treating absent as empty would re-clear the user's mutes on every single launch.
+ *
+ * An explicitly empty list is different: it is a real "unmute everything" from a client that knows
+ * the field, and is adopted.
+ */
+fun mergeMutedPublicChats(
+    local: Set<HexKey>,
+    remote: List<HexKey>?,
+): Set<HexKey> = remote?.toSet() ?: local
@@ -73,6 +73,13 @@ class AccountCacheState(
    val signerPermissionStore: NostrSignerPermissionStore = InMemoryNostrSignerPermissionStore(),
    /** App-global store of connected NIP-46 client display + relay info. */
    val nip46ClientStore: Nip46ClientStore = InMemoryNip46ClientStore(),
+    /**
+     * Starts per-account persistence of the Buzz client-side bookkeeping that has no Nostr event to
+     * rebuild from — the joined workspaces and the starred channels (restore now, mirror later
+     * changes). A lambda because those stores need an Android `Context` and this class deliberately
+     * takes none; no-op by default so tests and non-Android hosts build an Account without it.
+     */
+    val startBuzzPersistence: (Account) -> Unit = { },
 ) {
    val accounts = MutableStateFlow<Map<HexKey, Account>>(emptyMap())

@@ -83,6 +90,9 @@ class AccountCacheState(
        accounts.update { existingAccounts ->
            val oldValue = existingAccounts[pubkey]
            oldValue?.scope?.cancel()
+            // CallManager keeps its own watchdog scope, independent of the account scope
+            // cancelled above, so it has to be disposed explicitly.
+            oldValue?.callManager?.dispose()
            // Unregisters the tracker's persistent listener from the shared
            // client; without this every removed account leaks a listener.
            oldValue?.chatDeliveryTracker?.destroy()
@@ -104,7 +114,7 @@ class AccountCacheState(
                loadAccount(accountSettings)
            } catch (e: Exception) {
                if (e is kotlinx.coroutines.CancellationException) throw e
-                Log.w("AccountCacheState", "Failed to preload account ${savedAccount.npub}: ${e.message}", e)
+                Log.w("AccountCacheState", "Failed to preload account ${savedAccount.npub}", e)
            }
        }
    }
@@ -137,7 +147,7 @@ class AccountCacheState(
    fun deleteAccountFiles(pubkey: HexKey) {
        val dir = File(accountsRootDir(), pubkey)
        if (dir.exists() && !dir.deleteRecursively()) {
-            Log.w("AccountCacheState", "Failed to delete account directory ${dir.absolutePath}")
+            Log.w("AccountCacheState") { "Failed to delete account directory ${dir.absolutePath}" }
        }
    }

@@ -153,7 +163,7 @@ class AccountCacheState(
                if (child.deleteRecursively()) {
                    Log.d("AccountCacheState") { "Pruned orphan account dir ${child.name.take(8)}…" }
                } else {
-                    Log.w("AccountCacheState", "Failed to prune orphan account dir ${child.absolutePath}")
+                    Log.w("AccountCacheState") { "Failed to prune orphan account dir ${child.absolutePath}" }
                }
            }
        }
@@ -275,7 +285,7 @@ class AccountCacheState(
                    Dispatchers.IO +
                        SupervisorJob() +
                        CoroutineExceptionHandler { _, throwable ->
-                            Log.e("AccountCacheState", "Account ${signer.pubKey} caught exception: ${throwable.message}", throwable)
+                            Log.e("AccountCacheState", "Account ${signer.pubKey} caught exception", throwable)
                        },
                ),
            mlsGroupStateStore = mlsStore,
@@ -286,6 +296,10 @@ class AccountCacheState(
            signerPermissionStore = signerPermissionStore,
            nip46ClientStore = nip46ClientStore,
        ).also { newAccount ->
+            // Per account, not per device: the joined set makes a relay first-party for NIP-42, so a
+            // shared one hands every other logged-in account an automatic login on a workspace it
+            // never joined, and a shared star set reorders everyone's channel list at once.
+            startBuzzPersistence(newAccount)
            accounts.update { existingAccounts ->
                existingAccounts.plus(Pair(signer.pubKey, newAccount))
            }
@@ -0,0 +1,171 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.model.buzz
+
+import com.vitorpamplona.amethyst.commons.model.buzz.ChannelClassification
+import com.vitorpamplona.amethyst.commons.model.buzz.MembershipNotice
+import com.vitorpamplona.amethyst.model.LocalCache
+import com.vitorpamplona.amethyst.model.Note
+import com.vitorpamplona.amethyst.model.filterIntoSet
+import com.vitorpamplona.amethyst.service.relayClient.reqCommand.account.buzz.MembershipNotificationKinds
+import com.vitorpamplona.quartz.buzz.notifications.MemberAddedNotificationEvent
+import com.vitorpamplona.quartz.buzz.notifications.MemberRemovedNotificationEvent
+import com.vitorpamplona.quartz.nip01Core.core.HexKey
+import com.vitorpamplona.quartz.nip01Core.relay.filters.Filter
+import com.vitorpamplona.quartz.nip01Core.relay.normalizer.NormalizedRelayUrl
+import com.vitorpamplona.quartz.nip29RelayGroups.GroupId
+import com.vitorpamplona.quartz.nip29RelayGroups.metadata.GroupMetadataEvent
+
+/*
+ * The cache-side view of the Buzz membership stream: everything that reads kind-44100/44101 out of
+ * LocalCache instead of asking a relay for its own copy.
+ *
+ * The relay subscription lives in BuzzMembershipEoseManager, mounted with the rest of the account
+ * loaders. Every consumer of the stream — the Notifications feed's invite cards and Buzz DM discovery —
+ * observes the cache through here, so there is exactly one `#p=me` REQ per workspace relay for all of
+ * them.
+ *
+ * This is model code, not UI: the notifications DAL reads it from `acceptableEvent`, so it must not
+ * live under `ui/`.
+ */
+
+/** Every membership verdict addressed to [me], as the cache observers want it. */
+fun membershipNoticeFilter(me: HexKey) =
+    Filter(
+        kinds = MembershipNotificationKinds,
+        tags = mapOf("p" to listOf(me)),
+    )
+
+/**
+ * The workspace relay that vouched for this notice.
+ *
+ * A note records every relay it was seen on, and a Buzz membership notification is only meaningful on
+ * the relay that issued it — the channel UUID it names is that relay's. So prefer a relay we joined as a
+ * workspace; fall back to whatever else delivered it, which keeps a notice usable when the workspace set
+ * hasn't been restored from disk yet.
+ *
+ * [workspaces] is passed in rather than read from a singleton because the joined set is per account
+ * (`Account.buzzWorkspaces`): whose workspaces to prefer is a question only the caller can answer.
+ */
+private fun Note.membershipRelay(workspaces: Set<NormalizedRelayUrl>): NormalizedRelayUrl? {
+    val seen = relays
+    if (seen.isEmpty()) return null
+    return seen.firstOrNull { it in workspaces } ?: seen.first()
+}
+
+/** Flattens a cached kind-44100/44101 into a [MembershipNotice], or null when it isn't usable. */
+fun Note.toMembershipNotice(workspaces: Set<NormalizedRelayUrl>): MembershipNotice? {
+    val relay = membershipRelay(workspaces) ?: return null
+    return when (val noteEvent = event) {
+        is MemberAddedNotificationEvent ->
+            noteEvent.channel()?.let {
+                MembershipNotice(noteEvent.id, it, relay, noteEvent.actor(), noteEvent.createdAt, removed = false)
+            }
+
+        is MemberRemovedNotificationEvent ->
+            noteEvent.channel()?.let {
+                MembershipNotice(noteEvent.id, it, relay, noteEvent.actor(), noteEvent.createdAt, removed = true)
+            }
+
+        else -> null
+    }
+}
+
+fun List<Note>.toMembershipNotices(workspaces: Set<NormalizedRelayUrl>): List<MembershipNotice> = mapNotNull { it.toMembershipNotice(workspaces) }
+
+private fun Note.isMembershipNoticeFor(me: HexKey): Boolean =
+    when (val noteEvent = event) {
+        is MemberAddedNotificationEvent -> noteEvent.target().equals(me, ignoreCase = true)
+        is MemberRemovedNotificationEvent -> noteEvent.target().equals(me, ignoreCase = true)
+        else -> false
+    }
+
+/**
+ * Every membership verdict for [me] currently in the cache.
+ *
+ * Scanned off [LocalCache.notes] rather than read from an `observeNotes` snapshot, because that
+ * snapshot cannot contain these kinds. `LocalCache.filter` only yields addressables plus notes whose
+ * `kind.isRegular()` — and `isRegular()` is `> 0 && < 10_000`, so a Buzz 44100/44101 matches none of
+ * its branches and the seed comes back empty every time. Live arrivals are fine (the observer's `new()`
+ * applies no such gate), which is why a cold start looked correct: the observer registers before the
+ * relay answers. What broke was any projection built *after* the events had landed — switching to
+ * another account and back builds a fresh one, and `consumeRegularEvent` never re-notifies a duplicate,
+ * so it would have stayed empty for the rest of the session.
+ *
+ * So the observer is kept purely as the change signal and this scan is the data. It is the same shape
+ * `NotificationFeedFilter.feed()` uses over the same map, for the same reason.
+ */
+fun LocalCache.membershipNotices(
+    me: HexKey,
+    workspaces: Set<NormalizedRelayUrl>,
+): List<MembershipNotice> =
+    notes
+        .filterIntoSet { _, note -> note.isMembershipNoticeFor(me) }
+        .toList()
+        .toMembershipNotices(workspaces)
+
+/**
+ * The Buzz type of every channel whose kind-39000 the cache already holds, keyed by group id.
+ *
+ * Built from the metadata events themselves rather than from the [RelayGroupChannel]s they populate,
+ * because the two are filled in at different moments. `LocalCache.consume(GroupMetadataEvent)` loads the
+ * event onto its addressable note and wakes the cache observers *first*, and only then copies it into
+ * the channel — so a projection woken by that very emission reads a channel that is still empty, gets
+ * [ChannelClassification.UNKNOWN], and, because nothing emits a second time, stays wrong until an
+ * unrelated membership notice happens to arrive. (It also covers the case where the channel is never
+ * populated at all: `consume` only touches it when the event carried relay provenance.) Reading the
+ * event that caused the emission cannot race with itself.
+ *
+ * Keyed by group id alone, without the host relay: this is a fallback for [classifyBuzzChannel], which
+ * still prefers the relay-scoped channel whenever that one has already been filled in.
+ */
+fun buzzChannelTypes(metadataNotes: List<Note>): Map<String, ChannelClassification> {
+    val types = HashMap<String, ChannelClassification>(metadataNotes.size)
+    metadataNotes.forEach { note ->
+        val metadata = note.event as? GroupMetadataEvent ?: return@forEach
+        types[metadata.groupId()] =
+            if (metadata.isBuzzDmChannel()) ChannelClassification.DM else ChannelClassification.NAMED
+    }
+    return types
+}
+
+/**
+ * What [cache] currently knows about a channel's type, from its kind-39000.
+ *
+ * [ChannelClassification.UNKNOWN] until the directory lands — callers decide what to do with that, and
+ * the invite projection deliberately withholds rather than guessing (see
+ * [com.vitorpamplona.amethyst.commons.model.buzz.BuzzChannelInvites.pendingInvites]).
+ *
+ * [knownTypes] (from [buzzChannelTypes]) is consulted when the channel has no metadata yet, which is
+ * what makes the answer stable at the instant the directory lands — see that function for why the
+ * channel alone is not enough.
+ */
+fun classifyBuzzChannel(
+    cache: LocalCache,
+    channelId: String,
+    relay: NormalizedRelayUrl,
+    knownTypes: Map<String, ChannelClassification> = emptyMap(),
+): ChannelClassification {
+    val metadata =
+        cache.getRelayGroupChannelIfExists(GroupId(channelId, relay))?.event
+            ?: return knownTypes[channelId] ?: ChannelClassification.UNKNOWN
+    return if (metadata.isBuzzDmChannel()) ChannelClassification.DM else ChannelClassification.NAMED
+}
@@ -0,0 +1,144 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.model.buzz
+
+import androidx.compose.runtime.Stable
+import com.vitorpamplona.amethyst.commons.model.buzz.BuzzChannelInvite
+import com.vitorpamplona.amethyst.commons.model.buzz.BuzzChannelInvites
+import com.vitorpamplona.amethyst.commons.model.buzz.BuzzWorkspaces
+import com.vitorpamplona.amethyst.commons.model.nip29RelayGroups.RelayGroupListState
+import com.vitorpamplona.amethyst.model.LocalCache
+import com.vitorpamplona.quartz.nip01Core.core.HexKey
+import com.vitorpamplona.quartz.nip01Core.relay.filters.Filter
+import com.vitorpamplona.quartz.nip29RelayGroups.metadata.GroupMetadataEvent
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.flow.SharingStarted
+import kotlinx.coroutines.flow.StateFlow
+import kotlinx.coroutines.flow.combine
+import kotlinx.coroutines.flow.distinctUntilChanged
+import kotlinx.coroutines.flow.flowOn
+import kotlinx.coroutines.flow.map
+import kotlinx.coroutines.flow.stateIn
+
+/**
+ * The channels somebody else added the viewer to that are still awaiting a decision.
+ *
+ * A pure projection of what the cache already holds — the relay's kind-44100/44101 membership verdicts
+ * addressed to me, the channels' kind-39000 types, my kind-10009 joined list, and my local dismissals.
+ * Nothing here asserts membership (the relay already granted that); it only decides whose call it is to
+ * surface the channel.
+ *
+ * ### Account state, not screen state
+ *
+ * This hangs off [com.vitorpamplona.amethyst.model.Account] rather than a feed holder because the
+ * notifications DAL reads it: `NotificationFeedFilter.acceptableEvent` consults [pendingByEventId] to
+ * decide whether a cached kind-44100 is still a live question, and `convertToCard` uses the same map to
+ * build the row. A projection only the UI could reach would have forced the DAL to re-derive it.
+ *
+ * ### Derived, not recorded
+ *
+ * This used to read a process-wide registry that the Buzz DM discovery pass wrote into and its
+ * classification step deleted from. Because the deletion was remembered nowhere, any re-delivery of the
+ * same kind-44100 re-added an invite that had already been withdrawn, and the prompt appeared and
+ * disappeared on a loop. Deriving from the cache removes the second source of truth: the same events
+ * always produce the same answer, in any order, however many times they arrive.
+ */
+@Stable
+class ChannelInvitesState(
+    private val me: HexKey,
+    private val cache: LocalCache,
+    private val buzzWorkspaces: BuzzWorkspaces,
+    relayGroupList: RelayGroupListState,
+    dismissed: StateFlow<Set<String>>,
+    scope: CoroutineScope,
+) {
+    /**
+     * What every group whose kind-39000 has landed turns out to be, which is what makes an
+     * [com.vitorpamplona.amethyst.commons.model.buzz.ChannelClassification.UNKNOWN] channel decidable.
+     * Without this the projection would never recompute when the directory arrives.
+     *
+     * It carries the classification rather than merely signalling that it changed, and that is the
+     * point: `LocalCache.consume(GroupMetadataEvent)` wakes this observer *before* it copies the event
+     * into the [com.vitorpamplona.amethyst.commons.model.nip29RelayGroups.RelayGroupChannel], so a
+     * recompute that went back to the channel for the answer read one that was still empty, concluded
+     * UNKNOWN, and — with nothing left to emit — kept the invite hidden until an unrelated membership
+     * notice arrived. Device-confirmed: a kind-44100 followed 20s later by its kind-39000 produced no
+     * card at all, and one unrelated kind-44101 made it appear instantly.
+     *
+     * De-duplicated on the map, so a busy account's metadata traffic still only re-runs the projection
+     * when a group's type actually becomes known or changes.
+     */
+    private val knownChannelTypes =
+        cache
+            .observeNotes(Filter(kinds = listOf(GroupMetadataEvent.KIND)))
+            .map { buzzChannelTypes(it) }
+            .distinctUntilChanged()
+
+    /**
+     * The membership verdicts themselves, re-scanned only when something can actually change them.
+     *
+     * The scan walks every note in the cache, so it is deliberately NOT part of the combine below: the
+     * three inputs there (dismissals, my kind-10009, known channel types) change what the notices *mean*
+     * but never what they *are*, and folding them in would re-walk the whole cache on every list edit.
+     *
+     * The observer emission is the arrival signal — it cannot be the data, because `observeNotes`'
+     * initial snapshot can't hold these kinds at all (see [membershipNotices]). The workspace set is the
+     * second trigger: a notice's relay is resolved by preferring a joined workspace over whatever else
+     * delivered it, and restore-from-disk can land after the cache already holds notices, changing which
+     * relay a channel resolves against — and with it whether its kind-39000 is ever found.
+     */
+    private val notices =
+        combine(
+            cache.observeNotes(membershipNoticeFilter(me)),
+            buzzWorkspaces.flow,
+        ) { _, workspaces -> cache.membershipNotices(me, workspaces) }
+
+    /** Pending invites keyed by the kind-44100 that produced them — what the notifications DAL reads. */
+    val pendingByEventId: StateFlow<Map<HexKey, BuzzChannelInvite>> =
+        combine(
+            notices,
+            knownChannelTypes,
+            dismissed,
+            relayGroupList.liveRelayGroupList,
+        ) { verdicts, knownTypes, dismissals, joined ->
+            BuzzChannelInvites.pendingInvitesByEventId(
+                viewer = me,
+                notices = verdicts,
+                dismissed = dismissals,
+                joined = joined.mapTo(HashSet()) { it.groupId },
+                classify = { channelId, relay -> classifyBuzzChannel(cache, channelId, relay, knownTypes) },
+            )
+        }.flowOn(Dispatchers.IO)
+            .stateIn(scope, SharingStarted.Eagerly, emptyMap())
+
+    /** The same set as a newest-first list, for surfaces that render it directly. */
+    val flow: StateFlow<List<BuzzChannelInvite>> =
+        pendingByEventId
+            .map { it.values.sortedByDescending { invite -> invite.createdAt } }
+            .flowOn(Dispatchers.IO)
+            .stateIn(scope, SharingStarted.Eagerly, emptyList())
+
+    /** Whether this cached kind-44100 is still an unanswered question. Hot path — a map lookup. */
+    fun isPending(eventId: HexKey) = eventId in pendingByEventId.value
+
+    fun inviteFor(eventId: HexKey): BuzzChannelInvite? = pendingByEventId.value[eventId]
+}
@@ -25,6 +25,7 @@ import com.vitorpamplona.quartz.nip47WalletConnect.Nip47WalletConnect
 import com.vitorpamplona.quartz.nip47WalletConnect.events.NwcInfoEvent
 import com.vitorpamplona.quartz.utils.TimeUtils
 import kotlinx.coroutines.CancellationException
+import kotlinx.coroutines.CompletableDeferred
 import kotlinx.coroutines.CoroutineScope
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.launch
@@ -37,16 +38,23 @@ import java.util.concurrent.ConcurrentHashMap
 * supported RPC methods, and whether it emits notifications.
 *
 * Entries expire after [ttlSeconds] (default 2 days) so a wallet that later
- * changes its advertised capabilities is eventually re-checked. Reads never block
- * on the network:
+ * changes its advertised capabilities is eventually re-checked. Four entry
+ * points, in increasing order of how much they will wait:
 *
 *  - [current] returns whatever is cached (possibly stale, possibly null) with no
- *    side effect — for the payment hot path.
+ *    side effect and never blocks — for callers that can act on "don't know".
 *  - [refreshIfStale] triggers a background fetch when the entry is missing or
 *    expired, and returns immediately — call it right before using a wallet so a
 *    stale entry self-heals without holding up the transaction.
- *  - [getFresh] is the suspending variant for callers that can await (e.g. the
- *    notification watcher deciding whether to open a subscription).
+ *  - [currentOrFetch] waits only when nothing at all is cached, and returns a
+ *    stale entry as-is — for callers where "don't know" and "no" are different
+ *    answers, such as NIP-44 negotiation.
+ *  - [getFresh] waits whenever the entry is missing *or* expired, for a caller
+ *    that must not act on a stale answer. No production caller needs that today.
+ *
+ * Every fetching path funnels through one request per wallet, so the startup
+ * warm-up, a payment waiting on a cold cache and the notification watcher join
+ * the same call rather than racing each other.
 *
 * A completed fetch — including a definitive "wallet published no info event"
 * (null) — is cached with a timestamp. A *failed* fetch (network error/timeout)
@@ -65,7 +73,9 @@ class NwcInfoCache(
    )

    private val cache = ConcurrentHashMap<HexKey, Entry>()
-    private val inFlight = ConcurrentHashMap.newKeySet<HexKey>()
+
+    // Fetches in progress, keyed like [cache]. Every fetching path goes through [fetchOnce].
+    private val inFlight = ConcurrentHashMap<HexKey, CompletableDeferred<NwcInfoEvent?>>()

    private fun isFresh(entry: Entry): Boolean = now() - entry.fetchedAt < ttlSeconds

@@ -80,26 +90,85 @@ class NwcInfoCache(
    fun refreshIfStale(uri: Nip47WalletConnect.Nip47URINorm) {
        val entry = cache[uri.pubKeyHex]
        if (entry != null && isFresh(entry)) return
-        if (!inFlight.add(uri.pubKeyHex)) return

-        scope.launch(Dispatchers.IO) {
-            try {
-                fetchAndStore(uri)
-            } finally {
-                inFlight.remove(uri.pubKeyHex)
-            }
-        }
+        scope.launch(Dispatchers.IO) { fetchOnce(uri) }
    }

    /**
     * Suspends until a fresh-enough info event is available, fetching when the
     * entry is missing or expired. Returns the last cached (possibly stale) value
     * if the fetch fails.
+     *
+     * For a caller that must not act on a stale answer. No production caller needs
+     * that today; prefer [currentOrFetch], which only waits on a cold cache.
     */
    suspend fun getFresh(uri: Nip47WalletConnect.Nip47URINorm): NwcInfoEvent? {
        val entry = cache[uri.pubKeyHex]
        if (entry != null && isFresh(entry)) return entry.info
-        return fetchAndStore(uri)
+        return fetchOnce(uri)
+    }
+
+    /**
+     * Returns whatever is cached, waiting for a fetch only when there is nothing
+     * cached at all.
+     *
+     * This is the encryption-negotiation entry point. [current] answers "what does
+     * this wallet advertise" from memory, but on a cold cache it answers null, and
+     * a null there is indistinguishable from "no NIP-44" — so the caller silently
+     * downgrades to NIP-04 on the first transaction after every app start. Waiting
+     * once, only when nothing is known, removes that.
+     *
+     * A stale entry is returned as-is without waiting: it still says which
+     * encryption the wallet advertises, and [refreshIfStale] self-heals it in the
+     * background for next time.
+     */
+    suspend fun currentOrFetch(uri: Nip47WalletConnect.Nip47URINorm): NwcInfoEvent? {
+        val entry = cache[uri.pubKeyHex] ?: return fetchOnce(uri)
+        refreshIfStale(uri)
+        return entry.info
+    }
+
+    /**
+     * Runs [fetchAndStore] for [uri] exactly once, however many callers ask at
+     * once; every caller awaits that one result.
+     *
+     * The fetch runs in this cache's own [scope], never in the caller's. A caller
+     * on the payment path is a `viewModelScope` coroutine that dies when the user
+     * backs out of the screen — owning the fetch there would abandon it, leave the
+     * cache cold and make the next attempt pay the whole cost again. Here a caller
+     * giving up cancels only its own `await`, and the fetch it started still lands.
+     */
+    private suspend fun fetchOnce(uri: Nip47WalletConnect.Nip47URINorm): NwcInfoEvent? {
+        val key = uri.pubKeyHex
+        val ours = CompletableDeferred<NwcInfoEvent?>()
+        // putIfAbsent returns the previous entry, so a non-null result means
+        // someone else already started this wallet's fetch.
+        inFlight.putIfAbsent(key, ours)?.let { return it.await() }
+
+        val job =
+            scope.launch(Dispatchers.IO) {
+                var info: NwcInfoEvent? = null
+                try {
+                    info = fetchAndStore(uri)
+                } finally {
+                    // Non-suspending, so awaiters are released even if the fetch is cancelled.
+                    inFlight.remove(key, ours)
+                    ours.complete(info)
+                }
+            }
+
+        // A scope that was already cancelled — this account was logged off while a
+        // payment was in flight — never runs the body, so the finally above never
+        // releases anyone. Without this, the caller awaits forever and the abandoned
+        // slot makes every later call for this wallet do the same. Fires immediately
+        // when the job is already complete, and is a no-op on the normal path.
+        job.invokeOnCompletion {
+            if (!ours.isCompleted) {
+                inFlight.remove(key, ours)
+                ours.complete(null)
+            }
+        }
+        return ours.await()
    }

    private suspend fun fetchAndStore(uri: Nip47WalletConnect.Nip47URINorm): NwcInfoEvent? {
@@ -37,11 +37,15 @@ import com.vitorpamplona.quartz.nip47WalletConnect.cache.NostrWalletConnectReque
 import com.vitorpamplona.quartz.nip47WalletConnect.cache.NostrWalletConnectResponseCache
 import com.vitorpamplona.quartz.nip47WalletConnect.events.LnZapPaymentRequestEvent
 import com.vitorpamplona.quartz.nip47WalletConnect.events.LnZapPaymentResponseEvent
+import com.vitorpamplona.quartz.nip47WalletConnect.events.NwcInfoEvent
 import com.vitorpamplona.quartz.nip47WalletConnect.events.NwcNotificationEvent
 import com.vitorpamplona.quartz.nip47WalletConnect.rpc.NwcTransaction
+import com.vitorpamplona.quartz.nip47WalletConnect.rpc.PayInvoiceMethod
 import com.vitorpamplona.quartz.nip47WalletConnect.rpc.PaymentReceivedNotification
 import com.vitorpamplona.quartz.nip47WalletConnect.rpc.Request
 import com.vitorpamplona.quartz.nip47WalletConnect.rpc.Response
+import com.vitorpamplona.quartz.nip47WalletConnect.tags.ExtensionsTag
+import com.vitorpamplona.quartz.utils.Log
 import kotlinx.coroutines.CancellationException
 import kotlinx.coroutines.CoroutineScope
 import kotlinx.coroutines.Dispatchers
@@ -60,6 +64,7 @@ import kotlinx.coroutines.flow.flowOn
 import kotlinx.coroutines.flow.map
 import kotlinx.coroutines.flow.stateIn
 import kotlinx.coroutines.launch
+import kotlinx.coroutines.withTimeoutOrNull

 /**
 * Manages NIP-47 (Nostr Wallet Connect) related signing operations and decryption cache for a given account.
@@ -135,17 +140,58 @@ class NwcSignerState(
    }

    /**
-     * Non-blocking read of the negotiated encryption preference for a wallet.
-     * NIP-47 says a client "should always prefer nip44 if supported by the wallet
-     * service". Returns true only when the cached info event advertises `nip44_v2`;
-     * otherwise NIP-04 (the legacy default). Also nudges a background refresh so a
-     * stale/expired entry self-heals for the next transaction without blocking this
-     * one.
+     * The negotiated encryption preference for a wallet. NIP-47 says a client
+     * "should always prefer nip44 if supported by the wallet service", so a false
+     * here has to mean "the wallet does not offer NIP-44" — not "we have not asked
+     * yet". [walletInfo] is what makes that distinction true.
     */
-    private fun prefersNip44(uri: Nip47WalletConnect.Nip47URINorm?): Boolean {
-        uri ?: return false
-        infoCache?.refreshIfStale(uri)
-        return infoCache?.current(uri)?.encryptionSchemes()?.any { it.equals("nip44_v2", ignoreCase = true) } ?: false
+    private fun prefersNip44(info: NwcInfoEvent?): Boolean = info?.encryptionSchemes()?.any { it.equals("nip44_v2", ignoreCase = true) } == true
+
+    /**
+     * The wallet's advertised capabilities: the one place a send waits on them, and
+     * it waits AT MOST ONCE.
+     *
+     * WAITING IS THE POINT. The info cache is per-account and in memory only, so it
+     * starts empty on every app launch, and reading it without waiting makes "not
+     * fetched yet" indistinguishable from "not supported". That shipped twice: the
+     * first transaction to each wallet after a launch fell back to NIP-04 against a
+     * wallet advertising `nip44_v2`, and a payment to a wallet that had been
+     * advertising NWC-06 for twenty minutes still went out bare — with nothing, on
+     * either side, reporting an error.
+     *
+     * ONCE, because both questions read the same event. Each used to fetch for
+     * itself, which is free on a warm cache and doubles the stall on a cold one:
+     * [NwcInfoCache] deliberately does not cache a FAILED fetch, so with the relay
+     * down both waits ran in full and a 3s worst case became 6s.
+     *
+     * BOUNDED, because this sits in front of a payment the user has already tapped
+     * and the no-response timer does not start until it returns. On expiry the
+     * answer is null — read as NIP-04 and as no-metadata, both of them the safe
+     * direction — while the fetch keeps running in the cache's own scope so the next
+     * request gets the negotiated scheme. Never bound the fetch itself instead: a
+     * null from it is cached as a definitive "no info event" for the whole TTL,
+     * which would pin the wallet to NIP-04 for days.
+     */
+    private suspend fun walletInfo(uri: Nip47WalletConnect.Nip47URINorm?): NwcInfoEvent? {
+        uri ?: return null
+        return withTimeoutOrNull(NIP44_NEGOTIATION_WAIT_MS) { infoCache?.currentOrFetch(uri) }
+    }
+
+    /**
+     * Strips NWC-06 `metadata` from a request bound for a wallet that never said it
+     * understands the field — [MetadataCarrying] has the reason that matters.
+     *
+     * APPLIED WHERE THE REQUEST IS BUILT rather than at each call site, so populating
+     * `metadata` anywhere upstream is safe by construction.
+     *
+     * MUTATES the request in place — see the callers' KDoc. Requests are built per
+     * send and not reused, and stripping a copy would mean rebuilding a params object
+     * whose field list would then drift from the original.
+     */
+    private fun Request.dropMetadataIfUnsupported(info: NwcInfoEvent?) {
+        val carrier = metadataCarrier ?: return
+        if (carrier.metadata == null || info?.supportsExtension(ExtensionsTag.METADATA_CONVENTIONS) == true) return
+        carrier.metadata = null
    }

    fun hasWalletConnectSetup(): Boolean = settings.nwcWallets.value.isNotEmpty()
@@ -203,21 +249,30 @@ class NwcSignerState(
     */
    suspend fun sendNwcRequest(
        request: Request,
+        onTimeout: () -> Unit = {},
        onResponse: (Response?) -> Unit,
-    ): Pair<LnZapPaymentRequestEvent, NormalizedRelayUrl> = sendNwcRequestToWallet(defaultWalletUri.value, request, onResponse)
+    ): Pair<LnZapPaymentRequestEvent, NormalizedRelayUrl> = sendNwcRequestToWallet(defaultWalletUri.value, request, onTimeout, onResponse)

    /**
     * Sends a generic NIP-47 request to a specific wallet.
+     *
+     * [request] MAY BE MUTATED: NWC-06 `metadata` is stripped in place when the
+     * wallet has not advertised support for it. Build a fresh request per send
+     * rather than retaining or re-reading this one.
     */
    suspend fun sendNwcRequestToWallet(
        walletUri: Nip47WalletConnect.Nip47URINorm?,
        request: Request,
+        onTimeout: () -> Unit = {},
        onResponse: (Response?) -> Unit,
    ): Pair<LnZapPaymentRequestEvent, NormalizedRelayUrl> {
        val walletService = walletUri ?: throw IllegalArgumentException("No NIP47 setup")
        val walletSigner = buildSigner(walletService) ?: signer

-        val event = LnZapPaymentRequestEvent.createRequest(request, walletService.pubKeyHex, walletSigner, useNip44 = prefersNip44(walletService))
+        val info = walletInfo(walletService)
+        request.dropMetadataIfUnsupported(info)
+
+        val event = LnZapPaymentRequestEvent.createRequest(request, walletService.pubKeyHex, walletSigner, useNip44 = prefersNip44(info))

        val filter =
            NWCPaymentQueryState(
@@ -234,14 +289,7 @@ class NwcSignerState(
        // be missed.
        assembler.subscribeAndFlush(filter)

-        // Safety net: drop the filter after 60s if the wallet never replies.
-        // The happy path (response arrives) cancels this job and unsubscribes
-        // through assembler.unsubscribeSoon, which debounces.
-        val timeoutJob =
-            scope.launch(Dispatchers.IO) {
-                delay(60000)
-                assembler.unsubscribe(filter)
-            }
+        val timeoutJob = launchGiveUpTimer(assembler, filter, event.id, onTimeout)

        val responseCache = NostrWalletConnectResponseCache(walletSigner)
        cache.consume(event, null, true, walletService.relayUri) {
@@ -255,15 +303,30 @@ class NwcSignerState(

    /**
     * Sends a zap payment request to the default wallet.
+     *
+     * [metadata] is NWC-06's per-payment blob and is dropped unless the wallet
+     * advertises `06`; see [dropMetadataIfUnsupported].
     */
    suspend fun sendZapPaymentRequestFor(
        bolt11: String,
        zappedNote: Note?,
+        onTimeout: () -> Unit = {},
+        metadata: Map<String, Any?>? = null,
        onResponse: (Response?) -> Unit,
    ): Pair<LnZapPaymentRequestEvent, NormalizedRelayUrl> {
        val walletService = defaultWalletUri.value ?: throw IllegalArgumentException("No NIP47 setup")

-        val event = LnZapPaymentRequestEvent.create(bolt11, walletService.pubKeyHex, nip47Signer.value, useNip44 = prefersNip44(walletService))
+        val info = walletInfo(walletService)
+        val request = PayInvoiceMethod.create(bolt11, metadata)
+        request.dropMetadataIfUnsupported(info)
+
+        val event =
+            LnZapPaymentRequestEvent.createRequest(
+                request,
+                walletService.pubKeyHex,
+                nip47Signer.value,
+                useNip44 = prefersNip44(info),
+            )

        val filter =
            NWCPaymentQueryState(
@@ -278,14 +341,7 @@ class NwcSignerState(
        // See sendNwcRequestToWallet above for the rationale.
        assembler.subscribeAndFlush(filter)

-        // Safety net: drop the filter after 60s if the wallet never replies.
-        // The happy path (response arrives) cancels this job and instead
-        // hands off to assembler.unsubscribeSoon, which debounces.
-        val timeoutJob =
-            scope.launch(Dispatchers.IO) {
-                delay(60000) // waits 1 minute to complete payment.
-                assembler.unsubscribe(filter)
-            }
+        val timeoutJob = launchGiveUpTimer(assembler, filter, event.id, onTimeout)

        cache.consume(event, zappedNote, true, walletService.relayUri) {
            timeoutJob.cancel()
@@ -295,4 +351,59 @@ class NwcSignerState(

        return Pair(event, walletService.relayUri)
    }
+
+    /**
+     * Safety net for a wallet that never replies: drops the subscription filter and retires
+     * the request. The happy path cancels this job and unsubscribes through
+     * [NWCPaymentFilterAssembler.unsubscribeSoon] instead, which debounces.
+     */
+    private fun launchGiveUpTimer(
+        assembler: NWCPaymentFilterAssembler,
+        filter: NWCPaymentQueryState,
+        requestId: HexKey,
+        onTimeout: () -> Unit,
+    ) = scope.launch(Dispatchers.IO) {
+        delay(NWC_RESPONSE_TIMEOUT_MS)
+        assembler.unsubscribe(filter)
+        giveUpWaiting(requestId, onTimeout)
+    }
+
+    /**
+     * Retires a request whose response never arrived: removes the tracker entry so it
+     * does not leak, and tells the caller so the user hears about it. A silent give-up
+     * is the worst outcome for a payment UI — the action just appears not to have
+     * happened, which is indistinguishable from a refusal the wallet did send.
+     *
+     * A `cleanup` that returns false means a response beat us to the tracker entry,
+     * so the response path is already reporting and this must stay quiet.
+     */
+    private fun giveUpWaiting(
+        requestId: HexKey,
+        onTimeout: () -> Unit,
+    ) {
+        val wasStillPending = cache.paymentTracker.cleanup(requestId)
+        if (wasStillPending) {
+            Log.w("NwcSignerState") {
+                "No NIP-47 response for request $requestId after ${NWC_RESPONSE_TIMEOUT_MS}ms; giving up and dropping the subscription."
+            }
+            onTimeout()
+        }
+    }
+
+    companion object {
+        /**
+         * How long a NIP-47 request waits for its kind-23195 reply before the client
+         * gives up. Exposed in seconds so the UI can name the number it shows the user.
+         */
+        const val NWC_RESPONSE_TIMEOUT_SECONDS = 60
+
+        const val NWC_RESPONSE_TIMEOUT_MS = NWC_RESPONSE_TIMEOUT_SECONDS * 1000L
+
+        /**
+         * How long a request will wait for a cold info cache before falling back to
+         * NIP-04. Comfortably over a healthy single-relay round trip, far under the
+         * 30s the fetch itself would otherwise allow in front of a payment tap.
+         */
+        const val NIP44_NEGOTIATION_WAIT_MS = 3_000L
+    }
 }
@@ -58,7 +58,11 @@ class IndexerRelayListState(

    fun indexListEvent(note: Note) = note.event as? IndexerRelayListEvent ?: settings.backupIndexRelayList

-    suspend fun normalizeIndexerRelayListWithBackup(note: Note): Set<NormalizedRelayUrl> = indexListEvent(note)?.let { decryptionCache.relays(it) }?.ifEmpty { null } ?: DefaultIndexerRelayList
+    suspend fun normalizeIndexerRelayListWithBackup(note: Note): Set<NormalizedRelayUrl> {
+        val event = indexListEvent(note) ?: return DefaultIndexerRelayList
+        // Fully decrypted here, so empty means the user listed nothing — not "not decrypted yet".
+        return decryptionCache.relays(event)
+    }

    suspend fun normalizeIndexerRelayListWithBackupNoDefaults(note: Note): Set<NormalizedRelayUrl> = indexListEvent(note)?.let { decryptionCache.relays(it) } ?: emptySet()

@@ -73,12 +77,26 @@ class IndexerRelayListState(
     */
    fun normalizeIndexerRelayListPrecached(note: Note): Set<NormalizedRelayUrl> = indexListEvent(note)?.let { decryptionCache.cachedRelays(it) }?.ifEmpty { null } ?: DefaultIndexerRelayList

+    /** See `Nip65RelayListState.assumedDefaults`. Empty as soon as any kind:10086 exists. */
+    fun assumedDefaults(note: Note): Set<NormalizedRelayUrl> = if (indexListEvent(note) == null) DefaultIndexerRelayList else emptySet()
+
+    val assumedDefaultsFlow =
+        getIndexerRelayListFlow()
+            .map { assumedDefaults(it.note) }
+            .onStart { emit(assumedDefaults(indexerListNote)) }
+            .flowOn(Dispatchers.IO)
+            .stateIn(
+                scope,
+                SharingStarted.Eagerly,
+                assumedDefaults(indexerListNote),
+            )
+
    /**
-     * The account's indexer relays, **never empty** — [normalizeIndexerRelayListWithBackup]
-     * substitutes [DefaultIndexerRelayList] both when there is no kind:10086 and when the
-     * one we have decodes to zero relays. Callers assembling metadata / relay-list REQs read
-     * this and can rely on getting a usable set; use [flowNoDefaults] instead to show or diff
-     * what the user actually configured.
+     * The account's indexer relays. [normalizeIndexerRelayListWithBackup] substitutes
+     * [DefaultIndexerRelayList] when there is no kind:10086 at all — but **not** when the one we
+     * have decodes to zero relays, which is the user saying "no indexers" and is honored. Callers
+     * assembling metadata / relay-list REQs must therefore tolerate an empty set; use
+     * [flowNoDefaults] to show or diff what the user actually configured.
     *
     * Seeded via [normalizeIndexerRelayListPrecached] rather than `emptySet()`, for the same
     * reason as the search list: `flowOn(IO)` makes the first real emission asynchronous, so an
@@ -71,7 +71,15 @@ class FollowListsState(
 ) {
    val user = cache.getOrCreateUser(signer.pubKey)

-    fun existingPeopleListNotes() = cache.addressables.filter(FollowListEvent.KIND, user.pubkeyHex)
+    // Hides shells that a kind-5 deletion event from the list's author has already
+    // deleted (e.g. a persisted TopFilter re-creates an empty shell for the deleted
+    // address after a restart, and its name falls back to the dTag/UUID). Shells that
+    // are merely not loaded yet stay in the list so the UI can subscribe and fetch
+    // them from relays.
+    fun existingPeopleListNotes() =
+        cache.addressables
+            .filter(FollowListEvent.KIND, user.pubkeyHex)
+            .filter { it.event != null || !cache.hasBeenDeleted(it.address) }

    val followListVersions = MutableStateFlow(0)

@@ -255,6 +263,10 @@ class FollowListsState(
        val followListEvent = getPeopleList(identifierTag)
        val deletionEvent = account.signer.sign(DeletionEvent.build(listOf(followListEvent)))
        account.sendMyPublicAndPrivateOutbox(deletionEvent)
+        // Any screen whose persisted feed filter still points at this follow pack would
+        // keep re-creating an empty shell for its address (and render the dTag/UUID in
+        // the top bar) — reset those filters to their default.
+        account.settings.resetFeedFiltersPointingTo(followListEvent.address())
    }

    suspend fun addUserToSet(
@@ -69,10 +69,17 @@ class PeopleListsState(
 ) {
    val user = cache.getOrCreateUser(signer.pubKey)

+    // Hides the fixed-dTag block-list shell when it is not loaded (it has no
+    // meaningful name until it exists) and shells that a kind-5 deletion event from
+    // the list's author has already deleted (e.g. a persisted TopFilter re-creates an
+    // empty shell for the deleted address after a restart, and its name falls back to
+    // the dTag/UUID). Shells that are merely not loaded yet stay in the list so the UI
+    // can subscribe and fetch them from relays.
    fun existingPeopleListNotes() =
        cache.addressables
            .filter(PeopleListEvent.KIND, user.pubkeyHex)
            .filter { it.dTag() != PeopleListEvent.BLOCK_LIST_D_TAG || it.event != null }
+            .filter { it.event != null || !cache.hasBeenDeleted(it.address) }

    val peopleListVersions = MutableStateFlow(0)

@@ -262,6 +269,10 @@ class PeopleListsState(
        val followListEvent = getPeopleList(identifierTag)
        val deletionEvent = account.signer.sign(DeletionEvent.build(listOf(followListEvent)))
        account.sendMyPublicAndPrivateOutbox(deletionEvent)
+        // Any screen whose persisted feed filter still points at this list would keep
+        // re-creating an empty shell for its address (and render the dTag/UUID in the
+        // top bar) — reset those filters to their default.
+        account.settings.resetFeedFiltersPointingTo(followListEvent.address())
    }

    suspend fun addUserToSet(
@@ -58,7 +58,11 @@ class SearchRelayListState(

    fun searchListEvent(note: Note) = note.event as? SearchRelayListEvent ?: settings.backupSearchRelayList

-    suspend fun normalizeSearchRelayListWithBackup(note: Note): Set<NormalizedRelayUrl> = searchListEvent(note)?.let { decryptionCache.relays(it) }?.ifEmpty { null } ?: DefaultSearchRelayList
+    suspend fun normalizeSearchRelayListWithBackup(note: Note): Set<NormalizedRelayUrl> {
+        val event = searchListEvent(note) ?: return DefaultSearchRelayList
+        // Fully decrypted here, so empty means the user listed nothing — not "not decrypted yet".
+        return decryptionCache.relays(event)
+    }

    suspend fun normalizeSearchRelayListWithBackupNoDefaults(note: Note): Set<NormalizedRelayUrl> = searchListEvent(note)?.let { decryptionCache.relays(it) } ?: emptySet()

@@ -74,16 +78,31 @@ class SearchRelayListState(
     */
    fun normalizeSearchRelayListPrecached(note: Note): Set<NormalizedRelayUrl> = searchListEvent(note)?.let { decryptionCache.cachedRelays(it) }?.ifEmpty { null } ?: DefaultSearchRelayList

+    /** See `Nip65RelayListState.assumedDefaults`. Empty as soon as any kind:10007 exists. */
+    fun assumedDefaults(note: Note): Set<NormalizedRelayUrl> = if (searchListEvent(note) == null) DefaultSearchRelayList else emptySet()
+
+    val assumedDefaultsFlow =
+        getSearchRelayListFlow()
+            .map { assumedDefaults(it.note) }
+            .onStart { emit(assumedDefaults(searchListNote)) }
+            .flowOn(Dispatchers.IO)
+            .stateIn(
+                scope,
+                SharingStarted.Eagerly,
+                assumedDefaults(searchListNote),
+            )
+
    /**
-     * The account's search relays, **never empty** — [normalizeSearchRelayListWithBackup]
-     * substitutes [DefaultSearchRelayList] both when there is no kind:10007 and when the
-     * one we have decodes to zero relays. Callers assembling NIP-50 REQs read this and can
+     * The account's search relays. [normalizeSearchRelayListWithBackup] substitutes
+     * [DefaultSearchRelayList] when there is no kind:10007 at all — but **not** when the one we
+     * have decodes to zero relays, which is the user saying "no search relays" and is honored.
+     * Callers assembling NIP-50 REQs must tolerate an empty set, and can
     * rely on getting a usable set; use [flowNoDefaults] instead to show or diff what the
     * user actually configured.
     *
     * Seeded via [normalizeSearchRelayListPrecached] rather than `emptySet()`: `flowOn(IO)` means
     * the first real emission can never be synchronous with `stateIn`, so an `emptySet()` seed
-     * left a window where `.value` contradicted the "never empty" contract above and search
+     * left a window where `.value` reported nothing before the event had been read at all, so search
     * silently queried nothing. That window is unbounded for a NIP-46 signer whose list has
     * private entries, since the first emission waits on a remote decrypt.
     */
@@ -28,6 +28,7 @@ import com.vitorpamplona.amethyst.commons.cashu.ops.RestoreOutcome
 import com.vitorpamplona.amethyst.commons.cashu.ops.SendTokenCompleted
 import com.vitorpamplona.amethyst.commons.cashu.ops.TokenEntry
 import com.vitorpamplona.amethyst.commons.cashu.ops.describeMintError
+import com.vitorpamplona.amethyst.commons.relayClient.assemblers.cashuProofBackfillFilters
 import com.vitorpamplona.amethyst.model.AccountSettings
 import com.vitorpamplona.amethyst.model.LocalCache
 import com.vitorpamplona.quartz.nip01Core.core.Event
@@ -35,6 +36,8 @@ import com.vitorpamplona.quartz.nip01Core.core.HexKey
 import com.vitorpamplona.quartz.nip01Core.core.hexToByteArray
 import com.vitorpamplona.quartz.nip01Core.core.toHexKey
 import com.vitorpamplona.quartz.nip01Core.hints.EventHintBundle
+import com.vitorpamplona.quartz.nip01Core.relay.client.INostrClient
+import com.vitorpamplona.quartz.nip01Core.relay.client.accessories.fetchAllPagesFromPool
 import com.vitorpamplona.quartz.nip01Core.relay.normalizer.NormalizedRelayUrl
 import com.vitorpamplona.quartz.nip01Core.signers.NostrSigner
 import com.vitorpamplona.quartz.nip01Core.signers.NostrSignerInternal
@@ -61,12 +64,14 @@ import kotlinx.coroutines.flow.SharingStarted
 import kotlinx.coroutines.flow.StateFlow
 import kotlinx.coroutines.flow.asStateFlow
 import kotlinx.coroutines.flow.combine
+import kotlinx.coroutines.flow.first
 import kotlinx.coroutines.flow.flowOn
 import kotlinx.coroutines.flow.map
 import kotlinx.coroutines.flow.stateIn
 import kotlinx.coroutines.launch
 import kotlinx.coroutines.sync.Mutex
 import kotlinx.coroutines.sync.withLock
+import kotlinx.coroutines.withTimeoutOrNull
 import okhttp3.OkHttpClient
 import java.util.concurrent.ConcurrentHashMap

@@ -99,6 +104,7 @@ class CashuWalletState(
    private val pubKey: HexKey,
    private val signer: NostrSigner,
    private val cache: LocalCache,
+    private val client: INostrClient,
    private val scope: CoroutineScope,
    private val outboxRelaysFlow: StateFlow<Set<NormalizedRelayUrl>>,
    private val inboxRelaysFlow: StateFlow<Set<NormalizedRelayUrl>>,
@@ -519,6 +525,150 @@ class CashuWalletState(
                    if (ids.isNotEmpty()) removeEvents(ids)
                }
            }
+
+        // Page the full proof set back, once, as soon as we know there is a
+        // wallet and where to ask about it. The live subscription above cannot
+        // do this on its own — see [resyncProofsFromRelays].
+        //
+        // Gated on a wallet existing so an Account object that is only resident
+        // to decrypt a pushed gift wrap never pages a wallet nobody has: that
+        // is the same reason the wallet's relay subscription lives in
+        // CashuWalletEoseManager rather than here.
+        jobs +=
+            scope.launch(Dispatchers.IO) {
+                val ready =
+                    withTimeoutOrNull(BACKFILL_READY_WAIT_MS) {
+                        _walletEvent.first { it != null }
+                        outboxRelaysFlow.first { it.isNotEmpty() }
+                    }
+                if (ready == null) {
+                    Log.d("CashuWallet") { "No wallet + outbox relays within ${BACKFILL_READY_WAIT_MS}ms; skipping proof backfill" }
+                } else {
+                    resyncProofsFromRelays()
+                }
+            }
+    }
+
+    // ============================================================
+    // Proof backfill — paging past the relay's REQ cap
+    // ============================================================
+
+    /**
+     * True once a paged proof walk has completed for this session. Guards the
+     * automatic backfill only; [resyncProofsFromRelays] with `force` ignores it.
+     */
+    @Volatile private var proofBackfillDone = false
+
+    private val proofBackfillMutex = Mutex()
+
+    /**
+     * Re-download **every** kind:7375 this account ever published, by paging
+     * each outbox relay with `until` cursors, and then reconcile the result
+     * against the mints.
+     *
+     * ### Why this is needed
+     *
+     * [balanceSats] is a pure function of [_tokenEntries], which is a pure
+     * function of the kind:7375 events we happen to hold. Those arrive over the
+     * live wallet subscription, which sends one unbounded REQ per relay. A relay
+     * answers an unbounded REQ with its own cap (NIP-11 `limitation.max_limit`,
+     * or a hard-coded default) applied to the **newest** matching events — and
+     * the same filter also asks for kind:7376 history, which outnumbers the
+     * proofs by an order of magnitude on any wallet with a few hundred
+     * transactions. The proofs that lose that race are the ones at mints the
+     * user has not touched recently, so what drops off the bottom is precisely
+     * the balance the user forgot they had.
+     *
+     * Nothing recovers from it afterwards: a capped page and a complete page
+     * both just EOSE, and [PerUserEoseManager] records that EOSE as the `since`
+     * for every later REQ to that relay, so the events below the cap are never
+     * asked for again. The subset is stable across cold starts (same filter,
+     * same cap, same events) but differs between devices whose relay set,
+     * arrival order or uptime differ — which is why one account can read 39 sat
+     * on one phone, 1443 on another and 2522 on a third, with none of them
+     * being the wallet's actual balance.
+     *
+     * ### What this does
+     *
+     * `fetchAllPagesFromPool` walks each relay backwards page by page until a
+     * page comes back empty, so the cap bounds a page instead of the download.
+     * Events land in [LocalCache] through the client-wide `EventCollector`, but
+     * we also index what we receive directly rather than waiting on the bundled
+     * cache round-trip, so the balance is correct the moment the walk returns.
+     *
+     * ### Why the scrub afterwards
+     *
+     * Spent proofs are retired with a NIP-09 kind:5, and a relay that ignores
+     * deletions will happily hand those kind:7375 events back on a paged walk.
+     * Taken alone, this would trade an under-count for an over-count. So when
+     * the walk actually recovered something, we finish with the NUT-07
+     * [scrubLocallyStaleProofs] sweep: the mint — not the relay — decides which
+     * proofs are still unspent, and anything it calls SPENT is dropped and
+     * re-deleted. The sweep is skipped when the walk found nothing new, so a
+     * steady-state launch costs no mint traffic.
+     *
+     * Returns the number of kind:7375 events the walk delivered that we did not
+     * already hold, or null when it could not run (not started, no relays, or
+     * already done and not forced).
+     */
+    suspend fun resyncProofsFromRelays(force: Boolean = false): Int? {
+        if (!started) return null
+        if (proofBackfillDone && !force) return null
+        return proofBackfillMutex.withLock {
+            if (proofBackfillDone && !force) return@withLock null
+            val relays = outboxRelaysFlow.value
+            // Don't latch on an empty relay set — the NIP-65 list may simply not
+            // have arrived yet, and the caller retries once it does.
+            if (relays.isEmpty()) return@withLock null
+
+            val filters = cashuProofBackfillFilters(pubKey)
+            // The callback runs on the relay reader thread and must not suspend,
+            // so collect first and index after the walk.
+            val collected = ConcurrentHashMap<HexKey, CashuTokenEvent>()
+            runCatching {
+                client.fetchAllPagesFromPool(
+                    filters = relays.associateWith { filters },
+                    idleTimeoutMs = BACKFILL_IDLE_TIMEOUT_MS,
+                ) { event, _ ->
+                    if (event is CashuTokenEvent && event.pubKey == pubKey) {
+                        collected.putIfAbsent(event.id, event)
+                    }
+                }
+            }.onFailure {
+                Log.w("CashuWallet", "Paged proof backfill failed", it)
+            }.onSuccess {
+                // Latch only on a walk that actually completed. A walk that
+                // blew up (offline at launch, every relay unreachable) has
+                // proved nothing about what the relays hold, and latching on it
+                // would leave the wallet showing the truncated balance for the
+                // rest of the session with no automatic second attempt.
+                proofBackfillDone = true
+            }
+
+            val fresh = collected.values.filter { !tokenEvents.containsKey(it.id) }
+            Log.i("CashuWallet") {
+                "Proof backfill over ${relays.size} relay(s): ${collected.size} kind:7375 seen, ${fresh.size} new"
+            }
+
+            if (fresh.isNotEmpty()) {
+                applyEvents(fresh)
+                // A relay that ignores NIP-09 just handed back proofs the mint
+                // already burned. Let the mint arbitrate before the user sees a
+                // number.
+                runCatching { scrubLocallyStaleProofs() }
+                    .onFailure { Log.w("CashuWallet", "Post-backfill NUT-07 sweep failed", it) }
+            } else if (undecryptedTokenCount() > 0) {
+                // Nothing new off the relays, but we are still holding proofs
+                // we could not read. A decrypt failure hides money exactly as
+                // effectively as a missing event does, and the retry inside
+                // recomputeUnspent only fires when some *other* change marks
+                // the tokens dirty — which, in a wallet that has gone quiet, may
+                // be never. A user asking for a refresh is asking for that
+                // retry too.
+                recomputeUnspent()
+            }
+            fresh.size
+        }
    }

    fun destroy() {
@@ -704,8 +854,10 @@ class CashuWalletState(
    private suspend fun recomputeUnspent() {
        val all = tokenEvents.values.toList()
        // Decrypt anything we haven't seen before; reuse cached TokenContent
-        // for events we've already decrypted. Decryption failures are
-        // skipped — the proof set rebuilds the next time a re-key happens.
+        // for events we've already decrypted. Only successes are cached, so a
+        // failure is retried on the next recompute rather than being pinned as
+        // "empty" for the session.
+        var undecryptable = 0
        all.forEach { evt ->
            if (!tokenContents.containsKey(evt.id)) {
                val content =
@@ -715,7 +867,19 @@ class CashuWalletState(
                                "Failed to decrypt token ${evt.id.take(8)}: ${it.message}"
                            }
                        }.getOrNull()
-                if (content != null) tokenContents[evt.id] = content
+                if (content != null) tokenContents[evt.id] = content else undecryptable++
+            }
+        }
+
+        // A token we cannot decrypt is money we cannot see, and it drops out of
+        // the balance as silently as a token a relay never delivered. The
+        // retry above only fires when something else triggers a recompute, so
+        // say it out loud: with this counter, a wallet reading low because an
+        // external signer refused N decrypts is diagnosable from a log instead
+        // of looking identical to a wallet that is genuinely empty.
+        if (undecryptable > 0) {
+            Log.w("CashuWallet") {
+                "$undecryptable of ${all.size} kind:7375 event(s) failed to decrypt — balance excludes them"
            }
        }

@@ -723,6 +887,9 @@ class CashuWalletState(
        _tokenEntries.value = CashuWalletReader.computeUnspent(all, tokenContents)
    }

+    /** Token events we hold but have never managed to decrypt. See [recomputeUnspent]. */
+    private fun undecryptedTokenCount(): Int = tokenEvents.keys.count { it !in tokenContents.keys }
+
    private fun recomputePending() {
        // Shared destroyed/expired filter with the headless reader.
        _pendingQuotes.value = CashuWalletReader.computePending(quoteEvents.values, historyEvents.values)
@@ -747,8 +914,14 @@ class CashuWalletState(
    private suspend fun redeemPendingNutzapsSerialized() {
        if (!redeemMutex.tryLock()) return // a sweep is already in flight
        try {
-            val privkey = walletPrivkeyHex() ?: return
-            val pubkey = p2pkPubkeyHex() ?: return
+            // Establish there is work BEFORE touching the signer. This sweep
+            // fires from every relevant cache bundle, and the two key reads
+            // below are NIP-44 decrypts of kind:17375 — for a NIP-46 bunker or
+            // a NIP-55 external signer that is a round-trip out of the process
+            // (Amber even prompts on some configurations), paid on every bundle
+            // by a wallet whose nutzaps were all redeemed months ago. Nothing
+            // above the candidate filter needs a key, so hoist the filter.
+            if (nutzapEvents.isEmpty()) return
            val skipIds = HashSet<HexKey>()
            historyEvents.values.forEach { h ->
                h.redeemedReferences().forEach { skipIds.add(it.eventId) }
@@ -759,6 +932,17 @@ class CashuWalletState(
            val candidates = nutzapEvents.values.filter { it.id !in skipIds }
            if (candidates.isEmpty()) return

+            val privkey = walletPrivkeyHex() ?: return
+            // Derived from the same key the line above just decrypted — pass it
+            // in rather than letting p2pkPubkeyHex() decrypt kind:17375 a
+            // second time for the identical bytes.
+            val pubkey =
+                runCatching {
+                    Secp256k1
+                        .pubKeyCompress(Secp256k1.pubkeyCreate(privkey.hexToByteArray()))
+                        .toHexKey()
+                }.getOrNull() ?: return
+
            for (ev in candidates) {
                try {
                    ops.redeemNutzap(ev, privkey, pubkey)
@@ -918,11 +1102,26 @@ class CashuWalletState(
        val sharedMints = info.mints().map { it.mintUrl }.filter { it in ourMints }
        if (sharedMints.isEmpty()) return null

+        // One pass over the entries, not one per shared mint. This runs inside
+        // a composable `remember {}` on every zap chip, so it is per rendered
+        // note — and `_tokenEntries` is no longer the handful of events a
+        // truncated relay delivery used to leave behind, it is the wallet's
+        // whole proof set. The old filter-per-mint form was
+        // O(sharedMints × entries) with a throwaway list allocated per mint.
        val entries = _tokenEntries.value
+        val satsPerMint = HashMap<String, Long>(sharedMints.size)
+        var totalWalletSats = 0L
+        entries.forEach { entry ->
+            val amount = entry.content.totalAmount()
+            totalWalletSats += amount
+            val mint = entry.content.mint
+            if (mint in ourMints) satsPerMint[mint] = (satsPerMint[mint] ?: 0L) + amount
+        }
+
        var bestMint = sharedMints.first()
        var bestMintSats = 0L
        for (mint in sharedMints) {
-            val balance = entries.filter { it.content.mint == mint }.sumOf { it.content.totalAmount() }
+            val balance = satsPerMint[mint] ?: 0L
            if (balance > bestMintSats) {
                bestMintSats = balance
                bestMint = mint
@@ -932,7 +1131,7 @@ class CashuWalletState(
        return NutzapFunding(
            target = NutzapTarget(mintUrl = bestMint, recipientP2pkPubkeyHex = recipientPubkeyHex),
            bestSingleMintSats = bestMintSats,
-            totalWalletSats = entries.sumOf { it.content.totalAmount() },
+            totalWalletSats = totalWalletSats,
        )
    }

@@ -1203,11 +1402,26 @@ class CashuWalletState(
                entry to entry.content.proofs.mapTo(HashSet()) { it.secret }
            }

+        // Index secret → entries holding it. A superset of B must share every
+        // one of B's secrets, so the only entries that can possibly cover B are
+        // the ones indexed under B's first secret — which is a handful, not the
+        // whole wallet. The previous all-pairs scan was O(entries²) with a
+        // set-containment test inside; that was invisible while a truncated
+        // relay delivery kept the wallet at a few entries, and is not once the
+        // whole proof set is present.
+        val holdersOfSecret = HashMap<String, MutableList<Pair<TokenEntry, HashSet<String>>>>()
+        withSecrets.forEach { pair ->
+            pair.second.forEach { secret ->
+                holdersOfSecret.getOrPut(secret) { mutableListOf() }.add(pair)
+            }
+        }
+
        val redundant = mutableListOf<TokenEntry>()
        for ((entry, secrets) in withSecrets) {
            if (secrets.isEmpty()) continue
+            val candidates = holdersOfSecret[secrets.first()] ?: continue
            val isRedundant =
-                withSecrets.any { (other, otherSecrets) ->
+                candidates.any { (other, otherSecrets) ->
                    other.event.id != entry.event.id &&
                        otherSecrets.containsAll(secrets) &&
                        (
@@ -1567,6 +1781,22 @@ class CashuWalletState(
         */
        const val DISCOVERY_TIMEOUT_MS = 8_000L

+        /**
+         * How long the startup proof backfill waits for a wallet event plus a
+         * non-empty outbox relay set before giving up. Both are restored from
+         * AccountSettings almost immediately on a returning launch; this window
+         * only matters on a first sign-in, where they have to come off the
+         * network before we know there is a wallet and where its events live.
+         */
+        private const val BACKFILL_READY_WAIT_MS = 60_000L
+
+        /**
+         * Per-page idle window for the paged proof walk — measured from the
+         * relay's last message, not from the page's start, so a relay actively
+         * streaming a long backlog is never cut off mid-page.
+         */
+        private const val BACKFILL_IDLE_TIMEOUT_MS = 30_000L
+
        private const val NOT_STARTED_MESSAGE = "CashuWalletState.start() not called"
    }
 }
@@ -21,6 +21,7 @@
 package com.vitorpamplona.amethyst.model.nip65RelayList

 import com.vitorpamplona.amethyst.commons.defaults.Constants
+import com.vitorpamplona.amethyst.commons.defaults.relayListOrDefaultsWhenUnknown
 import com.vitorpamplona.amethyst.model.AccountSettings
 import com.vitorpamplona.amethyst.model.LocalCache
 import com.vitorpamplona.amethyst.model.Note
@@ -58,9 +59,9 @@ class Nip65RelayListState(

    fun nip65Event(note: Note) = note.event as? AdvertisedRelayListEvent ?: settings.backupNIP65RelayList

-    fun normalizeNIP65WriteRelayListWithBackup(note: Note): Set<NormalizedRelayUrl> = nip65Event(note)?.writeRelaysNorm()?.toSet() ?: Constants.eventFinderRelays
+    fun normalizeNIP65WriteRelayListWithBackup(note: Note): Set<NormalizedRelayUrl> = relayListOrDefaultsWhenUnknown(nip65Event(note), Constants.eventFinderRelays) { it.writeRelaysNorm()?.toSet() }

-    fun normalizeNIP65ReadRelayListWithBackup(note: Note): Set<NormalizedRelayUrl> = nip65Event(note)?.readRelaysNorm()?.toSet() ?: Constants.bootstrapInbox
+    fun normalizeNIP65ReadRelayListWithBackup(note: Note): Set<NormalizedRelayUrl> = relayListOrDefaultsWhenUnknown(nip65Event(note), Constants.bootstrapInbox) { it.readRelaysNorm()?.toSet() }

    fun normalizeNIP65WriteRelayListNoDefaults(note: Note): Set<NormalizedRelayUrl> = nip65Event(note)?.writeRelaysNorm()?.toSet() ?: emptySet()

@@ -70,6 +71,27 @@ class Nip65RelayListState(

    fun normalizeNIP65AllRelayListWithBackupNoDefaults(note: Note): Set<NormalizedRelayUrl> = nip65Event(note)?.relays()?.map { it.relayUrl }?.toSet() ?: emptySet()

+    /**
+     * The app defaults currently standing in for a user we have no kind:10002 for — empty as soon
+     * as one exists, including an empty one.
+     *
+     * Uses the same `nip65Event(note) == null` predicate the substitution itself uses, so the two
+     * cannot drift: whatever is listed here is exactly what the app is guessing on the user's
+     * behalf. See [relayListOrDefaultsWhenUnknown].
+     */
+    fun assumedDefaults(note: Note): Set<NormalizedRelayUrl> = if (nip65Event(note) == null) Constants.bootstrapInbox + Constants.eventFinderRelays else emptySet()
+
+    val assumedDefaultsFlow =
+        getNIP65RelayListFlow()
+            .map { assumedDefaults(it.note) }
+            .onStart { emit(assumedDefaults(nip65ListNote)) }
+            .flowOn(Dispatchers.IO)
+            .stateIn(
+                scope,
+                SharingStarted.Eagerly,
+                assumedDefaults(nip65ListNote),
+            )
+
    val outboxFlow =
        getNIP65RelayListFlow()
            .map { normalizeNIP65WriteRelayListWithBackup(it.note) }
@@ -25,6 +25,7 @@ import com.vitorpamplona.amethyst.model.AccountSyncedSettingsInternal
 import com.vitorpamplona.amethyst.model.LocalCache
 import com.vitorpamplona.amethyst.model.NoteState
 import com.vitorpamplona.quartz.nip01Core.core.JsonMapper
+import com.vitorpamplona.quartz.nip01Core.core.awaitCreatedAtToSupersede
 import com.vitorpamplona.quartz.nip01Core.signers.NostrSigner
 import com.vitorpamplona.quartz.nip78AppData.AppSpecificDataEvent
 import com.vitorpamplona.quartz.utils.Log
@@ -33,6 +34,8 @@ import kotlinx.coroutines.DelicateCoroutinesApi
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.flow.StateFlow
 import kotlinx.coroutines.launch
+import kotlinx.coroutines.sync.Mutex
+import kotlinx.coroutines.sync.withLock
 import kotlin.coroutines.cancellation.CancellationException

 class AppSpecificState(
@@ -52,12 +55,35 @@ class AppSpecificState(

    fun getAppSpecificDataFlow(): StateFlow<NoteState> = amethystSettingsNote.flow().metadata.stateFlow

+    /**
+     * Serializes the state snapshot and the timestamp it is stamped with. Two rapid toggles publish
+     * from separate coroutines on the signer's dispatcher; without this they could read the same
+     * previous timestamp and collide again, or take timestamps in the opposite order to the state
+     * they captured. Signing and encrypting stay outside the lock — those can wait on an external
+     * signer, and they don't affect ordering.
+     */
+    private val stampOrder = Mutex()
+
+    /**
+     * The newest version this instance has published, which is not always in [amethystSettingsNote]
+     * yet: the cache is only updated once the event comes back through the broadcaster.
+     */
+    private var lastPublishedAt = 0L
+
    suspend fun saveNewAppSpecificData(): AppSpecificDataEvent {
-        val toInternal = settings.syncedSettings.toInternal()
+        val (toInternal, createdAt) =
+            stampOrder.withLock {
+                val snapshot = settings.syncedSettings.toInternal(settings.mutedPublicChats.value)
+                val stamp = awaitCreatedAtToSupersede(maxOf(lastPublishedAt, amethystSettingsNote.event?.createdAt ?: 0L))
+                lastPublishedAt = stamp
+                snapshot to stamp
+            }
+
        return signer.sign(
            AppSpecificDataEvent.build(
                dTag = APP_SPECIFIC_DATA_D_TAG,
                description = signer.nip44Encrypt(JsonMapper.toJson(toInternal), signer.pubKey),
+                createdAt = createdAt,
            ),
        )
    }
@@ -24,6 +24,7 @@ import com.vitorpamplona.amethyst.model.Account
 import com.vitorpamplona.amethyst.model.LocalCache
 import com.vitorpamplona.amethyst.model.filterIntoSet
 import com.vitorpamplona.quartz.nip01Core.core.Address
+import com.vitorpamplona.quartz.nip01Core.core.awaitCreatedAtToSupersede
 import com.vitorpamplona.quartz.nip01Core.relay.filters.Filter
 import com.vitorpamplona.quartz.nip01Core.relay.normalizer.NormalizedRelayUrl
 import com.vitorpamplona.quartz.nip01Core.signers.NostrSigner
@@ -31,7 +32,6 @@ import com.vitorpamplona.quartz.nip89AppHandlers.PlatformType
 import com.vitorpamplona.quartz.nip89AppHandlers.definition.AppDefinitionEvent
 import com.vitorpamplona.quartz.nip89AppHandlers.recommendation.AppRecommendationEvent
 import com.vitorpamplona.quartz.nip89AppHandlers.recommendation.tags.RecommendationTag
-import com.vitorpamplona.quartz.utils.TimeUtils
 import kotlinx.coroutines.CoroutineScope
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.flow.SharingStarted
@@ -85,15 +85,15 @@ class AppRecommendationsState(
    private val publishMutex = Mutex()

    /**
-     * Returns a createdAt strictly greater than whatever AppRecommendationEvent
-     * currently sits in cache for this d-tag. Needed because
-     * LocalCache.consumeBaseReplaceable drops updates whose createdAt isn't
-     * strictly greater, and TimeUtils.now() has only second resolution.
+     * The createdAt this d-tag's next version needs to supersede whatever is in cache for it. Waits
+     * out the second rather than stamping the future, so repeatedly toggling one recommendation
+     * cannot drift its `created_at` ahead of the clock. Runs under [publishMutex], which is what
+     * keeps two waits from racing each other onto the same second.
     */
-    private fun nextCreatedAt(supportedKind: String): Long {
+    private suspend fun nextCreatedAt(supportedKind: String): Long {
        val address = Address(AppRecommendationEvent.KIND, signer.pubKey, supportedKind)
        val latest = cache.getAddressableNoteIfExists(address)?.event?.createdAt ?: 0L
-        return maxOf(TimeUtils.now(), latest + 1)
+        return awaitCreatedAtToSupersede(latest)
    }

    private fun currentRecommendations(supportedKind: String): List<RecommendationTag> {
@@ -37,25 +37,36 @@ import kotlinx.serialization.json.Json
 import kotlin.coroutines.cancellation.CancellationException

 /**
- * Device-global persistence for the NIP-OA attestations this device holds
- * ([BuzzHeldAttestations]), so a held credential survives an app restart instead of
- * needing to be re-pasted. Uses the app-wide [sharedPreferencesDataStore] like
- * [NamecoinSharedPreferences] (not per-account — the store is already keyed by the agent
- * pubkey each attestation authorizes).
+ * Per-account persistence for the NIP-OA attestation this account holds
+ * ([BuzzHeldAttestations]), so a held credential survives an app restart instead of needing to be
+ * re-pasted. The key is namespaced by pubkey; the store used to be one device-global list because
+ * each entry carried the agent key it authorized, which made the file a per-account store with
+ * extra steps.
 *
- * On construction it loads the saved entries into the singleton — **re-verifying each
- * against its agent key**, so a tampered on-disk credential is dropped rather than trusted
- * — then mirrors every later change back to disk. Construct once, eagerly, at startup.
+ * On construction it loads this account's saved attestation and mirrors every later change back to
+ * disk. Re-verification on restore is no longer done here: [BuzzHeldAttestations.put] verifies
+ * against the agent key itself and rejects what fails, so a tampered on-disk credential is dropped
+ * by the same gate that rejects a mistyped one. Construct once per account, eagerly.
 */
@Stable
 class BuzzAttestationPreferences(
    private val context: Context,
    private val scope: CoroutineScope,
+    private val pubKeyHex: HexKey,
+    private val attestation: BuzzHeldAttestations,
 ) {
-    private val json = Json { ignoreUnknownKeys = true }
+    private val key = stringPreferencesKey("$KEY_PREFIX$pubKeyHex")

    @Serializable
    private data class Entry(
+        val owner: HexKey,
+        val conditions: String,
+        val sig: HexKey,
+    )
+
+    /** The pre-namespacing on-disk shape: one list for the whole device, each entry agent-keyed. */
+    @Serializable
+    private data class LegacyEntry(
        val agent: HexKey,
        val owner: HexKey,
        val conditions: String,
@@ -67,41 +78,76 @@ class BuzzAttestationPreferences(
            restoreFromDisk()
            // Persist on every change AFTER the initial restore (drop(1) skips the value
            // present at collection start, which restoreFromDisk already wrote).
-            BuzzHeldAttestations.flow.drop(1).collect { persist(it) }
+            attestation.flow.drop(1).collect { persist(it) }
        }
    }

    private suspend fun restoreFromDisk() {
        try {
-            val raw = context.sharedPreferencesDataStore.data.first()[KEY] ?: return
-            val verified =
-                json
-                    .decodeFromString<List<Entry>>(raw)
-                    .mapNotNull { e ->
-                        val attestation = OwnerAttestation(e.owner, e.conditions, e.sig)
-                        // Only reinstate a credential that still verifies for its agent key.
-                        if (attestation.verify(e.agent)) e.agent to attestation else null
-                    }.toMap()
-            if (verified.isNotEmpty()) BuzzHeldAttestations.restore(verified)
+            val prefs = context.sharedPreferencesDataStore.data.first()
+            // put() verifies, so a credential that no longer checks out is dropped either way.
+            restoreFrom(prefs[key], prefs[LEGACY_KEY], pubKeyHex)?.let(attestation::put)
        } catch (e: Exception) {
            if (e is CancellationException) throw e
-            Log.e("BuzzAttestationPrefs") { "Error reading held attestations: ${e.message}" }
+            Log.e("BuzzAttestationPrefs") { "Error reading held attestation: ${e.message}" }
        }
    }

-    private suspend fun persist(entries: Map<HexKey, OwnerAttestation>) {
+    private suspend fun persist(held: OwnerAttestation?) {
        try {
-            val list = entries.map { (agent, a) -> Entry(agent, a.ownerPubKey, a.conditions, a.sig) }
            context.sharedPreferencesDataStore.edit { prefs ->
-                prefs[KEY] = json.encodeToString(list)
+                // Write [NONE] rather than removing the key: removing it is indistinguishable from
+                // never having migrated, which would let the legacy list re-seed a credential the
+                // user just deleted. See [restoreFrom].
+                prefs[key] = if (held == null) NONE else json.encodeToString(Entry(held.ownerPubKey, held.conditions, held.sig))
            }
        } catch (e: Exception) {
            if (e is CancellationException) throw e
-            Log.e("BuzzAttestationPrefs") { "Error writing held attestations: ${e.message}" }
+            Log.e("BuzzAttestationPrefs") { "Error writing held attestation: ${e.message}" }
        }
    }

    companion object {
-        private val KEY = stringPreferencesKey("buzz.heldAttestations")
+        private const val KEY_PREFIX = "buzz.heldAttestation."
+
+        /** The device-global key written before the store became per-account; read-only now. */
+        private val LEGACY_KEY = stringPreferencesKey("buzz.heldAttestations")
+
+        /**
+         * Tombstone for "this account has been migrated and holds nothing", which an *absent* key
+         * cannot express — absent still means "never migrated" and is allowed to seed from
+         * [LEGACY_KEY]. Without it, removing a held attestation lasted only until the next launch,
+         * because nothing ever clears the legacy list. (The starred-channel and joined-workspace
+         * stores get this for free: they persist an empty *set*, which reads back present.)
+         */
+        private const val NONE = ""
+
+        private val json = Json { ignoreUnknownKeys = true }
+
+        /**
+         * Which attestation to reinstate, given this account's saved value and the pre-namespacing
+         * device-global list. Pure, so the migration precedence is testable without a `Context`.
+         *
+         * [saved] wins whenever it is present, [NONE] included. Only a never-migrated account falls
+         * back to [legacy], and it takes just the entry issued to its own key — that list was
+         * already agent-keyed, so no other account's credential can match. Nothing is verified here;
+         * [BuzzHeldAttestations.put] is the gate that rejects a tampered credential.
+         */
+        internal fun restoreFrom(
+            saved: String?,
+            legacy: String?,
+            agentPubKey: HexKey,
+        ): OwnerAttestation? {
+            if (saved != null) {
+                if (saved == NONE) return null
+                val entry = json.decodeFromString<Entry>(saved)
+                return OwnerAttestation(entry.owner, entry.conditions, entry.sig)
+            }
+            val list = legacy ?: return null
+            return json
+                .decodeFromString<List<LegacyEntry>>(list)
+                .firstOrNull { it.agent == agentPubKey }
+                ?.let { OwnerAttestation(it.owner, it.conditions, it.sig) }
+        }
    }
 }
@@ -25,6 +25,7 @@ import androidx.compose.runtime.Stable
 import androidx.datastore.preferences.core.edit
 import androidx.datastore.preferences.core.stringSetPreferencesKey
 import com.vitorpamplona.amethyst.commons.model.buzz.BuzzChannelStars
+import com.vitorpamplona.quartz.nip01Core.core.HexKey
 import com.vitorpamplona.quartz.utils.Log
 import kotlinx.coroutines.CoroutineScope
 import kotlinx.coroutines.flow.drop
@@ -33,28 +34,39 @@ import kotlinx.coroutines.launch
 import kotlin.coroutines.cancellation.CancellationException

 /**
- * Device-global persistence for the set of starred Buzz workspace channels ([BuzzChannelStars]),
- * so favorites survive a restart. Mirrors [BuzzWorkspacePreferences]: app-wide (not per-account),
- * loads the saved ids into the singleton on construction, then writes every later change back.
- * Construct once, eagerly.
+ * Per-account persistence for the set of starred Buzz workspace channels ([BuzzChannelStars]), so
+ * favorites survive a restart. Mirrors [BuzzWorkspacePreferences] in both shape and reasoning: the
+ * key is namespaced by pubkey because a star is personal — it says which channels *this* user wants
+ * pinned — and one device-global set meant one account's favorites reordered and badged every other
+ * logged-in account's channel list. Loads this account's saved ids into [stars] on construction,
+ * then writes every later change back. Construct once per account, eagerly.
 */
@Stable
 class BuzzChannelStarPreferences(
    private val context: Context,
    private val scope: CoroutineScope,
+    private val pubKeyHex: HexKey,
+    private val stars: BuzzChannelStars,
 ) {
+    private val key = stringSetPreferencesKey("$KEY_PREFIX$pubKeyHex")
+
    init {
        scope.launch {
            restoreFromDisk()
            // drop(1) skips the value present at collection start, which restoreFromDisk already wrote.
-            BuzzChannelStars.flow.drop(1).collect { persist(it) }
+            stars.flow.drop(1).collect { persist(it) }
        }
    }

    private suspend fun restoreFromDisk() {
        try {
-            val raw = context.sharedPreferencesDataStore.data.first()[KEY] ?: return
-            if (raw.isNotEmpty()) BuzzChannelStars.restore(raw)
+            val prefs = context.sharedPreferencesDataStore.data.first()
+            // Fall back to the pre-namespacing device-global key so an upgrade doesn't unpin
+            // everything. That set is what every account already saw; the next toggle writes to this
+            // account's own key and takes over. The legacy key is left for other accounts to seed
+            // from and is never written again.
+            val raw = prefs[key] ?: prefs[LEGACY_KEY] ?: return
+            if (raw.isNotEmpty()) stars.restore(raw)
        } catch (e: Exception) {
            if (e is CancellationException) throw e
            Log.e("BuzzChannelStarPrefs") { "Error reading starred channels: ${e.message}" }
@@ -63,7 +75,10 @@ class BuzzChannelStarPreferences(

    private suspend fun persist(ids: Set<String>) {
        try {
-            context.sharedPreferencesDataStore.edit { prefs -> prefs[KEY] = ids }
+            // Always write the starred set, empty included — never remove the key. An absent key
+            // means "never migrated" and re-seeds from the legacy one above, so removing it
+            // would undo the user's last removal on the next launch.
+            context.sharedPreferencesDataStore.edit { prefs -> prefs[key] = ids }
        } catch (e: Exception) {
            if (e is CancellationException) throw e
            Log.e("BuzzChannelStarPrefs") { "Error writing starred channels: ${e.message}" }
@@ -71,6 +86,9 @@ class BuzzChannelStarPreferences(
    }

    companion object {
-        private val KEY = stringSetPreferencesKey("buzz.starredChannels")
+        private const val KEY_PREFIX = "buzz.starredChannels."
+
+        /** The device-global key written before the set became per-account; read-only now. */
+        private val LEGACY_KEY = stringSetPreferencesKey("buzz.starredChannels")
    }
 }
@@ -25,6 +25,7 @@ import androidx.compose.runtime.Stable
 import androidx.datastore.preferences.core.edit
 import androidx.datastore.preferences.core.stringSetPreferencesKey
 import com.vitorpamplona.amethyst.commons.model.buzz.BuzzWorkspaces
+import com.vitorpamplona.quartz.nip01Core.core.HexKey
 import com.vitorpamplona.quartz.nip01Core.relay.normalizer.NormalizedRelayUrl
 import com.vitorpamplona.quartz.nip01Core.relay.normalizer.RelayUrlNormalizer
 import com.vitorpamplona.quartz.utils.Log
@@ -35,36 +36,56 @@ import kotlinx.coroutines.launch
 import kotlin.coroutines.cancellation.CancellationException

 /**
- * Device-global persistence for the set of joined `block/buzz` workspaces ([BuzzWorkspaces]),
- * so the app knows which relays to connect + NIP-42-authenticate + run member-channel discovery
- * against on a cold start — Buzz membership is server-side (granted by the HTTP invite claim),
- * with no NIP-51/kind-10009 join event to rebuild the set from. Uses the app-wide
- * [sharedPreferencesDataStore] like [BuzzAttestationPreferences] (not per-account: a joined
- * relay is workspace-wide, and restoring only marks relays to sync — the relay still gates every
- * read/write by the authenticated key).
+ * Per-account persistence for the set of joined `block/buzz` workspaces ([BuzzWorkspaces]), so the
+ * app knows which relays to connect + NIP-42-authenticate + run member-channel discovery against on
+ * a cold start — Buzz membership is server-side (granted by the HTTP invite claim), with no
+ * NIP-51/kind-10009 join event to rebuild the set from.
 *
- * On construction it loads the saved relay URLs into the singleton (re-normalizing each, dropping
- * any that no longer parse), then mirrors every later change back to disk. Construct once, eagerly.
+ * **Per account, not per device.** The set used to be one device-global key shared by every logged-in
+ * account, on the reasoning that restoring only marks relays to sync and the relay gates each
+ * read/write by the authenticated key anyway. That missed one consumer: the joined set also makes a
+ * relay first-party in `AuthCoordinator.isFirstParty`, so one account joining a workspace silently
+ * gave *every* other logged-in account an automatic NIP-42 login there — the bystander-account leak
+ * the per-account gate exists to prevent. The key is namespaced by pubkey for the same reason the
+ * relay-auth overrides moved to a per-account file.
+ *
+ * Still on the app-wide [sharedPreferencesDataStore] file — the namespacing, not the file, is what
+ * separates accounts, and one file avoids a second DataStore per logged-in account.
+ *
+ * On construction it loads this account's saved relay URLs into [workspaces] (re-normalizing each,
+ * dropping any that no longer parse), then mirrors every later change back to disk. Construct once
+ * per account, eagerly.
 */
@Stable
 class BuzzWorkspacePreferences(
    private val context: Context,
    private val scope: CoroutineScope,
+    private val pubKeyHex: HexKey,
+    private val workspaces: BuzzWorkspaces,
 ) {
+    private val key = stringSetPreferencesKey("$KEY_PREFIX$pubKeyHex")
+
    init {
        scope.launch {
            restoreFromDisk()
            // Persist on every change AFTER the initial restore (drop(1) skips the value present
            // at collection start, which restoreFromDisk already wrote).
-            BuzzWorkspaces.flow.drop(1).collect { persist(it) }
+            workspaces.flow.drop(1).collect { persist(it) }
        }
    }

    private suspend fun restoreFromDisk() {
        try {
-            val raw = context.sharedPreferencesDataStore.data.first()[KEY] ?: return
+            val prefs = context.sharedPreferencesDataStore.data.first()
+            // Fall back to the pre-namespacing device-global key so an upgrade doesn't empty the
+            // workspaces hub. That set is whatever any account joined, which is exactly what every
+            // account already saw before this became per-account — so seeding from it changes
+            // nothing that was true yesterday, and the first join after the upgrade writes to this
+            // account's own key and takes over. The legacy key is left in place for the other
+            // accounts to seed from; nothing writes it again.
+            val raw = prefs[key] ?: prefs[LEGACY_KEY] ?: return
            val relays = raw.mapNotNull { RelayUrlNormalizer.normalizeOrNull(it) }.toSet()
-            if (relays.isNotEmpty()) BuzzWorkspaces.restore(relays)
+            if (relays.isNotEmpty()) workspaces.restore(relays)
        } catch (e: Exception) {
            if (e is CancellationException) throw e
            Log.e("BuzzWorkspacePrefs") { "Error reading joined workspaces: ${e.message}" }
@@ -73,8 +94,11 @@ class BuzzWorkspacePreferences(

    private suspend fun persist(relays: Set<NormalizedRelayUrl>) {
        try {
+            // Always write the joined set, empty included — never remove the key. An absent key
+            // means "never migrated" and re-seeds from the legacy one above, so removing it
+            // would undo the user's last removal on the next launch.
            context.sharedPreferencesDataStore.edit { prefs ->
-                prefs[KEY] = relays.map { it.url }.toSet()
+                prefs[key] = relays.map { it.url }.toSet()
            }
        } catch (e: Exception) {
            if (e is CancellationException) throw e
@@ -83,6 +107,9 @@ class BuzzWorkspacePreferences(
    }

    companion object {
-        private val KEY = stringSetPreferencesKey("buzz.joinedWorkspaces")
+        private const val KEY_PREFIX = "buzz.joinedWorkspaces."
+
+        /** The device-global key written before the set became per-account; read-only now. */
+        private val LEGACY_KEY = stringSetPreferencesKey("buzz.joinedWorkspaces")
    }
 }
@@ -0,0 +1,101 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.model.preferences
+
+import androidx.compose.runtime.Stable
+import androidx.datastore.core.DataStore
+import androidx.datastore.preferences.core.Preferences
+import androidx.datastore.preferences.core.edit
+import androidx.datastore.preferences.core.stringSetPreferencesKey
+import com.vitorpamplona.amethyst.ui.navigation.drawer.DrawerSectionId
+import com.vitorpamplona.amethyst.ui.navigation.drawer.drawerSectionIdsFromNames
+import com.vitorpamplona.amethyst.ui.navigation.drawer.toNames
+import com.vitorpamplona.quartz.utils.Log
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.flow.MutableStateFlow
+import kotlinx.coroutines.flow.StateFlow
+import kotlinx.coroutines.flow.asStateFlow
+import kotlinx.coroutines.flow.drop
+import kotlinx.coroutines.flow.first
+import kotlinx.coroutines.flow.update
+import kotlinx.coroutines.launch
+import kotlin.coroutines.cancellation.CancellationException
+
+/**
+ * Device-global persistence for the drawer section headings the user has collapsed, so the side menu
+ * comes back folded the way they left it instead of springing fully open on every launch. Which
+ * headings are folded is a per-device view choice, so unlike the hidden rows beside it in the drawer
+ * it is never published to relays.
+ *
+ * Mirrors [RelayGroupDeletionPreferences]: app-wide (not per-account), loads the saved names on
+ * construction, then writes every later change back. Takes the [DataStore] rather than a `Context`
+ * so the whole cycle is exercised by a plain unit test against a temp file.
+ *
+ * Construct once, eagerly. The restore is a fire-and-forget coroutine, not a barrier, so the flow
+ * reads as "nothing collapsed" until it lands; building this at app startup rather than on first use
+ * puts that read many frames ahead of the drawer's first composition (and the store's file has
+ * already been parsed by then, for `UiSharedPreferences`). Worst case if it ever lost that race is
+ * cosmetic — a heading renders open and then folds — which is why no one waits on it.
+ */
+@Stable
+class DrawerSectionCollapsePreferences(
+    private val store: DataStore<Preferences>,
+    scope: CoroutineScope,
+) {
+    private val collapsed = MutableStateFlow<Set<DrawerSectionId>>(emptySet())
+
+    /** The collapsed headings; the drawer collects this to decide which sections render their rows. */
+    val flow: StateFlow<Set<DrawerSectionId>> = collapsed.asStateFlow()
+
+    init {
+        scope.launch {
+            restoreFromDisk()
+            // drop(1) skips the value present at collection start, which restoreFromDisk already wrote.
+            collapsed.drop(1).collect { persist(it) }
+        }
+    }
+
+    /** Collapses [section] if expanded, expands it if collapsed. Safe to call from the main thread. */
+    fun toggle(section: DrawerSectionId) = collapsed.update { if (section in it) it - section else it + section }
+
+    private suspend fun restoreFromDisk() {
+        try {
+            val raw = store.data.first()[KEY] ?: return
+            collapsed.value = drawerSectionIdsFromNames(raw)
+        } catch (e: Exception) {
+            if (e is CancellationException) throw e
+            Log.e("DrawerSectionCollapsePrefs") { "Error reading collapsed drawer sections: ${e.message}" }
+        }
+    }
+
+    private suspend fun persist(sections: Set<DrawerSectionId>) {
+        try {
+            store.edit { prefs -> prefs[KEY] = sections.toNames() }
+        } catch (e: Exception) {
+            if (e is CancellationException) throw e
+            Log.e("DrawerSectionCollapsePrefs") { "Error writing collapsed drawer sections: ${e.message}" }
+        }
+    }
+
+    companion object {
+        private val KEY = stringSetPreferencesKey("ui.drawer.collapsedSections")
+    }
+}
@@ -0,0 +1,68 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.model.serverList
+
+import com.vitorpamplona.amethyst.model.nip51Lists.indexerRelays.IndexerRelayListState
+import com.vitorpamplona.amethyst.model.nip51Lists.searchRelays.SearchRelayListState
+import com.vitorpamplona.amethyst.model.nip65RelayList.Nip65RelayListState
+import com.vitorpamplona.quartz.nip01Core.relay.normalizer.NormalizedRelayUrl
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.flow.StateFlow
+import kotlinx.coroutines.flow.combine
+import kotlinx.coroutines.flow.flowOn
+import kotlinx.coroutines.flow.stateIn
+
+/**
+ * The relays the app is **guessing** on the user's behalf because it has not seen their lists yet.
+ *
+ * Non-empty only while the corresponding event is absent — never because a list is empty, which is
+ * a choice we honor (see `relayListOrDefaultsWhenUnknown`). It therefore empties itself, per list,
+ * the moment the user's own data lands; no window, no timeout, no bookkeeping.
+ *
+ * **Deliberately NOT merged into [TrustedRelayListsState].** That one feeds `Account.isInMyRelayList`
+ * -> `RelayAuthPermissionLedger` -> `RelayAuthResolver`, i.e. the NIP-42 AUTH decision. Guessed
+ * relays must never make the app sign an AUTH challenge as though they were the user's own — that
+ * would turn a timing signal into a signed identity assertion. The single consumer of this flow is
+ * Tor routing.
+ */
+class AssumedRelayListsState(
+    val nip65RelayList: Nip65RelayListState,
+    val searchRelayList: SearchRelayListState,
+    val indexerRelayList: IndexerRelayListState,
+    val scope: CoroutineScope,
+) {
+    val flow: StateFlow<Set<NormalizedRelayUrl>> =
+        combine(
+            nip65RelayList.assumedDefaultsFlow,
+            searchRelayList.assumedDefaultsFlow,
+            indexerRelayList.assumedDefaultsFlow,
+        ) { nip65, search, indexer ->
+            nip65 + search + indexer
+        }.flowOn(Dispatchers.IO)
+            .stateIn(
+                scope,
+                kotlinx.coroutines.flow.SharingStarted.Eagerly,
+                nip65RelayList.assumedDefaultsFlow.value +
+                    searchRelayList.assumedDefaultsFlow.value +
+                    indexerRelayList.assumedDefaultsFlow.value,
+            )
+}
@@ -20,14 +20,17 @@
 */
 package com.vitorpamplona.amethyst.model.torState

+import com.vitorpamplona.amethyst.model.Account
 import com.vitorpamplona.amethyst.model.accountsCache.AccountCacheState
 import com.vitorpamplona.quartz.nip01Core.relay.normalizer.NormalizedRelayUrl
+import com.vitorpamplona.quartz.utils.Log
 import kotlinx.coroutines.CoroutineScope
 import kotlinx.coroutines.ExperimentalCoroutinesApi
 import kotlinx.coroutines.FlowPreview
 import kotlinx.coroutines.flow.Flow
 import kotlinx.coroutines.flow.MutableStateFlow
 import kotlinx.coroutines.flow.SharingStarted
+import kotlinx.coroutines.flow.StateFlow
 import kotlinx.coroutines.flow.combine
 import kotlinx.coroutines.flow.debounce
 import kotlinx.coroutines.flow.emitAll
@@ -35,112 +38,132 @@ import kotlinx.coroutines.flow.onEach
 import kotlinx.coroutines.flow.stateIn
 import kotlinx.coroutines.flow.transformLatest

+/**
+ * Pushes the relay classifications [TorRelayState] needs — which relays are DM, trusted, guessed, or
+ * money-operation relays — as a union across every logged-in account.
+ *
+ * All four are the same fold: pick one set per account, union them, publish. It used to be written
+ * out four times at ~30 lines each, and the copies had already drifted apart in trivial ways (an
+ * `if (isEmpty)` guard that could never fire, differently-named accumulators). Sharing one
+ * implementation is what keeps a fifth classification from being another 30 lines of the same
+ * thing — and, more importantly, from being 30 lines that quietly forget a step.
+ */
 class AccountsTorStateConnector(
    accountsCache: AccountCacheState,
    torEvaluatorFlow: TorRelayState,
    scope: CoroutineScope,
 ) {
-    @OptIn(ExperimentalCoroutinesApi::class, FlowPreview::class)
-    val allDmRelayFlows: Flow<Set<NormalizedRelayUrl>> =
-        accountsCache.accounts
-            .debounce(200)
-            .transformLatest { snapshot ->
-                val dmFlows = snapshot.map { it.value.dmRelayList.flow }
-
-                val dmFlowReady =
-                    dmFlows.ifEmpty {
-                        listOf(MutableStateFlow(emptySet()))
-                    }
-
-                if (dmFlowReady.isEmpty()) {
-                    emit(emptySet())
-                } else {
-                    emitAll(
-                        combine(dmFlowReady) {
-                            val dmRelays = mutableSetOf<NormalizedRelayUrl>()
-                            it.forEach {
-                                dmRelays.addAll(it)
-                            }
-                            dmRelays.toSet()
-                        },
-                    )
-                }
-            }.onEach {
-                torEvaluatorFlow.dmRelays.tryEmit(it)
-            }.stateIn(
-                scope,
-                SharingStarted.Eagerly,
-                emptySet(),
-            )
-
+    /**
+     * Union of one relay set across all logged-in accounts, republished into [TorRelayState].
+     *
+     * `debounce(200)` rides out the burst of account churn at login; `transformLatest` drops the
+     * previous fan-in when the account set changes so a logged-out account cannot keep contributing.
+     * The seed is `emptySet()` for every classification: before any account exists, nothing is
+     * classified.
+     *
+     * Takes its collaborators as parameters rather than reading constructor properties because the
+     * call sites are property initializers, where non-`val` constructor parameters are in scope but
+     * member functions cannot see them.
+     */
    @OptIn(FlowPreview::class, ExperimentalCoroutinesApi::class)
-    val allTrustedRelaysFlow: Flow<Set<NormalizedRelayUrl>> =
+    private fun unionAcrossAccounts(
+        accountsCache: AccountCacheState,
+        scope: CoroutineScope,
+        select: (Account) -> Flow<Set<NormalizedRelayUrl>>,
+        publish: (Set<NormalizedRelayUrl>) -> Unit,
+    ): StateFlow<Set<NormalizedRelayUrl>> =
        accountsCache.accounts
            .debounce(200)
            .transformLatest { snapshot ->
-                val trustedRelayFlows = snapshot.map { it.value.trustedRelays.flow }
-
-                val trustedRelayFlowReady =
-                    trustedRelayFlows.ifEmpty {
-                        listOf(MutableStateFlow(emptySet()))
-                    }
-
-                if (trustedRelayFlowReady.isEmpty()) {
-                    emit(emptySet())
-                } else {
-                    emitAll(
-                        combine(trustedRelayFlowReady) {
-                            val trustedRelays = mutableSetOf<NormalizedRelayUrl>()
-                            it.forEach {
-                                trustedRelays.addAll(it)
-                            }
-                            trustedRelays.toSet()
-                        },
-                    )
-                }
-            }.onEach {
-                torEvaluatorFlow.trustedRelays.tryEmit(it)
-            }.stateIn(
-                scope,
-                SharingStarted.Eagerly,
-                emptySet(),
-            )
-
-    // Persistent money-operation relays across all accounts: NIP-47 wallet relays and saved CLINK
-    // Debits service relays. Feeds TorRelayState.moneyOpRelays so these connections honor the
-    // money-operations Tor preference instead of being classified as generic "new" relays.
-    @OptIn(FlowPreview::class, ExperimentalCoroutinesApi::class)
-    val allMoneyOpRelaysFlow: Flow<Set<NormalizedRelayUrl>> =
-        accountsCache.accounts
-            .debounce(200)
-            .transformLatest { snapshot ->
-                val perAccountFlows =
-                    snapshot.map { (_, account) ->
-                        combine(
-                            account.settings.nwcWallets,
-                            account.settings.clinkDebitWallets,
-                        ) { nwcWallets, clinkDebitWallets ->
-                            val relays = mutableSetOf<NormalizedRelayUrl>()
-                            nwcWallets.forEach { relays.add(it.uri.relayUri) }
-                            clinkDebitWallets.forEach { relays.addAll(it.pointer.relays) }
-                            relays.toSet()
-                        }
-                    }
-
-                val ready = perAccountFlows.ifEmpty { listOf(MutableStateFlow(emptySet())) }
+                val perAccount =
+                    snapshot
+                        .map { select(it.value) }
+                        .ifEmpty { listOf(MutableStateFlow(emptySet())) }

                emitAll(
-                    combine(ready) { perAccount ->
-                        val moneyOpRelays = mutableSetOf<NormalizedRelayUrl>()
-                        perAccount.forEach { moneyOpRelays.addAll(it) }
-                        moneyOpRelays.toSet()
+                    combine(perAccount) { sets ->
+                        sets.flatMapTo(mutableSetOf()) { it }
                    },
                )
-            }.onEach {
-                torEvaluatorFlow.moneyOpRelays.tryEmit(it)
-            }.stateIn(
+            }.onEach(publish)
+            .stateIn(
                scope,
                SharingStarted.Eagerly,
                emptySet(),
            )
+
+    /** NIP-17 DM relays: these follow the dedicated DM preference, never the generic "new" one. */
+    val allDmRelayFlows: StateFlow<Set<NormalizedRelayUrl>> =
+        unionAcrossAccounts(
+            accountsCache,
+            scope,
+            select = { it.dmRelayList.flow },
+            publish = { torEvaluatorFlow.dmRelays.tryEmit(it) },
+        )
+
+    /** Everything the user actually put in one of their own relay lists. */
+    val allTrustedRelaysFlow: StateFlow<Set<NormalizedRelayUrl>> =
+        unionAcrossAccounts(
+            accountsCache,
+            scope,
+            select = { it.trustedRelays.flow },
+            publish = { torEvaluatorFlow.trustedRelays.tryEmit(it) },
+        )
+
+    /**
+     * Relays the app is *guessing* while an account's own lists are unknown. Feeds
+     * [TorRelayState.assumedRelays] and nothing else — see `AssumedRelayListsState` for why these
+     * must never reach the AUTH decision.
+     *
+     * Per account, so a second login cannot re-open the guess for an established one; each
+     * account's contribution empties itself as soon as that account's own lists land.
+     */
+    val allAssumedRelaysFlow: StateFlow<Set<NormalizedRelayUrl>> =
+        unionAcrossAccounts(
+            accountsCache,
+            scope,
+            select = { it.assumedRelays.flow },
+            publish = {
+                logHandover(it)
+                torEvaluatorFlow.assumedRelays.tryEmit(it)
+            },
+        )
+
+    /**
+     * Persistent money-operation relays: NIP-47 wallet relays and saved CLINK Debits service
+     * relays, so these connections honor the money-operations preference rather than being
+     * classified as generic "new" relays.
+     */
+    val allMoneyOpRelaysFlow: StateFlow<Set<NormalizedRelayUrl>> =
+        unionAcrossAccounts(
+            accountsCache,
+            scope,
+            select = { account ->
+                combine(
+                    account.settings.nwcWallets,
+                    account.settings.clinkDebitWallets,
+                ) { nwcWallets, clinkDebitWallets ->
+                    val relays = mutableSetOf<NormalizedRelayUrl>()
+                    nwcWallets.forEach { relays.add(it.uri.relayUri) }
+                    clinkDebitWallets.forEach { relays.addAll(it.pointer.relays) }
+                    relays.toSet()
+                }
+            },
+            publish = { torEvaluatorFlow.moneyOpRelays.tryEmit(it) },
+        )
+
+    @Volatile private var lastAssumedCount: Int = -1
+
+    /**
+     * The handover is the whole contract of the guessed-relay feature: the moment a user's own
+     * lists arrive, every relay we were guessing about goes back to the policy they actually asked
+     * for. Logged at INFO because "did it hand over, and when" is not answerable from any other
+     * line — the reconnect that follows looks identical to an ordinary one.
+     */
+    private fun logHandover(relays: Set<NormalizedRelayUrl>) {
+        if (relays.size == lastAssumedCount) return
+        val released = if (relays.isEmpty()) " (own lists arrived; released to their real Tor policy)" else ""
+        Log.i("AccountsTorState") { "Guessed relays: $lastAssumedCount -> ${relays.size}$released" }
+        lastAssumedCount = relays.size
+    }
 }
@@ -22,3 +22,5 @@ package com.vitorpamplona.amethyst.model.torState

 // Canonical type now lives in commons
 typealias TorRelayEvaluation = com.vitorpamplona.amethyst.commons.tor.TorRelayEvaluation
+
+typealias RelayClassification = com.vitorpamplona.amethyst.commons.tor.RelayClassification
@@ -46,6 +46,13 @@ class TorRelayState(
    val dmRelays = MutableStateFlow<Set<NormalizedRelayUrl>>(emptySet())
    val trustedRelays = MutableStateFlow<Set<NormalizedRelayUrl>>(emptySet())

+    /**
+     * Relays guessed on the user's behalf while their own lists are unknown. Fed by
+     * [AccountsTorStateConnector]; see `AssumedRelayListsState` for why this is separate from
+     * [trustedRelays] rather than merged into it.
+     */
+    val assumedRelays = MutableStateFlow<Set<NormalizedRelayUrl>>(emptySet())
+
    /**
     * Relays known to be used for money operations from persistent configuration: NIP-47 wallet
     * relays and saved CLINK Debits service relays. Fed by [AccountsTorStateConnector] across all
@@ -130,47 +137,49 @@ class TorRelayState(
                currentSettings(),
            )

-    val flow =
-        combineTransform(
-            torSettings,
+    private fun currentClassification() =
+        RelayClassification(
+            trusted = trustedRelays.value,
+            dm = dmRelays.value,
+            moneyOp = currentMoneyOpRelays(),
+            assumed = assumedRelays.value,
+        )
+
+    /**
+     * The four category sets as one value. Folding them here also keeps the evaluation flow below
+     * at two sources instead of six — `combineTransform`'s typed overloads stop at five.
+     */
+    private val classification =
+        combine(
            trustedRelays,
            dmRelays,
            moneyOpRelays,
            adHocMoneyOpCounts,
-        ) {
-            torSettings: TorRelaySettings,
-            trustedRelayList: Set<NormalizedRelayUrl>,
-            dmRelayList: Set<NormalizedRelayUrl>,
-            moneyOpRelayList: Set<NormalizedRelayUrl>,
-            adHocMoneyOps: Map<NormalizedRelayUrl, Int>,
-            ->
-            emit(
-                TorRelayEvaluation(
-                    torSettings = torSettings,
-                    trustedRelayList = trustedRelayList,
-                    dmRelayList = dmRelayList,
-                    moneyOpRelayList = moneyOpRelayList + adHocMoneyOps.keys,
-                ),
+            assumedRelays,
+        ) { trusted, dm, moneyOp, adHocMoneyOps, assumed ->
+            RelayClassification(
+                trusted = trusted,
+                dm = dm,
+                moneyOp = moneyOp + adHocMoneyOps.keys,
+                assumed = assumed,
            )
+        }
+
+    val flow =
+        combineTransform(
+            torSettings,
+            classification,
+        ) { torSettings: TorRelaySettings, classification: RelayClassification ->
+            emit(TorRelayEvaluation(torSettings, classification))
        }.onStart {
            emit(
-                TorRelayEvaluation(
-                    torSettings = torSettings.value,
-                    trustedRelayList = trustedRelays.value,
-                    dmRelayList = dmRelays.value,
-                    moneyOpRelayList = currentMoneyOpRelays(),
-                ),
+                TorRelayEvaluation(torSettings.value, currentClassification()),
            )
        }.flowOn(Dispatchers.IO)
            .stateIn(
                scope,
                SharingStarted.Eagerly,
-                TorRelayEvaluation(
-                    torSettings = torSettings.value,
-                    trustedRelayList = trustedRelays.value,
-                    dmRelayList = dmRelays.value,
-                    moneyOpRelayList = currentMoneyOpRelays(),
-                ),
+                TorRelayEvaluation(torSettings.value, currentClassification()),
            )

    /**
@@ -178,13 +187,7 @@ class TorRelayState(
     * snapshot. This makes ad-hoc money-op registration ([registerMoneyOpRelays]) take effect on the
     * very next connection attempt, with no dependency on the combine pipeline having propagated yet.
     */
-    fun shouldUseTorForRelay(relay: NormalizedRelayUrl) =
-        TorRelayEvaluation(
-            torSettings = currentSettings(),
-            trustedRelayList = trustedRelays.value,
-            dmRelayList = dmRelays.value,
-            moneyOpRelayList = currentMoneyOpRelays(),
-        ).useTor(relay)
+    fun shouldUseTorForRelay(relay: NormalizedRelayUrl) = TorRelayEvaluation(currentSettings(), currentClassification()).useTor(relay)

    fun okHttpClientForRelay(url: NormalizedRelayUrl): OkHttpClient = okHttpClient.getHttpClient(shouldUseTorForRelay(url))
 }
@@ -31,7 +31,6 @@ import android.os.Message
 import android.os.Messenger
 import android.os.RemoteException
 import android.os.SystemClock
-import android.util.Log
 import androidx.core.net.toUri
 import com.vitorpamplona.amethyst.Amethyst
 import com.vitorpamplona.amethyst.commons.connectedApps.signers.NostrSignerPermissionLedger
@@ -50,6 +49,7 @@ import com.vitorpamplona.amethyst.napplet.gateways.AccountNappletGateways
 import com.vitorpamplona.amethyst.napplethost.NappletIpc
 import com.vitorpamplona.amethyst.ui.MainActivity
 import com.vitorpamplona.quartz.nip01Core.core.HexKey
+import com.vitorpamplona.quartz.utils.Log
 import kotlinx.coroutines.CoroutineScope
 import kotlinx.coroutines.CoroutineStart
 import kotlinx.coroutines.Dispatchers
@@ -154,6 +154,21 @@ class NappletBrokerService : Service() {
    private var foregroundLeaseWatchdog: Job? = null

    private fun handleMessage(msg: Message): Boolean {
+        // A sandbox surface is being destroyed: drop every reference we hold to its Messenger. Holding a
+        // client's Messenger keeps a binder alive, which pins that surface's whole Activity (and its
+        // WebView) in the `:napplet` process past onDestroy — reclaimable only by killing the process.
+        if (msg.what == NappletIpc.MSG_RELEASE_CLIENT) {
+            msg.replyTo?.let { incBus.removeAll(it) }
+            // Release its foreground lease too; otherwise a destroyed surface keeps the main process
+            // pinned resumed until the lease watchdog expires it.
+            msg.data?.getString(NappletIpc.KEY_LAUNCH_TOKEN)?.let { token ->
+                synchronized(foregroundLeases) {
+                    if (foregroundLeases.remove(token) != null) SandboxForegroundHold.release()
+                }
+            }
+            return true
+        }
+
        // A sandbox surface (full-screen :napplet host) entered, renewed, or left the foreground. Hold the
        // main process resumed while at least one is foreground, so opening it doesn't tear down Tor/relays.
        if (msg.what == NappletIpc.MSG_SET_FOREGROUND) {
@@ -167,7 +182,7 @@ class NappletBrokerService : Service() {
                    // could still spam distinct keys to keep the network up. Bound the damage: refuse new
                    // lease keys past the cap. Real usage holds only a handful of foreground surfaces.
                    if (firstReport && foregroundLeases.size >= MAX_FOREGROUND_LEASES) {
-                        Log.w("NappletBrokerService", "Foreground lease cap reached; ignoring new lease $token")
+                        Log.w("NappletBrokerService") { "Foreground lease cap reached; ignoring new lease $token" }
                        return true
                    }
                    foregroundLeases[token] = SystemClock.elapsedRealtime()
@@ -359,7 +374,7 @@ class NappletBrokerService : Service() {
                        while (iterator.hasNext()) {
                            val entry = iterator.next()
                            if (now - entry.value > FOREGROUND_LEASE_TTL_MS) {
-                                Log.w("NappletBrokerService", "Foreground lease ${entry.key} expired (host process gone?); releasing hold")
+                                Log.w("NappletBrokerService") { "Foreground lease ${entry.key} expired (host process gone?); releasing hold" }
                                iterator.remove()
                                SandboxForegroundHold.release()
                            }
@@ -117,7 +117,7 @@ object SandboxForegroundHold {
                synchronized(this@SandboxForegroundHold) {
                    // A surface may have re-acquired while we waited; only tear down if still released.
                    if (holdCount == 0) {
-                        Log.d("SandboxForegroundHold", "No foreground sandbox surface for ${LINGER_MS}ms; releasing the resource hold")
+                        Log.d("SandboxForegroundHold") { "No foreground sandbox surface for ${LINGER_MS}ms; releasing the resource hold" }
                        holdJob?.cancel()
                        holdJob = null
                    }
@@ -0,0 +1,101 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.napplet
+
+import android.os.Bundle
+import androidx.activity.ComponentActivity
+import com.vitorpamplona.amethyst.napplethost.WebFileChooserLauncher
+
+/**
+ * Invisible main-process host for one file pick made on behalf of an **embedded** WebView surface.
+ *
+ * The surface renders from the keyless `:napplet` process, which has no Activity to start a picker or
+ * a permission prompt from, so [WebFileChooserCoordinator] launches this instead. It exists only long
+ * enough to run the pick and report the result, and it reports on every exit — a chosen file, a
+ * cancel, a system teardown — because the page's `<input type="file">` stays busy until it hears
+ * something back.
+ */
+class WebFileChooserActivity : ComponentActivity() {
+    private var token: String? = null
+    private var reported = false
+
+    // Field, not a local: registerForActivityResult must run before this activity reaches STARTED.
+    private val chooser =
+        WebFileChooserLauncher(this) { uris ->
+            report(uris?.map { it.toString() }?.toTypedArray())
+            finish()
+        }
+
+    override fun onCreate(savedInstanceState: Bundle?) {
+        super.onCreate(savedInstanceState)
+
+        val token = intent.getStringExtra(WebFileChooserCoordinator.EXTRA_TOKEN)
+        this.token = token
+        val ask = token?.let { WebFileChooserCoordinator.pendingFor(it) }
+        if (ask == null) {
+            // No pending request under this token: the surface went away, or the process restarted and
+            // the request died with it. Nothing to report to.
+            reported = true
+            finish()
+            return
+        }
+
+        // A recreated instance has lost the in-flight request that its result would be matched against
+        // (configChanges keeps this rare — a system kill, not a rotation), and relaunching would stack a
+        // second picker on the first. Release the page's input now rather than let it wait on a result
+        // that can no longer be routed anywhere.
+        if (savedInstanceState != null) {
+            finish()
+            return
+        }
+
+        chooser.launch(
+            acceptTypes = ask.acceptTypes,
+            allowMultiple = ask.allowMultiple,
+            captureEnabled = ask.captureEnabled,
+            pageTitle = ask.pageTitle,
+        )
+    }
+
+    /** Fail-open toward the page: any unreported teardown still releases its file input. */
+    override fun finish() {
+        report(null)
+        super.finish()
+    }
+
+    /**
+     * The system can destroy this host without ever calling [finish] — a low-memory kill while the
+     * picker is on top. Without this the page's file input would wait on a result nobody is left to
+     * send, dead for the life of the page, and the coordinator would hold the reply callback (and the
+     * controller behind it) forever.
+     */
+    override fun onDestroy() {
+        chooser.teardown()
+        report(null)
+        super.onDestroy()
+    }
+
+    private fun report(uris: Array<String>?) {
+        if (reported) return
+        reported = true
+        token?.let { WebFileChooserCoordinator.complete(it, uris) }
+    }
+}
@@ -0,0 +1,101 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.napplet
+
+import android.content.Context
+import android.content.Intent
+import com.vitorpamplona.quartz.utils.Log
+import java.util.UUID
+import java.util.concurrent.ConcurrentHashMap
+
+/**
+ * Runs the system file picker on behalf of an **embedded** WebView surface.
+ *
+ * The two embedded providers ([NappletBrowserService][com.vitorpamplona.amethyst.napplethost.NappletBrowserService]
+ * and [NappletHostService][com.vitorpamplona.amethyst.napplethost.NappletHostService]) host their
+ * WebView in the keyless `:napplet` process as a windowless Service, so when a page taps
+ * `<input type="file">` there is no Activity there to start a picker from. They send the *description*
+ * of the request over Messenger instead; this holds it here in the main process and launches
+ * [WebFileChooserActivity], which runs the picker (and the camera, and the CAMERA permission prompt
+ * that a `capture` input needs) and reports back to the caller, which relays the URIs to the sandbox.
+ *
+ * Mirrors [NappletConsentCoordinator]: the pending request is keyed by a one-time token so the
+ * throwaway Activity carries nothing but that token. Every request completes exactly once — a
+ * dismissed picker resolves to null, which is what releases the page's file input.
+ *
+ * URI read grants are per-UID, so the `content://` URIs granted to this process are readable by the
+ * WebView in `:napplet` without any re-granting.
+ */
+object WebFileChooserCoordinator {
+    /** The request as it arrived from the sandbox, plus where to send the answer. */
+    class Pending(
+        val acceptTypes: List<String>,
+        val allowMultiple: Boolean,
+        val captureEnabled: Boolean,
+        val pageTitle: String?,
+        val onResult: (Array<String>?) -> Unit,
+    )
+
+    private val pending = ConcurrentHashMap<String, Pending>()
+
+    /**
+     * Shows a picker for [acceptTypes] and calls [onResult] with the picked URIs as strings, or null
+     * when nothing was chosen. [onResult] always runs, including when no picker host could be started
+     * at all — the page's file input is waiting on it.
+     */
+    fun request(
+        context: Context,
+        acceptTypes: List<String>,
+        allowMultiple: Boolean,
+        captureEnabled: Boolean,
+        pageTitle: String?,
+        onResult: (Array<String>?) -> Unit,
+    ) {
+        val token = UUID.randomUUID().toString()
+        pending[token] = Pending(acceptTypes, allowMultiple, captureEnabled, pageTitle, onResult)
+
+        val launch =
+            Intent(context, WebFileChooserActivity::class.java)
+                .addFlags(Intent.FLAG_ACTIVITY_NEW_TASK)
+                .putExtra(EXTRA_TOKEN, token)
+
+        runCatching { context.startActivity(launch) }
+            .onFailure { e ->
+                Log.w(TAG, "Could not start the file chooser host", e)
+                complete(token, null)
+            }
+    }
+
+    /** Called by [WebFileChooserActivity] to learn what to ask the user for. */
+    fun pendingFor(token: String): Pending? = pending[token]
+
+    /** Called by [WebFileChooserActivity] with the outcome; null = nothing chosen. Resolves at most once. */
+    fun complete(
+        token: String,
+        uris: Array<String>?,
+    ) {
+        pending.remove(token)?.onResult?.invoke(uris)
+    }
+
+    const val EXTRA_TOKEN = "web_file_chooser_token"
+
+    private const val TAG = "WebFileChooser"
+}
@@ -46,7 +46,6 @@ import okhttp3.Authenticator
 import okhttp3.Call
 import okhttp3.Callback
 import okhttp3.CookieJar
-import okhttp3.Dns
 import okhttp3.HttpUrl
 import okhttp3.HttpUrl.Companion.toHttpUrlOrNull
 import okhttp3.OkHttpClient
@@ -54,6 +53,7 @@ import okhttp3.Request
 import okhttp3.Response
 import java.io.ByteArrayOutputStream
 import java.io.IOException
+import java.io.InputStream
 import java.io.InterruptedIOException
 import java.net.InetAddress
 import java.net.URLDecoder
@@ -112,15 +112,13 @@ class NappletResourceFetcher(
            .authenticator(Authenticator.NONE)
            .proxyAuthenticator(Authenticator.NONE)
            .callTimeout(FETCH_TIMEOUT_SECONDS, TimeUnit.SECONDS)
-            .dns(
-                Dns { hostname ->
-                    baseClient.dns.lookup(hostname).also { addresses ->
-                        if (addresses.isEmpty() || !addresses.all(::isPublicAddress)) {
-                            throw BlockedResourceException("Resolved address is not public.")
-                        }
+            .dns { hostname ->
+                baseClient.dns.lookup(hostname).also { addresses ->
+                    if (addresses.isEmpty() || !addresses.all(::isPublicAddress)) {
+                        throw BlockedResourceException("Resolved address is not public.")
                    }
-                },
-            ).addNetworkInterceptor { chain ->
+                }
+            }.addNetworkInterceptor { chain ->
                chain.proceed(
                    chain
                        .request()
@@ -193,7 +191,7 @@ class NappletResourceFetcher(
                is NProfile -> resolveReplaceable(0, entity.hex)
                else -> null
            } ?: return null
-        return NappletResource(event.toJson().encodeToByteArray(), "application/json")
+        return NappletResource(event.toJson().encodeToByteArray(), MIME_JSON)
    }

    /** A non-replaceable event by id: local cache first, then a bounded relay fetch. */
@@ -300,7 +298,7 @@ class NappletResourceFetcher(
            meta
                .removeSuffix(";base64")
                .substringBefore(';')
-                .ifEmpty { "text/plain" }
+                .ifEmpty { MIME_PLAIN_TEXT }
                .lowercase()
        val bytes =
            if (isBase64) {
@@ -323,8 +321,8 @@ class NappletResourceFetcher(
        val type =
            when {
                sniffed in ALLOWED_SNIFFED_TYPES -> sniffed
-                declaredType == "application/json" && isJson(bytes) -> "application/json"
-                declaredType == "text/plain" && isPlainText(bytes) -> "text/plain"
+                declaredType == MIME_JSON && isJson(bytes) -> MIME_JSON
+                declaredType == MIME_PLAIN_TEXT && isPlainText(bytes) -> MIME_PLAIN_TEXT
                else -> null
            } ?: return failure(ERROR_DECODE_FAILED, "Resource MIME is not in the runtime allowlist.")
        return success(NappletResource(bytes, type))
@@ -353,7 +351,7 @@ class NappletResourceFetcher(
        message: String? = null,
    ): NappletResourceResult = NappletResourceResult.Failure(error, message)

-    private fun readBounded(input: java.io.InputStream): ByteArray? {
+    private fun readBounded(input: InputStream): ByteArray? {
        input.use { source ->
            val output = ByteArrayOutputStream()
            val buffer = ByteArray(8 * 1024)
@@ -417,6 +415,8 @@ class NappletResourceFetcher(
        private const val ERROR_UNSUPPORTED_SCHEME = "unsupported-scheme"
        private const val ERROR_DECODE_FAILED = "decode-failed"
        private const val ERROR_NETWORK = "network-error"
+        private const val MIME_JSON = "application/json"
+        private const val MIME_PLAIN_TEXT = "text/plain"
        private val SHA256 = Regex("^[0-9a-f]{64}$")
        private val ALLOWED_SNIFFED_TYPES =
            setOf(
@@ -432,5 +432,5 @@ class NappletResourceFetcher(

    private class BlockedResourceException(
        message: String,
-    ) : java.io.IOException(message)
+    ) : IOException(message)
 }
@@ -26,9 +26,10 @@ import com.vitorpamplona.amethyst.commons.model.payments.PaymentSource
 import com.vitorpamplona.amethyst.model.Account
 import com.vitorpamplona.amethyst.model.Note
 import com.vitorpamplona.amethyst.service.lnurl.LightningAddressResolver
+import com.vitorpamplona.amethyst.ui.nwc.nwcFailureDetail
+import com.vitorpamplona.amethyst.ui.nwc.nwcTimeoutMessage
 import com.vitorpamplona.amethyst.ui.stringRes
 import com.vitorpamplona.quartz.nip01Core.core.toHexKey
-import com.vitorpamplona.quartz.nip47WalletConnect.rpc.IErrorResponseLike
 import com.vitorpamplona.quartz.nip47WalletConnect.rpc.PayKeysendMethod
 import com.vitorpamplona.quartz.nip47WalletConnect.rpc.Response
 import com.vitorpamplona.quartz.nip47WalletConnect.rpc.TlvRecord
@@ -159,15 +160,17 @@ class V4VPaymentHandler(
                    tlvRecords = tlvRecords,
                )

-            account.zaps.sendNwcRequest(request) { response: Response? ->
-                if (response is IErrorResponseLike) {
-                    onError(
-                        stringRes(context, R.string.error_dialog_pay_invoice_error),
-                        response.errorMessage()
-                            ?: stringRes(context, R.string.error_parsing_error_message),
-                    )
-                }
-            }
+            account.zaps.sendNwcRequest(
+                request = request,
+                onResponse = { response: Response? ->
+                    response.nwcFailureDetail(context)?.let { detail ->
+                        onError(stringRes(context, R.string.error_dialog_pay_invoice_error), detail)
+                    }
+                },
+                onTimeout = {
+                    onError(stringRes(context, R.string.error_dialog_pay_invoice_error), nwcTimeoutMessage(context))
+                },
+            )
        }
    }

@@ -250,15 +253,18 @@ class V4VPaymentHandler(
            is PaymentSource.Nwc -> {
                var done = 0
                payables.forEach { payable ->
-                    account.zaps.sendZapPaymentRequestFor(payable.invoice, zappedNote) { response ->
-                        if (response is IErrorResponseLike) {
-                            onError(
-                                stringRes(context, R.string.error_dialog_pay_invoice_error),
-                                response.errorMessage()
-                                    ?: stringRes(context, R.string.error_parsing_error_message),
-                            )
-                        }
-                    }
+                    account.zaps.sendZapPaymentRequestFor(
+                        bolt11 = payable.invoice,
+                        zappedNote = zappedNote,
+                        onResponse = { response ->
+                            response.nwcFailureDetail(context)?.let { detail ->
+                                onError(stringRes(context, R.string.error_dialog_pay_invoice_error), detail)
+                            }
+                        },
+                        onTimeout = {
+                            onError(stringRes(context, R.string.error_dialog_pay_invoice_error), nwcTimeoutMessage(context))
+                        },
+                    )
                    done++
                    onProgress(done.toFloat() / payables.size)
                }
@@ -29,10 +29,12 @@ import com.vitorpamplona.amethyst.model.LocalCache
 import com.vitorpamplona.amethyst.model.Note
 import com.vitorpamplona.amethyst.model.User
 import com.vitorpamplona.amethyst.service.lnurl.LightningAddressResolver
+import com.vitorpamplona.amethyst.ui.nwc.nwcFailureDetail
+import com.vitorpamplona.amethyst.ui.nwc.nwcTimeoutMessage
 import com.vitorpamplona.amethyst.ui.stringRes
 import com.vitorpamplona.quartz.experimental.clink.pointers.NDebit
 import com.vitorpamplona.quartz.nip01Core.relay.normalizer.NormalizedRelayUrl
-import com.vitorpamplona.quartz.nip47WalletConnect.rpc.PayInvoiceErrorResponse
+import com.vitorpamplona.quartz.nip47WalletConnect.rpc.NwcTransactionMetadata
 import com.vitorpamplona.quartz.nip53LiveActivities.streaming.LiveActivitiesEvent
 import com.vitorpamplona.quartz.nip57Zaps.LnZapEvent
 import com.vitorpamplona.quartz.nip57Zaps.LnZapRequestEvent
@@ -60,6 +62,11 @@ class ZapPaymentHandler(
        val info: MyZapSplitSetup,
        val amountMilliSats: Long,
        val invoice: String,
+        // The signed kind 9734 this invoice was fetched with, and the message on it.
+        // Carried so the NWC payment can name the payee (NWC-06 `metadata`); null for
+        // a NONZAP split, which has no zap request to send.
+        val zapRequest: LnZapRequestEvent? = null,
+        val message: String = "",
    )

    data class UnverifiedZapSplitSetup(
@@ -417,21 +424,30 @@ class ZapPaymentHandler(
                account.zaps.sendZapPaymentRequestFor(
                    bolt11 = payable.invoice,
                    zappedNote = note,
+                    // Dropped unless the wallet advertises NWC-06 — see NwcSignerState.
+                    metadata =
+                        NwcTransactionMetadata.build(
+                            zapRequest = payable.zapRequest,
+                            recipientIdentifier = payable.info.lnAddress,
+                            comment = payable.message,
+                        ),
                    onResponse = { response ->
                        progress.step()
-                        if (response is PayInvoiceErrorResponse) {
+                        response.nwcFailureDetail(context)?.let { detail ->
                            onError(
                                stringRes(context, R.string.error_dialog_pay_invoice_error),
-                                stringRes(
-                                    context,
-                                    R.string.wallet_connect_pay_invoice_error_error,
-                                    response.error?.message
-                                        ?: response.error?.code?.toString() ?: "Error parsing error message",
-                                ),
+                                stringRes(context, R.string.wallet_connect_pay_invoice_error_error, detail),
                                payable.info.user,
                            )
                        }
                    },
+                    onTimeout = {
+                        onError(
+                            stringRes(context, R.string.error_dialog_pay_invoice_error),
+                            nwcTimeoutMessage(context),
+                            payable.info.user,
+                        )
+                    },
                )

                progress.step()
@@ -551,6 +567,10 @@ class ZapPaymentHandler(
    ): Payable {
        var progressThisPayment = 0.00f

+        // Only the request the provider actually accepted may be claimed as bound to
+        // this invoice; see lnAddressInvoice's onZapRequestSent.
+        var sentZapRequest: LnZapRequestEvent? = null
+
        val invoice =
            LightningAddressResolver().lnAddressInvoice(
                lnAddress = lud16,
@@ -564,6 +584,7 @@ class ZapPaymentHandler(
                    onProgressStep(step)
                },
                context = context,
+                onZapRequestSent = { sentZapRequest = it },
            )

        onProgressStep(1 - progressThisPayment)
@@ -572,6 +593,8 @@ class ZapPaymentHandler(
            info = splitSetup,
            amountMilliSats = zapValue,
            invoice = invoice,
+            zapRequest = sentZapRequest,
+            message = message,
        )
    }
 }
@@ -1,99 +0,0 @@
-/*
- * Copyright (c) 2025 Vitor Pamplona
- *
- * Permission is hereby granted, free of charge, to any person obtaining a copy of
- * this software and associated documentation files (the "Software"), to deal in
- * the Software without restriction, including without limitation the rights to use,
- * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
- * Software, and to permit persons to whom the Software is furnished to do so,
- * subject to the following conditions:
- *
- * The above copyright notice and this permission notice shall be included in all
- * copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
- * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
- * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
- * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
- * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
- */
-package com.vitorpamplona.amethyst.service.ai
-
-import kotlinx.coroutines.delay
-
-/**
- * TODO: Remove before shipping. Debug-only mock for testing the AI writing help UI
- * on devices without Gemini Nano / AICore support.
- */
-class MockWritingAssistant : WritingAssistant {
-    override suspend fun checkAvailability(): WritingAssistantStatus = WritingAssistantStatus.Available
-
-    override suspend fun transform(
-        text: String,
-        tone: WritingTone,
-    ): WritingResult {
-        delay(800)
-
-        val transformed =
-            when (tone) {
-                WritingTone.CORRECT -> {
-                    correctMock(text)
-                }
-
-                WritingTone.REPHRASE -> {
-                    "Here's another way to put it: $text"
-                }
-
-                WritingTone.SHORTER -> {
-                    text
-                        .split(".")
-                        .firstOrNull()
-                        ?.trim()
-                        ?.plus(".") ?: text
-                }
-
-                WritingTone.ELABORATE -> {
-                    "$text Furthermore, this point deserves deeper consideration and nuance."
-                }
-
-                WritingTone.FRIENDLY -> {
-                    "Hey! $text Hope that makes sense! :)"
-                }
-
-                WritingTone.PROFESSIONAL -> {
-                    "I would like to bring to your attention the following: $text"
-                }
-
-                WritingTone.MORE_DIRECT -> {
-                    text.replace("I think ", "").replace("maybe ", "").replace("perhaps ", "")
-                }
-
-                WritingTone.PUNCHY -> {
-                    text.uppercase().replace(".", "!")
-                }
-
-                WritingTone.EMOJIFY -> {
-                    "$text \uD83D\uDE80\uD83D\uDD25\u2728"
-                }
-            }
-
-        return WritingResult(
-            originalText = text,
-            transformedText = transformed,
-            tone = tone,
-        )
-    }
-
-    private fun correctMock(text: String): String =
-        text
-            .replace("teh ", "the ")
-            .replace("dont ", "don't ")
-            .replace("cant ", "can't ")
-            .replace("wont ", "won't ")
-            .replace("i ", "I ")
-
-    override fun close() {
-        // no-op: mock holds no native handles or background workers to release.
-    }
-}
@@ -25,6 +25,15 @@ import androidx.compose.runtime.Immutable
 interface WritingAssistant {
    suspend fun checkAvailability(): WritingAssistantStatus

+    /**
+     * Asks the platform to fetch the on-device model when [checkAvailability] reported
+     * [WritingAssistantStatus.Downloadable]. Returns the status after the attempt.
+     *
+     * Implementations must be safe to call repeatedly: only the first call per instance
+     * starts a download, later ones just report the current status.
+     */
+    suspend fun requestDownload(): WritingAssistantStatus
+
    suspend fun transform(
        text: String,
        tone: WritingTone,
@@ -40,8 +49,6 @@ enum class WritingTone {
    ELABORATE,
    FRIENDLY,
    PROFESSIONAL,
-    MORE_DIRECT,
-    PUNCHY,
    EMOJIFY,
 }

@@ -50,6 +57,9 @@ sealed class WritingAssistantStatus {

    data object Unavailable : WritingAssistantStatus()

+    /** The device supports the model but it has not been fetched yet. */
+    data object Downloadable : WritingAssistantStatus()
+
    data object Downloading : WritingAssistantStatus()
 }

@@ -53,6 +53,7 @@ class CallForegroundService : Service() {
        const val ACTION_UPDATE = "com.vitorpamplona.amethyst.CALL_UPDATE"
        const val EXTRA_PEER_NAME = "peer_name"
        const val EXTRA_IS_VIDEO = "is_video"
+        const val EXTRA_IS_SCREEN_SHARING = "is_screen_sharing"
        const val EXTRA_STATUS_TEXT = "status_text"
        const val EXTRA_IS_RINGING = "is_ringing"
        private const val HANGUP_REQUEST_CODE = 0x70001
@@ -75,6 +76,7 @@ class CallForegroundService : Service() {
            ACTION_START, ACTION_UPDATE -> {
                val peerName = intent.getStringExtra(EXTRA_PEER_NAME) ?: "Unknown"
                val isVideo = intent.getBooleanExtra(EXTRA_IS_VIDEO, false)
+                val isScreenSharing = intent.getBooleanExtra(EXTRA_IS_SCREEN_SHARING, false)
                val isRinging = intent.getBooleanExtra(EXTRA_IS_RINGING, false)
                val statusText = intent.getStringExtra(EXTRA_STATUS_TEXT)
                val notification = buildNotification(peerName, statusText)
@@ -97,6 +99,9 @@ class CallForegroundService : Service() {
                                if (isVideo && hasCameraPermission) {
                                    type = type or ServiceInfo.FOREGROUND_SERVICE_TYPE_CAMERA
                                }
+                                if (isScreenSharing) {
+                                    type = type or ServiceInfo.FOREGROUND_SERVICE_TYPE_MEDIA_PROJECTION
+                                }
                            }
                            type
                        } else {
@@ -108,7 +113,11 @@ class CallForegroundService : Service() {
                    try {
                        val fallbackType =
                            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.UPSIDE_DOWN_CAKE) {
-                                ServiceInfo.FOREGROUND_SERVICE_TYPE_PHONE_CALL
+                                var type = ServiceInfo.FOREGROUND_SERVICE_TYPE_PHONE_CALL
+                                if (isScreenSharing) {
+                                    type = type or ServiceInfo.FOREGROUND_SERVICE_TYPE_MEDIA_PROJECTION
+                                }
+                                type
                            } else {
                                0
                            }
@@ -142,6 +151,23 @@ class CallForegroundService : Service() {
     * it at 3 seconds as a safety net.
     */
    override fun onTaskRemoved(rootIntent: Intent?) {
+        val removed = rootIntent?.component?.className
+        Log.d(TAG) { "onTaskRemoved root=$removed" }
+
+        // Only the call's own task going away means the user dismissed the call. This callback
+        // fires for *every* task of the app, and MainActivity lives in a separate one (it is
+        // `singleInstance`, and CallActivity is launched with FLAG_ACTIVITY_NEW_TASK). Android
+        // reclaims that backgrounded MainActivity task on its own while a call is running —
+        // notably a few hundred ms after CallActivity enters picture-in-picture on HOME — and
+        // hanging up on it ended calls the user never touched.
+        //
+        // A null root intent leaves the source unknown; treat it as a dismissal so a genuinely
+        // swiped-away app can't leave a call running with no UI to end it.
+        if (removed != null && removed != CallActivity::class.java.name) {
+            super.onTaskRemoved(rootIntent)
+            return
+        }
+
        publishHangupBlocking()
        stopForeground(STOP_FOREGROUND_REMOVE)
        stopSelf()
@@ -21,6 +21,8 @@
 package com.vitorpamplona.amethyst.service.call

 import android.content.Context
+import android.content.Intent
+import android.media.projection.MediaProjection
 import com.vitorpamplona.quartz.nipACWebRtcCalls.tags.CallType
 import com.vitorpamplona.quartz.utils.Log
 import kotlinx.coroutines.flow.MutableStateFlow
@@ -65,9 +67,20 @@ class CallMediaManager(
    var localVideoTrack: VideoTrack? = null
        private set

+    var screenVideoSource: VideoSource? = null
+        private set
+    var screenVideoTrack: VideoTrack? = null
+        private set
+
    private var cameraCapturer: CameraVideoCapturer? = null
    private var surfaceTextureHelper: SurfaceTextureHelper? = null
+    private var screenCapturer: ScreenShareCapturer? = null
+    private var screenSurfaceTextureHelper: SurfaceTextureHelper? = null
    private var usingFrontCamera: Boolean = true
+    private var cameraWasEnabledBeforeScreenShare = false
+    private var stoppingScreenShare = false
+
+    var onScreenShareEnded: (() -> Unit)? = null

    private val _localVideoTrackFlow = MutableStateFlow<VideoTrack?>(null)
    val localVideoTrackFlow: StateFlow<VideoTrack?> = _localVideoTrackFlow.asStateFlow()
@@ -75,6 +88,9 @@ class CallMediaManager(
    private val _isVideoEnabled = MutableStateFlow(false)
    val isVideoEnabled: StateFlow<Boolean> = _isVideoEnabled.asStateFlow()

+    private val _isScreenSharing = MutableStateFlow(false)
+    val isScreenSharing: StateFlow<Boolean> = _isScreenSharing.asStateFlow()
+
    private val _isFrontCamera = MutableStateFlow(true)
    val isFrontCamera: StateFlow<Boolean> = _isFrontCamera.asStateFlow()

@@ -146,6 +162,136 @@ class CallMediaManager(
        captureFps = fps
    }

+    /**
+     * Starts Android's system screen capture using the one-shot permission result supplied by
+     * [android.media.projection.MediaProjectionManager]. The returned track is owned by this
+     * manager and must be attached to the peer senders before [stopScreenShare] releases it.
+     */
+    @Synchronized
+    fun startScreenShare(permissionData: Intent): VideoTrack {
+        screenVideoTrack?.let { return it }
+
+        val factory = peerConnectionFactory ?: throw IllegalStateException("PeerConnectionFactory not initialized")
+        val egl = sharedEglBase ?: throw IllegalStateException("EGL context not initialized")
+        val displayMetrics = context.resources.displayMetrics
+        val captureSize = screenShareCaptureSize(displayMetrics.widthPixels, displayMetrics.heightPixels)
+        cameraWasEnabledBeforeScreenShare = _isVideoEnabled.value
+        var source: VideoSource? = null
+        var track: VideoTrack? = null
+        var helper: SurfaceTextureHelper? = null
+        var capturer: ScreenShareCapturer? = null
+
+        try {
+            val createdSource = factory.createVideoSource(true)
+            source = createdSource
+            val createdTrack = factory.createVideoTrack("screen0", createdSource)
+            track = createdTrack
+            val createdHelper = SurfaceTextureHelper.create("ScreenCaptureThread", egl.eglBaseContext)
+            helper = createdHelper
+            val createdCapturer =
+                ScreenShareCapturer(
+                    permissionData,
+                    object : MediaProjection.Callback() {
+                        override fun onStop() {
+                            if (!stoppingScreenShare) {
+                                onScreenShareEnded?.invoke()
+                            }
+                        }
+                    },
+                )
+            capturer = createdCapturer
+
+            screenVideoSource = createdSource
+            screenVideoTrack = createdTrack
+            screenSurfaceTextureHelper = createdHelper
+            screenCapturer = createdCapturer
+            if (cameraWasEnabledBeforeScreenShare) {
+                stopCamera()
+            }
+            createdCapturer.initialize(createdHelper, context, createdSource.capturerObserver)
+            createdCapturer.startCapture(captureSize.width, captureSize.height, captureFps)
+            _isScreenSharing.value = true
+            _isVideoEnabled.value = true
+            _localVideoTrackFlow.value = createdTrack
+            return createdTrack
+        } catch (e: Exception) {
+            screenCapturer = null
+            screenSurfaceTextureHelper = null
+            screenVideoTrack = null
+            screenVideoSource = null
+            runCatching { capturer?.dispose() }
+            runCatching { helper?.dispose() }
+            runCatching { track?.dispose() }
+            runCatching { source?.dispose() }
+            if (cameraWasEnabledBeforeScreenShare) {
+                _isVideoEnabled.value = true
+                _localVideoTrackFlow.value = localVideoTrack
+                startCamera()
+            }
+            cameraWasEnabledBeforeScreenShare = false
+            throw e
+        }
+    }
+
+    /**
+     * Stops screen capture and restores the camera state from before sharing started. The
+     * returned resources remain alive until the caller has replaced every [RtpSender] track.
+     *
+     * Pass `restoreCamera = false` when the whole session is going away — see [dispose]. Restoring
+     * a camera that is about to be torn down opens the device for a few hundred milliseconds
+     * (lighting the privacy indicator) and makes the following [stopCamera] block waiting for the
+     * capture session it just started.
+     */
+    @Synchronized
+    fun stopScreenShare(restoreCamera: Boolean = true): ScreenShareResources? {
+        val track = screenVideoTrack ?: return null
+        val source = requireNotNull(screenVideoSource)
+        stoppingScreenShare = true
+        try {
+            screenCapturer?.let { capturer ->
+                runCatching { capturer.stopCapture() }
+                runCatching { capturer.dispose() }
+            }
+            screenSurfaceTextureHelper?.let { runCatching { it.dispose() } }
+        } finally {
+            screenCapturer = null
+            screenSurfaceTextureHelper = null
+            screenVideoTrack = null
+            screenVideoSource = null
+            _isScreenSharing.value = false
+
+            if (restoreCamera && cameraWasEnabledBeforeScreenShare) {
+                recreateCameraResources()
+                _isVideoEnabled.value = true
+                _localVideoTrackFlow.value = localVideoTrack
+                startCamera()
+            } else {
+                _isVideoEnabled.value = false
+                _localVideoTrackFlow.value = localVideoTrack
+            }
+            cameraWasEnabledBeforeScreenShare = false
+            stoppingScreenShare = false
+        }
+        return ScreenShareResources(track, source)
+    }
+
+    fun disposeScreenShareResources(resources: ScreenShareResources?) {
+        resources ?: return
+        runCatching { resources.track.dispose() }
+        runCatching { resources.source.dispose() }
+    }
+
+    private fun recreateCameraResources() {
+        val factory = peerConnectionFactory ?: return
+        // RtpSender.setTrack may release the previous native track wrapper, so restore a fresh
+        // camera track before binding it back to the senders.
+        runCatching { localVideoTrack?.dispose() }
+        runCatching { localVideoSource?.dispose() }
+        localVideoSource = factory.createVideoSource(false)
+        localVideoTrack = factory.createVideoTrack("video0", localVideoSource)
+    }
+
+    @Synchronized
    fun startCamera() {
        if (cameraCapturer != null) return
        val source = localVideoSource ?: return
@@ -186,6 +332,7 @@ class CallMediaManager(
        )
    }

+    @Synchronized
    fun stopCamera() {
        try {
            cameraCapturer?.stopCapture()
@@ -215,6 +362,10 @@ class CallMediaManager(
    }

    fun dispose() {
+        // Everything below tears the camera down, so don't let the screen-share stop bring it back
+        // up first — that opened the device mid-hangup and made stopCamera() wait on it.
+        val screenResources = stopScreenShare(restoreCamera = false)
+        disposeScreenShareResources(screenResources)
        try {
            stopCamera()
        } catch (e: Exception) {
@@ -21,6 +21,8 @@
 package com.vitorpamplona.amethyst.service.call

 import com.vitorpamplona.amethyst.commons.nipACWebRtcCalls.CallManager
+import com.vitorpamplona.amethyst.commons.nipACWebRtcCalls.CallState
+import com.vitorpamplona.amethyst.model.Account
 import com.vitorpamplona.amethyst.ui.screen.loggedIn.AccountViewModel

 /**
@@ -34,33 +36,61 @@ import com.vitorpamplona.amethyst.ui.screen.loggedIn.AccountViewModel
 * whose lifetime is tied to the Activity's lifecycle.
 */
 object CallSessionBridge {
+    /** Account-scoped: survives MainActivity being destroyed mid-call. */
    var callManager: CallManager? = null
        private set
+
+    /** Account-scoped: everything [CallActivity] needs (signer, settings, signaling publish). */
+    var account: Account? = null
+        private set
+
+    /**
+     * Activity-scoped, and therefore nullable at any time: MainActivity can be destroyed while a
+     * call is still running. Only consumers that genuinely need ViewModel-level helpers should
+     * read this, and they must tolerate null.
+     */
    var accountViewModel: AccountViewModel? = null
        private set

    fun set(
        callManager: CallManager,
+        account: Account,
        accountViewModel: AccountViewModel,
    ) {
        this.callManager = callManager
+        this.account = account
        this.accountViewModel = accountViewModel
    }

    /**
-     * Resets call state and clears all references. Called from
-     * [AccountViewModel.onCleared] during logout or account switch.
+     * Drops only the Activity-scoped [accountViewModel] reference. Called from
+     * [AccountViewModel.onCleared], which fires on every MainActivity destruction — including
+     * while a call is in progress — so it must leave [callManager] and [account] intact.
+     *
+     * While a call is up the reference is kept: [CallActivity] still renders its UI from this
+     * ViewModel and holds a strong reference to it either way, so clearing here would free
+     * nothing and would only break the running call's UI. It is replaced wholesale by [set] as
+     * soon as MainActivity comes back, and dropped by [clear] on logout / account switch.
+     */
+    fun clearViewModel() {
+        if (callManager?.state?.value !is CallState.Idle) return
+        accountViewModel = null
+    }
+
+    /**
+     * Ends the current call and clears all references. Called on a real logout or account switch
+     * from `AccountSessionManager`, alongside `NestBridge.clear()`.
     *
     * Uses [CallManager.reset] (non-blocking, no mutex) instead of
     * [CallManager.hangup] to avoid deadlocking on `stateMutex` if
-     * a cancelled coroutine on the dying `viewModelScope` still holds
-     * it. Hangup signaling to the remote peer is the responsibility
-     * of [CallActivity.onDestroy] and [CallForegroundService], not
+     * a cancelled coroutine still holds it. Hangup signaling to the remote peer is the
+     * responsibility of [CallActivity.onDestroy] and [CallForegroundService], not
     * the bridge teardown.
     */
    fun clear() {
        callManager?.reset()
        callManager = null
+        account = null
        accountViewModel = null
    }
 }
@@ -0,0 +1,53 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.service.call
+
+import org.webrtc.VideoSource
+import org.webrtc.VideoTrack
+import kotlin.math.min
+import kotlin.math.roundToInt
+
+internal data class ScreenShareCaptureSize(
+    val width: Int,
+    val height: Int,
+)
+
+internal fun screenShareCaptureSize(
+    widthPixels: Int,
+    heightPixels: Int,
+    maxDimension: Int = 1920,
+): ScreenShareCaptureSize {
+    val width = widthPixels.coerceAtLeast(2)
+    val height = heightPixels.coerceAtLeast(2)
+    val scale = min(1f, maxDimension.toFloat() / maxOf(width, height))
+
+    fun even(value: Int): Int = value.coerceAtLeast(2).let { it - it % 2 }
+
+    return ScreenShareCaptureSize(
+        width = even((width * scale).roundToInt()),
+        height = even((height * scale).roundToInt()),
+    )
+}
+
+data class ScreenShareResources(
+    val track: VideoTrack,
+    val source: VideoSource,
+)
@@ -0,0 +1,219 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.service.call
+
+import android.app.Activity
+import android.content.Context
+import android.content.Intent
+import android.hardware.display.DisplayManager
+import android.hardware.display.VirtualDisplay
+import android.media.projection.MediaProjection
+import android.media.projection.MediaProjectionManager
+import android.view.Surface
+import org.webrtc.CapturerObserver
+import org.webrtc.SurfaceTextureHelper
+import org.webrtc.ThreadUtils
+import org.webrtc.VideoCapturer
+import org.webrtc.VideoFrame
+import org.webrtc.VideoSink
+
+/**
+ * Captures the screen through [MediaProjection] and feeds it to WebRTC.
+ *
+ * Behaviourally a drop-in for `org.webrtc.ScreenCapturerAndroid` (a derivative of it — original
+ * © 2016 The WebRTC project authors, BSD-style license), with one defect fixed: the upstream
+ * class builds the capture `Surface` inline,
+ *
+ * ```java
+ * virtualDisplay = mediaProjection.createVirtualDisplay(..., new Surface(helper.getSurfaceTexture()), ...);
+ * ```
+ *
+ * and keeps no reference to it, so `Surface.release()` is never called. `VirtualDisplay.release()`
+ * does not cover it — the Surface belongs to the caller — so every capture session leaked one,
+ * reclaimed only whenever the finalizer next ran. It showed up as a StrictMode
+ * `LeakedClosableViolation` pointing at `ScreenCapturerAndroid.createVirtualDisplay`, and
+ * `changeCaptureFormat` leaked another one per call. This version owns the Surface and releases
+ * it with the virtual display.
+ */
+class ScreenShareCapturer(
+    private val mediaProjectionPermissionResultData: Intent,
+    private val mediaProjectionCallback: MediaProjection.Callback,
+) : VideoCapturer,
+    VideoSink {
+    private var width: Int = 0
+    private var height: Int = 0
+
+    private var virtualDisplay: VirtualDisplay? = null
+
+    /** The reference the upstream capturer drops on the floor. Released in [releaseDisplay]. */
+    private var surface: Surface? = null
+
+    private var surfaceTextureHelper: SurfaceTextureHelper? = null
+    private var capturerObserver: CapturerObserver? = null
+    private var mediaProjection: MediaProjection? = null
+    private var mediaProjectionManager: MediaProjectionManager? = null
+
+    private var numCapturedFrames: Long = 0
+    private var isDisposed = false
+
+    private fun checkNotDisposed() {
+        if (isDisposed) throw IllegalStateException("capturer is disposed.")
+    }
+
+    @Synchronized
+    override fun initialize(
+        surfaceTextureHelper: SurfaceTextureHelper,
+        applicationContext: Context,
+        capturerObserver: CapturerObserver,
+    ) {
+        checkNotDisposed()
+        this.surfaceTextureHelper = surfaceTextureHelper
+        this.capturerObserver = capturerObserver
+        this.mediaProjectionManager = applicationContext.getSystemService(MediaProjectionManager::class.java)
+    }
+
+    @Synchronized
+    override fun startCapture(
+        width: Int,
+        height: Int,
+        ignoredFramerate: Int,
+    ) {
+        checkNotDisposed()
+        this.width = width
+        this.height = height
+
+        val helper = surfaceTextureHelper ?: throw IllegalStateException("surfaceTextureHelper not set.")
+        val manager = mediaProjectionManager ?: throw IllegalStateException("capturer not initialized.")
+
+        val projection =
+            manager.getMediaProjection(Activity.RESULT_OK, mediaProjectionPermissionResultData)
+                ?: throw IllegalStateException("MediaProjection permission data was rejected.")
+        mediaProjection = projection
+
+        // Let the MediaProjection callback use the SurfaceTextureHelper thread.
+        projection.registerCallback(mediaProjectionCallback, helper.handler)
+
+        createVirtualDisplay()
+        capturerObserver?.onCapturerStarted(true)
+        helper.startListening(this)
+    }
+
+    @Synchronized
+    override fun stopCapture() {
+        checkNotDisposed()
+        val helper = surfaceTextureHelper ?: return
+        ThreadUtils.invokeAtFrontUninterruptibly(helper.handler) {
+            helper.stopListening()
+            capturerObserver?.onCapturerStopped()
+
+            releaseDisplay()
+
+            mediaProjection?.let { projection ->
+                // Unregister the callback before stopping, otherwise the callback recursively
+                // calls this method.
+                projection.unregisterCallback(mediaProjectionCallback)
+                projection.stop()
+            }
+            mediaProjection = null
+        }
+    }
+
+    @Synchronized
+    override fun dispose() {
+        isDisposed = true
+        // Best-effort. On the failure path startCapture() can have created the display and Surface
+        // without a matching stopCapture(), and nothing else would hand them back.
+        releaseDisplay()
+    }
+
+    /**
+     * Changes the output video size, e.g. when the captured screen rotates.
+     */
+    @Synchronized
+    override fun changeCaptureFormat(
+        width: Int,
+        height: Int,
+        ignoredFramerate: Int,
+    ) {
+        checkNotDisposed()
+        this.width = width
+        this.height = height
+
+        // Capturer is stopped; the virtual display will be created by startCapture().
+        if (virtualDisplay == null) return
+
+        val helper = surfaceTextureHelper ?: return
+
+        // Recreate on the SurfaceTextureHelper thread to avoid interfering with frame processing,
+        // which runs on that same thread.
+        ThreadUtils.invokeAtFrontUninterruptibly(helper.handler) {
+            releaseDisplay()
+            createVirtualDisplay()
+        }
+    }
+
+    private fun createVirtualDisplay() {
+        val helper = surfaceTextureHelper ?: return
+        val projection = mediaProjection ?: return
+
+        helper.setTextureSize(width, height)
+
+        val newSurface = Surface(helper.surfaceTexture)
+        surface = newSurface
+        virtualDisplay =
+            projection.createVirtualDisplay(
+                "WebRTC_ScreenCapture",
+                width,
+                height,
+                VIRTUAL_DISPLAY_DPI,
+                DISPLAY_FLAGS,
+                newSurface,
+                null,
+                null,
+            )
+    }
+
+    /** Releases the virtual display first, so nothing is still drawing into the Surface. */
+    private fun releaseDisplay() {
+        virtualDisplay?.release()
+        virtualDisplay = null
+        surface?.release()
+        surface = null
+    }
+
+    /** Called on the internal looper thread of [SurfaceTextureHelper]. */
+    override fun onFrame(frame: VideoFrame) {
+        numCapturedFrames++
+        capturerObserver?.onFrameCaptured(frame)
+    }
+
+    override fun isScreencast(): Boolean = true
+
+    fun getNumCapturedFrames(): Long = numCapturedFrames
+
+    companion object {
+        private const val DISPLAY_FLAGS =
+            DisplayManager.VIRTUAL_DISPLAY_FLAG_PUBLIC or DisplayManager.VIRTUAL_DISPLAY_FLAG_PRESENTATION
+
+        /** DPI for the VirtualDisplay; does not appear to matter here. */
+        private const val VIRTUAL_DISPLAY_DPI = 400
+    }
+}
@@ -78,7 +78,7 @@ class MemoryTrimmingService(
        level: Int = ComponentCallbacks2.TRIM_MEMORY_BACKGROUND,
    ) {
        if (isTrimmingMemoryMutex.compareAndSet(false, true)) {
-            Log.d("ServiceManager", "Trimming Memory (level=$level)")
+            Log.d("ServiceManager") { "Trimming Memory (level=$level)" }
            try {
                doTrim(account, otherAccounts, level)
            } finally {
@@ -27,11 +27,12 @@ import coil3.annotation.ExperimentalCoilApi
 import coil3.fetch.FetchResult
 import coil3.fetch.Fetcher
 import coil3.network.CacheStrategy
+import coil3.network.ConcurrentRequestStrategy
 import coil3.network.ConnectivityChecker
-import coil3.network.DeDupeConcurrentRequestStrategy
 import coil3.network.NetworkFetcher
 import coil3.network.okhttp.asNetworkClient
 import coil3.request.Options
+import com.vitorpamplona.amethyst.service.okhttp.BlossomReadAuthTokenProvider
 import com.vitorpamplona.amethyst.service.uploads.blossom.bud10.BlossomServerResolver
 import com.vitorpamplona.quartz.utils.startsWithIgnoreCase
 import okhttp3.Call
@@ -57,8 +58,15 @@ class BlossomFetcher(
    class Factory(
        val blossomServerResolver: () -> BlossomServerResolver,
        val networkClient: (url: String) -> Call.Factory,
+        // Shared with every other network-backed factory on this ImageLoader --
+        // see the note in ImageLoaderSetup.setup(): the de-dupe only works when
+        // all fetchers coordinate through the same instance.
+        concurrentRequestStrategy: ConcurrentRequestStrategy,
+        private val readAuth: BlossomReadAuthTokenProvider? = null,
    ) : Fetcher.Factory<Uri> {
+        private val cacheStrategyLazy = lazy { CacheStrategy.DEFAULT }
        private val connectivityCheckerLazy = singleParameterLazy(::ConnectivityChecker)
+        private val concurrentRequestStrategyLazy = lazyOf(concurrentRequestStrategy)

        override fun create(
            data: Uri,
@@ -66,16 +74,20 @@ class BlossomFetcher(
            imageLoader: ImageLoader,
        ): Fetcher? {
            if (!isApplicable(data)) return null
+            // Wrapped per resolved url (not per Factory) because the server the
+            // blob actually lives on is only known once the resolver has run.
            return BlossomFetcher(options, data, blossomServerResolver) { url ->
-                NetworkFetcher(
-                    url = url,
-                    options = options,
-                    networkClient = lazy { networkClient(url).asNetworkClient() },
-                    diskCache = lazy { imageLoader.diskCache },
-                    cacheStrategy = lazy { CacheStrategy.DEFAULT },
-                    connectivityChecker = lazy { connectivityCheckerLazy.get(options.context) },
-                    concurrentRequestStrategy = lazy { DeDupeConcurrentRequestStrategy() },
-                )
+                readAuthAware(url, readAuth) { authHeader ->
+                    NetworkFetcher(
+                        url = url,
+                        options = options.withAuthHeader(authHeader),
+                        networkClient = lazy { networkClient(url).asNetworkClient() },
+                        diskCache = lazy { imageLoader.diskCache },
+                        cacheStrategy = cacheStrategyLazy,
+                        connectivityChecker = lazy { connectivityCheckerLazy.get(options.context) },
+                        concurrentRequestStrategy = concurrentRequestStrategyLazy,
+                    )
+                }
            }
        }

@@ -0,0 +1,109 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.service.images
+
+import coil3.Extras
+import coil3.fetch.FetchResult
+import coil3.fetch.Fetcher
+import coil3.network.HttpException
+import coil3.network.httpHeaders
+import coil3.request.Options
+import com.vitorpamplona.amethyst.service.okhttp.BlossomReadAuthInterceptor
+import com.vitorpamplona.amethyst.service.okhttp.BlossomReadAuthTokenProvider
+import okhttp3.HttpUrl.Companion.toHttpUrlOrNull
+
+/**
+ * Retries an auth-gated Blossom blob with a signed BUD-01 `t=get` token when the
+ * anonymous fetch comes back `401`.
+ *
+ * This is the half of the read-auth flow that has to wait for a signature.
+ * `BlossomReadAuthInterceptor` cannot: it runs on an OkHttp dispatcher thread,
+ * so waiting there holds one of the 16 per-host slots and stalls every other
+ * image from the same host. `Fetcher.fetch()` is `suspend`, so the wait costs a
+ * suspended coroutine and nothing else.
+ *
+ * [build] produces the underlying network fetcher, optionally carrying an
+ * `Authorization` header. Deliberately a `(String?) -> Fetcher` lambda rather
+ * than taking Coil's [Options] directly — the retry decision is then testable
+ * without an Android `Context` to construct [Options] with.
+ */
+class BlossomReadAuthFetcher(
+    private val url: String,
+    private val auth: BlossomReadAuthTokenProvider,
+    private val build: (authHeader: String?) -> Fetcher,
+) : Fetcher {
+    override suspend fun fetch(): FetchResult? {
+        try {
+            return build(null).fetch()
+        } catch (e: HttpException) {
+            // Coil's NetworkFetcher throws HttpException for any non-2xx/304,
+            // which is how a 401 reaches us with its code intact.
+            if (e.response.code != HTTP_UNAUTHORIZED) throw e
+
+            val httpUrl = url.toHttpUrlOrNull() ?: throw e
+            // Gate only: read-auth applies to Blossom blob URLs, but the token is
+            // scoped to the host (BUD-11 `server` tag) and carries no `x` tag.
+            BlossomReadAuthInterceptor.blossomHashOrNull(httpUrl.encodedPath) ?: throw e
+            val header = auth.header(httpUrl.host) ?: throw e
+
+            return build(header).fetch()
+        }
+    }
+
+    companion object {
+        private const val HTTP_UNAUTHORIZED = 401
+    }
+}
+
+/**
+ * Wraps [build] in read-auth handling when a token provider is configured, and
+ * returns the plain fetcher when it isn't (tests, pre-configuration call sites).
+ */
+fun readAuthAware(
+    url: String,
+    auth: BlossomReadAuthTokenProvider?,
+    build: (authHeader: String?) -> Fetcher,
+): Fetcher =
+    if (auth == null) {
+        build(null)
+    } else {
+        BlossomReadAuthFetcher(url, auth, build)
+    }
+
+/**
+ * Copy of these options carrying [header] as `Authorization`, or the same
+ * options when there is no header. Coil's `NetworkFetcher` builds its request
+ * from `options.httpHeaders`, so this is how the retry gets authenticated.
+ */
+fun Options.withAuthHeader(header: String?): Options =
+    if (header == null) {
+        this
+    } else {
+        copy(
+            extras =
+                extras
+                    .newBuilder()
+                    .set(
+                        Extras.Key.httpHeaders,
+                        httpHeaders.newBuilder().set("Authorization", header).build(),
+                    ).build(),
+        )
+    }
@@ -33,6 +33,7 @@ import coil3.gif.AnimatedImageDecoder
 import coil3.gif.GifDecoder
 import coil3.memory.MemoryCache
 import coil3.network.CacheStrategy
+import coil3.network.ConcurrentRequestStrategy
 import coil3.network.ConnectivityChecker
 import coil3.network.DeDupeConcurrentRequestStrategy
 import coil3.network.NetworkFetcher
@@ -43,6 +44,7 @@ import coil3.svg.SvgDecoder
 import coil3.util.Logger
 import coil3.video.VideoFrameDecoder
 import com.vitorpamplona.amethyst.isDebug
+import com.vitorpamplona.amethyst.service.okhttp.BlossomReadAuthTokenProvider
 import com.vitorpamplona.amethyst.service.uploads.blossom.bud10.BlossomServerResolver
 import com.vitorpamplona.quartz.utils.Log
 import kotlinx.coroutines.CoroutineScope
@@ -60,7 +62,7 @@ class ImageLoaderSetup {

        val debugLogger = if (isDebug) MyDebugLogger() else null

-        @OptIn(DelicateCoilApi::class)
+        @OptIn(DelicateCoilApi::class, ExperimentalCoilApi::class)
        fun setup(
            app: Context,
            diskCache: () -> DiskCache,
@@ -69,7 +71,19 @@ class ImageLoaderSetup {
            callFactory: (url: String) -> Call.Factory,
            thumbnailCache: ThumbnailDiskCache,
            backgroundScope: CoroutineScope,
+            // Signs the BUD-01 retry when a gated host answers 401. Null keeps every
+            // fetch anonymous (tests, pre-configuration call sites).
+            readAuth: BlossomReadAuthTokenProvider? = null,
        ) {
+            // ONE strategy for the whole ImageLoader. DeDupeConcurrentRequestStrategy
+            // coordinates through a map of in-flight fetches that it owns, so it only
+            // works when every fetcher shares the same instance -- a fresh one per
+            // request can never see anybody else's fetch and the de-dupe silently
+            // no-ops. Shared across all three network-backed factories so a feed
+            // image and the same blob reached through `blossom:` (or a profile
+            // picture) still collapse onto one download.
+            val concurrentRequests = DeDupeConcurrentRequestStrategy()
+
            SingletonImageLoader.setUnsafe(
                ImageLoader
                    .Builder(app)
@@ -87,13 +101,13 @@ class ImageLoaderSetup {
                        add(Base64Fetcher.Factory)
                        add(BlurHashFetcher.Factory)
                        add(ThumbHashFetcher.Factory)
-                        add(BlossomFetcher.Factory(blossomServerResolver, callFactory))
-                        add(ProfilePictureFetcher.Factory(thumbnailCache, callFactory, backgroundScope))
+                        add(BlossomFetcher.Factory(blossomServerResolver, callFactory, concurrentRequests, readAuth))
+                        add(ProfilePictureFetcher.Factory(thumbnailCache, callFactory, backgroundScope, concurrentRequests, readAuth))
                        add(Base64Fetcher.BKeyer)
                        add(BlurHashFetcher.BKeyer)
                        add(ThumbHashFetcher.TKeyer)
                        add(ProfilePictureFetcher.BKeyer)
-                        add(OkHttpFactory(callFactory))
+                        add(OkHttpFactory(callFactory, concurrentRequests, readAuth))
                    }.build(),
            )
        }
@@ -132,9 +146,12 @@ class MyDebugLogger(
@OptIn(ExperimentalCoilApi::class)
 class OkHttpFactory(
    val networkClient: (url: String) -> Call.Factory,
+    concurrentRequestStrategy: ConcurrentRequestStrategy,
+    private val readAuth: BlossomReadAuthTokenProvider? = null,
 ) : Fetcher.Factory<Uri> {
    private val cacheStrategyLazy = lazy { CacheStrategy.DEFAULT }
    private val connectivityCheckerLazy = singleParameterLazy(::ConnectivityChecker)
+    private val concurrentRequestStrategyLazy = lazyOf(concurrentRequestStrategy)

    override fun create(
        data: Uri,
@@ -145,15 +162,17 @@ class OkHttpFactory(

        val url = data.toString()

-        return NetworkFetcher(
-            url = url,
-            options = options,
-            networkClient = lazy { networkClient(url).asNetworkClient() },
-            diskCache = lazy { imageLoader.diskCache },
-            cacheStrategy = cacheStrategyLazy,
-            connectivityChecker = lazy { connectivityCheckerLazy.get(options.context) },
-            concurrentRequestStrategy = lazy { DeDupeConcurrentRequestStrategy() },
-        )
+        return readAuthAware(url, readAuth) { authHeader ->
+            NetworkFetcher(
+                url = url,
+                options = options.withAuthHeader(authHeader),
+                networkClient = lazy { networkClient(url).asNetworkClient() },
+                diskCache = lazy { imageLoader.diskCache },
+                cacheStrategy = cacheStrategyLazy,
+                connectivityChecker = lazy { connectivityCheckerLazy.get(options.context) },
+                concurrentRequestStrategy = concurrentRequestStrategyLazy,
+            )
+        }
    }

    private fun isApplicable(data: Uri): Boolean = data.scheme == "http" || data.scheme == "https"
@@ -30,12 +30,13 @@ import coil3.fetch.Fetcher
 import coil3.fetch.ImageFetchResult
 import coil3.key.Keyer
 import coil3.network.CacheStrategy
+import coil3.network.ConcurrentRequestStrategy
 import coil3.network.ConnectivityChecker
-import coil3.network.DeDupeConcurrentRequestStrategy
 import coil3.network.NetworkFetcher
 import coil3.network.okhttp.asNetworkClient
 import coil3.request.Options
 import com.vitorpamplona.amethyst.commons.ui.components.ProfilePictureUrl
+import com.vitorpamplona.amethyst.service.okhttp.BlossomReadAuthTokenProvider
 import kotlinx.coroutines.CoroutineScope
 import kotlinx.coroutines.launch
 import okhttp3.Call
@@ -95,8 +96,16 @@ class ProfilePictureFetcher(
        private val thumbnailCache: ThumbnailDiskCache,
        private val networkClient: (url: String) -> Call.Factory,
        private val backgroundScope: CoroutineScope,
+        // Shared with every other network-backed factory on this ImageLoader --
+        // see the note in ImageLoaderSetup.setup(). Avatars repeat constantly
+        // down a feed, so this is where a per-request instance cost the most:
+        // every row holding the same author's picture downloaded it again.
+        concurrentRequestStrategy: ConcurrentRequestStrategy,
+        private val readAuth: BlossomReadAuthTokenProvider? = null,
    ) : Fetcher.Factory<ProfilePictureUrl> {
+        private val cacheStrategyLazy = lazy { CacheStrategy.DEFAULT }
        private val connectivityCheckerLazy = singleParameterLazy(::ConnectivityChecker)
+        private val concurrentRequestStrategyLazy = lazyOf(concurrentRequestStrategy)

        override fun create(
            data: ProfilePictureUrl,
@@ -106,15 +115,17 @@ class ProfilePictureFetcher(
            val diskCacheLazy = lazy { imageLoader.diskCache }

            val netFetcher =
-                NetworkFetcher(
-                    url = data.url,
-                    options = options,
-                    networkClient = lazy { networkClient(data.url).asNetworkClient() },
-                    diskCache = diskCacheLazy,
-                    cacheStrategy = lazy { CacheStrategy.DEFAULT },
-                    connectivityChecker = lazy { connectivityCheckerLazy.get(options.context) },
-                    concurrentRequestStrategy = lazy { DeDupeConcurrentRequestStrategy() },
-                )
+                readAuthAware(data.url, readAuth) { authHeader ->
+                    NetworkFetcher(
+                        url = data.url,
+                        options = options.withAuthHeader(authHeader),
+                        networkClient = lazy { networkClient(data.url).asNetworkClient() },
+                        diskCache = diskCacheLazy,
+                        cacheStrategy = cacheStrategyLazy,
+                        connectivityChecker = lazy { connectivityCheckerLazy.get(options.context) },
+                        concurrentRequestStrategy = concurrentRequestStrategyLazy,
+                    )
+                }

            return ProfilePictureFetcher(
                data.url,
@@ -201,6 +201,13 @@ class LightningAddressResolver {
            ?: response.code.toString()
    }

+    /**
+     * @param onZapRequestSent receives the zap request that was ACTUALLY sent to the
+     *   callback, or null when it was not. A provider that does not advertise
+     *   `allowsNostr` never sees [nostrRequest], and its invoice therefore commits to
+     *   nothing about it — so a caller must not go on to claim the two are bound. See
+     *   the drop below.
+     */
    suspend fun lnAddressInvoice(
        lnAddress: String,
        milliSats: Long,
@@ -209,6 +216,7 @@ class LightningAddressResolver {
        okHttpClient: (String) -> OkHttpClient,
        onProgress: (percent: Float) -> Unit,
        context: Context,
+        onZapRequestSent: (LnZapRequestEvent?) -> Unit = {},
    ): String {
        val mapper = jacksonObjectMapper()

@@ -264,12 +272,19 @@ class LightningAddressResolver {
            )
        }

+        // NIP-57 binds a zap request to its invoice through `description_hash`, and a
+        // provider that ignores `nostr=` mints an invoice that commits to nothing about
+        // it. Report what actually went, so a caller cannot attach the event to a
+        // payment it was never bound to.
+        val sentZapRequest = nostrRequest?.takeIf { allowsNostr }
+        onZapRequestSent(sentZapRequest)
+
        val invoice =
            fetchLightningInvoice(
                lnCallback = callbackUrl,
                milliSats = milliSats,
                message = message,
-                nostrRequest = if (allowsNostr) nostrRequest else null,
+                nostrRequest = sentZapRequest,
                okHttpClient = okHttpClient,
                context = context,
            )
@@ -35,6 +35,7 @@ import com.vitorpamplona.amethyst.commons.nipACWebRtcCalls.CallManager
 import com.vitorpamplona.amethyst.model.Account
 import com.vitorpamplona.amethyst.model.LocalCache
 import com.vitorpamplona.amethyst.model.Note
+import com.vitorpamplona.amethyst.model.isMutedPublicChatMessage
 import com.vitorpamplona.amethyst.service.call.notification.CallNotifier
 import com.vitorpamplona.amethyst.service.notifications.renderers.ArticleNotification
 import com.vitorpamplona.amethyst.service.notifications.renderers.BadgeNotification
@@ -75,6 +76,11 @@ import com.vitorpamplona.quartz.nip34Git.issue.GitIssueEvent
 import com.vitorpamplona.quartz.nip34Git.patch.GitPatchEvent
 import com.vitorpamplona.quartz.nip34Git.pr.GitPullRequestEvent
 import com.vitorpamplona.quartz.nip34Git.pr.GitPullRequestUpdateEvent
+import com.vitorpamplona.quartz.nip34Git.reply.GitReplyEvent
+import com.vitorpamplona.quartz.nip34Git.status.GitStatusAppliedEvent
+import com.vitorpamplona.quartz.nip34Git.status.GitStatusClosedEvent
+import com.vitorpamplona.quartz.nip34Git.status.GitStatusDraftEvent
+import com.vitorpamplona.quartz.nip34Git.status.GitStatusOpenEvent
 import com.vitorpamplona.quartz.nip54Wiki.WikiNoteEvent
 import com.vitorpamplona.quartz.nip57Zaps.LnZapEvent
 import com.vitorpamplona.quartz.nip58Badges.award.BadgeAwardEvent
@@ -218,11 +224,20 @@ class EventNotificationConsumer(
        // Don't push-notify events this account authored.
        if (event.pubKey == account.signer.pubKey) return

-        // Drop reactions/zaps/reposts whose target note lives on a muted thread
-        // (matches the in-app feed, which mutes all four).
+        // Drop reactions/zaps/reposts whose target note lives on a muted thread, or in a
+        // public chat the user has silenced (matches the in-app feed, which mutes all four).
+        // Without the second check, muting a channel still let a like on your own message
+        // there notify you — the row's glyph promises silence, so it has to mean it.
        if (event is ReactionEvent || event is LnZapEvent || event is RepostEvent || event is GenericRepostEvent) {
            val target = LocalCache.getNoteIfExists(event)?.replyTo?.lastOrNull()
-            if (target != null && account.isThreadMuted(account.resolveThreadRoot(target))) return
+            if (target != null &&
+                (
+                    account.isThreadMuted(account.resolveThreadRoot(target)) ||
+                        isMutedPublicChatMessage(target.event, account.settings.mutedPublicChats.value)
+                )
+            ) {
+                return
+            }
        }

        when (event) {
@@ -268,6 +283,11 @@ class EventNotificationConsumer(
            is GitPatchEvent -> CodeNotification.notify(applicationContext, account, event)
            is GitPullRequestEvent -> CodeNotification.notify(applicationContext, account, event)
            is GitPullRequestUpdateEvent -> CodeNotification.notify(applicationContext, account, event)
+            is GitReplyEvent -> CodeNotification.notify(applicationContext, account, event)
+            is GitStatusOpenEvent -> CodeNotification.notify(applicationContext, account, event)
+            is GitStatusAppliedEvent -> CodeNotification.notify(applicationContext, account, event)
+            is GitStatusClosedEvent -> CodeNotification.notify(applicationContext, account, event)
+            is GitStatusDraftEvent -> CodeNotification.notify(applicationContext, account, event)

            is LiveChessGameAcceptEvent -> ChessNotification.notify(applicationContext, account, event, R.string.app_notification_chess_challenge_accepted)
            is LiveChessMoveEvent -> ChessNotification.notify(applicationContext, account, event, R.string.app_notification_chess_your_turn)
@@ -315,6 +335,12 @@ class EventNotificationConsumer(
        event: ChannelMessageEvent,
        account: Account,
    ) {
+        // Reads local device state, NOT the NIP-78 blob: on a push-driven cold start
+        // AppSpecificState may not have decrypted yet (and for a NIP-55 account that is
+        // an Amber IPC round-trip that can fail outright in the background). Losing this
+        // race would post exactly the notification the mute exists to prevent.
+        if (isMutedPublicChatMessage(event, account.settings.mutedPublicChats.value)) return
+
        val note = LocalCache.getNoteIfExists(event.id) ?: return

        if (NotificationFeedFilter.isNotifiablePublicChatReply(note, account.signer.pubKey)) {
@@ -47,6 +47,11 @@ import com.vitorpamplona.quartz.nip34Git.issue.GitIssueEvent
 import com.vitorpamplona.quartz.nip34Git.patch.GitPatchEvent
 import com.vitorpamplona.quartz.nip34Git.pr.GitPullRequestEvent
 import com.vitorpamplona.quartz.nip34Git.pr.GitPullRequestUpdateEvent
+import com.vitorpamplona.quartz.nip34Git.reply.GitReplyEvent
+import com.vitorpamplona.quartz.nip34Git.status.GitStatusAppliedEvent
+import com.vitorpamplona.quartz.nip34Git.status.GitStatusClosedEvent
+import com.vitorpamplona.quartz.nip34Git.status.GitStatusDraftEvent
+import com.vitorpamplona.quartz.nip34Git.status.GitStatusOpenEvent
 import com.vitorpamplona.quartz.nip54Wiki.WikiNoteEvent
 import com.vitorpamplona.quartz.nip57Zaps.LnZapEvent
 import com.vitorpamplona.quartz.nip58Badges.award.BadgeAwardEvent
@@ -105,7 +110,9 @@ class NotificationDispatcher(
        // consumeFromCache can't route it. It's delivered directly via
        // [notifyWelcome] from processMarmotWelcomeFlow, which does know the
        // recipient account.
-        private val NOTIFICATION_KINDS: Set<Int> =
+        // `internal` (was `private`) so the notification-kinds contract test
+        // can pin the push-side kind set against the in-app feed's kind set.
+        internal val NOTIFICATION_KINDS: Set<Int> =
            setOf(
                // Direct-arrival
                PrivateDmEvent.KIND,
@@ -131,6 +138,14 @@ class NotificationDispatcher(
                GitIssueEvent.KIND,
                GitPullRequestEvent.KIND,
                GitPullRequestUpdateEvent.KIND,
+                // NIP-34 threaded activity: legacy git-reply comment (1622)
+                // and the four status transitions (open/applied/closed/draft,
+                // kinds 1630-1633). Same push channel as issues/patches/PRs.
+                GitReplyEvent.KIND,
+                GitStatusOpenEvent.KIND,
+                GitStatusAppliedEvent.KIND,
+                GitStatusClosedEvent.KIND,
+                GitStatusDraftEvent.KIND,
                HighlightEvent.KIND,
                LongTextNoteEvent.KIND,
                WikiNoteEvent.KIND,
@@ -92,6 +92,11 @@ class NotificationRelayService : Service() {
        // Keeps notification updates well under Android's rate limit (~10/s).
        private const val NOTIFICATION_REFRESH_MS = 1000L

+        // Toggles the expanded per-job breakdown on and off. Fired by the notification's own
+        // action button, so the details are always something the user asked for.
+        private const val ACTION_SHOW_DETAILS = "com.vitorpamplona.amethyst.SHOW_NOTIFICATION_SERVICE_DETAILS"
+        private const val ACTION_HIDE_DETAILS = "com.vitorpamplona.amethyst.HIDE_NOTIFICATION_SERVICE_DETAILS"
+
        const val ACTION_AUTO_RESTART = "com.vitorpamplona.amethyst.AUTO_RESTART_NOTIFICATION_SERVICE"

        fun start(context: Context) {
@@ -149,6 +154,9 @@ class NotificationRelayService : Service() {
    /** Last non-empty per-job breakdown, kept so a reconnect does not blank the expanded view. */
    private var lastBreakdown: List<String> = emptyList()

+    /** Whether the user asked for the per-job breakdown. Off until they tap "show details". */
+    private var detailsExpanded = false
+
    override fun onBind(intent: Intent?): IBinder? = null

    override fun onCreate() {
@@ -165,6 +173,13 @@ class NotificationRelayService : Service() {
        startId: Int,
    ): Int {
        Log.d(TAG, "Starting service")
+        // The details toggle re-enters here through the notification's action button. It only
+        // flips the flag; the rebuild happens in the ensureForeground() below, which reposts the
+        // notification with (or without) the breakdown.
+        when (intent?.action) {
+            ACTION_SHOW_DETAILS -> detailsExpanded = true
+            ACTION_HIDE_DETAILS -> detailsExpanded = false
+        }
        // Every startForegroundService() call re-arms Android's "must call
        // startForeground() within the timeout" requirement — including the repeated
        // calls MainActivity.onResume fires on each resume, even when the service is
@@ -359,9 +374,12 @@ class NotificationRelayService : Service() {
                PendingIntent.FLAG_IMMUTABLE or PendingIntent.FLAG_UPDATE_CURRENT,
            )

-        // Expanded only. The collapsed line stays the bare count it has always been — that is all
-        // most people want from an ongoing notification — and the per-job breakdown appears solely
-        // when someone deliberately expands it to ask why the phone is talking to N relays.
+        // Opt-in, never automatic. Android auto-expands a notification when it is the only one in
+        // the shade, and there is no way to opt out of that — so attaching the breakdown as a
+        // BigTextStyle up front made the per-job list the *default* view for anyone whose shade was
+        // otherwise empty, which is the opposite of what it is for. The card is therefore built
+        // with no expanded style at all until someone taps "show details"; that reposts it with the
+        // breakdown and a "hide details" action that puts it back to the bare count.
        //
        // Held across reconnects rather than recomputed blindly: the breakdown is derived from the
        // *connected* relays, so a drop to zero (the "connecting…" state) would otherwise empty it and
@@ -369,9 +387,37 @@ class NotificationRelayService : Service() {
        // looking at it. What each connection is *for* does not change while it is re-establishing,
        // so the last known answer is still the right one; only the count above it goes stale, and
        // that count is already labelled "connecting".
-        val fresh = RelayPurposeSummary.lines(this)
-        if (fresh.isNotEmpty()) lastBreakdown = fresh
-        val breakdown = fresh.ifEmpty { lastBreakdown }.takeIf { it.isNotEmpty() }
+        //
+        // Computed only while expanded: walking every connected relay's active requests once a
+        // second is wasted work when nobody has asked to see the result.
+        val breakdown =
+            if (detailsExpanded) {
+                val fresh = RelayPurposeSummary.lines(this)
+                if (fresh.isNotEmpty()) lastBreakdown = fresh
+                lastBreakdown.takeIf { it.isNotEmpty() }
+            } else {
+                null
+            }
+
+        val detailsIntent =
+            Intent(this, NotificationRelayService::class.java).apply {
+                action = if (detailsExpanded) ACTION_HIDE_DETAILS else ACTION_SHOW_DETAILS
+            }
+        val detailsPendingIntent =
+            PendingIntent.getService(
+                this,
+                if (detailsExpanded) 4 else 3,
+                detailsIntent,
+                PendingIntent.FLAG_IMMUTABLE or PendingIntent.FLAG_UPDATE_CURRENT,
+            )
+        val detailsLabel =
+            getString(
+                if (detailsExpanded) {
+                    R.string.always_on_notif_hide_details
+                } else {
+                    R.string.always_on_notif_show_details
+                },
+            )

        // Deliberately left ungrouped. This notification is ongoing and IMPORTANCE_LOW, so it
        // sits in the shade's Silent section next to the low-importance content kinds
@@ -396,7 +442,8 @@ class NotificationRelayService : Service() {
                            .bigText(contentText + "\n\n" + it.joinToString("\n")),
                    )
                }
-            }.setSmallIcon(R.drawable.amethyst_service)
+            }.addAction(0, detailsLabel, detailsPendingIntent)
+            .setSmallIcon(R.drawable.amethyst_service)
            .setContentIntent(pendingIntent)
            .setOngoing(true)
            .setSilent(true)
@@ -32,9 +32,11 @@ import com.vitorpamplona.quartz.nip01Core.relay.normalizer.NormalizedRelayUrl
 /**
 * The per-job breakdown behind the always-on notification's relay count.
 *
- * **Only ever shown expanded.** The collapsed line stays exactly what it was — a count — because
- * that is all most people ever want from an ongoing notification. This is for the moment someone
- * taps to ask *why* their phone is talking to 40 relays.
+ * **Only ever shown on request.** The card stays exactly what it was — a count — because that is all
+ * most people ever want from an ongoing notification. This is for the moment someone taps
+ * "show details" to ask *why* their phone is talking to 40 relays. It is not attached to the
+ * notification otherwise: Android auto-expands a lone notification, so anything hung off the
+ * expanded view alone would be the default view rather than an opt-in one.
 *
 * A relay usually serves several jobs at once (measured: a typical relay carries four), so these
 * counts deliberately **overlap and sum to more than the relay count**. They answer "how many relays
@@ -35,12 +35,26 @@ import com.vitorpamplona.quartz.nip34Git.issue.GitIssueEvent
 import com.vitorpamplona.quartz.nip34Git.patch.GitPatchEvent
 import com.vitorpamplona.quartz.nip34Git.pr.GitPullRequestEvent
 import com.vitorpamplona.quartz.nip34Git.pr.GitPullRequestUpdateEvent
+import com.vitorpamplona.quartz.nip34Git.reply.GitReplyEvent
+import com.vitorpamplona.quartz.nip34Git.status.GitStatusAppliedEvent
+import com.vitorpamplona.quartz.nip34Git.status.GitStatusClosedEvent
+import com.vitorpamplona.quartz.nip34Git.status.GitStatusDraftEvent
+import com.vitorpamplona.quartz.nip34Git.status.GitStatusOpenEvent

 /**
 * Git / code notifications — NIP-34 issues (1621), patches (1617), pull requests
- * (1618) and PR updates (1619) on repos you maintain. Rendered as a slate card
- * titled by the action ("X opened an issue" …) with the subject as the body.
+ * (1618), PR updates (1619), replies (1622, legacy), and status transitions
+ * (1630 open, 1631 applied/merged, 1632 closed, 1633 draft) on repos or threads
+ * you're p-tagged into. Rendered as a slate card titled by the action ("X opened
+ * an issue", "X merged a pull request", …) with the subject as the body.
 * Author name + avatar enriched observably.
+ *
+ * Status kinds resolve their title from the *target* event's kind (patch/PR/issue)
+ * when it's in cache, so a merge on a PR reads "merged a pull request" but the
+ * same 1631 targeting a plain kind-1617 patch reads "applied a patch". Falls
+ * back to a generic wording when the target isn't yet resolved (rare: the
+ * notification lands after the target because the p-tag subscription pulls
+ * status events regardless of whether the target has been seen).
 */
 object CodeNotification {
    suspend fun notify(
@@ -67,6 +81,89 @@ object CodeNotification {
        event: GitPullRequestUpdateEvent,
    ) = post(context, account, event.id, event.createdAt, event.pubKey, R.string.app_notification_code_channel_message_pr_update, event.content)

+    suspend fun notify(
+        context: Context,
+        account: Account,
+        event: GitReplyEvent,
+    ) = post(context, account, event.id, event.createdAt, event.pubKey, R.string.app_notification_code_channel_message_reply, event.content)
+
+    suspend fun notify(
+        context: Context,
+        account: Account,
+        event: GitStatusOpenEvent,
+    ) = post(context, account, event.id, event.createdAt, event.pubKey, R.string.app_notification_code_channel_message_status_open, event.content)
+
+    suspend fun notify(
+        context: Context,
+        account: Account,
+        event: GitStatusAppliedEvent,
+    ) = post(
+        context,
+        account,
+        event.id,
+        event.createdAt,
+        event.pubKey,
+        titleRes =
+            titleForStatusOnTarget(
+                event.rootEventId(),
+                pr = R.string.app_notification_code_channel_message_status_applied_pr,
+                patch = R.string.app_notification_code_channel_message_status_applied_patch,
+                issue = R.string.app_notification_code_channel_message_status_applied_issue,
+                fallback = R.string.app_notification_code_channel_message_status_applied,
+            ),
+        subject = event.content,
+    )
+
+    suspend fun notify(
+        context: Context,
+        account: Account,
+        event: GitStatusClosedEvent,
+    ) = post(
+        context,
+        account,
+        event.id,
+        event.createdAt,
+        event.pubKey,
+        titleRes =
+            titleForStatusOnTarget(
+                event.rootEventId(),
+                pr = R.string.app_notification_code_channel_message_status_closed_pr,
+                patch = R.string.app_notification_code_channel_message_status_closed_patch,
+                issue = R.string.app_notification_code_channel_message_status_closed_issue,
+                fallback = R.string.app_notification_code_channel_message_status_closed,
+            ),
+        subject = event.content,
+    )
+
+    suspend fun notify(
+        context: Context,
+        account: Account,
+        event: GitStatusDraftEvent,
+    ) = post(context, account, event.id, event.createdAt, event.pubKey, R.string.app_notification_code_channel_message_status_draft, event.content)
+
+    /**
+     * Pick a title string for a status event based on the *target*'s kind, so
+     * a 1631 on a kind-1618 PR reads "merged a pull request" while the same
+     * status kind on a kind-1617 patch reads "applied a patch". [rootId] is
+     * the marked-`root` `e` tag on the status event; when the target isn't in
+     * cache we return [fallback] which is deliberately generic.
+     */
+    private fun titleForStatusOnTarget(
+        rootId: String?,
+        pr: Int,
+        patch: Int,
+        issue: Int,
+        fallback: Int,
+    ): Int {
+        val targetKind = rootId?.let { LocalCache.getNoteIfExists(it)?.event?.kind } ?: return fallback
+        return when (targetKind) {
+            GitPullRequestEvent.KIND -> pr
+            GitPatchEvent.KIND -> patch
+            GitIssueEvent.KIND -> issue
+            else -> fallback
+        }
+    }
+
    private suspend fun post(
        context: Context,
        account: Account,
@@ -58,7 +58,7 @@ object NwcPaymentNotifier {
        val time = tx.settled_at ?: tx.created_at ?: TimeUtils.now()

        val title = stringRes(context, R.string.app_notification_payments_channel_message, amount)
-        val comment = (tx.parsedMetadata()?.comment ?: tx.description)?.ifBlank { null }
+        val comment = tx.parsedMetadata()?.displayComment() ?: tx.displayDescription()
        val body = comment ?: title

        val accountNpub = NotificationRoutes.accountNpub(account)
@@ -49,22 +49,27 @@ import java.util.concurrent.ConcurrentHashMap
 *  - and at most one retry (an application interceptor's second `chain.proceed`
 *    runs the downstream chain again, it does not re-enter this interceptor).
 *
- * [authHeaderProvider] is `(host, sha256) -> header?`. It is synchronous by
- * contract (the caller bridges the suspend signer), returns `null` when no
- * signer is available or signing times out, and is only consulted on a real
- * `401`, so an unauthenticated user simply keeps seeing the broken image
- * rather than paying any signing cost.
+ * This interceptor never signs and never waits. [cachedHeaderProvider] is a
+ * pure cache read and [onAuthRequired] is fire-and-forget: `intercept` runs on
+ * an OkHttp dispatcher thread, where blocking would hold one of the 16 per-host
+ * slots for the whole signing window and stall every other image from that
+ * host. The signed *retry* therefore lives one layer up, in
+ * `BlossomReadAuthFetcher`, which is `suspend` and can await the signature
+ * without occupying a slot.
 *
- * The first blob from an auth-gated host costs an extra round trip (anonymous
- * `GET` → `401` → signed retry), but that host is then remembered in
- * [knownAuthHosts] so every later blob from it is signed **up front** — one
- * round trip, not two. This matters on a Buzz community feed where nearly every
- * image comes from the same gated host: without it each image would keep paying
- * the wasted 401 probe. The learned host also short-circuits to anonymous when
- * no signer is available, so a logged-out user never re-probes needlessly.
+ * The first blob from an auth-gated host still costs an extra round trip
+ * (anonymous `GET` -> `401` -> signed retry by the fetcher), but the host is
+ * then remembered in [knownAuthHosts] so every later blob from it is signed
+ * **up front** from the cache — one round trip, not two. This matters on a Buzz
+ * community feed where nearly every image comes from the same gated host.
+ * Callers that cannot retry (e.g. the media3 video datasource) get the token on
+ * their next request, once [onAuthRequired] has landed it in the cache.
 */
 class BlossomReadAuthInterceptor(
-    private val authHeaderProvider: (host: String, sha256: HexKey) -> String?,
+    /** Pure cache read — must not sign, must not block. */
+    private val cachedHeaderProvider: (host: String) -> String?,
+    /** Fire-and-forget: starts a signature for a host we just learned is gated. */
+    private val onAuthRequired: (host: String) -> Unit,
 ) : Interceptor {
    // Hosts observed to answer 401 to an anonymous Blossom GET. Small (a user
    // follows a handful of auth-gated servers at most) and shared across all
@@ -81,14 +86,16 @@ class BlossomReadAuthInterceptor(
            return chain.proceed(request)
        }

-        val sha256 = blossomHashOrNull(request.url.encodedPath) ?: return chain.proceed(request)
+        // The hash is a gate, not an input: read-auth applies only to Blossom
+        // blob URLs. The token itself is host-scoped and carries no `x` tag.
+        blossomHashOrNull(request.url.encodedPath) ?: return chain.proceed(request)
        val host = request.url.host

        // Known-gated host: skip the anonymous probe and sign the first attempt.
        // Falls through to anonymous only when we can't produce a token (no
        // signer / timeout) — the server would 401 either way.
        if (host in knownAuthHosts) {
-            authHeaderProvider(host, sha256)?.let { header ->
+            cachedHeaderProvider(host)?.let { header ->
                return chain.proceed(request.withAuth(header))
            }
        }
@@ -99,12 +106,12 @@ class BlossomReadAuthInterceptor(
        // Learn the host so its next blob is signed up front.
        knownAuthHosts.add(host)

-        val header = authHeaderProvider(host, sha256) ?: return response
+        // Start the signature but do not wait for it: this thread holds a
+        // per-host dispatcher slot. BlossomReadAuthFetcher performs the signed
+        // retry for this very request from a coroutine.
+        onAuthRequired(host)

-        // Close the 401 body before replaying so the connection can be reused.
-        response.close()
-
-        return chain.proceed(request.withAuth(header))
+        return response
    }

    private fun Request.withAuth(header: String) =
@@ -21,29 +21,49 @@
 package com.vitorpamplona.amethyst.service.okhttp

 import com.vitorpamplona.amethyst.commons.service.upload.BlossomAuth
-import com.vitorpamplona.quartz.nip01Core.core.HexKey
 import com.vitorpamplona.quartz.nip01Core.signers.NostrSigner
-import kotlinx.coroutines.runBlocking
+import kotlinx.coroutines.CompletableDeferred
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.launch
 import kotlinx.coroutines.withTimeoutOrNull
 import java.util.concurrent.ConcurrentHashMap
+import kotlin.coroutines.cancellation.CancellationException

 /**
- * Signs and caches BUD-01 read-auth headers for [BlossomReadAuthInterceptor].
+ * Signs and caches BUD-01 read-auth headers for auth-gated Blossom hosts.
 *
- * The interceptor is synchronous (it runs on an OkHttp dispatcher thread) but
- * signing is `suspend`, so [authHeader] bridges with [runBlocking] guarded by a
- * timeout: an internal key signs instantly, while a remote (NIP-46) or external
- * (NIP-55) signer that hangs or needs user interaction simply yields `null` and
- * the download stays unauthenticated instead of pinning the thread.
+ * Signing never blocks a caller's thread. It runs on [scope]; callers either
+ * `suspend` on [header] or fire [warm] and pick the token up later. That
+ * matters because the consumer used to be [BlossomReadAuthInterceptor], which
+ * runs on an OkHttp dispatcher thread — bridging the suspend signer with
+ * `runBlocking` there held one of the 16 per-host dispatcher slots for as long
+ * as the signer took (up to the timeout), so a feed's first burst against a
+ * gated host could occupy every slot and stall every other image from it.
 *
- * Tokens are cached per host, not per blob. A BUD-11 `server`-scoped token
- * grants reads for every blob on the host (thumbnails included), so one signed
- * event covers a whole feed's worth of images from an auth-gated host for the
- * life of the token. The blob hash of the request that first triggered signing
- * is still included as the `x` tag for BUD-01 servers that check it.
+ * One signature per host, however many callers. The token cache alone couldn't
+ * provide that: it is only populated *after* a signature returns, so a cold
+ * burst of N images all missed it and all signed concurrently — with a NIP-55
+ * external signer that meant N IPC round trips (and potentially N prompts).
+ * [inFlight] is what collapses them; the leader signs and every follower awaits
+ * the same [CompletableDeferred].
+ *
+ * Tokens are cached per host, not per blob, and are therefore minted with a
+ * BUD-11 `server` tag and **no** `x` tag. BUD-11 lists `x` as optional for
+ * `GET /<sha256>` but is strict about what including one means: "When `x` tags
+ * are present, the token is only valid for operations on the specified blob
+ * hashes." A token carrying the hash of whichever blob happened to trigger
+ * signing would therefore be invalid for every other blob it was reused for.
+ * Server-scoped and hash-free, one signed event legitimately covers a whole
+ * feed's worth of images from the host for the life of the token.
+ *
+ * The tradeoff that buys: the token authorizes reading any blob on that host
+ * until it expires, rather than one. It is only ever sent to that host, over
+ * TLS, and BUD-11 sanctions the shape — but it is a wider grant than a
+ * per-blob token, which is the price of caching at all.
 */
 class BlossomReadAuthTokenProvider(
    private val signerProvider: () -> NostrSigner?,
+    private val scope: CoroutineScope,
    private val clock: () -> Long = { System.currentTimeMillis() },
 ) {
    private class CachedToken(
@@ -52,31 +72,91 @@ class BlossomReadAuthTokenProvider(
    )

    private val cache = ConcurrentHashMap<String, CachedToken>()
+    private val inFlight = ConcurrentHashMap<String, CompletableDeferred<String?>>()

-    fun authHeader(
-        host: String,
-        sha256: HexKey,
-    ): String? {
-        val now = clock()
+    /**
+     * The token already held for [host], or null. Pure map read — safe to call
+     * from an OkHttp interceptor, and never signs.
+     */
+    fun cachedHeader(host: String): String? = cache[host]?.takeIf { it.expiresAtMs > clock() }?.header

-        cache[host]?.let { if (it.expiresAtMs > now) return it.header }
+    /**
+     * The token for [host], signing one if none is cached. Suspends rather than
+     * blocking, so the caller must already be in a coroutine — on the image path
+     * that is Coil's `Fetcher.fetch()`.
+     */
+    suspend fun header(host: String): String? {
+        cachedHeader(host)?.let { return it }
+        return signOnce(host)?.await()
+    }
+
+    /**
+     * Starts a signature for [host] without waiting for it. For callers that
+     * cannot suspend (the interceptor) and only need the token to exist by the
+     * time some later request needs it.
+     */
+    fun warm(host: String) {
+        if (cachedHeader(host) != null) return
+        signOnce(host)
+    }
+
+    /**
+     * Returns the in-flight signature for [host], starting one if this caller
+     * wins the race. Null when there is no signer to sign with.
+     *
+     * Leader/follower over [ConcurrentHashMap.putIfAbsent] rather than
+     * `computeIfAbsent`: the completion handler removes the map entry, and a job
+     * that finishes immediately would run that removal *inside* the mapping
+     * function, which `ConcurrentHashMap` forbids.
+     */
+    private fun signOnce(host: String): CompletableDeferred<String?>? {
+        inFlight[host]?.let { return it }

        val signer = signerProvider() ?: return null

-        val header =
-            runBlocking {
-                withTimeoutOrNull(SIGN_TIMEOUT_MS) {
-                    BlossomAuth.createGetAuth(
-                        hash = sha256,
-                        alt = "Downloading media from $host",
-                        signer = signer,
-                        servers = listOf(host),
-                    )
-                }
-            } ?: return null
+        val fresh = CompletableDeferred<String?>()
+        inFlight.putIfAbsent(host, fresh)?.let { return it }

-        cache[host] = CachedToken(header, now + CACHE_TTL_MS)
-        return header
+        scope
+            .launch {
+                val header =
+                    try {
+                        withTimeoutOrNull(SIGN_TIMEOUT_MS) {
+                            BlossomAuth.createGetAuth(
+                                // No `x` tag: this token is reused for every blob
+                                // on the host. See the class kdoc.
+                                hash = null,
+                                alt = "Downloading media from $host",
+                                signer = signer,
+                                servers = listOf(host),
+                            )
+                        }
+                    } catch (e: Exception) {
+                        if (e is CancellationException) throw e
+                        null
+                    }
+
+                if (header != null) {
+                    cache[host] = CachedToken(header, clock() + CACHE_TTL_MS)
+                }
+
+                // Retire the entry *before* completing it. `invokeOnCompletion` fires when the
+                // job ends, which is after `complete()` resumes the awaiting caller — so a
+                // caller that returned from `header()` could come straight back, find this
+                // finished deferred still in the map, and be handed its already-signed token
+                // instead of signing a new one. A caller whose token has just expired does
+                // exactly that, and got the expired token back for as long as the window
+                // lasted — [refreshesAfterExpiry] closes it immediately and so hit it every run.
+                inFlight.remove(host, fresh)
+                fresh.complete(header)
+            }.invokeOnCompletion {
+                inFlight.remove(host, fresh)
+                // No-op when the job completed normally; releases followers when
+                // it was cancelled (scope torn down) instead of hanging them.
+                fresh.complete(null)
+            }
+
+        return fresh
    }

    companion object {
@@ -84,7 +164,8 @@ class BlossomReadAuthTokenProvider(
        // refresh a little early to avoid handing over a token that dies mid-flight.
        private const val CACHE_TTL_MS = 55L * 60L * 1000L

-        // Bounds how long an image download may block waiting on a slow signer.
+        // Bounds how long an image may wait on a slow signer. No thread is held
+        // for this window any more — only the waiting coroutine.
        private const val SIGN_TIMEOUT_MS = 8_000L
    }
 }
@@ -0,0 +1,241 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.service.priority
+
+import android.content.Context
+import android.os.Process
+import android.os.SystemClock
+import android.provider.Settings
+import com.vitorpamplona.quartz.utils.Log
+import java.io.File
+
+/**
+ * Demotes the app's network/ingest worker threads below the UI thread so a cold-start relay storm
+ * cannot starve the main thread out of its frames.
+ *
+ * **Why this exists.** On a cold start the outbox model dials ~190 relays at once and the process
+ * grows to ~650 threads (OkHttp's TaskRunner pool, OkHttp dispatchers, the kotlinx scheduler and
+ * Arti's tokio workers). Every one of them is born at nice 0. The main thread is nice -10, but a
+ * single -10 thread against dozens of simultaneously-runnable nice-0 threads still loses a large
+ * share of its schedulable time to the runqueue — long enough that the first feed frame takes
+ * seconds and the "Loading account" screen stays on-screen well after the account itself has
+ * loaded.
+ *
+ * **Measured on a release-codegen build** (`:amethyst:installPlayBenchmark`, i.e. R8-minified +
+ * baseline-profile AOT), SM-T220, 5-round round-robin, every run valid:
+ *
+ * | workers at | starvation | runqueue wait | time to first paint | spread |
+ * |---|---|---|---|---|
+ * | nice 0 (off) | 26.7% | 2300 ms | 11.1 s | 5.63 s |
+ * | nice 5 | 22.0% | 1774 ms | 8.0 s | 4.05 s |
+ * | nice 9 | 17.1% | 1280 ms | 8.4 s | 3.05 s |
+ * | **nice 10** | **14.6%** | **1234 ms** | **6.2 s** | **1.55 s** |
+ *
+ * nice 10 beat the control in 5 of 5 paired rounds (median 5.0 s faster, ~45%) and collapsed the
+ * run-to-run spread from 5.6 s to 1.6 s, so [DEFAULT_NICE] is 10.
+ *
+ * **This effect only exists in a release build, so never re-validate it on a debug one.** In a
+ * debug build the same sweep changes nothing measurable: there the main thread is ~70% busy,
+ * saturated with ART interpretation, so scheduling was never the constraint (starvation is 15% in
+ * debug vs 27% in release). R8 collapses main's own work while leaving the relay storm untouched,
+ * which is what promotes starvation to the binding constraint. An emulator is equally misleading
+ * for the opposite reason — its shared cores manufacture contention real hardware does not have.
+ *
+ * **Why a /proc sweep instead of thread factories.** The largest pool by far is OkHttp's
+ * `TaskRunner` backend, a process-wide singleton whose thread factory OkHttp does not expose per
+ * client, so there is no injection point to set a priority at creation time. Sweeping
+ * `/proc/self/task` catches every pool uniformly — including threads OkHttp renames after the host
+ * they are currently serving. A nice value is per-OS-thread and survives renaming, so seeing a
+ * thread once is enough; the sweep only has to be frequent enough to catch newly-spawned ones.
+ *
+ * Note that [Thread.setPriority] does NOT map to a Linux nice level on Android — only
+ * [Process.setThreadPriority] does. (`AudioTrackPlayer` documents the same trap for audio.)
+ *
+ * **Scope.** [DENYLIST] holds the threads that must keep their scheduling: the main thread,
+ * RenderThread (it draws the frames we are trying to protect), the ART daemons (demoting
+ * HeapTaskDaemon would make the GC pressure *worse*, not better) and binder threads (IPC replies
+ * the system waits on). Everything else is app work that should yield to the UI.
+ *
+ * **Cost.** Each thread is touched once, not once per sweep, and the interval backs off whenever a
+ * sweep finds nothing new — the storm front-loads thread creation, so most sweeps after the first
+ * few seconds are empty. Threads that exit are pruned so a recycled tid is re-evaluated.
+ *
+ * **Runtime override.** [SETTING_KEY] overrides [DEFAULT_NICE] without a rebuild, and is also the
+ * off switch (any value <= 0 disables the governor entirely):
+ * ```
+ * adb shell settings put global amethyst_worker_nice 5    # demote to nice 5 instead
+ * adb shell settings put global amethyst_worker_nice 0    # disable
+ * adb shell settings delete global amethyst_worker_nice   # back to DEFAULT_NICE
+ * ```
+ * Despite AOSP's `androidSetThreadPriority` calling `set_sched_policy(SP_BACKGROUND)` at nice >= 10,
+ * no cpuset/schedtune move was observed on real hardware (SM-T220 / Android 14): at nice 5, 9 and 10
+ * every worker kept main's exact membership (`schedtune:/top-app`, `cpuset:/top-app`, `cpu:/`) and
+ * only the nice value changed — so 10 carries no hidden cgroup penalty over 9.
+ */
+object WorkerThreadPriorityGovernor {
+    /** `Settings.Global` key overriding [DEFAULT_NICE]; any value <= 0 disables the governor. */
+    const val SETTING_KEY = "amethyst_worker_nice"
+
+    /** Best measured value on a release-codegen build — see the table in the class doc. */
+    const val DEFAULT_NICE = 10
+
+    /** Sweep cadence while threads are still appearing. */
+    private const val MIN_INTERVAL_MS = 250L
+
+    /** Ceiling the interval backs off to while a sweep keeps finding nothing new. */
+    private const val MAX_BURST_INTERVAL_MS = 2_000L
+
+    /** How long to stay in the adaptive burst before settling at [IDLE_INTERVAL_MS]. */
+    private const val BURST_DURATION_MS = 120_000L
+
+    /** Steady-state cadence; relay reconnects still spawn threads long after boot. */
+    private const val IDLE_INTERVAL_MS = 5_000L
+
+    /**
+     * Threads whose scheduling must not be touched. Matched as prefixes against the kernel `comm`
+     * (which the kernel caps at 15 characters, so these are deliberately short).
+     */
+    private val DENYLIST =
+        listOf(
+            // Draws the frames this whole exercise is meant to protect.
+            "RenderThread",
+            "hwuiTask",
+            "GPU completion",
+            // ART daemons — demoting the GC would deepen the very stalls we are fixing.
+            "HeapTaskDaemon",
+            "ReferenceQueueD",
+            "FinalizerDaemon",
+            "FinalizerWatchd",
+            "Signal Catcher",
+            "Jit thread pool",
+            "Runtime worker",
+            "perfetto_hprof",
+            // Debugger/profiler plumbing.
+            "ADB-JDWP",
+            "JDWP",
+            // Synchronous IPC the system framework blocks on.
+            "binder:",
+        )
+
+    @Volatile private var started = false
+
+    fun start(context: Context) {
+        if (started) return
+        val targetNice = resolveTargetNice(context)
+        if (targetNice == null) {
+            Log.i("ThreadPriority") { "Worker thread governor disabled via $SETTING_KEY" }
+            return
+        }
+        started = true
+        Log.i("ThreadPriority") { "Worker thread governor on, target nice=$targetNice" }
+
+        Thread({ sweepLoop(targetNice) }, "worker-nice-governor")
+            .apply {
+                isDaemon = true
+                start()
+            }
+    }
+
+    /** Returns the nice level to apply, or null when the governor should not run at all. */
+    private fun resolveTargetNice(context: Context): Int? {
+        val configured =
+            runCatching {
+                Settings.Global.getInt(context.contentResolver, SETTING_KEY, DEFAULT_NICE)
+            }.getOrDefault(DEFAULT_NICE)
+
+        // Only a demotion makes sense here; <= 0 is the documented off switch and anything above
+        // the nice ceiling is a typo we should not act on.
+        return configured.takeIf { it in 1..19 }
+    }
+
+    private fun sweepLoop(targetNice: Int) {
+        // The governor must keep running while the pools it polices saturate the CPU, so it runs
+        // slightly above default rather than as background work.
+        runCatching { Process.setThreadPriority(Process.THREAD_PRIORITY_FOREGROUND) }
+
+        val startedAt = SystemClock.elapsedRealtime()
+        val mainTid = Process.myPid()
+        // Tids already dealt with — demoted, or skipped because they are on the denylist. Both are
+        // permanent decisions, so keeping them here means a thread costs one `comm` read for its
+        // whole life instead of one per sweep. Seeded with our own tid so the sweep can't demote
+        // the governor itself.
+        val handled = HashSet<Int>().apply { add(Process.myTid()) }
+        var interval = MIN_INTERVAL_MS
+
+        while (true) {
+            val demoted = sweepOnce(mainTid, targetNice, handled)
+            if (demoted > 0) {
+                Log.d("ThreadPriority") { "Demoted $demoted thread(s) to nice $targetNice" }
+            }
+
+            // Thread creation is front-loaded into the connect storm, so once a sweep comes back
+            // empty the next one almost certainly will too — back off instead of spinning.
+            interval =
+                when {
+                    SystemClock.elapsedRealtime() - startedAt >= BURST_DURATION_MS -> IDLE_INTERVAL_MS
+                    demoted > 0 -> MIN_INTERVAL_MS
+                    else -> (interval * 2).coerceAtMost(MAX_BURST_INTERVAL_MS)
+                }
+
+            runCatching { Thread.sleep(interval) }.onFailure { return }
+        }
+    }
+
+    private fun sweepOnce(
+        mainTid: Int,
+        targetNice: Int,
+        handled: MutableSet<Int>,
+    ): Int {
+        // list() rather than listFiles(): this runs hundreds of times over a boot and the File
+        // objects would be pure garbage on an already GC-pressured heap.
+        val tidNames = File("/proc/self/task").list() ?: return 0
+        val live = HashSet<Int>(tidNames.size * 2)
+        var demoted = 0
+
+        for (tidName in tidNames) {
+            val tid = tidName.toIntOrNull() ?: continue
+            live.add(tid)
+            if (tid == mainTid || tid in handled) continue
+
+            // A thread can exit between listing and reading; treat any failure as "skip" and let
+            // the next sweep retry, since it is not yet recorded in `handled`.
+            val name =
+                runCatching {
+                    File("/proc/self/task/$tidName/comm").readText().trim()
+                }.getOrNull() ?: continue
+
+            if (DENYLIST.any { name.startsWith(it) }) {
+                handled.add(tid)
+                continue
+            }
+
+            if (runCatching { Process.setThreadPriority(tid, targetNice) }.isSuccess) {
+                handled.add(tid)
+                demoted++
+            }
+        }
+
+        // Drop tids that have exited so the kernel recycling one into a new thread doesn't leave
+        // that thread permanently un-demoted.
+        handled.retainAll(live)
+        return demoted
+    }
+}
@@ -20,13 +20,13 @@
 */
 package com.vitorpamplona.amethyst.service.relayClient

+import com.vitorpamplona.amethyst.commons.tor.RelayClassification
 import com.vitorpamplona.amethyst.commons.tor.TorRelaySettings
 import com.vitorpamplona.amethyst.model.torState.TorRelayEvaluation
 import com.vitorpamplona.amethyst.service.connectivity.ConnectivityStatus
 import com.vitorpamplona.amethyst.service.resourceusage.UsageKeys
 import com.vitorpamplona.amethyst.ui.tor.TorServiceStatus
 import com.vitorpamplona.quartz.nip01Core.relay.client.INostrClient
-import com.vitorpamplona.quartz.nip01Core.relay.normalizer.NormalizedRelayUrl
 import com.vitorpamplona.quartz.utils.Log
 import kotlinx.coroutines.CoroutineScope
 import kotlinx.coroutines.Dispatchers
@@ -101,9 +101,7 @@ class RelayProxyClientConnector(
    // flipped relay would sit out its (now-irrelevant) backoff. We track these so such a relay can
    // skip its retry delay on the next reconnect — scoped to onlyIfChanged, so only the relays that
    // actually flipped re-dial and the rest of the pool's backoff is left untouched.
-    private var lastTrustedRelays: Set<NormalizedRelayUrl>? = null
-    private var lastDmRelays: Set<NormalizedRelayUrl>? = null
-    private var lastMoneyOpRelays: Set<NormalizedRelayUrl>? = null
+    private var lastClassification: RelayClassification? = null

    @OptIn(FlowPreview::class)
    val relayServices =
@@ -152,7 +150,7 @@ class RelayProxyClientConnector(
                    onTrigger(UsageKeys.TRIGGER_OFF)
                    client.disconnect()
                }
-                if (infra.torStatus is TorServiceStatus.Active) {
+                if (infra.torStatus.isFullyBootstrapped) {
                    Log.d("ManageRelayServices", "Connectivity off, Tor idle")
                }
                // disconnect() already cleared every relay's backoff. Forget the network
@@ -163,7 +161,7 @@ class RelayProxyClientConnector(
            infra.connectivity is ConnectivityStatus.Active && !client.isActive() -> {
                Log.d("ManageRelayServices", "Connectivity On: Resuming Relay Services")

-                if (infra.torStatus is TorServiceStatus.Active) {
+                if (infra.torStatus.isFullyBootstrapped) {
                    Log.d("ManageRelayServices", "Connectivity resumed, Tor active")
                }

@@ -174,9 +172,7 @@ class RelayProxyClientConnector(
                lastTorSettings = torSettings
                lastTorConnection = infra.torConnection
                lastClearConnection = infra.clearConnection
-                lastTrustedRelays = infra.evaluator.trustedRelayList
-                lastDmRelays = infra.evaluator.dmRelayList
-                lastMoneyOpRelays = infra.evaluator.moneyOpRelayList
+                lastClassification = infra.evaluator.classification
            }

            else -> {
@@ -202,13 +198,13 @@ class RelayProxyClientConnector(
                // so let onlyIfChanged pick out the flipped relay(s) and skip THEIR retry delay —
                // without resetBackoff(), so the rest of the pool's backoff is untouched (these sets
                // churn while relay lists load, and forgiving the whole pool then would be too much).
+                //
+                // One comparison over the whole classification, not one per category: this used to
+                // be a four-way `||` and adding a category meant remembering to extend it. Missing
+                // a term fails silently — the affected relays keep a socket on a transport the
+                // policy has already moved them off.
                val classificationChanged =
-                    lastTrustedRelays != null &&
-                        (
-                            infra.evaluator.trustedRelayList != lastTrustedRelays ||
-                                infra.evaluator.dmRelayList != lastDmRelays ||
-                                infra.evaluator.moneyOpRelayList != lastMoneyOpRelays
-                        )
+                    lastClassification != null && infra.evaluator.classification != lastClassification

                val previousNetworkId = lastNetworkId

@@ -216,9 +212,7 @@ class RelayProxyClientConnector(
                lastClearConnection = infra.clearConnection
                lastNetworkId = networkId ?: lastNetworkId
                lastTorSettings = torSettings
-                lastTrustedRelays = infra.evaluator.trustedRelayList
-                lastDmRelays = infra.evaluator.dmRelayList
-                lastMoneyOpRelays = infra.evaluator.moneyOpRelayList
+                lastClassification = infra.evaluator.classification

                if (networkChanged) {
                    Log.d("ManageRelayServices") {
@@ -265,8 +265,8 @@ private fun RelayHeader(
        horizontalArrangement = Arrangement.spacedBy(11.dp),
    ) {
        RobohashFallbackAsyncImage(
-            robot = info?.id ?: prompt.relayUrl.displayUrl(),
-            model = info?.icon,
+            robot = info.id ?: prompt.relayUrl.displayUrl(),
+            model = info.icon,
            contentDescription = null,
            colorFilter = RelayIconFilter,
            modifier = Modifier.size(34.dp).clip(MaterialTheme.shapes.small),
--- a/Show More
+++ b/Show More