perf(ai): bound in-flight GenAI work and stop blocking IO threads on it

Follow-up to the crash fix, which changed what cancellation costs.

Inferences can no longer be recalled: awaitDetached() detaches instead of
cancelling, because cancelling the future is what killed the process. So
abandoning a running batch no longer stops anything — it leaves seven rewrites
burning on-device compute for text the user has already moved past, and since
precomputeAiResults() runs on every keystroke, each later pause stacked seven
more on top with nothing bounding the pile.

The composer now coalesces instead of abandoning. The debounce window stays
freely cancellable (nothing has reached the model yet), but once a batch's
inferences are under way it is left to finish and the newest draft text is
stashed in aiPendingText, picked up when that batch ends. In-flight work is
bounded at one batch however fast the user types, and per-batch latency is
untouched — the seven tones still run concurrently.

MLKitImageLabelService moves off ListenableFuture.get() onto awaitDetached().
Describing an image takes seconds, and get() held an IO thread for all of it
uninterruptibly, so backing out of the composer left the thread pinned until
AICore answered. This needs a CancellationException rethrow ahead of the
existing catch-all: now that the awaits suspend, a cancelled caller lands there
and must not be swallowed as "no suggestion".

Also drops MIN_CONFIDENCE/MAX_LABELS, which nothing has referenced since the
keyword image-labeling path was removed, and corrects the class KDoc that still
described that fallback.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E1mgCe29aaWUwGmGHKnFKo

.claude/CLAUDE.md

@@ -263,7 +263,33 @@ Commit the regenerated `material_symbols_outlined.ttf` alongside your
 at runtime because the glyph is not in the bundled font.
 
 Reusing a codepoint already present in `MaterialSymbols.kt` does NOT require
-regenerating. See `tools/material-symbols-subset/README.md` for details and
+regenerating.
+
+### Amethyst's own icons are also a font
+
+The icons in `commons/.../commons/icons/*.kt` (Like, Reply, Reposted, Zap, …) are
+**also** compiled into a font, `composeResources/font/amethyst_icons.ttf`, and drawn
+as glyphs via `AmethystIconGlyph`. Drawing an `ImageVector` rasterises its paths into
+a per-instance cached layer, so a feed re-rasterised the same glyph once per card;
+a glyph is a blit from the shared text atlas. Measured: frame P90 **-10.7%**,
+overrun P90 **-17.4%** on the feed scroll benchmark.
+
+**MANDATORY:** whenever you add or change an icon under `commons/.../commons/icons/`,
+regenerate the font *and* its codepoint table together:
+
+```bash
+python3 tools/icon-font/build_icon_font.py \
+  commons/src/commonMain/kotlin/com/vitorpamplona/amethyst/commons/icons \
+  commons/src/commonMain/composeResources/font/amethyst_icons.ttf \
+  commons/src/commonMain/kotlin/com/vitorpamplona/amethyst/commons/icons/symbols/AmethystIcons.kt
+```
+
+Both outputs must be committed together: codepoints are assigned in filename order,
+so adding an icon renumbers the ones after it, and a stale `AmethystIcons.kt` then
+points at the wrong glyph. Needs `fonttools` (`pip install fonttools`). The script
+prints any icon it could not convert — an icon that is skipped must keep using its
+`ImageVector`.
+ See `tools/material-symbols-subset/README.md` for details and
 prerequisites (`pip install fonttools brotli`).
 
 ## Code Formatting

.claude/hooks/lib/git_push_gate.py

@@ -0,0 +1,61 @@
+#!/usr/bin/env python3
+"""Decide whether a PreToolUse payload on stdin is a push/PR boundary.
+
+Shared by every pre-push hook in this directory (pre-push-spotless.sh,
+pre-push-orphan-strings.sh) so the gate condition is defined once. Each hook is
+a separate process with its own stdin, so this is exec'd per hook rather than
+run once and shared.
+
+Exit 0 = this call publishes code (gate it). Exit 1 = let it through.
+"""
+
+import json
+import shlex
+import sys
+
+# Reaching the push subcommand means stepping over git's global options first.
+GLOBAL_WITH_ARG = {"-c", "-C", "--namespace", "--git-dir", "--work-tree", "--exec-path"}
+
+
+def is_boundary(data):
+    tool = data.get("tool_name", "")
+    if tool.endswith("create_pull_request"):
+        return True
+    if tool != "Bash":
+        return False
+
+    cmd = (data.get("tool_input") or {}).get("command", "")
+    # Tokenize like a shell so `push` inside a quoted commit message or heredoc
+    # stays one token and is NOT mistaken for the push subcommand.
+    try:
+        tokens = shlex.split(cmd, comments=True)
+    except ValueError:
+        tokens = cmd.split()
+
+    for i, token in enumerate(tokens):
+        if token != "git" and not token.endswith("/git"):
+            continue
+        j = i + 1
+        while j < len(tokens):
+            tok = tokens[j]
+            if tok in GLOBAL_WITH_ARG:
+                j += 2
+            elif tok.startswith("-"):
+                j += 1
+            else:
+                break
+        if j < len(tokens) and tokens[j] == "push":
+            return True
+    return False
+
+
+def main():
+    try:
+        data = json.load(sys.stdin)
+    except Exception:
+        return 1
+    return 0 if is_boundary(data) else 1
+
+
+if __name__ == "__main__":
+    sys.exit(main())

.claude/hooks/orphan_strings_check.py

@@ -0,0 +1,87 @@
+#!/usr/bin/env python3
+"""Fail if any locale declares a string resource its default values/ no longer has.
+
+A key removed or renamed in a default `values/strings.xml` orphans every
+`values-<locale>/strings.xml` entry that still declares it. In an Android res
+tree that is an `[ExtraTranslation]` lint ERROR, which aborts
+`:amethyst:lint<Variant>` and with it the whole `test-and-build-android` CI job.
+
+Run directly, or via the pre-push-orphan-strings.sh hook that wraps it.
+Exits 0 when clean, 2 with a report when not.
+"""
+
+import glob
+import os
+import re
+import sys
+from collections import defaultdict
+
+# values-night, values-v29, values-sw600dp, ... are configuration qualifiers,
+# not locales; only locale-qualified dirs can hold a translation.
+LOCALE = re.compile(r"^values-(?:b\+[A-Za-z0-9+]+|[a-z]{2,3}(?:-r[A-Z]{2,3})?)$")
+NAMED = re.compile(r'<(?:string|plurals|string-array)\s+[^>]*name="([^"]+)"')
+
+# Both Crowdin-managed resource systems (see the find-missing-translations
+# skill, "Resource trees — scan BOTH"), each with what an orphan costs there.
+# Android res is the tree lint policies; the Compose-Multiplatform catalog is
+# not lint-checked, but an orphan there is the same authoring mistake and
+# leaves a dead translation behind.
+ROOTS = (
+    ("*/src/*/res/values", "Android lint [ExtraTranslation] error — aborts the build"),
+    ("*/src/*/composeResources/values", "dead translation — key no longer exists in the default catalog"),
+)
+
+
+def names(paths):
+    found = set()
+    for path in paths:
+        with open(path, encoding="utf-8") as handle:
+            found |= set(NAMED.findall(handle.read()))
+    return found
+
+
+def find_orphans():
+    orphans = defaultdict(list)  # (res_root, key, consequence) -> [locale, ...]
+    for pattern, consequence in ROOTS:
+        for default_dir in sorted(glob.glob(pattern)):
+            res_root = os.path.dirname(default_dir)
+            base = names(glob.glob(os.path.join(default_dir, "*.xml")))
+            for locale_dir in sorted(glob.glob(os.path.join(res_root, "values-*"))):
+                locale = os.path.basename(locale_dir)
+                if not LOCALE.match(locale):
+                    continue
+                extra = names(glob.glob(os.path.join(locale_dir, "*.xml"))) - base
+                for key in extra:
+                    orphans[(res_root, key, consequence)].append(locale[len("values-"):])
+    return orphans
+
+
+def main():
+    orphans = find_orphans()
+    if not orphans:
+        return 0
+
+    total = sum(len(v) for v in orphans.values())
+    out = sys.stderr
+    print(
+        f"BLOCKED: {total} orphaned translation(s) across {len(orphans)} key(s) — "
+        "translated in a locale, absent from that tree's default values/.",
+        file=out,
+    )
+    print(file=out)
+    for (res_root, key, consequence), locales in sorted(orphans.items()):
+        print(f"  {res_root}: {key!r} in {len(locales)} locale(s) — {consequence}", file=out)
+        print(f"      {' '.join(sorted(locales))}", file=out)
+    print(file=out)
+    print(
+        "A key removed or renamed in a default values/strings.xml must be deleted\n"
+        "from every values-*/strings.xml in the SAME commit. Crowdin's next sync is\n"
+        "not a cleanup step CI waits for — lint runs on the tree you push.\n"
+        "See amethyst/src/main/res/CLAUDE.md, 'Renaming or removing a string key'.",
+        file=out,
+    )
+    return 2
+
+
+if __name__ == "__main__":
+    sys.exit(main())

.claude/hooks/pre-push-orphan-strings.sh

@@ -0,0 +1,37 @@
+#!/bin/bash
+# PreToolUse gate: no locale string may outlive its default-locale key.
+#
+# Fires on `git push` (Bash tool) and on the create_pull_request MCP tool.
+# Delegates to orphan_strings_check.py, which compares every
+# `values-<locale>/*.xml` resource name against the union of names declared in
+# that tree's default `values/*.xml`. Anything present in a locale but absent
+# from the default is an orphan: in an Android res tree Android lint reports it
+# as an [ExtraTranslation] ERROR, which aborts `:amethyst:lint<Variant>` and
+# therefore the whole `test-and-build-android` CI job.
+#
+# Why a dedicated hook instead of "just run lint": `:amethyst:lintFdroidBenchmark`
+# takes ~19 minutes on a warm daemon, so nobody runs it per-commit. This check is
+# a directory scan and finishes in well under a second.
+#
+# Run the scan by hand any time with:  .claude/hooks/orphan_strings_check.py
+set -uo pipefail
+
+hook_dir="$(cd "$(dirname "$0")" && pwd)"
+cd "${CLAUDE_PROJECT_DIR:-.}" || exit 0
+
+# --- Is this call a push/PR boundary? ---
+payload="$(cat)"
+
+# Cheap pure-bash pre-filter before paying for a python spawn. The gate below
+# can only answer "yes" for a payload containing "push" (a git push command) or
+# "pull_request" (the create_pull_request MCP tool), so anything else is a
+# guaranteed no. This hook runs on EVERY Bash tool call, and the spawn it skips
+# costs ~35ms each time.
+case "$payload" in
+  *push*|*pull_request*) ;;
+  *) exit 0 ;;
+esac
+
+printf '%s' "$payload" | python3 "$hook_dir/lib/git_push_gate.py" || exit 0
+
+exec python3 "$hook_dir/orphan_strings_check.py"

.claude/hooks/pre-push-spotless.sh

@@ -9,48 +9,23 @@
 # so a clean apply means a green check.
 set -uo pipefail
 
+hook_dir="$(cd "$(dirname "$0")" && pwd)"
 cd "${CLAUDE_PROJECT_DIR:-.}" || exit 0
 
-# --- Parse the tool call off stdin; decide whether this call is a boundary. ---
+# --- Is this call a push/PR boundary? ---
 payload="$(cat)"
-should_gate="$(
-  printf '%s' "$payload" | python3 -c '
-import json, shlex, sys
-try:
-    data = json.load(sys.stdin)
-except Exception:
-    print("no"); sys.exit(0)
-tool = data.get("tool_name", "")
-if tool.endswith("create_pull_request"):
-    print("yes"); sys.exit(0)
-if tool != "Bash":
-    print("no"); sys.exit(0)
-cmd = (data.get("tool_input") or {}).get("command", "")
-# Tokenize like a shell so `push` inside a quoted commit message or heredoc
-# stays one token and is NOT mistaken for the push subcommand.
-try:
-    tokens = shlex.split(cmd, comments=True)
-except ValueError:
-    tokens = cmd.split()
-GLOBAL_WITH_ARG = {"-c", "-C", "--namespace", "--git-dir", "--work-tree", "--exec-path"}
-for i, t in enumerate(tokens):
-    if t != "git" and not t.endswith("/git"):
-        continue
-    j = i + 1
-    while j < len(tokens):  # skip git global options to reach the subcommand
-        tok = tokens[j]
-        if tok in GLOBAL_WITH_ARG:
-            j += 2; continue
-        if tok.startswith("-"):
-            j += 1; continue
-        break
-    if j < len(tokens) and tokens[j] == "push":
-        print("yes"); sys.exit(0)
-print("no")
-' 2>/dev/null
-)"
 
-[ "$should_gate" = "yes" ] || exit 0
+# Cheap pure-bash pre-filter before paying for a python spawn. The gate below
+# can only answer "yes" for a payload containing "push" (a git push command) or
+# "pull_request" (the create_pull_request MCP tool), so anything else is a
+# guaranteed no. This hook runs on EVERY Bash tool call, and the spawn it skips
+# costs ~35ms each time.
+case "$payload" in
+  *push*|*pull_request*) ;;
+  *) exit 0 ;;
+esac
+
+printf '%s' "$payload" | python3 "$hook_dir/lib/git_push_gate.py" || exit 0
 
 # Nothing to format if no Kotlin is tracked/changed at all — cheap early out.
 if ! git ls-files --error-unmatch '*.kt' '*.kts' >/dev/null 2>&1; then

.claude/settings.json

@@ -8,6 +8,11 @@
             "type": "command",
             "command": "$CLAUDE_PROJECT_DIR/.claude/hooks/pre-push-spotless.sh",
             "timeout": 180
+          },
+          {
+            "type": "command",
+            "command": "$CLAUDE_PROJECT_DIR/.claude/hooks/pre-push-orphan-strings.sh",
+            "timeout": 30
           }
         ]
       }

.claude/skills/find-missing-translations/SKILL.md

@@ -540,6 +540,7 @@ When adding translated strings to locale files:
 - **Pasting the union set of missing keys into every locale → duplicate keys** — the union is the right set to *translate*, but the wrong set to *insert*. A key missing in only some locales, inserted into all of them, duplicates in the ones that already had it. Drive each file's insertion off its own per-locale diff (see Step 6). In `commons`, a duplicate key is build-breaking: `convertXmlValueResourcesForCommonMain` fails with `Duplicated key '…'`. **Always run the post-insertion duplicate + XML-wellformedness gate in Step 6 before declaring done.** (Happened 2026-07-21 with `ps1_save_block` / `podcast_value_for_value` / `chats_history_relays`.)
 - **Declaring the pass done without running `:amethyst:lintPlayBenchmark`** — the duplicate-key + XML + `convertXmlValueResourcesForCommonMain` gate is necessary but nowhere near sufficient. `MissingQuantity` and `ImpliedQuantity` are errors, there is no lint baseline, and `abortOnError` is on, so a change that compiles and passes every check in Step 6's first half can still take CI red. Compiling is not evidence. (Happened 2026-08-13: 3 lint errors after a clean duplicate/XML gate and a green `compileFdroidDebugKotlin`.)
 - **Converting a `<string>` to `<plurals>` with `other` only** — "Crowdin fills the rest" is false; `MissingQuantity` errors immediately and CI fails before any sync. Supply every category the locale uses at conversion time, and re-check the declension rather than reusing the old text for `one`.
+- **Renaming or removing a key in `values/strings.xml` without deleting it from every locale in the same commit** — the surviving locale entries become orphans, and `ExtraTranslation` is an error. "Crowdin drops retired keys on its next sync" is the same false belief as the `other`-only shortcut above: lint runs on the tree you push. Worse, it's *partly* true — the sync cleans some locales and silently leaves others, so the files you happen to open look fine. Scan with the sub-second `.claude/hooks/orphan_strings_check.py` instead of the ~19-minute lint; see `amethyst/src/main/res/CLAUDE.md`, "Renaming or removing a string key". (Happened 2026-08-31: `route_video`/`new_short` left in 15 of 47 locales, 30 errors, red `main`.)
 - **Putting `tools:ignore` on a locale file** — Crowdin strips it on the next export. Suppressions belong on the source entry in `values/strings.xml`, which propagates. The `tools:ignore="Typos"` copies visible in cs/de/ar/eo/bn are the *result* of that propagation, not proof that locale-file attributes survive. (Happened 2026-08-13; it broke `main`.)
 - **Suppressing a lint rule on a key nothing references** — check `grep -rn "<key>" --include='*.kt'` first. `poll_results_voters` was a bare noun with no count, zero call sites, and an unlocalizable shape; deleting it retired the problem outright where a suppression would only have muted it.
 - **Comparing placeholders without a `(?<!\\)` guard** — `\%2$d` is an escaped literal to lint, but a naive `%\d+\$[sd]` regex matches the placeholder inside it and reports the string clean. A parity sweep missing this guard will certify a broken translation. Also treat a *repeated* index (`%1$s` twice where the base has it once) as legitimate — German does this where English says "They".

.claude/skills/find-non-lambda-logs/SKILL.md

@@ -1,16 +1,17 @@
 ---
 name: find-non-lambda-logs
-description: Use when auditing or migrating Log calls — flags both interpolated Log.d/i/w/e that should use the lambda overload (allocation hygiene) and catch-block Log.w/e that interpolate ${e.message} but drop the throwable (lost stack traces)
+description: Use when auditing or migrating Log calls — flags interpolated Log.d/i/w/e that should use the lambda overload (allocation hygiene), catch-block Log.w/e that interpolate ${e.message} but drop the throwable (lost stack traces), and files still importing android.util.Log (no lambda overload, bypasses Log.minLevel)
 ---
 
 # Find Non-Lambda Log Calls
 
 ## Overview
 
-Two related logging hygiene issues:
+Three related logging hygiene issues:
 
 1. **Lambda overload missing.** `Log.d/i/w/e` calls that use string interpolation without the lambda overload waste string allocation when the log level is filtered out in release builds.
 2. **Throwable dropped in catch blocks.** `Log.w/e` calls inside `catch (e: ...)` blocks that interpolate `${e.message}` but don't pass `e` lose the stack trace, and log nothing useful when `e.message` is null (NPE, IOException with no message, etc.).
+3. **Still on `android.util.Log`.** Files importing the platform logger bypass `Log.minLevel` and the `LogSink`, and have no lambda overload — so neither fix above can be applied to them. Step 0 finds these; the last section migrates them.
 
 ## When to Use
 
@@ -39,6 +40,54 @@ Log.d("Tag", "Initialization complete")
 
 **Important:** Tags can be string literals (`"Tag"`) or variables (`tag`, `LOG_TAG`). Run both patterns for each step.
 
+**The throwable-name alternation, used by Steps 2 and 3** — define it once and reuse it, rather than writing a shorter list in one step and a longer one in another:
+
+```bash
+THROWABLE='(e|t|it|ex|err|error|throwable|cause|tr)'
+```
+
+**Filter the noise before counting**, or the totals mislead: drop `/build/`, `/androidTest/` and `/src/test/` (release filtering doesn't apply to tests), and drop lines whose first non-space character is `//` or `*` — commented-out calls and KDoc examples both match these patterns. A `grep -vE ':[0-9]+: *(//|\*)'` handles the last one.
+
+### Step 0: Find files still on `android.util.Log` (run this first)
+
+**Two patterns — the fully-qualified one alone is a false negative.** Almost nobody writes `android.util.Log.w(...)` at the call site; they `import android.util.Log` and then write `Log.w(...)`, which is indistinguishable from the wrapper by call shape. The import is the reliable signal:
+
+```bash
+# the form that actually occurs
+grep -rln --include='*.kt' '^import android\.util\.Log$' . | grep -v '/build/' | grep -v PlatformLog
+
+# the rare fully-qualified call
+grep -rnE --include='*.kt' 'android\.util\.Log\.(d|i|w|e|v)\(' . | grep -v '/build/' | grep -v PlatformLog
+```
+
+On 2026-08-28 the fully-qualified pattern reported **0** while the import pattern found **16 production files** (9 in `nappletHost`, the rest in amethyst's `favorites/` and `napplet/`). Exclude `PlatformLog.android.kt`, which is the wrapper implementation and must call `android.util.Log`.
+
+These bypass the `Log.minLevel` filter and the `LogSink` indirection entirely, and — the practical consequence for this skill — **they have no lambda overload**, so Steps 1–3 cannot be applied to them until they are migrated. Subtract these files from the Step 1–3 candidate lists, or migrate them first (see the last section).
+
+### Step 0b: The patterns are line-anchored — sweep multi-line calls separately
+
+Every `pattern:` in Steps 1–3 matches a call written on one line. A call formatted as
+
+```kotlin
+Log.d(
+    TAG,
+    "WASTE ${url.url} dials=${r.tentatives.get()} " +
+        "fail=[${r.failures.entries.joinToString { … }}]",
+)
+```
+
+is **structurally invisible** to them. That biases the audit towards short calls and away from expensive ones — the multi-line form is what long, heavily interpolated messages look like, and those are exactly the ones worth deferring. A 2026-08-28 sweep converted three one-line banner calls in `BootRelayDiagnostics.kt` while walking past two `Log.d` calls in `forEach` loops immediately below them, running 25 and 20 iterations per census with nested `joinToString` in each — strictly the larger cost, three lines away.
+
+Catch them with the open-paren-at-EOL form, then read each hit:
+
+```bash
+grep -rnE --include='*.kt' 'Log\.[diwe]\($' . | grep -v '/build/'
+# or, to see the whole call:
+rg -U --multiline --type kotlin 'Log\.[diwe]\(\n[^)]*\$\{'
+```
+
+**Prioritise call sites inside loops over one-liners.** A `Log.d` in a 25-iteration `forEach` discards 25 built strings per pass; a one-line banner discards one.
+
 ### Step 1: Find interpolated Log.d/Log.i (highest priority — filtered in release)
 
 ```
@@ -61,7 +110,14 @@ pattern: Log\.(w|e)\(\w+,\s*"[^"]*\$
 type: kotlin
 ```
 
-Then **manually exclude** lines where a throwable is passed as third argument (ending with `, e)`, `, throwable)`, etc.). Check the actual line — a catch block catching `e` doesn't mean `e` is passed to the Log call.
+Then **manually exclude** lines where a throwable is passed as third argument. Check the actual line — a catch block catching `e` doesn't mean `e` is passed to the Log call.
+
+**`it` is the name you will miss.** `Result.onFailure { ... }` is the dominant shape in this repo, so most correct calls end `, it)`, not `, e)`. Excluding only `e`/`throwable` inflates the result badly — a 2026-08-28 pass reported 23 hits where the real number was 8, because 14 of them were `.onFailure { Log.w(TAG, "...", it) }` and already correct. Also note the throwable is not always last on the line (`}.onFailure { Log.w(...) }.getOrDefault(false)`), so anchoring the exclusion to `$` misses them:
+
+```bash
+grep -rnE --include='*.kt' 'Log\.(w|e)\([^,]+,\s*"[^"]*\$' . \
+  | grep -vE ",\s*$THROWABLE\)"      # note: no $ anchor, and `it` included
+```
 
 ### Step 3: Find catch-block Log.w/e that drop the throwable
 
@@ -70,23 +126,14 @@ Among the Step 2 hits, the calls that interpolate `${e.message}` (or `${t.messag
 Quick filter:
 
 ```
-pattern: Log\.(w|e)\([^)]*\$\{(e|t|throwable|cause)\.message\}[^)]*\)$
+pattern: Log\.(w|e)\([^)]*\$\{(e|t|it|ex|err|throwable|cause)\.message\}
 type: kotlin
 ```
 
-Then for each hit, open the file and confirm the line is **inside a `catch (e: ...)` block** and **does not pass `e` (or the matching name) as a third argument**. False positives: extension functions / helpers that accept an `e: SomeError` parameter and forward it elsewhere.
+Note this deliberately omits the `\)$` anchor and includes `it` — same reasons as Step 2. Then for each hit, open the file and confirm the line is **inside a `catch (e: ...)` block** and **does not pass `e` (or the matching name) as a third argument**. False positives: extension functions / helpers that accept an `e: SomeError` parameter and forward it elsewhere.
 
 Both Step 2 and Step 3 may flag the same line — handle Step 3 first (different fix), then apply Step 2 to whatever remains.
 
-### Step 4: Verify no android.util.Log leakage
-
-```
-pattern: android\.util\.Log\.(d|i|w|e|v)\(
-type: kotlin
-```
-
-These bypass the `Log.minLevel` filter entirely. Exclude `PlatformLog.android.kt` which is the wrapper implementation.
-
 ## Fix Patterns
 
 ### Lambda overload (Step 1 + Step 2)
@@ -106,7 +153,7 @@ Switch to `(tag, msg, throwable)` — the lambda overload does **not** accept a
 ```kotlin
 // Before — stack trace lost, prints "...failed: null" if e.message is null
 try { groupManager.clearAllState() } catch (e: Exception) {
-    Log.w("MarmotManager") { "clearAllState failed: ${e.message}" }
+    Log.w("MarmotManager", "clearAllState failed: ${e.message}")
 }
 
 // After — full stack trace logged
@@ -120,6 +167,25 @@ Trade-off: the message string is allocated eagerly even when warn is filtered, b
 ## Do NOT Convert
 
 - **To lambda:** calls passing a `Throwable` parameter — the lambda overload `(tag) { message }` has no throwable parameter.
+- **To lambda: any call in a file that imports `android.util.Log`.** The platform `Log` has no lambda overload, so the conversion fails to compile with `None of the following candidates is applicable`. Either migrate the file first (below) or leave the call alone. (Hit on 2026-08-28: three edits in two files had to be reverted.)
 - Static string calls with no `$` interpolation — no allocation benefit.
 - Commented-out log calls.
 - Informational/intentional log of `e.message` *outside* a catch block (rare; usually means the exception was already handled and only the message is meaningful).
+
+## Migrating a file off `android.util.Log`
+
+This is what unlocks Steps 1–3 for the files Step 0 finds. It is a behaviour change, so check it rather than assuming — but in this repo the check has come out safe, and here is the reasoning to redo:
+
+1. **Which levels does the file use?** `grep -hoE 'Log\.[a-zA-Z]+' <files> | sort | uniq -c`. The wrapper has `d/i/w/e` only — **no `v`**, and no `getStackTraceString`. A `Log.v` call has no direct equivalent and needs a decision, not a rename.
+2. **Would the gate drop them?** `LogLevel { DEBUG, INFO, WARN, ERROR }`, the gate is `minLevel <= <level>`, and `Amethyst.DEFAULT_LOG_LEVEL` is INFO in debug, **WARN in release** (deliberately — so relay-protocol refusals stay visible in the field). The wrapper's own default is `DEBUG`. So `Log.w` and `Log.e` survive in every build type and in every process, including before `Amethyst.init` runs — which matters for `:napplet`. `Log.d`/`Log.i` **would** go silent in release; those need a conscious call.
+3. **Does the output move?** No. `PlatformLogSink` on Android delegates to `android.util.Log`, so lines land in logcat unchanged.
+4. **Can the module see quartz?** `nappletHost` already has `implementation(project(":quartz"))`. Check before assuming.
+
+Then: swap `import android.util.Log` → `import com.vitorpamplona.quartz.utils.Log`, run `./gradlew spotlessApply` (import order changes), and convert only the interpolated no-throwable calls to the lambda form. Calls that already pass a throwable keep the eager three-arg shape — the wrapper's `w(tag, msg, throwable)` matches exactly, so only the import moves.
+
+**Verify the throwables survived**, since a careless rewrite can drop the third argument silently:
+
+```bash
+grep -hoE 'Log\.[diwe]\([^)]*,\s*(e|it)\)' <files> | wc -l   # compare before/after
+```
+

.claude/skills/searchable-events/references/searchable-kinds.md

@@ -2,9 +2,9 @@
 
 Every concrete `SearchableEvent` implementor in Quartz, with the exact `indexableContent()`
 expression. **Update this file in the same PR as any change to the searchable set or to an
-`indexableContent()` body** (see SKILL.md). Verified against the code 2026-08-04.
+`indexableContent()` body** (see SKILL.md). Verified against the code 2026-08-25.
 
-Counts: 126 concrete classes covering 129 kind values (`GitStatusEvent` spans 4 kinds;
+Counts: 130 concrete classes covering 133 kind values (`GitStatusEvent` spans 4 kinds;
 kind 30063 has a collision — see the footnote). File paths are under
 `quartz/src/commonMain/kotlin/com/vitorpamplona/quartz/`.
 
@@ -100,6 +100,10 @@ Separator legend: **NL** = `joinToString("\n")`, **SP** = `joinToString(" ")`.
 | 30313 | MeetingRoomEvent | nip53LiveActivities/meetingSpaces | `listOfNotNull(title(), summary())` NL |
 | 30315 | StatusEvent | nip38UserStatus | `content` |
 | 30382 | ContactCardEvent | nip85TrustedAssertions/users | `(listOfNotNull(petName(), summary()) + topics())` NL — public tags only, never the NIP-44 content |
+| 30392 | UserTrustedListEvent | experimental/trustedLists/users | inherited `TrustedListEvent`: `title() ?: ""` — the label only; `metric`/`d` are machine ids and `content` is a JSON echo of the membership |
+| 30393 | EventTrustedListEvent | experimental/trustedLists/events | inherited `TrustedListEvent`: `title() ?: ""` |
+| 30394 | AddressableTrustedListEvent | experimental/trustedLists/addressables | inherited `TrustedListEvent`: `title() ?: ""` |
+| 30395 | ExternalIdTrustedListEvent | experimental/trustedLists/externalIds | inherited `TrustedListEvent`: `title() ?: ""` |
 | 30402 | ClassifiedsEvent | nip99Classifieds | `listOfNotNull(title(), summary(), content)` NL |
 | 30617 | GitRepositoryEvent | nip34Git/repository | `listOfNotNull(name(), description(), content)` NL |
 | 30620 | WorkflowDefEvent | buzz/workflow | `listOfNotNull(name(), content)` NL |
@@ -150,6 +154,7 @@ declares `KIND = 30063` and implements `SearchableEvent` (`content`), but `Event
 | `InteractiveStoryBaseEvent` | `listOfNotNull(title(), summary(), content)` NL | 30296, 30297 |
 | `AddressableVideoEvent` | `listOfNotNull(title(), content)` NL | 34235, 34236 |
 | `RegularVideoEvent` | `listOfNotNull(title(), content)` NL | 21, 22 |
+| `TrustedListEvent` | `title() ?: ""` | 30392, 30393, 30394, 30395 |
 
 ## How to regenerate / verify this table
 

.github/workflows/build.yml

@@ -21,8 +21,11 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v7
 
+      - name: Orphaned translations (no locale string may outlive its default key)
+        run: .claude/hooks/orphan_strings_check.py
+
       - name: Set up JDK 21
-        uses: actions/setup-java@v5.7.0
+        uses: actions/setup-java@v6.0.0
         with:
           distribution: 'temurin'
           java-version: 21
@@ -69,7 +72,7 @@ jobs:
         uses: actions/checkout@v7
 
       - name: Set up JDK 21
-        uses: actions/setup-java@v5.7.0
+        uses: actions/setup-java@v6.0.0
         with:
           distribution: 'temurin'
           java-version: 21
@@ -94,6 +97,39 @@ jobs:
             $CMD
           fi
 
+      # This job runs five test suites (:quartz, :commons, :nestsClient, :cli,
+      # :desktopApp) but, unlike test-geode / test-quartz-ios /
+      # test-and-build-android, published nothing when one of them failed. The
+      # console line names the failing test and the exception class and stops
+      # there, so the message is lost with the runner. That is how the
+      # NostrClientNegentropySyncTest failure in run 10540 became
+      # undiagnosable: NegentropySyncException carries a `detail` naming which
+      # branch fired (connect timeout / idle silence / NEG-ERR / disconnect),
+      # and nobody could read it. Same action and pin as the Android job below.
+      - name: Desktop Test Report
+        uses: mikepenz/action-junit-report@a9170d5795813c01ab4901ffb045b52bab4ab09d # v6.5.0
+        if: always()
+        with:
+          report_paths: '**/build/test-results/**/TEST-*.xml'
+          annotate_only: true
+          detailed_summary: true
+          fail_on_failure: true
+
+      # The HTML reports carry the full stack traces and stdout/stderr the
+      # annotations truncate. Named per-OS because the three matrix legs upload
+      # into the same run and artifact names must be unique.
+      - name: Upload Desktop Test Reports
+        uses: actions/upload-artifact@v7
+        if: failure()
+        with:
+          name: Desktop Test Reports (${{ matrix.os }})
+          path: |
+            quartz/build/reports/tests
+            commons/build/reports/tests
+            nestsClient/build/reports/tests
+            cli/build/reports/tests
+            desktopApp/build/reports/tests
+
       # jpackage pins libicu to the build host's version (libicu74 on
       # ubuntu-24.04). Rewrite the .deb so testers on other Debian/Ubuntu
       # releases can install the uploaded artifact.
@@ -126,7 +162,7 @@ jobs:
         uses: actions/checkout@v7
 
       - name: Set up JDK 21
-        uses: actions/setup-java@v5.7.0
+        uses: actions/setup-java@v6.0.0
         with:
           distribution: 'temurin'
           java-version: 21
@@ -158,6 +194,64 @@ jobs:
           name: geode Test Reports
           path: geode/build/reports
 
+  # Until this job existed nothing ran the linuxX64 target at all — it was compiled by
+  # no CI leg. That is how a copy-on-write LargeCache with O(n) writes and a non-atomic
+  # read-copy-write (concurrent writers silently dropped entries) sat in the tree
+  # unnoticed, and how TestResourceLoader stayed a TODO() that failed every vector-driven
+  # suite on the target.
+  #
+  # Runs the whole :quartz suite on a Linux Native frontend, which also catches a
+  # commonMain or commonTest source reaching for a JVM-only API on a target that, unlike
+  # Apple, has no Foundation to fall back on.
+  test-quartz-linux-native:
+    needs: lint
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+
+      - name: Set up JDK 21
+        uses: actions/setup-java@v6.0.0
+        with:
+          distribution: 'temurin'
+          java-version: 21
+
+      - name: Set up Gradle
+        uses: gradle/actions/setup-gradle@v6
+        with:
+          cache-read-only: ${{ github.ref != 'refs/heads/main' }}
+
+      # The Kotlin/Native toolchain (compiler distribution + LLVM + the sysroot) lands
+      # in ~/.konan, which setup-gradle does not cache. Without this the job re-downloads
+      # well over a gigabyte on every run. Keyed on the version catalog so a Kotlin bump
+      # re-populates it.
+      - name: Cache Kotlin/Native toolchain
+        uses: actions/cache@v4
+        with:
+          path: ~/.konan
+          key: konan-${{ runner.os }}-${{ hashFiles('gradle/libs.versions.toml') }}
+          restore-keys: konan-${{ runner.os }}-
+
+      - name: Test Quartz on Linux Native
+        run: ./gradlew :quartz:linuxX64Test
+
+      - name: Linux Native Test Report
+        uses: mikepenz/action-junit-report@a9170d5795813c01ab4901ffb045b52bab4ab09d # v6.5.0
+        if: always()
+        with:
+          report_paths: 'quartz/build/test-results/linuxX64Test/TEST-*.xml'
+          annotate_only: true
+          detailed_summary: true
+          fail_on_failure: true
+
+      - name: Upload Linux Native Test Reports
+        uses: actions/upload-artifact@v7
+        if: failure()
+        with:
+          name: Quartz Linux Native Test Reports
+          path: quartz/build/reports
+
   test-quartz-ios:
     # Phase 1 of the iOS support plan
     # (amethyst/plans/2026-05-24-ios-support.md): keep :quartz green on iOS
@@ -173,7 +267,7 @@ jobs:
         uses: actions/checkout@v7
 
       - name: Set up JDK 21
-        uses: actions/setup-java@v5.7.0
+        uses: actions/setup-java@v6.0.0
         with:
           distribution: 'temurin'
           java-version: 21
@@ -232,7 +326,7 @@ jobs:
         uses: actions/checkout@v7
 
       - name: Set up JDK 21
-        uses: actions/setup-java@v5.7.0
+        uses: actions/setup-java@v6.0.0
         with:
           distribution: 'temurin'
           java-version: 21
@@ -289,7 +383,7 @@ jobs:
       # GITHUB_TOKEN is read-only). fail_on_failure preserves the old step's
       # behavior of marking the job red when a test fails.
       - name: Android Test Report
-        uses: mikepenz/action-junit-report@d9f48fc87bc235f7e214acf696ca5abc0a986f16 # v6.4.2
+        uses: mikepenz/action-junit-report@a9170d5795813c01ab4901ffb045b52bab4ab09d # v6.5.0
         if: always()
         with:
           report_paths: '**/build/test-results/**/TEST-*.xml'

.github/workflows/bump-homebrew-geode-formula.yml

@@ -3,11 +3,11 @@ name: Bump Homebrew Formula (geode relay)
 # Sibling of bump-homebrew-formula.yml (the amy CLI). Same mechanism, different
 # artifact:
 #   - bump-homebrew-formula.yml       -> Formula `amy`   (the headless CLI)
-#   - this workflow                   -> Formula `geode` (the standalone relay)
+#   - this workflow                   -> Formula `geode-relay` (the standalone relay)
 #
 # After a stable release, download the published `geode-<version>-jvm.tar.gz`
 # bundle, compute its sha256, and open a PR that syncs
-# `geode/packaging/homebrew/geode.rb`'s url + sha256 to that release. Keeping the
+# `geode/packaging/homebrew/geode-relay.rb`'s url + sha256 to that release. Keeping the
 # in-repo reference formula accurate makes the eventual homebrew-core submission a
 # copy-paste.
 #
@@ -101,7 +101,7 @@ jobs:
       - name: Update reference formula
         run: |
           set -euo pipefail
-          FORMULA=geode/packaging/homebrew/geode.rb
+          FORMULA=geode/packaging/homebrew/geode-relay.rb
           URL="${{ steps.asset.outputs.url }}"
           SHA="${{ steps.asset.outputs.sha256 }}"
           # Rewrite the two indented lines in the formula block. Anchoring on the
@@ -119,11 +119,11 @@ jobs:
           token: ${{ secrets.GITHUB_TOKEN }}
           base: main
           branch: chore/bump-geode-formula-${{ steps.rel.outputs.tag }}
-          add-paths: geode/packaging/homebrew/geode.rb
+          add-paths: geode/packaging/homebrew/geode-relay.rb
           commit-message: 'chore: sync geode Homebrew formula to ${{ steps.rel.outputs.tag }}'
           title: 'chore: sync geode Homebrew formula to ${{ steps.rel.outputs.tag }}'
           body: |
-            Auto-synced `geode/packaging/homebrew/geode.rb` to the
+            Auto-synced `geode/packaging/homebrew/geode-relay.rb` to the
             `${{ steps.rel.outputs.tag }}` release:
 
             - `url`    -> `${{ steps.asset.outputs.url }}`
@@ -158,7 +158,7 @@ jobs:
                 ``,
                 `Recovery options:`,
                 `1. Re-run the workflow once the underlying issue is fixed`,
-                `2. Manually update \`geode/packaging/homebrew/geode.rb\` (url + sha256) from the release asset`,
+                `2. Manually update \`geode/packaging/homebrew/geode-relay.rb\` (url + sha256) from the release asset`,
                 `3. Check the release actually published \`geode-${tag.replace(/^v/, '')}-jvm.tar.gz\``
               ].join('\n'),
               labels: ['release-ops', 'bug']

.github/workflows/bump-homebrew.yml

@@ -1,7 +1,7 @@
 name: Sync Homebrew Cask Reference
 
 # Sibling of bump-homebrew-formula.yml (amy) and bump-homebrew-geode-formula.yml
-# (geode). Same mechanism, third artifact:
+# (geode-relay). Same mechanism, third artifact:
 #   - this workflow -> Cask `amethyst-nostr` (the desktop GUI app / DMG)
 #
 # What it does: after a stable release, download the published macOS DMG, assert

.github/workflows/bump-winget.yml

@@ -2,7 +2,7 @@ name: Sync Winget Manifest Reference
 
 # Fourth sibling of the three Homebrew sync workflows, same shape:
 #   bump-homebrew-formula.yml       -> Formula `amy`
-#   bump-homebrew-geode-formula.yml -> Formula `geode`
+#   bump-homebrew-geode-formula.yml -> Formula `geode-relay`
 #   bump-homebrew.yml               -> Cask    `amethyst-nostr`
 #   this workflow                   -> Winget  `VitorPamplona.Amethyst`
 #

.github/workflows/create-release.yml

@@ -78,7 +78,7 @@ jobs:
         uses: actions/checkout@v7
 
       - name: Set up JDK 21
-        uses: actions/setup-java@v5.7.0
+        uses: actions/setup-java@v6.0.0
         with:
           distribution: 'temurin'
           java-version: 21
@@ -344,7 +344,7 @@ jobs:
 
       - name: Upload to GH Release (skip on dry-run)
         if: github.event_name != 'workflow_dispatch' || github.event.inputs.dry_run != 'true'
-        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228  # v3.0.2
+        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64  # v3.0.3
         with:
           files: dist/*
           tag_name: ${{ steps.ver.outputs.tag }}
@@ -405,7 +405,7 @@ jobs:
         uses: actions/checkout@v7
 
       - name: Set up JDK 21
-        uses: actions/setup-java@v5.7.0
+        uses: actions/setup-java@v6.0.0
         with:
           distribution: 'temurin'
           java-version: 21
@@ -604,7 +604,7 @@ jobs:
 
       - name: Upload to GH Release (skip on dry-run)
         if: github.event_name != 'workflow_dispatch' || github.event.inputs.dry_run != 'true'
-        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228  # v3.0.2
+        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64  # v3.0.3
         with:
           files: dist/*
           tag_name: ${{ steps.ver.outputs.tag }}
@@ -662,7 +662,7 @@ jobs:
         uses: actions/checkout@v7
 
       - name: Set up JDK 21
-        uses: actions/setup-java@v5.7.0
+        uses: actions/setup-java@v6.0.0
         with:
           distribution: 'temurin'
           java-version: 21
@@ -864,7 +864,7 @@ jobs:
 
       - name: Upload to GH Release (skip on dry-run)
         if: github.event_name != 'workflow_dispatch' || github.event.inputs.dry_run != 'true'
-        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228  # v3.0.2
+        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64  # v3.0.3
         with:
           files: dist/*
           tag_name: ${{ steps.ver.outputs.tag }}
@@ -953,7 +953,7 @@ jobs:
         uses: actions/checkout@v7
 
       - name: Set up JDK 21
-        uses: actions/setup-java@v5.7.0
+        uses: actions/setup-java@v6.0.0
         with:
           distribution: 'temurin'
           java-version: 21
@@ -1097,7 +1097,7 @@ jobs:
           fi
 
       - name: Upload Android assets to GH Release
-        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228  # v3.0.2
+        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64  # v3.0.3
         with:
           files: dist/*
           tag_name: ${{ github.ref_name }}

.github/workflows/smoke-test-desktop.yml

@@ -28,7 +28,7 @@ jobs:
         uses: actions/checkout@v7
 
       - name: Set up JDK 21
-        uses: actions/setup-java@v5.7.0
+        uses: actions/setup-java@v6.0.0
         with:
           distribution: 'temurin'
           java-version: 21
@@ -66,7 +66,7 @@ jobs:
         uses: actions/checkout@v7
 
       - name: Set up JDK 21
-        uses: actions/setup-java@v5.7.0
+        uses: actions/setup-java@v6.0.0
         with:
           distribution: 'temurin'
           java-version: 21

BUILDING.md

@@ -533,7 +533,7 @@ reads an optional per-release changelog from
 
 ## Bootstrap runbook (one-time)
 
-> **Status as of v1.14.0: neither Homebrew nor Winget has been bootstrapped.**
+> **Status as of v1.14.0:** Winget has been submitted — [microsoft/winget-pkgs#422752](https://github.com/microsoft/winget-pkgs/pull/422752), pending CLA + review. Neither Homebrew package (`amethyst-nostr` cask, `amy` formula) has been submitted yet.
 > `https://formulae.brew.sh/api/cask/amethyst-nostr.json` and
 > `microsoft/winget-pkgs/manifests/v/VitorPamplona/Amethyst` both 404, so
 > **Amethyst does not currently ship through either channel.** The bump
@@ -618,15 +618,33 @@ that is needed.
 
 ### Homebrew cask (one-time initial PR)
 
+> `brew bump-cask-pr` **cannot** do this step. It *updates* an existing cask —
+> against a name that isn't in the tap yet it fails outright:
+> `Error: Cask 'amethyst-nostr' is unavailable: No Cask with this name exists.`
+> The first submission is a **new-cask** PR, which is a different flow:
+
 ```bash
-brew bump-cask-pr amethyst-nostr \
-  --version 1.12.1 \
-  --url "https://github.com/vitorpamplona/amethyst/releases/download/v1.12.1/amethyst-desktop-1.12.1-macos-arm64.dmg"
+# 1. Scaffold from the published DMG (macOS arm64 — there is no Intel DMG)
+brew create --cask \
+  https://github.com/vitorpamplona/amethyst/releases/download/v1.14.0/amethyst-desktop-1.14.0-macos-arm64.dmg \
+  --set-name amethyst-nostr
+
+# 2. Fill in the cask body, then audit as a NEW cask (stricter than a bump)
+brew audit --new --cask amethyst-nostr
+brew install --cask amethyst-nostr        # verify it actually installs
+brew uninstall --cask amethyst-nostr
+
+# 3. Open the PR against Homebrew/homebrew-cask by hand
 ```
 
+The DMG **must be notarized and stapled** or Homebrew will reject it; verify
+with `spctl -a -t open --context context:primary-signature -v <dmg>` before
+submitting.
+
 The cask filename is `amethyst-nostr` (not `amethyst` — that's taken by a
 tiling window manager). After the first PR is merged, `bump-homebrew.yml`
-auto-submits new version bumps on each stable release.
+auto-submits new version bumps on each stable release — *that* is where
+`brew bump-cask-pr` applies.
 
 > **The desktop app is already on mainline Homebrew.** `homebrew/cask` *is* the
 > mainline cask repo — GUI apps live in homebrew-**cask**, CLIs in

CONTRIBUTING-WITH-AI.md

@@ -186,6 +186,13 @@ device. PRs that introduce any of them will be sent back.
   body only runs when the log level is enabled. Plain
   `Log.d("msg $x")` allocates the formatted string on every call,
   including in feed and scroll hot paths.
+- **Never `import android.util.Log`.** The platform logger bypasses
+  `Log.minLevel` and the `LogSink`, and it has no lambda overload, so
+  the rule above cannot be applied at those call sites. The one
+  legitimate user is `PlatformLog.android.kt`, which implements the
+  wrapper. A call that must pass a throwable uses the eager three-arg
+  form `Log.w(tag, "msg", e)` — the lambda overload takes no throwable,
+  and dropping it to keep the lambda loses the stack trace.
 - **Strip diagnostic `Log.d` calls before commit.** Logs added
   during on-device debugging — even lambda-form ones — must be
   removed from the production diff. They survive R8 stripping only

RELEASE_OPS.md

@@ -101,15 +101,20 @@ git -c credential.helper= -c credential.helper='!gh auth git-credential' push up
 ```
 
 When the `Create Release Assets` workflow finishes (~25–30 min) the GH Release
-holds **31 assets**, per the asset-name contract:
+holds **47 assets**, per the asset-name contract:
 
 - **Android (13):** 5 Google Play APKs + 5 F-Droid APKs + 2 AABs + the F-Droid
   `.apks` set for Accrescent
   (`amethyst-googleplay-*-v…apk` / `.aab`, `amethyst-fdroid-*-v…apk` / `.aab` / `.apks`)
-- **Desktop (8):** DMG (macOS **arm64 only** — there is no Intel DMG),
-  MSI + zip, DEB, RPM, AppImage, flatpak, tar.gz
-- **CLI (5):** the `amy` artifacts
-- **Relay (5):** the `geode` artifacts, plus the geode Docker image
+- **Desktop (14):** macOS DMG (**arm64 only** — there is no Intel DMG), Windows
+  MSI (x64 only — **no arm64 MSI**) + portable zip (x64, arm64), and Linux
+  DEB/RPM/AppImage/flatpak/tar.gz in both x64 and arm64. BUILDING.md § Release
+  runbook has the per-leg breakdown and why the two gaps exist.
+- **CLI (10):** the `amy` artifacts — the no-JRE `jvm.tar.gz`, macOS arm64,
+  Windows x64 + arm64, and Linux DEB/RPM/tar.gz in both x64 and arm64
+- **Relay (10):** the `geode` artifacts, same matrix as `amy`. The geode Docker
+  image is **not** a release asset — it goes to the registry, so don't count it
+  here.
 - **Maven Central:** `com.vitorpamplona.quartz:quartz:<version>` published.
   `repo1.maven.org` lags the publish by tens of minutes — a 404 right after the
   run is normal. Confirm the step's log says "Deployment is being published to
@@ -121,8 +126,9 @@ holds **31 assets**, per the asset-name contract:
 ## 3. Per-channel shipping
 
 ### GitHub Releases — automatic
-Nothing to do beyond pushing the tag. Verify the asset count and that Intel +
-ARM DMGs are both present (BUILDING.md § Verify).
+Nothing to do beyond pushing the tag. Verify the asset count (BUILDING.md
+§ Verify). macOS is **arm64-only** — there is no Intel DMG, so a single
+`amethyst-desktop-<version>-macos-arm64.dmg` is the expected, correct result.
 
 ### Google Play — manual upload
 1. Download `amethyst-googleplay-<version>.aab` from the GH Release.
@@ -177,7 +183,7 @@ when unset. To fan the release event out to more relays for discoverability,
 set `RELAY_URLS` for the run:
 
 ```bash
-RELAY_URLS="wss://relay.zapstore.dev,wss://relay.damus.io,wss://nos.lol,wss://vitor.nostr1.com" \
+RELAY_URLS="wss://relay.zapstore.dev,wss://nos.lol,wss://nostr.mom,wss://vitor.nostr1.com" \
   SIGN_WITH=<amethyst-nsec> zsp publish
 ```
 
@@ -188,10 +194,22 @@ itself reads from.
 
 `bump-homebrew.yml` and `bump-winget.yml` are wired to open PRs against
 `Homebrew/homebrew-cask` (cask `amethyst-nostr`) and `microsoft/winget-pkgs`
-(`VitorPamplona.Amethyst`) — but **neither package has ever been submitted
-upstream**, so both workflows detect that and skip with a `::warning::`. As of
-**v1.14.0** these two channels deliver nothing; macOS and Windows users get the
-desktop app from GitHub Releases only.
+(`VitorPamplona.Amethyst`). Both can only *update* a package that already
+exists upstream, so until the one-time bootstrap lands they detect the absence
+and skip with a `::warning::`.
+
+Bootstrap status:
+
+| Channel | Upstream package | State |
+|---|---|---|
+| **Winget** | `microsoft/winget-pkgs` → `VitorPamplona.Amethyst` | **Submitted at v1.14.0** — [PR #422752](https://github.com/microsoft/winget-pkgs/pull/422752), pending CLA + review |
+| **Homebrew cask** | `Homebrew/homebrew-cask` → `amethyst-nostr` | Not submitted |
+| **Homebrew formula** | `Homebrew/homebrew-core` → `amy` | Not submitted |
+
+Until each lands, that channel delivers nothing and macOS/Windows users get the
+desktop app from GitHub Releases only. Re-check before assuming — the state
+above is a snapshot, and `gh api repos/microsoft/winget-pkgs/contents/manifests/v/VitorPamplona`
+(404 = still absent) answers it in one call.
 
 Two separate faults kept this invisible until v1.13.1, both now fixed:
 
@@ -283,7 +301,7 @@ Owner assignments and rotation reminders live with the team (issue tracker).
 
 ## 6. Post-release verification
 
-- [ ] GH Release: 31 assets, sizes sane, and the asset-name set matches the
+- [ ] GH Release: 47 assets, sizes sane, and the asset-name set matches the
       previous release (see the `diff` one-liner in BUILDING.md § Release
       runbook). macOS is arm64-only — do **not** look for an Intel DMG.
 - [ ] Maven Central: `quartz:<version>` resolves (allow tens of minutes of

amethyst/plans/2026-08-25-compose-ime-inset-wedge-upstream.md

@@ -0,0 +1,379 @@
+# Upstream issue draft — Compose `WindowInsets.ime` permanently wedges after a cancelled IME animation
+
+Target: Google IssueTracker → **component 612128 (Jetpack Compose)**.
+The library-specific component the docs link to (856989, from the "Create a new issue" button on
+the Compose Foundation release notes) does not grant public Create Issues permission, so this is
+filed one level up with a routing request at the top of the body.
+
+Status: **FILED as https://issuetracker.google.com/issues/552500419 (b/552500419)** on 2026-08-25,
+against component 612128 with a routing request. Remaining open item: the AOSP commit that introduced `runningAnimation`
+between 1.3.0 and 1.4.0-alpha01 has not been identified (android.googlesource.com returned 403
+to automated fetch). Adding the commit link before filing would help triage.
+
+---
+
+## Title
+
+`WindowInsets.ime` stops updating permanently when an IME animation is cancelled without `onEnd` (regression in 1.4.0, still present in 1.13.0-alpha01)
+
+## Routing
+
+Please reassign to the owner of **`androidx.compose.foundation` / `foundation-layout`**
+(WindowInsets). Filing here because component 856989 — the target of the "Create a new issue"
+button on the [Compose Foundation release notes](https://developer.android.com/jetpack/androidx/releases/compose-foundation)
+— does not grant Create Issues permission to external accounts. That documented path being
+unusable by the public is arguably a separate docs bug worth fixing.
+
+## Affected versions
+
+* **Broken:** `androidx.compose.foundation:foundation-layout` **1.4.0 → 1.12.0 (current stable) and 1.13.0-alpha01**
+* **Not broken:** 1.3.0 and earlier
+* Verified by inspecting published `-sources.jar` for 1.2.0, 1.3.0, 1.4.0-alpha01…rc01, 1.4.0,
+  1.5.0, 1.6.0, 1.7.0, 1.8.0, 1.9.0, 1.10.0, 1.11.0, 1.12.0, 1.13.0-alpha01.
+  `runningAnimation` and its guard are absent in 1.3.0 and present from 1.4.0-alpha01 onward,
+  textually unchanged since.
+* Reproduced on a Pixel 8, Android 17 (API 37). The API-30-only self-heal (below) means API 31+
+  has no recovery path at all.
+
+## Summary
+
+If a `WindowInsetsAnimation` is prepared and started but never ended — what a cancelled IME
+animation looks like — `InsetsListener.runningAnimation` stays `true` forever. From that point
+`onApplyWindowInsets` matches neither of its two branches, so `composeInsets.update()` is never
+called again and **`WindowInsets.ime` is frozen for the remaining life of the window**.
+
+Every `Modifier.imePadding()` in the app then holds a keyboard-height gap open with no keyboard
+on screen, permanently. `WindowInsets.imeAnimationTarget` keeps reporting correctly, because
+`updateImeAnimationTarget()` is called outside the guard — that asymmetry is the only reason a
+workaround is possible at all.
+
+## Reproduction
+
+Deterministic instrumented test, ~3s, no gestures and no timing dependence. It drives Compose's
+own listener through the cancelled-animation sequence using **public** interfaces
+(`WindowInsetsAnimationCompat.Callback`, `OnApplyWindowInsetsListener`); reflection is used only
+to obtain the listener instance for the view. Inside the androidx codebase `InsetsListener` is
+directly accessible, so `listenerFor()` can be deleted and the rest of the test used verbatim.
+
+```
+FAIL  aCancelledImeAnimationMustNotWedgeTheAnimatedInset
+      expected:<0> but was:<957>
+PASS  theAnimationTargetSurvivesTheWedge
+```
+
+The second test is expected to pass and is included on purpose: it pins the asymmetry between the
+two readings, and would catch a "fix" that broke `imeAnimationTarget` instead.
+
+The full test source is attached below.
+
+## Root cause
+
+`compose/foundation/foundation-layout/src/androidMain/kotlin/androidx/compose/foundation/layout/WindowInsets.android.kt`
+
+```kotlin
+override fun onPrepare(animation: WindowInsetsAnimationCompat) {
+    prepared = true
+    runningAnimation = true          // set here…
+}
+
+override fun onStart(animation, bounds): BoundsCompat {
+    prepared = false                 // …prepared cleared, runningAnimation left set
+    return super.onStart(animation, bounds)
+}
+
+override fun onEnd(animation: WindowInsetsAnimationCompat) {
+    prepared = false
+    runningAnimation = false         // …cleared ONLY here
+    …
+}
+
+override fun onApplyWindowInsets(view: View, insets: WindowInsetsCompat): WindowInsetsCompat {
+    savedInsets = insets
+    composeInsets.updateImeAnimationTarget(insets)   // unconditional — stays correct
+    if (prepared) {
+        if (Build.VERSION.SDK_INT == Build.VERSION_CODES.R) {
+            view.post(this)                          // self-heal, API 30 ONLY
+        }
+    } else if (!runningAnimation) {
+        composeInsets.updateImeAnimationSource(insets)
+        composeInsets.update(insets)                 // the animated inset — never reached when wedged
+    }
+    …
+}
+```
+
+After a cancelled animation: `prepared == false` (cleared by `onStart`) and
+`runningAnimation == true` (never cleared, because `onEnd` never came). Neither branch runs.
+`composeInsets.update()` is dead.
+
+### Why the existing self-heal does not help
+
+`run()` exists precisely to handle a cancelled animation, but:
+
+1. it is gated to `Build.VERSION.SDK_INT == Build.VERSION_CODES.R` (API 30 only), and
+2. it is posted only from the `if (prepared)` branch, and returns early unless `prepared` is still
+   `true` — which `onStart` has already cleared.
+
+So it covers "cancelled between `onPrepare` and `onStart`, on API 30". It does not cover
+"cancelled after `onStart`", on any API level.
+
+### Why applications cannot recover
+
+The only reset is `insetsListener.resetState()`, called from `WindowInsetsHolder.incrementAccessors()`
+when `accessCount` transitions `0 → 1`. `accessCount` is driven by `WindowInsetsHolder.current()`'s
+`DisposableEffect`, so it only reaches 0 when *every* insets consumer leaves composition
+simultaneously.
+
+In a single-Activity app whose shell (scaffold / bottom bar / drawer) always reads insets, that
+never happens — the holder is created once and lives for the whole process. There is no public API
+to force the reset. `WindowInsetsHolder` is `internal`.
+
+Multi-Activity apps mask this: a new Activity means a new `View`, a new holder, and fresh state, so
+the wedge dies with the Activity and reads as a transient glitch.
+
+### Regression point
+
+1.3.0's `onApplyWindowInsets` had no such gate and could not wedge:
+
+```kotlin
+override fun onApplyWindowInsets(view: View, insets: WindowInsetsCompat): WindowInsetsCompat {
+    if (prepared) {
+        savedInsets = insets
+        if (Build.VERSION.SDK_INT == Build.VERSION_CODES.R) view.post(this)
+        return insets
+    }
+    composeInsets.update(insets)      // unconditional once onStart cleared `prepared`
+    return …
+}
+```
+
+1.4.0 introduced `runningAnimation` and the `else if (!runningAnimation)` guard. Its own comment
+states the intent:
+
+> `// If an animation is running, rely on onProgress() to update the insets`
+> `// On APIs less than 30 where the IME animation is backported, this avoids reporting`
+> `// the final insets for a frame while the animation is running.`
+
+i.e. a **one-frame** cosmetic flash on **API < 30** was fixed by making the update path conditional
+on a flag that only `onEnd` clears — trading a single wrong frame on old devices for permanent
+state corruption on all of them. The compensating recovery was never widened past `SDK_INT == R`.
+
+## Real-world impact
+
+Observed in a production Compose app (Amethyst, a Nostr client; single-Activity, `NavHost`,
+77 `imePadding()` sites):
+
+* On a Pixel 8 / Android 17, after ordinary manual use, `WindowInsets.ime` pinned at 957px while
+  the window reported `ime frame=[0,0][0,0]` — keyboard gone — and stayed pinned for 85+ seconds
+  until the process was restarted. Nothing in the app cleared it.
+* Instrumented `WindowInsets.ime` vs `WindowInsets.imeAnimationTarget` across the failure:
+
+  ```
+  17:12:58.803  animated=882  target=957   ← healthy open, 13 intermediate frames
+  17:12:58.902  animated=957  target=957
+  17:13:00.584  animated=957  target=0     ← dismissed; animated frozen
+  17:13:02.430  animated=0    target=957   ← reopened; snaps, no intermediate frames
+  17:13:03.479  animated=957  target=0     ← dismissed; frozen permanently
+  ```
+
+  Note the loss of per-frame updates after the wedge: healthy transitions carry ~13 intermediate
+  values over ~264ms; post-wedge transitions carry none.
+* Because the app never navigates away from its single Activity and its shell always reads insets,
+  `accessCount` never returns to 0, so the wedge is permanent for the session. Sessions in this app
+  routinely run for days.
+
+The trigger for the underlying cancellation was not isolated — it is infrequent and required
+extended manual use to hit. The defect being reported is not the cancellation itself but that
+Compose enters a state it can never leave when one occurs. The attached test reproduces that state
+directly and deterministically.
+
+## Suggested fixes
+
+Roughly in order of how targeted they are:
+
+1. **Generalise the existing self-heal.** Post the `run()` reconciliation on all API levels, and
+   arm it after `onStart` as well as after `onPrepare`, so that an `onApplyWindowInsets` that
+   arrives with no intervening `onProgress` clears `runningAnimation` and applies `savedInsets`.
+   This preserves the API<30 one-frame behaviour the guard was added for, while bounding the
+   failure to a frame rather than forever.
+2. **Reconcile on dispatch.** In `onApplyWindowInsets`, if `runningAnimation` is set but no
+   `onProgress` has been received since `onStart`, treat the animation as finished and update.
+3. **Expose a reset.** A public way to reach `WindowInsetsHolder.resetState()` (or a documented
+   condition under which it runs) would at least let applications self-heal. Today they cannot,
+   short of reflection into an `internal` class — which R8 can rename or strip in exactly the
+   release builds where this occurs.
+
+(1) or (2) is preferable: (3) only makes the bug survivable rather than fixing it.
+
+## Environment
+
+* `androidx.compose.foundation:foundation-layout` 1.12.0 (Compose BOM 2026.08.00)
+* Pixel 8 (`shiba`), Android 17 / API 37, gesture navigation, Gboard, 120Hz
+* Also inspected: 1.13.0-alpha01 — identical listener code
+
+---
+
+## Attachment — the failing test
+
+```kotlin
+package com.vitorpamplona.amethyst.ui.insets
+
+import android.view.View
+import android.view.animation.LinearInterpolator
+import androidx.compose.foundation.layout.ExperimentalLayoutApi
+import androidx.compose.foundation.layout.WindowInsets
+import androidx.compose.foundation.layout.ime
+import androidx.compose.foundation.layout.imeAnimationTarget
+import androidx.compose.runtime.getValue
+import androidx.compose.runtime.mutableIntStateOf
+import androidx.compose.runtime.setValue
+import androidx.compose.ui.platform.LocalDensity
+import androidx.compose.ui.platform.LocalView
+import androidx.compose.ui.test.junit4.createComposeRule
+import androidx.core.graphics.Insets
+import androidx.core.view.OnApplyWindowInsetsListener
+import androidx.core.view.WindowInsetsAnimationCompat
+import androidx.core.view.WindowInsetsCompat
+import org.junit.Assert.assertEquals
+import org.junit.Rule
+import org.junit.Test
+
+/**
+ * Upstream regression test for androidx.compose.foundation:foundation-layout.
+ *
+ * A `WindowInsetsAnimation` that is prepared and started but never ended — which is what a
+ * cancelled IME animation looks like — leaves `InsetsListener.runningAnimation` set forever.
+ * `onApplyWindowInsets` then matches neither of its two branches, so `composeInsets.update()`
+ * is never called again and `WindowInsets.ime` is dead for the life of the window.
+ *
+ * Introduced in 1.4.0 (absent in 1.3.0, where `onApplyWindowInsets` updated unconditionally
+ * once `onStart` had cleared `prepared`). Still present in 1.12.0 and 1.13.0-alpha01. The
+ * compensating self-heal (`view.post(this)` -> `run()`) is scoped to `SDK_INT == R`, so on
+ * API 31+ nothing clears the flag; `WindowInsetsHolder.resetState()` only runs when the
+ * holder's accessCount transitions 0 -> 1, which never happens in an app whose shell always
+ * reads insets.
+ *
+ * [aCancelledImeAnimationMustNotWedgeTheAnimatedInset] FAILS on every version from 1.4.0 on.
+ * [theAnimationTargetSurvivesTheWedge] documents the asymmetry that makes a workaround possible
+ * and is expected to PASS — `updateImeAnimationTarget` is called outside the guard.
+ */
+class ComposeImeInsetWedgeTest {
+    @get:Rule val rule = createComposeRule()
+
+    private val keyboardHeight = 957
+
+    private fun imeInsets(bottom: Int): WindowInsetsCompat =
+        WindowInsetsCompat
+            .Builder()
+            .setInsets(WindowInsetsCompat.Type.ime(), Insets.of(0, 0, 0, bottom))
+            .setVisible(WindowInsetsCompat.Type.ime(), bottom > 0)
+            .build()
+
+    /** Compose's own listener for this view. Private class, but both interfaces it exposes are public. */
+    private fun listenerFor(view: View): Any {
+        val holderClass = Class.forName("androidx.compose.foundation.layout.WindowInsetsHolder")
+        val companion =
+            holderClass.getDeclaredField("Companion").run {
+                isAccessible = true
+                get(null)
+            }
+        val holder =
+            companion.javaClass
+                .getDeclaredMethod("getOrCreateFor", View::class.java)
+                .run {
+                    isAccessible = true
+                    invoke(companion, view)
+                }
+        return holderClass.getDeclaredField("insetsListener").run {
+            isAccessible = true
+            get(holder)!!
+        }
+    }
+
+    private fun anim() = WindowInsetsAnimationCompat(WindowInsetsCompat.Type.ime(), LinearInterpolator(), 250L)
+
+    private fun bounds() =
+        WindowInsetsAnimationCompat.BoundsCompat(
+            Insets.NONE,
+            Insets.of(0, 0, 0, keyboardHeight),
+        )
+
+    @OptIn(ExperimentalLayoutApi::class)
+    @Test
+    fun aCancelledImeAnimationMustNotWedgeTheAnimatedInset() {
+        var animated by mutableIntStateOf(-1)
+        lateinit var view: View
+
+        rule.setContent {
+            view = LocalView.current
+            val density = LocalDensity.current
+            animated = WindowInsets.ime.getBottom(density)
+        }
+        rule.waitForIdle()
+
+        val listener = listenerFor(view)
+        val onApply = listener as OnApplyWindowInsetsListener
+        val callback = listener as WindowInsetsAnimationCompat.Callback
+
+        // Baseline: with no animation in flight the inset tracks normally.
+        rule.runOnUiThread { onApply.onApplyWindowInsets(view, imeInsets(keyboardHeight)) }
+        rule.waitForIdle()
+        assertEquals("baseline: the inset must follow a plain dispatch", keyboardHeight, animated)
+
+        // A cancelled animation: prepared and started, but onEnd never arrives.
+        rule.runOnUiThread {
+            callback.onPrepare(anim())
+            callback.onStart(anim(), bounds())
+        }
+        rule.waitForIdle()
+
+        // The keyboard is gone and the window says so. The animated inset must follow.
+        rule.runOnUiThread { onApply.onApplyWindowInsets(view, imeInsets(0)) }
+        rule.waitForIdle()
+
+        assertEquals(
+            "WindowInsets.ime must still track the window after an animation was cancelled " +
+                "without onEnd; it is instead frozen at the keyboard height forever",
+            0,
+            animated,
+        )
+    }
+
+    @OptIn(ExperimentalLayoutApi::class)
+    @Test
+    fun theAnimationTargetSurvivesTheWedge() {
+        var target by mutableIntStateOf(-1)
+        lateinit var view: View
+
+        rule.setContent {
+            view = LocalView.current
+            val density = LocalDensity.current
+            target = WindowInsets.imeAnimationTarget.getBottom(density)
+        }
+        rule.waitForIdle()
+
+        val listener = listenerFor(view)
+        val onApply = listener as OnApplyWindowInsetsListener
+        val callback = listener as WindowInsetsAnimationCompat.Callback
+
+        rule.runOnUiThread { onApply.onApplyWindowInsets(view, imeInsets(keyboardHeight)) }
+        rule.waitForIdle()
+        assertEquals(keyboardHeight, target)
+
+        rule.runOnUiThread {
+            callback.onPrepare(anim())
+            callback.onStart(anim(), bounds())
+        }
+        rule.waitForIdle()
+
+        rule.runOnUiThread { onApply.onApplyWindowInsets(view, imeInsets(0)) }
+        rule.waitForIdle()
+
+        assertEquals(
+            "updateImeAnimationTarget is called outside the guard, so this reading stays truthful",
+            0,
+            target,
+        )
+    }
+}
+```

amethyst/plans/2026-08-26-bootstrap-relays-skip-tor-until-user-data.md

@@ -0,0 +1,182 @@
+# Defaults stand in for the user's relay lists only while we have no event
+
+**Status:** proposal — not implemented
+**Goal:** first-login startup on a Tor-enabled install
+**Related:** `fix/tor-bootstrap-stall-and-ondemand`, `[[fresh-install-routes-everything-via-tor]]`
+
+## The rule
+
+Three states, currently collapsed into two:
+
+| we have | effective list | today |
+|---|---|---|
+| **no event** for the user | app defaults | defaults ✅ |
+| event, **empty** list | **empty** — the user chose nothing | defaults ❌ |
+| event with relays | those relays | those relays ✅ |
+
+Everything below follows from separating "we don't know" from "we know, and it's nothing".
+
+## Why the first login is slow
+
+On a fresh install **100% of relay traffic is Tor-routed by construction**.
+`TorRelayState.trustedRelays` is empty, so `TorRelayEvaluation.useTor()` falls through to
+`newRelaysViaTor` (**default true**) for every URL — and the kind-10002 that would populate it can
+only be fetched over Tor. Measured (SM-T220, same account, same ~app+8-10s login, fresh install
+each; the Tor-OFF arm sets the pref, force-stops, then starts the timed run so Arti never boots):
+
+| @20s census | Tor ON | Tor OFF |
+|---|---|---|
+| feed on screen | login+18s | **login+11s** |
+| relays opened | 18/40 | **32/41** |
+| relays serving events | 9 | **22** |
+| events ingested | 2,830 | **6,134 / 7,641** |
+
+≈7s of first paint and half the relay coverage.
+
+## Finding 1 — every `WithBackup` helper keys on emptiness, not absence
+
+This is a pre-existing bug against the rule above, and it must be fixed first because the whole
+feature depends on the distinction being real.
+
+```kotlin
+// AdvertisedRelayListEvent
+fun relays()         = tags.mapNotNull(AdvertisedRelayInfo::parse)                    // [] when none
+fun readRelaysNorm() = tags.mapNotNull(AdvertisedRelayInfo::parseReadNorm).ifEmpty { null }   // null!
+fun writeRelaysNorm()= tags.mapNotNull(AdvertisedRelayInfo::parseWriteNorm).ifEmpty { null }  // null!
+```
+
+| helper | fallback fires when | correct |
+|---|---|---|
+| `normalizeNIP65AllRelayListWithBackup` | event absent only | ✅ (by accident — `relays()` has no `ifEmpty`) |
+| `normalizeNIP65Read/WriteRelayListWithBackup` | event absent **or list empty** | ❌ |
+| `normalizeIndexerRelayListWithBackup` | `?.ifEmpty { null } ?: DefaultIndexerRelayList` | ❌ |
+| `normalizeSearchRelayListWithBackup` | `?.ifEmpty { null } ?: DefaultSearchRelayList` | ❌ |
+
+Consequence today: **a user who publishes a kind-10002 with only write relays gets
+`Constants.bootstrapInbox` silently substituted as their inbox list.** Same for a deliberately empty
+search or indexer list. The app overrides an explicit choice.
+
+The mirror problem sinks the obvious implementation: the `NoDefaults` variants return `emptySet()`
+for *both* "no event" and "empty event", so `trustedRelays.isEmpty()` cannot be used as the
+"do we have data yet" signal.
+
+**Fix:** make presence explicit, and never infer it from emptiness.
+
+```kotlin
+// absent -> defaults; present -> whatever it says, including nothing
+fun readRelayList(note: Note): Set<NormalizedRelayUrl> =
+    nip65Event(note)?.let { it.readRelaysNorm()?.toSet() ?: emptySet() } ?: Constants.bootstrapInbox
+```
+
+Same shape for write/all, and drop the `?.ifEmpty { null }` from the indexer and search helpers.
+Worth doing on its own merits even if the rest of this plan is dropped.
+
+**This removes the need for any window or timeout.** The fallback becomes a pure function of "do we
+have the event", so it ends the instant one arrives — even an empty one. No per-account bookkeeping,
+no 30s backstop, no race to close.
+
+## Finding 2 — do NOT put defaults into `TrustedRelayListsState`
+
+Tempting (it already merges all nine lists) but wrong: `account.trustedRelays.flow` feeds
+`Account.kt:454`
+
+```kotlin
+isInMyRelayList = { relayUrl -> ... it in trustedRelays.flow.value }
+```
+
+which feeds `RelayAuthPermissionLedger` -> `RelayAuthResolver` -> **the NIP-42 AUTH decision**.
+Adding defaults there would make the app **auto-AUTH to the six hardcoded bootstrap relays as if
+they were the user's own** — signing a challenge with the user's key and revealing the pubkey — at
+exactly the moment we are also going clearnet. That converts a modest timing leak into a signed
+identity assertion. See `[[relay-auth-always-was-gated]]` and `[[inbox-wine-notify-auth-billing]]`
+for why AUTH is the sensitive edge.
+
+(The `saveTrustedRelayList(trustedRelays + relay)` write path in `RelayGroupChannelListScreen:449`
+is **not** a hazard — it reads `account.trustedRelayList` (the NIP-51 list), not the merged
+`trustedRelays`. Checked.)
+
+**Instead:** add a separate, purpose-named flow consumed only by Tor evaluation, e.g.
+`Account.relaysAssumedWhileUnknown` — the union of the with-defaults views, non-empty only while the
+corresponding events are absent. `AccountsTorStateConnector` feeds it into a new
+`TorRelayState.assumedRelays`. Nothing else reads it.
+
+## Where the check goes in `useTor()`
+
+```
+torType == OFF        -> false
+isLocalHost           -> false
+isOverlayNetwork      -> false
+isOnion               -> onionRelaysViaTor
+in moneyOpRelayList   -> moneyOperationsViaTor
+in dmRelayList        -> dmRelaysViaTor
+in trustedRelayList   -> trustedRelaysViaTor
+in assumedRelayList   -> trustedRelaysViaTor      <-- new, immediately above the fallback
+else                  -> newRelaysViaTor
+```
+
+Landing immediately above the fallback means **.onion, money-operation and DM relays keep their own
+policy for free** — the change can only ever affect URLs that would have been treated as "new".
+
+Resolve to `trustedRelaysViaTor`, **not** a hardcoded `false`:
+
+- default user (`false`) -> clearnet -> fast start;
+- hardened user (`true`) -> stays on Tor, automatically, with no new setting to discover.
+
+That is the difference between "the app overrides you" and "the app treats its stand-in list the way
+you asked your own list to be treated".
+
+## Privacy, for the PR body
+
+The window correlates the user's **IP with their pubkey** at ~6 hardcoded relays, because the REQ
+asks those relays for that pubkey's events. A first login is the most sensitive moment there is.
+
+What makes it defensible: **`trustedRelaysViaTor` already defaults to false**, so the moment
+kind-10002 lands the user's own relays are dialled over clearnet anyway. This moves an existing
+disclosure slightly earlier, to a different well-known set. It is not a new class of exposure for
+the default configuration — and it is *not* an AUTH disclosure, provided Finding 2 is respected.
+
+If `trustedRelaysViaTor` ever becomes default-true, **this feature must be revisited in the same
+commit** — its justification disappears. Leave a comment at the default linking the two.
+
+Residual, worth verifying rather than assuming: `useTor()` is keyed by relay **URL**, and the pool
+multiplexes every subscription for a URL over one socket. During the window, anything addressed to a
+default relay rides that clearnet socket — including a kind-1059 giftwrap subscription, since the DM
+list is also absent. Measure it (below) before deciding it is acceptable.
+
+## Testing
+
+Unit — the rule itself, per list type: absent event -> defaults; present-but-empty -> **empty**;
+present-with-values -> values. The middle case is the regression guard and the one that fails today.
+
+Unit (`TorRelayEvaluationTest`): an assumed relay resolves to `trustedRelaysViaTor` (both values);
+.onion / money-op / DM keep their own policy while also listed as assumed; a non-assumed "new" relay
+still resolves to `newRelaysViaTor`; an empty assumed set is byte-for-byte today's behaviour.
+
+Unit: `isInMyRelayList` does **not** see assumed relays (guards Finding 2 permanently).
+
+Device — the number that justifies the change. `relaytiming.sh` + `BootRelayDiag` census,
+`VERBOSE_LOGS=true` benchmark build, fresh install each, counterbalanced, n>=3:
+- primary: login -> first note; login -> own profile + follow list;
+- secondary: relays opened / serving / events at the 20s census;
+- guard: grep the verbose log for any request to a default relay during the window that is not for
+  the account's own pubkey, and for any AUTH sent to one.
+
+Harness traps (all in `[[fresh-install-routes-everything-via-tor]]`): the tablet raises its lock
+screen during long waits (`wm dismiss-keyguard`, not just `KEYCODE_WAKEUP`); the login layout shifts
+when the IME opens, so dismiss it before tapping fixed coordinates; `BACK` on the home screen exits
+the app; always assert the run left the login screen before trusting its timing.
+
+## Expected outcome
+
+Approach the Tor-OFF column: ≈**-7s to first paint, ~2x relay coverage** in the first 20s, with
+everything after the first event behaving exactly as today.
+
+If the gain is materially smaller, the likely cause is that the feed is gated on outbox-discovered
+relays (which stay "new", hence Tor) rather than the user's own list — in which case the win is
+limited to profile and follows, and may not be worth the privacy cost. Decide on the numbers.
+
+## Order of work
+
+1. Fix the absent-vs-empty bug in the four helpers + tests. Independently correct; ship separately.
+2. Add `relaysAssumedWhileUnknown` + `TorRelayState.assumedRelays` + the `useTor()` branch.
+3. Device A/B. Keep only if it earns its keep.

amethyst/plans/2026-09-01-payment-targets-zap-rail.md

@@ -0,0 +1,346 @@
+# NIP-A3 Payment Targets in the zap picker — v1
+
+**Status:** proposal
+**Modules:** `quartz`, `commons`, `amethyst`
+**Scope:** when a note's author publishes a NIP-A3 payment target, **an
+installed app can handle it**, and the note carries no NIP-57 zap split — show
+one amount-less chip per such target that hands off to that app.
+
+> **Revised after the first implementation.** This document originally gated the
+> chip on *symmetry* — both parties publishing the same protocol — and capped the
+> row at two chips. Both are gone: the gate is capability alone (can anything on
+> this phone open the URI), there is no cap, and the setting now defaults **on**.
+> Sections below that argue for symmetry are kept for the reasoning, but §5 is
+> the current rule.
+
+Deliberately excluded from v1: amounts, in-app payment, receipts, fiat
+conversion, desktop.
+
+---
+
+## 1. Why v1 has no amounts
+
+Zap presets are **sats**. A `venmo` / `iban` / `upi` chip cannot send 1000
+sats, and there is **no FX or bitcoin-price service anywhere in this repo**
+(grepped `quartz`, `commons`, `amethyst`). So v1 does not pretend: the chip
+carries no number, emits no RFC-8905 `amount=`, and the amount is named in the
+external app. The UI has to *say* that rather than leave a suspicious blank —
+see §4.
+
+Corollary: **the note's zap counter will not move.** No kind:9735, nothing to
+count. In code it is a rail; to the user it must read as *pay*, not *zap*.
+
+---
+
+## 2. The layout decision — and the refactor it deletes
+
+> This is the one place v1 diverges from the sketch, and the reason is that it
+> makes the change roughly half the size.
+
+The sketch was "add the icons to the toggle." The toggle is the segmented
+control **inside each amount pill** (`UnifiedZapAmountChip`,
+`ReactionsRow.kt:2362`). Putting an amount-less rail there has two costs:
+
+1. **It repeats.** With presets of 1000/5000/10000, the identical amount-less
+   Venmo segment renders three times and means the same thing each time.
+2. **It forces `ZapRail` to become a sealed interface.** The enum
+   (`ReactionsRow.kt:2481`) is payload-free, so a segment can't know *which*
+   target it opens. Making it data-carrying drags in `present`, `preferred`,
+   `selectedRail`, `ZapRailIcon`, `previewPreferredRail`, `previewRailsFor`
+   and the settings preview row — and, because `PaymentTarget` has no
+   `equals`, breaks the `remember(preferred, present)` key so the user's
+   selection resets on recompose.
+
+**Instead: render the chip as a sibling of the amount pills**, appended to the
+existing `FlowRow` in `ZapAmountChoiceGrid` (`ReactionsRow.kt:2297`), next to
+the `Tune` preset-editor button. It wraps for free, it renders **once**, and
+`ZapRail`, `UnifiedZapAmountChip` and every preview stay **completely
+untouched**. Same popup, same place the user is already looking.
+
+If an FX service ever lands and the amount becomes expressible, the chip moves
+into the toggle then — that is the natural migration, not a reason to pay for
+it now.
+
+---
+
+## 3. Intent discovery — the constraint that decides it
+
+`targetSdk = 37`. Under Android 11+ package visibility,
+`queryIntentActivities` returns **empty** for any intent not covered by a
+`<queries>` declaration — so *without a manifest change this feature silently
+shows nothing on every modern device*. The existing `<queries>` block
+(`AndroidManifest.xml:4`) covers only `nostrsigner`, TTS, Health Connect and
+Tor.
+
+### 3.1 Manifest
+
+Add one `<intent>` per scheme we probe. The important economy: an arbitrary
+user-typed type (`iban`, `upi`, `pix`, …) always falls back to
+`payto://<type>/<authority>`, so **one `payto` entry covers every generic
+type**. Only the ~12 special-cased crypto schemes in `paymentTargetStyleFor`
+(`DisplayPaymentTargets.kt:190`) need their own entries.
+
+```xml
+<intent>
+    <action android:name="android.intent.action.VIEW" />
+    <data android:scheme="payto" />
+</intent>
+<!-- + one each: bitcoin, lightning, liquidnetwork, ethereum, monero, dash,
+     zcash, bitcoincash, litecoin, dogecoin, solana, tron -->
+```
+
+Use **`<queries>`, never `QUERY_ALL_PACKAGES`** — the latter is a
+policy-restricted permission on Play and would need a declaration; specific
+`<intent>` filters need nothing. On minSdk 26–29 `<queries>` is ignored and
+everything resolves, which is a strict superset of the gated behaviour.
+
+### 3.2 https targets are exempt
+
+`cashapp` / `venmo` / `paypal` map to `https://…`, which a browser always
+resolves — discovery would be a tautology. **Skip discovery for https
+targets and always show them**: opening `venmo.com/<handle>` in a browser is a
+legitimate way to pay, so nothing is broken. For these three types the chip is
+therefore gated only on the author having published one.
+
+**But §4.2 still needs the control probe here.** To tell a real app handler
+from a browser, resolve a control `https://<nonexistent-host>/` and treat the
+target as app-backed only if its resolver set contains a package outside that
+control set. It never gates the chip — it decides whether the chip wears the
+app's icon or the brand-colour glyph, and a Chrome icon on a Venmo chip is
+worse than no icon at all.
+
+### 3.3 The cache — keyed by scheme+host, warmed from the open picker
+
+The naive cache is per-post and lazy. With symmetry gone the probe set is the
+author's target list, so:
+
+> **Probe the targets of the one author whose picker is open** — typically 1–5
+> entries — and **merge** the answers into the cache. Merging matters: replacing
+> would evict what was learned about every other author the moment a second
+> picker opened. Feed rendering still never triggers a probe.
+
+- **Key:** `"<scheme>://<host>"`, e.g. `payto://iban`, `bitcoin://`. Scheme
+  alone is too coarse — an app may declare `android:scheme="payto"
+  android:host="iban"`, so a scheme-only hit would wrongly claim `payto://upi`
+  is handled.
+- **Warm:** a `LaunchedEffect` keyed on the author's observed kind:10133 probes
+  that handful of keys off the main thread when the picker opens.
+- **Read:** synchronous map lookup — required, because
+  `RailCapabilityResolver.peek` is called from inside `remember {}`.
+- **Recomposition:** the map must be a `MutableStateFlow<Map<String, Boolean>>`,
+  not a bare `ConcurrentHashMap`. A plain map write is invisible to Compose and
+  the chip would not appear until something else recomposed.
+- **Invalidation:** clear on app foreground (`ProcessLifecycleOwner`
+  `ON_START`) and re-warm — this is exactly the "user left, installed Venmo,
+  came back" flow. A `PACKAGE_ADDED`/`REMOVED` receiver is more precise but is
+  more moving parts than v1 needs.
+
+Home: `amethyst/…/service/payments/PayToAppAvailability.kt` (Android-only;
+`PackageManager` has no KMP equivalent). The scheme mapping it needs moves out
+of the UI file into `commons` (§6.0).
+
+---
+
+## 4. The chip's face
+
+### 4.1 Saying "the app decides the amount"
+
+An amount-less chip beside pills that all show numbers reads as a bug unless
+it is visibly a *different kind of thing*. Three cues, no extra layout:
+
+1. **No number.** Icon + protocol label only (`VENMO`).
+2. **A different terminal glyph.** `MaterialSymbols.OpenInNew` instead of the
+   `ArrowForward` every amount segment uses — "this leaves the app."
+3. **A string that says it outright**, e.g. *"Amount set in %1$s"*, shown as
+   the chip's `contentDescription` and as a toast on long-press.
+
+**Both glyphs are already in `MaterialSymbols.kt`** (`OpenInNew:280`,
+`AccountBalanceWallet:27`) — **no `tools/material-symbols-subset/subset.sh`
+run is needed**, and §4.2 adds no new glyphs either.
+
+Long-press must **not** inherit `onChangeAmount` (the sat-preset editor is
+meaningless here); it copies the authority, matching `PaymentTargetChip`'s
+long-press on the profile.
+
+### 4.2 Which icon it wears — the installed app's, not a bundled logo
+
+**This already works in this codebase.** `ExternalSignerButton.kt:118` renders
+installed NIP-55 signers with `it.loadLabel(pm)` / `it.loadIcon(pm)` →
+`toBitmap()` → Coil's `rememberAsyncImagePainter`, off the back of
+`getExternalSignersInstalled` (`quartz/…/IsExternalSignerInstalled.kt`), which
+is `queryIntentActivities(ACTION_VIEW, "nostrsigner:")` — **the same call
+§3 already makes for discovery.** The `ResolveInfo` we keep to answer "can
+anything open this?" also carries the icon and the app's own name. The icon is
+therefore very close to free; what it costs is care.
+
+**Do not bundle brand logos.** Three reasons, in order of weight:
+
+1. **Trademark, not licence.** `CLAUDE.md`'s dependency gate covers *code*
+   licences; a Venmo or PayPal mark shipped inside an MIT APK is a separate
+   trademark question. Referential use is usually permitted, redistribution of
+   the mark often is not. That is a maintainer's call, not a silent one.
+2. **The type space is unbounded.** `PaymentTargetsViewModel.addTarget` accepts
+   any `type.trim().lowercase()`, so a bundled set can never be complete —
+   `pix`, `upi`, `swish`, `interac` and the next one all miss.
+3. **The codebase already decided this.** `paymentTargetStyleFor` pairs brand
+   *colours* (`VENMO_BLUE #008CFF`, `PAYPAL_DEEP_BLUE #003087`,
+   `CASHAPP_LIME #00E64D`) with the generic `AccountBalanceWallet` glyph.
+   Brand colour + generic glyph is the established pattern; keep it as the
+   fallback. Brand marks are also absent from Material Symbols, so each would
+   be a hand-authored `ImageVector` like `CustomHashTagIcons.Cashu`.
+
+So: **the installed app's icon *is* the brand icon**, sourced from the device
+instead of shipped. It is self-limiting in the right direction — the "popular
+options" are exactly the ones with an app installed.
+
+**Four things the precedent gets away with and we would not:**
+
+- **Load once, in the warm step.** `ExternalSignerButton` calls `loadIcon()` +
+  `toBitmap()` inside a `LazyColumn` item, so it re-runs on recomposition —
+  tolerable in a one-shot dialog, not in the zap popup. `loadIcon` reads the
+  target APK's resources, so it is I/O: do it in §3.3's off-main warm and
+  cache the **`ImageBitmap`**, never the `Drawable`.
+- **Size and mask it.** minSdk is 26, so any icon may be an
+  `AdaptiveIconDrawable`: a 108×108 canvas whose outer margin the launcher
+  masks away. A bare `toBitmap()` drawn at 18dp shows a small logo floating in
+  padding. Use `toBitmap(px, px)` at the target size plus
+  `Modifier.clip(CircleShape)` — what a launcher does. The precedent renders
+  at 48dp and gets away with it.
+- **Pick one app, or none.** `payto://` can resolve to several. Ask
+  `resolveActivity(intent, MATCH_DEFAULT_ONLY)` for the user's default; when
+  Android hands back its `ResolverActivity` (no default set) there is no app
+  to name — fall back to the glyph rather than showing the chooser's icon.
+- **Accept that it cannot be tinted.** Every other rail is a monochrome glyph
+  tinted `BitcoinOrange` / `onSurface`. A full-colour raster can't join that
+  scheme — which is arguably the point: it is the visual signal that this
+  segment leaves the app. It needs the circular clip and a slightly smaller
+  optical size to sit beside 18dp glyphs.
+
+**This promotes the https control-probe from a nicety to v1 work.** §3.2 exempts
+`venmo` / `paypal` / `cashapp` from discovery because a browser always resolves
+`https://`. That is fine for *gating*, but not for *icons*: with only a browser
+installed, `resolveActivity` returns **Chrome**, and a Chrome icon on a Venmo
+chip is worse than no icon. So an https target needs the control probe
+(resolve `https://<nonexistent-host>/`, treat the target as app-backed only if
+its resolver set contains a package outside that control set) to decide
+**icon vs brand-colour glyph**, even though it never gates the chip.
+
+---
+
+## 5. Gates (all must hold)
+
+1. Setting `showPayToZapChip` — **default on**. The chip only ever shows a
+   target its author chose to publish, to a device that can already open it,
+   so the discovery gate is doing the real narrowing (`UiSettings.kt:67` →
+   `UiSettingsFlow.kt:59` → `UISharedPreferences.kt:192`).
+2. Note has **no** zap split: `zapSplitSetup().isNullOrEmpty()`. payto can't
+   fan out and returns no receipt. `RailCapabilityResolver.peek` **already
+   computes `splits`** — one-line reuse.
+3. Recipient (note author) publishes ≥1 handoff-class target.
+4. §3 says an app can handle it (or it's https). **This is the substantive
+   gate**; everything else is a precondition.
+
+No cap: every openable target is offered. Discovery is what bounds the row —
+a target with nothing to open it never reaches the picker.
+
+**Handoff-class** excludes the wallet-covered types — `lightning`/`ln`/`lnurl`
+and `bitcoin`/`btc`/`onchain` *are* the existing LIGHTNING and ONCHAIN rails.
+Without this exclusion the picker grows a second Bolt icon beside the first.
+
+---
+
+## 6. Implementation
+
+### 6.0 Prep — no behaviour change
+- `quartz`: `PaymentTarget` → `data class` (it has no `equals` today; needed
+  for list keys and dedupe, and it fixes the hand-rolled field-by-field
+  compare in `PaymentTargetsViewModel.addTarget`).
+- `commons/…/model/payments/PaymentTargetTypes.kt` (package exists, holds
+  `PaymentSourceResolver`): `canonical(raw)`, `isWalletCovered(canonical)`,
+  `schemeFor(canonical)`. Move `LIGHTNING_TARGET_TYPES` /
+  `BITCOIN_TARGET_TYPES` (`DisplayPaymentTargets.kt:67,70`) and the scheme half
+  of `paymentTargetStyleFor` here — today they are duplicated twice inside one
+  Android UI file, and discovery needs them too.
+- `commons/…/model/User.kt`: `paymentTargetsNote` + `paymentTargets()`,
+  mirroring `nutzapInfoNote` (`User.kt:79`).
+
+**No new relay subscription:** kind 10133 already rides in
+`UserMetadataForKeyKinds` beside kind:0 and kind:10019
+(`FilterUserMetadataForKey.kt:50`), so the recipient's targets are in cache by
+the time the note renders — same as the nutzap rail.
+
+### 6.1 Matcher — pure, headless
+`commons/…/model/payments/PayToRailMatcher.kt`: canonicalize both sides, drop
+wallet-covered types, intersect on type, dedupe by type. No Android, no
+Compose.
+
+### 6.2 Discovery
+`amethyst/…/service/payments/PayToAppAvailability.kt` per §3.3 + the manifest
+`<queries>` entries per §3.1. Each cache entry holds what §4.2 needs as well as
+the yes/no: `{ resolves: Boolean, label: String?, icon: ImageBitmap? }` —
+decoded once in the warm step at the 18dp target size, never per composition.
+Icon and label are null for the no-default (`ResolverActivity`) and
+browser-only cases, and the chip falls back to the brand-colour glyph.
+
+### 6.3 Capability
+- `RailCapability` += `payToTargets: List<PaymentTarget> = emptyList()` —
+  defaulted, so `RailCapabilityCashuStatusTest` and every existing call site
+  compile untouched.
+- `peek(..., senderTargets = emptyList(), payToEnabled = false, available = emptyMap())`
+  — **defaulted, because `zapClick` also calls `peek`**
+  (`ReactionsRow.kt:1464`) for the one-tap fast path, which must stay
+  Lightning-only. Returns empty when splits exist.
+- `observeZapRailCapability` (`ReactionsRow.kt:2098`) adds four inputs, each
+  both a subscription trigger and a `remember` key — the contract spelled out
+  in the "do NOT delete these as unused" comment at `ReactionsRow.kt:2105`:
+  `paymentTargetsState.flow`, the author's `paymentTargetsNote`,
+  `uiSettingsFlow.showPayToZapRail`, and the availability `StateFlow`.
+
+### 6.4 UI
+One new `PayToHandoffChip` composable appended to `ZapAmountChoiceGrid`'s
+`FlowRow`. Action: `uriHandler.openUri(...)`; keep the existing try/catch →
+`no_payment_app_found_for_type` toast (string exists) as a belt-and-braces
+fallback for the race where the app is uninstalled between warm and tap. It
+must not touch `zappingProgress`, `zapStartingTime` or `accountViewModel.zap`.
+
+### 6.5 Settings + strings
+`showPayToZapRail` through the `showOnchainWallet` chain + `SettingsCatalogBuilder`;
+new strings; changelog.
+
+---
+
+## 7. Tests
+
+| Level | Test | Asserts |
+|---|---|---|
+| `commons/commonTest` | `PaymentTargetTypesTest` | alias collapse, case/whitespace, wallet-covered set, scheme mapping |
+| `commons/commonTest` | `PayToRailMatcherTest` | empty sender → empty; no overlap → empty; `ln` vs `lightning` → empty (wallet-covered); `Venmo` vs `venmo` → match; dedupe by type |
+| `amethyst/test` | sibling of `RailCapabilityCashuStatusTest` | split present → empty; setting off → empty; no author → empty; unavailable scheme → empty; https target → shown without probe; **existing rails unaffected** |
+| `amethyst/test` | `PayToAppAvailabilityTest` | key is scheme+host, not scheme; probe count == sender's target count, independent of post count; `ResolverActivity` default → null icon; browser-only https → null icon (control probe) |
+| Manual | | chip appears once (not per pill); tap opens the app; **counter does not move**; split note shows no chip; install app → background → foreground → chip appears; adaptive icon is masked round, not floating in padding; https target with no app shows the glyph, not Chrome |
+
+---
+
+## 8. Open decisions
+
+1. **Chip placement** — sibling vs inside the toggle (§2). Recommend sibling:
+   renders once and deletes the whole `ZapRail` refactor. Flagged because it
+   diverges from the original sketch.
+2. **Default for `showPayToZapRail`** — recommend **off**, matching how
+   `ReactionRowAction.Pay` already ships disabled.
+3. **Private rumors** — on-chain is suppressed there (it would e-tag the
+   rumor). A payto handoff publishes nothing, so it is arguably safe.
+   Recommend **allow**, noting the divergence from the on-chain precedent.
+4. **`ReactionRowAction.Pay` overlap** — recommend keeping both, `Pay`
+   disabled by default: `Pay` browses *all* of a recipient's targets, this
+   chip is the *matched, installed, splitless* shortcut.
+5. **Colour icon beside monochrome glyphs** (§4.2). The app icon can't be
+   tinted, so the chip will be the one full-colour thing in the popup.
+   Recommend **accepting** it as the "this leaves the app" signal — but it is a
+   visible break from the rail iconography and worth an explicit yes.
+6. ~~**Symmetry heuristic**~~ — *removed; see the note at the top.* It was
+   right for closed loops (Venmo, Cash App, UPI),
+   arguably too strict for open ones (Monero: a sender needs a wallet, not a
+   published address). Ship strict; relaxing later is additive. Note that
+   intent discovery already covers much of what symmetry was proxying for, so
+   dropping symmetry for scheme-based types is a live option.

amethyst/src/androidTest/java/com/vitorpamplona/amethyst/DMFileDecryptionTest.kt

@@ -21,8 +21,8 @@
 package com.vitorpamplona.amethyst
 
 import androidx.test.ext.junit.runners.AndroidJUnit4
-import com.vitorpamplona.amethyst.service.okhttp.EncryptedBlobInterceptor
-import com.vitorpamplona.amethyst.service.okhttp.EncryptionKeyCache
+import com.vitorpamplona.amethyst.commons.service.http.EncryptedBlobInterceptor
+import com.vitorpamplona.amethyst.commons.service.http.EncryptionKeyCache
 import com.vitorpamplona.quartz.nip01Core.core.hexToByteArray
 import com.vitorpamplona.quartz.utils.ciphers.AESGCM
 import okhttp3.OkHttpClient

amethyst/src/androidTest/java/com/vitorpamplona/amethyst/ImageUploadTesting.kt

@@ -25,10 +25,10 @@ import android.graphics.Color
 import androidx.core.graphics.createBitmap
 import androidx.test.ext.junit.runners.AndroidJUnit4
 import androidx.test.platform.app.InstrumentationRegistry
+import com.vitorpamplona.amethyst.commons.service.http.DefaultContentTypeInterceptor
 import com.vitorpamplona.amethyst.model.AccountSettings
 import com.vitorpamplona.amethyst.model.LocalCache
 import com.vitorpamplona.amethyst.model.nipB7Blossom.BlossomServerListState
-import com.vitorpamplona.amethyst.service.okhttp.DefaultContentTypeInterceptor
 import com.vitorpamplona.amethyst.service.uploads.FileHeader
 import com.vitorpamplona.amethyst.service.uploads.ImageDownloader
 import com.vitorpamplona.amethyst.service.uploads.blossom.BlossomUploader

amethyst/src/androidTest/java/com/vitorpamplona/amethyst/NotificationFeedFilterModeOverrideTest.kt

@@ -21,14 +21,14 @@
 package com.vitorpamplona.amethyst
 
 import androidx.test.ext.junit.runners.AndroidJUnit4
+import com.vitorpamplona.amethyst.commons.model.topNavFeeds.TopFilter
 import com.vitorpamplona.amethyst.commons.relayClient.assemblers.CashuMintDirectoryFilterAssembler
+import com.vitorpamplona.amethyst.commons.relayClient.nip47WalletConnect.NWCPaymentFilterAssembler
 import com.vitorpamplona.amethyst.model.Account
 import com.vitorpamplona.amethyst.model.AccountSettings
 import com.vitorpamplona.amethyst.model.LocalCache
-import com.vitorpamplona.amethyst.model.TopFilter
 import com.vitorpamplona.amethyst.service.location.LocationState
 import com.vitorpamplona.amethyst.service.okhttp.OkHttpWebSocket
-import com.vitorpamplona.amethyst.service.relayClient.reqCommand.nwc.NWCPaymentFilterAssembler
 import com.vitorpamplona.amethyst.ui.screen.loggedIn.notifications.dal.NotificationFeedFilter
 import com.vitorpamplona.quartz.nip01Core.crypto.KeyPair
 import com.vitorpamplona.quartz.nip01Core.relay.client.NostrClient

amethyst/src/androidTest/java/com/vitorpamplona/amethyst/ThreadDualAxisChartAssemblerTest.kt

@@ -23,13 +23,13 @@ package com.vitorpamplona.amethyst
 import androidx.test.ext.junit.runners.AndroidJUnit4
 import com.fasterxml.jackson.module.kotlin.readValue
 import com.vitorpamplona.amethyst.commons.relayClient.assemblers.CashuMintDirectoryFilterAssembler
+import com.vitorpamplona.amethyst.commons.relayClient.nip47WalletConnect.NWCPaymentFilterAssembler
 import com.vitorpamplona.amethyst.commons.viewmodels.thread.ThreadFeedFilter
 import com.vitorpamplona.amethyst.model.Account
 import com.vitorpamplona.amethyst.model.AccountSettings
 import com.vitorpamplona.amethyst.model.LocalCache
 import com.vitorpamplona.amethyst.service.location.LocationState
 import com.vitorpamplona.amethyst.service.okhttp.OkHttpWebSocket
-import com.vitorpamplona.amethyst.service.relayClient.reqCommand.nwc.NWCPaymentFilterAssembler
 import com.vitorpamplona.quartz.nip01Core.core.Event
 import com.vitorpamplona.quartz.nip01Core.crypto.KeyPair
 import com.vitorpamplona.quartz.nip01Core.crypto.verify

amethyst/src/androidTest/java/com/vitorpamplona/amethyst/tor/TorBootstrapInstrumentedTest.kt

@@ -25,7 +25,10 @@ import androidx.test.filters.LargeTest
 import androidx.test.platform.app.InstrumentationRegistry
 import com.vitorpamplona.amethyst.ui.tor.TorService
 import com.vitorpamplona.amethyst.ui.tor.TorServiceStatus
+import kotlinx.coroutines.CoroutineScope
 import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.SupervisorJob
+import kotlinx.coroutines.cancel
 import kotlinx.coroutines.flow.first
 import kotlinx.coroutines.runBlocking
 import kotlinx.coroutines.withTimeout
@@ -58,7 +61,7 @@ import kotlin.system.measureTimeMillis
  *   3. `./gradlew :amethyst:connectedPlayDebugAndroidTest -P android.testInstrumentationRunnerArguments.class=com.vitorpamplona.amethyst.tor.TorBootstrapInstrumentedTest`
  *
  * **What it covers that [TorManagerTest] does not:**
- *   - Real `ArtiNative.initialize` → `create_bootstrapped` → SOCKS listener bind.
+ *   - Real `ArtiNative.initialize` → `create_unbootstrapped_async` → SOCKS listener bind.
  *   - Real rustls `CryptoProvider` install (regression check after the arti-v2.3.0 bump).
  *   - Real `destroy()` releasing the state file lock so a second `initialize()` succeeds.
  *   - OkHttp routing traffic through the SOCKS port and Arti exiting through the
@@ -73,7 +76,14 @@ import kotlin.system.measureTimeMillis
 @Ignore("Tier-3 integration test — requires on-device network access to Tor. See class kdoc to enable.")
 class TorBootstrapInstrumentedTest {
     private val context = InstrumentationRegistry.getInstrumentation().targetContext
-    private val torService = TorService(context)
+
+    /**
+     * [TorService] promotes Bootstrapping -> Active from a coroutine on this scope, so the test
+     * must own one and cancel it — without a live scope `status` would never reach Active and every
+     * assertion below would hang until its timeout.
+     */
+    private val scope = CoroutineScope(SupervisorJob() + Dispatchers.IO)
+    private val torService = TorService(context, scope)
 
     @After
     fun tearDown() =
@@ -81,11 +91,12 @@ class TorBootstrapInstrumentedTest {
             // Drop the native client so this test's state file lock doesn't bleed into
             // the next instrumented run on the same device.
             torService.reset()
+            scope.cancel()
         }
 
     /**
      * Cold-start bootstrap. The whole point of the custom Arti build is that this
-     * works at all — if create_bootstrapped panics (e.g., because we forgot to install
+     * works at all — if client creation panics (e.g., because we forgot to install
      * a rustls CryptoProvider after an arti bump) the test catches it.
      */
     @Test

amethyst/src/androidTest/java/com/vitorpamplona/amethyst/ui/actions/MediaSaverTestSupport.kt

@@ -0,0 +1,66 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.ui.actions
+
+import android.content.Context
+import kotlinx.coroutines.runBlocking
+import org.junit.Assert.assertNull
+import org.junit.Assert.assertTrue
+import java.io.File
+import java.util.UUID
+
+/**
+ * Shared harness for the MediaSaverToDisk instrumented tests: writes a small payload
+ * file, drives [MediaSaverToDisk.save] with the given MIME type, and asserts the save
+ * reported success. Package-level support object per the AvifInstrumentedTestSupport
+ * precedent.
+ */
+object MediaSaverTestSupport {
+    /** Drives one save and fails the test if it reported an error or never succeeded. */
+    fun saveAndAssertSuccess(
+        context: Context,
+        mimeType: String,
+    ) {
+        val localFile = File(context.cacheDir, "media-saver-${UUID.randomUUID()}.bin")
+        localFile.writeBytes(ByteArray(2048) { it.toByte() })
+
+        var failure: Throwable? = null
+        var succeeded = false
+
+        try {
+            runBlocking {
+                MediaSaverToDisk.save(
+                    localFile = localFile,
+                    mimeType = mimeType,
+                    context = context,
+                    onSuccess = { succeeded = true },
+                    onError = { failure = it },
+                )
+            }
+        } finally {
+            localFile.delete()
+        }
+
+        // Surfaces e.g. the #4009 IllegalArgumentException as the test failure message.
+        assertNull("save() reported an error: ${failure?.message}", failure)
+        assertTrue("save() never reported success", succeeded)
+    }
+}

amethyst/src/androidTest/java/com/vitorpamplona/amethyst/ui/actions/MediaSaverToDiskLegacyStorageTest.kt

@@ -0,0 +1,155 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.ui.actions
+
+import android.Manifest
+import android.content.pm.PackageManager
+import android.os.Build
+import android.os.Environment
+import android.os.ParcelFileDescriptor
+import androidx.test.ext.junit.runners.AndroidJUnit4
+import androidx.test.platform.app.InstrumentationRegistry
+import org.junit.After
+import org.junit.Assert.assertEquals
+import org.junit.Assume.assumeTrue
+import org.junit.Before
+import org.junit.Test
+import org.junit.runner.RunWith
+import java.io.File
+import java.io.IOException
+
+/**
+ * Covers the pre-Q writer, which MediaStore never sees: below API 29 saveContentDefault
+ * writes straight to a public directory and lets the media scanner index it.
+ *
+ * That path used to hardcode Pictures for every content type, so videos, audio and PDFs
+ * were all filed under Pictures/Amethyst. It now routes through the same MediaStoreTarget
+ * as the MediaStore path. minSdk is 26, so this range ships.
+ *
+ * There is no JVM coverage of any of this: Build.VERSION.SDK_INT is 0 under
+ * returnDefaultValues, so unit tests can only reach the routing function, never the writer.
+ *
+ * **Running this suite:** below Q the storage grant must exist before the app process
+ * forks (external storage is mounted at fork time), and Gradle's connectedAndroidTest
+ * installs and instruments with no window to grant in between - so these tests skip
+ * under it. Drive them manually on an API 26-28 device:
+ * ```
+ * ./gradlew :amethyst:assemblePlayDebug :amethyst:assemblePlayDebugAndroidTest
+ * adb install -r -g amethyst/build/outputs/apk/play/debug/amethyst-play-arm64-v8a-debug.apk
+ * adb install -r -g amethyst/build/outputs/apk/androidTest/play/debug/amethyst-play-debug-androidTest.apk
+ * adb shell am instrument -w -e class com.vitorpamplona.amethyst.ui.actions.MediaSaverToDiskLegacyStorageTest \
+ *     com.vitorpamplona.amethyst.debug.test/androidx.test.runner.AndroidJUnitRunner
+ * ```
+ */
+@RunWith(AndroidJUnit4::class)
+class MediaSaverToDiskLegacyStorageTest {
+    private val context get() = InstrumentationRegistry.getInstrumentation().targetContext
+
+    /** Every directory production can write to, straight from the routing table. */
+    private val watchedDirs = MediaSaverToDisk.MediaStoreTarget.entries.map { it.relativeDirectory }
+    private val createdFiles = mutableListOf<File>()
+
+    @Before
+    fun onlyBelowScopedStorage() {
+        assumeTrue("saveContentDefault only runs below API 29", Build.VERSION.SDK_INT < Build.VERSION_CODES.Q)
+
+        // The legacy writer needs the runtime permission; no androidx.test:rules on the
+        // classpath, so grant it through the instrumentation shell instead. The output has
+        // to be drained: executeShellCommand runs asynchronously and closing the descriptor
+        // early kills the command before it applies.
+        val fd =
+            InstrumentationRegistry
+                .getInstrumentation()
+                .uiAutomation
+                .executeShellCommand(
+                    "pm grant ${context.packageName} android.permission.WRITE_EXTERNAL_STORAGE",
+                )
+        ParcelFileDescriptor.AutoCloseInputStream(fd).use { it.readBytes() }
+
+        assertEquals(
+            "WRITE_EXTERNAL_STORAGE was not granted; the legacy writer cannot be exercised",
+            PackageManager.PERMISSION_GRANTED,
+            context.checkSelfPermission(Manifest.permission.WRITE_EXTERNAL_STORAGE),
+        )
+
+        // Holding the permission is not enough below Q: external storage is mounted into
+        // the process when it forks, so a grant to an already-running process never
+        // reaches it and every write fails with EACCES. Probe for real writability and
+        // skip rather than report a routing failure that is really a harness problem.
+        assumeTrue(
+            "External storage is not writable by this process; below API 29 the grant must " +
+                "exist at install time. See this class's KDoc for the exact run recipe.",
+            canWriteToPublicStorage(),
+        )
+    }
+
+    private fun canWriteToPublicStorage(): Boolean =
+        try {
+            val dir = amethystDir("Movies").apply { if (!exists()) mkdirs() }
+            val probe = File(dir, ".write-probe-${System.nanoTime()}")
+            val writable = probe.createNewFile()
+            probe.delete()
+            writable
+        } catch (e: IOException) {
+            false
+        }
+
+    @After
+    fun cleanUp() {
+        createdFiles.forEach { it.delete() }
+    }
+
+    @Test
+    fun videoGoesToMovies() = assertRoutes("video/mp4", "Movies")
+
+    @Test
+    fun imageGoesToPictures() = assertRoutes("image/jpeg", "Pictures")
+
+    @Test
+    fun audioGoesToMusic() = assertRoutes("audio/mpeg", "Music")
+
+    @Test
+    fun pdfGoesToDownloads() = assertRoutes("application/pdf", "Download")
+
+    /**
+     * Saves one file and asserts it appeared under [expectedDir]/Amethyst and nowhere else.
+     * Checking the other directories is the point: the bug was everything landing in Pictures.
+     */
+    private fun assertRoutes(
+        mimeType: String,
+        expectedDir: String,
+    ) {
+        val before = snapshot()
+
+        MediaSaverTestSupport.saveAndAssertSuccess(context, mimeType)
+
+        val added = snapshot().mapValues { (dir, names) -> names - before.getValue(dir) }
+        added.forEach { (dir, names) -> names.forEach { createdFiles.add(File(amethystDir(dir), it)) } }
+
+        val dirsThatGrew = added.filterValues { it.isNotEmpty() }.keys
+        assertEquals("$mimeType should land only in $expectedDir/Amethyst", setOf(expectedDir), dirsThatGrew)
+        assertEquals("expected exactly one new file", 1, added.getValue(expectedDir).size)
+    }
+
+    private fun amethystDir(publicDir: String) = File(Environment.getExternalStoragePublicDirectory(publicDir), "Amethyst")
+
+    private fun snapshot(): Map<String, Set<String>> = watchedDirs.associateWith { amethystDir(it).list()?.toSet() ?: emptySet() }
+}

amethyst/src/androidTest/java/com/vitorpamplona/amethyst/ui/actions/MediaSaverToDiskMediaStoreTest.kt

@@ -0,0 +1,117 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.ui.actions
+
+import android.content.ContentResolver
+import android.content.ContentUris
+import android.net.Uri
+import android.os.Build
+import android.provider.MediaStore
+import androidx.test.ext.junit.runners.AndroidJUnit4
+import androidx.test.platform.app.InstrumentationRegistry
+import org.junit.After
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertTrue
+import org.junit.Assume.assumeTrue
+import org.junit.Before
+import org.junit.Test
+import org.junit.runner.RunWith
+
+/**
+ * End-to-end regression test for issue #4009: drives the real ContentResolver, so it
+ * catches both symptoms of a collection/directory mismatch - Android 10 rejects the
+ * insert outright (the quoted rejection lives in [MediaSaverToDisk.MediaStoreTarget]'s
+ * KDoc), and later releases accept it and silently misfile the video.
+ */
+@RunWith(AndroidJUnit4::class)
+class MediaSaverToDiskMediaStoreTest {
+    private val context get() = InstrumentationRegistry.getInstrumentation().targetContext
+    private val resolver: ContentResolver get() = context.contentResolver
+
+    /** Only rows this test inserted, as item Uris in the collection they went into. */
+    private val created = mutableListOf<Uri>()
+
+    @Before
+    fun requiresScopedStorage() {
+        assumeTrue("saveContentQ only runs on API 29+", Build.VERSION.SDK_INT >= Build.VERSION_CODES.Q)
+    }
+
+    @After
+    fun cleanUp() {
+        created.forEach { resolver.delete(it, null, null) }
+    }
+
+    @Test
+    fun savingAVideoLandsInMoviesAndNotPictures() {
+        val relativePath = saveAndReadBackRelativePath("video/mp4", MediaStore.Video.Media.EXTERNAL_CONTENT_URI)
+
+        assertEquals("Movies/Amethyst/", relativePath)
+    }
+
+    @Test
+    fun savingAnImageStillLandsInPictures() {
+        val relativePath = saveAndReadBackRelativePath("image/jpeg", MediaStore.Images.Media.EXTERNAL_CONTENT_URI)
+
+        assertEquals("Pictures/Amethyst/", relativePath)
+    }
+
+    private fun saveAndReadBackRelativePath(
+        mimeType: String,
+        collection: Uri,
+    ): String? {
+        // Anything at or below this id predates the test and must never be read or deleted:
+        // this suite is meant to be runnable on a real device holding real media.
+        val highWaterMark = maxIdIn(collection)
+
+        MediaSaverTestSupport.saveAndAssertSuccess(context, mimeType)
+
+        return rowInsertedAfter(collection, highWaterMark)
+    }
+
+    private fun maxIdIn(collection: Uri): Long {
+        resolver
+            .query(collection, arrayOf(MediaStore.MediaColumns._ID), null, null, "${MediaStore.MediaColumns._ID} DESC")
+            ?.use { cursor ->
+                if (cursor.moveToFirst()) return cursor.getLong(0)
+            }
+        return -1L
+    }
+
+    /** Reads back the row the save just inserted and records it for cleanup. */
+    private fun rowInsertedAfter(
+        collection: Uri,
+        highWaterMark: Long,
+    ): String? {
+        resolver
+            .query(
+                collection,
+                arrayOf(MediaStore.MediaColumns._ID, MediaStore.MediaColumns.RELATIVE_PATH),
+                "${MediaStore.MediaColumns._ID} > ?",
+                arrayOf(highWaterMark.toString()),
+                "${MediaStore.MediaColumns._ID} ASC",
+            )?.use { cursor ->
+                assertTrue("save() reported success but inserted no row into $collection", cursor.moveToFirst())
+                created.add(ContentUris.withAppendedId(collection, cursor.getLong(0)))
+                return cursor.getString(1)
+            }
+        return null
+    }
+}

amethyst/src/androidTest/java/com/vitorpamplona/amethyst/ui/actions/MediaStoreTargetInstrumentedTest.kt

@@ -0,0 +1,45 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.ui.actions
+
+import android.os.Environment
+import androidx.test.ext.junit.runners.AndroidJUnit4
+import com.vitorpamplona.amethyst.ui.actions.MediaSaverToDisk.MediaStoreTarget
+import org.junit.Assert.assertEquals
+import org.junit.Test
+import org.junit.runner.RunWith
+
+/**
+ * [MediaStoreTarget] spells its directories out as literals because Environment's
+ * DIRECTORY_* fields are plain statics that the unit-test android.jar leaves null.
+ * This is the other half of that trade: on a real device the literals are checked
+ * against the platform constants they stand in for.
+ */
+@RunWith(AndroidJUnit4::class)
+class MediaStoreTargetInstrumentedTest {
+    @Test
+    fun directoriesMatchThePlatformConstants() {
+        assertEquals(Environment.DIRECTORY_PICTURES, MediaStoreTarget.IMAGES.relativeDirectory)
+        assertEquals(Environment.DIRECTORY_MUSIC, MediaStoreTarget.AUDIO.relativeDirectory)
+        assertEquals(Environment.DIRECTORY_MOVIES, MediaStoreTarget.VIDEO.relativeDirectory)
+        assertEquals(Environment.DIRECTORY_DOWNLOADS, MediaStoreTarget.DOWNLOADS.relativeDirectory)
+    }
+}

amethyst/src/androidTest/java/com/vitorpamplona/amethyst/ui/actions/uploads/FileProviderPathsTest.kt

@@ -0,0 +1,84 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.ui.actions.uploads
+
+import android.os.Environment
+import androidx.core.content.FileProvider
+import androidx.test.ext.junit.runners.AndroidJUnit4
+import androidx.test.platform.app.InstrumentationRegistry
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertTrue
+import org.junit.Assert.fail
+import org.junit.Test
+import org.junit.runner.RunWith
+import java.io.File
+
+/**
+ * Pins what `res/xml/file_paths.xml` is allowed to hand out.
+ *
+ * The provider root used to be `<external-path path=".">`, i.e. the whole of
+ * `Environment.getExternalStorageDirectory()`. It is now the app-specific
+ * `<external-files-path>`, which is the only external location Amethyst ever
+ * shares from (camera/video capture). These tests fail if either half of that
+ * regresses: the capture paths must still resolve, and the external-storage
+ * root must not.
+ */
+@RunWith(AndroidJUnit4::class)
+class FileProviderPathsTest {
+    private val context = InstrumentationRegistry.getInstrumentation().targetContext
+    private val authority = "${context.packageName}.provider"
+
+    @Test
+    fun photoCaptureUriResolves() {
+        val uri = getPhotoUri(context)
+        assertEquals("content", uri.scheme)
+        assertEquals(authority, uri.authority)
+        assertTrue("expected the external_files root, got $uri", uri.path!!.startsWith("/external_files/"))
+    }
+
+    @Test
+    fun videoCaptureUriResolves() {
+        val uri = getVideoUri(context)
+        assertEquals("content", uri.scheme)
+        assertEquals(authority, uri.authority)
+        assertTrue("expected the external_files root, got $uri", uri.path!!.startsWith("/external_files/"))
+    }
+
+    @Test
+    fun cacheDirStillResolves() {
+        val file = File(context.cacheDir, "amethyst_share_probe.png")
+        val uri = FileProvider.getUriForFile(context, authority, file)
+        assertEquals(authority, uri.authority)
+        assertTrue("expected the cache root, got $uri", uri.path!!.startsWith("/cache/"))
+    }
+
+    @Test
+    fun externalStorageRootIsNoLongerShareable() {
+        @Suppress("DEPRECATION")
+        val outside = File(Environment.getExternalStorageDirectory(), "Download/not-ours.pdf")
+        try {
+            val uri = FileProvider.getUriForFile(context, authority, outside)
+            fail("FileProvider should not map $outside, but produced $uri")
+        } catch (expected: IllegalArgumentException) {
+            // Correct: no configured root contains it.
+        }
+    }
+}

amethyst/src/androidTest/java/com/vitorpamplona/amethyst/ui/insets/ComposeImeInsetWedgeTest.kt

@@ -0,0 +1,191 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.ui.insets
+
+import android.view.View
+import android.view.animation.LinearInterpolator
+import androidx.compose.foundation.layout.ExperimentalLayoutApi
+import androidx.compose.foundation.layout.WindowInsets
+import androidx.compose.foundation.layout.ime
+import androidx.compose.foundation.layout.imeAnimationTarget
+import androidx.compose.runtime.getValue
+import androidx.compose.runtime.mutableIntStateOf
+import androidx.compose.runtime.setValue
+import androidx.compose.ui.platform.LocalDensity
+import androidx.compose.ui.platform.LocalView
+import androidx.compose.ui.test.junit4.createComposeRule
+import androidx.core.graphics.Insets
+import androidx.core.view.OnApplyWindowInsetsListener
+import androidx.core.view.WindowInsetsAnimationCompat
+import androidx.core.view.WindowInsetsCompat
+import org.junit.Assert.assertEquals
+import org.junit.Ignore
+import org.junit.Rule
+import org.junit.Test
+
+/**
+ * Upstream regression test for androidx.compose.foundation:foundation-layout.
+ *
+ * A `WindowInsetsAnimation` that is prepared and started but never ended — which is what a
+ * cancelled IME animation looks like — leaves `InsetsListener.runningAnimation` set forever.
+ * `onApplyWindowInsets` then matches neither of its two branches, so `composeInsets.update()`
+ * is never called again and `WindowInsets.ime` is dead for the life of the window.
+ *
+ * Introduced in 1.4.0 (absent in 1.3.0, where `onApplyWindowInsets` updated unconditionally
+ * once `onStart` had cleared `prepared`). Still present in 1.12.0 and 1.13.0-alpha01. The
+ * compensating self-heal (`view.post(this)` -> `run()`) is scoped to `SDK_INT == R`, so on
+ * API 31+ nothing clears the flag; `WindowInsetsHolder.resetState()` only runs when the
+ * holder's accessCount transitions 0 -> 1, which never happens in an app whose shell always
+ * reads insets.
+ *
+ * Filed upstream as b/552500419.
+ *
+ * [aCancelledImeAnimationMustNotWedgeTheAnimatedInset] FAILS on every version from 1.4.0 on, so it
+ * is [Ignore]d to keep CI green. It is not a test of Amethyst code — it is the upstream repro we
+ * attached to the bug. **Re-run it by hand after every Compose upgrade**: when it passes, the
+ * upstream fix has landed and [com.vitorpamplona.amethyst.ui.insets.SafeImeInsets] can be retired.
+ *
+ * [theAnimationTargetSurvivesTheWedge] documents the asymmetry that makes a workaround possible
+ * and is expected to PASS — `updateImeAnimationTarget` is called outside the guard. It stays
+ * enabled, because it guards the premise [com.vitorpamplona.amethyst.ui.insets.SafeImeInsets]
+ * depends on: if a future Compose release stopped keeping `imeAnimationTarget` current, our
+ * fallback would silently start reading a dead value too.
+ */
+class ComposeImeInsetWedgeTest {
+    @get:Rule val rule = createComposeRule()
+
+    private val keyboardHeight = 957
+
+    private fun imeInsets(bottom: Int): WindowInsetsCompat =
+        WindowInsetsCompat
+            .Builder()
+            .setInsets(WindowInsetsCompat.Type.ime(), Insets.of(0, 0, 0, bottom))
+            .setVisible(WindowInsetsCompat.Type.ime(), bottom > 0)
+            .build()
+
+    /** Compose's own listener for this view. Private class, but both interfaces it exposes are public. */
+    private fun listenerFor(view: View): Any {
+        val holderClass = Class.forName("androidx.compose.foundation.layout.WindowInsetsHolder")
+        val companion =
+            holderClass.getDeclaredField("Companion").run {
+                isAccessible = true
+                get(null)
+            }
+        val holder =
+            companion.javaClass
+                .getDeclaredMethod("getOrCreateFor", View::class.java)
+                .run {
+                    isAccessible = true
+                    invoke(companion, view)
+                }
+        return holderClass.getDeclaredField("insetsListener").run {
+            isAccessible = true
+            get(holder)!!
+        }
+    }
+
+    private fun anim() = WindowInsetsAnimationCompat(WindowInsetsCompat.Type.ime(), LinearInterpolator(), 250L)
+
+    private fun bounds() =
+        WindowInsetsAnimationCompat.BoundsCompat(
+            Insets.NONE,
+            Insets.of(0, 0, 0, keyboardHeight),
+        )
+
+    @OptIn(ExperimentalLayoutApi::class)
+    @Test
+    @Ignore("Fails by design until upstream fixes b/552500419 — re-run by hand on every Compose upgrade")
+    fun aCancelledImeAnimationMustNotWedgeTheAnimatedInset() {
+        var animated by mutableIntStateOf(-1)
+        lateinit var view: View
+
+        rule.setContent {
+            view = LocalView.current
+            val density = LocalDensity.current
+            animated = WindowInsets.ime.getBottom(density)
+        }
+        rule.waitForIdle()
+
+        val listener = listenerFor(view)
+        val onApply = listener as OnApplyWindowInsetsListener
+        val callback = listener as WindowInsetsAnimationCompat.Callback
+
+        // Baseline: with no animation in flight the inset tracks normally.
+        rule.runOnUiThread { onApply.onApplyWindowInsets(view, imeInsets(keyboardHeight)) }
+        rule.waitForIdle()
+        assertEquals("baseline: the inset must follow a plain dispatch", keyboardHeight, animated)
+
+        // A cancelled animation: prepared and started, but onEnd never arrives.
+        rule.runOnUiThread {
+            callback.onPrepare(anim())
+            callback.onStart(anim(), bounds())
+        }
+        rule.waitForIdle()
+
+        // The keyboard is gone and the window says so. The animated inset must follow.
+        rule.runOnUiThread { onApply.onApplyWindowInsets(view, imeInsets(0)) }
+        rule.waitForIdle()
+
+        assertEquals(
+            "WindowInsets.ime must still track the window after an animation was cancelled " +
+                "without onEnd; it is instead frozen at the keyboard height forever",
+            0,
+            animated,
+        )
+    }
+
+    @OptIn(ExperimentalLayoutApi::class)
+    @Test
+    fun theAnimationTargetSurvivesTheWedge() {
+        var target by mutableIntStateOf(-1)
+        lateinit var view: View
+
+        rule.setContent {
+            view = LocalView.current
+            val density = LocalDensity.current
+            target = WindowInsets.imeAnimationTarget.getBottom(density)
+        }
+        rule.waitForIdle()
+
+        val listener = listenerFor(view)
+        val onApply = listener as OnApplyWindowInsetsListener
+        val callback = listener as WindowInsetsAnimationCompat.Callback
+
+        rule.runOnUiThread { onApply.onApplyWindowInsets(view, imeInsets(keyboardHeight)) }
+        rule.waitForIdle()
+        assertEquals(keyboardHeight, target)
+
+        rule.runOnUiThread {
+            callback.onPrepare(anim())
+            callback.onStart(anim(), bounds())
+        }
+        rule.waitForIdle()
+
+        rule.runOnUiThread { onApply.onApplyWindowInsets(view, imeInsets(0)) }
+        rule.waitForIdle()
+
+        assertEquals(
+            "updateImeAnimationTarget is called outside the guard, so this reading stays truthful",
+            0,
+            target,
+        )
+    }
+}

amethyst/src/androidTest/java/com/vitorpamplona/amethyst/ui/note/DeferredAnimationTest.kt

@@ -0,0 +1,91 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.ui.note
+
+import androidx.compose.animation.core.tween
+import androidx.compose.material3.Text
+import androidx.compose.runtime.mutableStateOf
+import androidx.compose.ui.Alignment
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.platform.testTag
+import androidx.compose.ui.test.assertIsDisplayed
+import androidx.compose.ui.test.junit4.createComposeRule
+import androidx.compose.ui.test.onNodeWithTag
+import androidx.test.ext.junit.runners.AndroidJUnit4
+import com.vitorpamplona.amethyst.ui.actions.DeferredCrossfade
+import org.junit.Rule
+import org.junit.Test
+import org.junit.runner.RunWith
+
+/**
+ * The feed's animated elements defer building their `Transition` until a value actually changes,
+ * because first composition has nothing to animate and building one per card per scroll is pure
+ * waste (measured: roughly half the composition cost of every reaction-row button).
+ *
+ * The whole point of deferring rather than removing is that the animation must still play. These
+ * tests pin that: they drive the clock manually and assert that the **first** change — the one that
+ * happens right after the transition is lazily created — still shows outgoing and incoming content
+ * simultaneously, which only a running animation does. A regression that turned the deferral into a
+ * plain snap would show exactly one of them and fail here.
+ */
+@RunWith(AndroidJUnit4::class)
+class DeferredAnimationTest {
+    @get:Rule
+    val rule = createComposeRule()
+
+    @Test
+    fun deferredCrossfadeStillAnimatesTheFirstChange() {
+        val state = mutableStateOf("A")
+        rule.mainClock.autoAdvance = false
+
+        rule.setContent {
+            DeferredCrossfade(
+                targetState = state.value,
+                modifier = Modifier,
+                contentAlignment = Alignment.TopStart,
+                animationSpec = tween(DURATION_MS),
+                label = "test",
+            ) { value ->
+                Text(value, modifier = Modifier.testTag("text_$value"))
+            }
+        }
+
+        // Before any change the transition has not been built, and only the current value renders.
+        rule.onNodeWithTag("text_A").assertIsDisplayed()
+        rule.onNodeWithTag("text_B").assertDoesNotExist()
+
+        state.value = "B"
+        rule.mainClock.advanceTimeByFrame()
+        rule.mainClock.advanceTimeBy(DURATION_MS / 3L)
+
+        // Mid-crossfade both are in the tree. This is the assertion that a snap would fail.
+        rule.onNodeWithTag("text_A").assertExists()
+        rule.onNodeWithTag("text_B").assertExists()
+
+        rule.mainClock.advanceTimeBy(DURATION_MS * 3L)
+        rule.onNodeWithTag("text_B").assertIsDisplayed()
+        rule.onNodeWithTag("text_A").assertDoesNotExist()
+    }
+
+    companion object {
+        const val DURATION_MS = 300
+    }
+}

amethyst/src/androidTest/java/com/vitorpamplona/amethyst/ui/screen/loggedIn/relays/eventsync/EventSyncTest.kt

@@ -22,7 +22,7 @@ package com.vitorpamplona.amethyst.ui.screen.loggedIn.relays.eventsync
 
 import androidx.test.ext.junit.runners.AndroidJUnit4
 import com.vitorpamplona.amethyst.commons.defaults.Constants
-import com.vitorpamplona.amethyst.service.okhttp.DefaultContentTypeInterceptor
+import com.vitorpamplona.amethyst.commons.service.http.DefaultContentTypeInterceptor
 import com.vitorpamplona.quartz.nip01Core.crypto.KeyPair
 import com.vitorpamplona.quartz.nip01Core.relay.client.NostrClient
 import com.vitorpamplona.quartz.nip01Core.relay.client.accessories.RelayLogger

amethyst/src/fdroid/java/com/vitorpamplona/amethyst/service/ai/NoOpWritingAssistant.kt

@@ -20,9 +20,16 @@
  */
 package com.vitorpamplona.amethyst.service.ai
 
+import com.vitorpamplona.amethyst.commons.service.ai.WritingAssistant
+import com.vitorpamplona.amethyst.commons.service.ai.WritingAssistantStatus
+import com.vitorpamplona.amethyst.commons.service.ai.WritingResult
+import com.vitorpamplona.amethyst.commons.service.ai.WritingTone
+
 class NoOpWritingAssistant : WritingAssistant {
     override suspend fun checkAvailability(): WritingAssistantStatus = WritingAssistantStatus.Unavailable
 
+    override suspend fun requestDownload(): WritingAssistantStatus = WritingAssistantStatus.Unavailable
+
     override suspend fun transform(
         text: String,
         tone: WritingTone,

amethyst/src/fdroid/java/com/vitorpamplona/amethyst/service/ai/WritingAssistantFactory.kt

@@ -21,8 +21,12 @@
 package com.vitorpamplona.amethyst.service.ai
 
 import android.content.Context
+import com.vitorpamplona.amethyst.commons.service.ai.WritingAssistant
 
 object WritingAssistantFactory {
+    /** Whether this flavor ships a real assistant. Drives the Settings tile. */
+    const val IS_SUPPORTED = false
+
     @Suppress("UNUSED_PARAMETER")
     fun create(context: Context): WritingAssistant = NoOpWritingAssistant()
 }

amethyst/src/fdroid/java/com/vitorpamplona/amethyst/ui/components/SelectNotificationProvider.kt

@@ -54,9 +54,19 @@ import com.halilibo.richtext.markdown.BasicMarkdown
 import com.halilibo.richtext.ui.RichTextStyle
 import com.halilibo.richtext.ui.material3.RichText
 import com.halilibo.richtext.ui.resolveDefaults
-import com.vitorpamplona.amethyst.R
 import com.vitorpamplona.amethyst.commons.icons.symbols.Icon
 import com.vitorpamplona.amethyst.commons.icons.symbols.MaterialSymbols
+import com.vitorpamplona.amethyst.commons.resources.Res
+import com.vitorpamplona.amethyst.commons.resources.error_dialog_button_ok
+import com.vitorpamplona.amethyst.commons.resources.push_server_explainer
+import com.vitorpamplona.amethyst.commons.resources.push_server_install_app
+import com.vitorpamplona.amethyst.commons.resources.push_server_install_app_description
+import com.vitorpamplona.amethyst.commons.resources.push_server_none
+import com.vitorpamplona.amethyst.commons.resources.push_server_none_explainer
+import com.vitorpamplona.amethyst.commons.resources.push_server_title
+import com.vitorpamplona.amethyst.commons.resources.push_server_uses_app_explainer
+import com.vitorpamplona.amethyst.commons.resources.quick_action_dont_show_again_button
+import com.vitorpamplona.amethyst.commons.resources.select_push_server
 import com.vitorpamplona.amethyst.model.UiSettingsFlow
 import com.vitorpamplona.amethyst.service.notifications.PushDistributorHandler
 import com.vitorpamplona.amethyst.ui.screen.loggedIn.settings.SettingsBlockTile
@@ -100,7 +110,7 @@ fun SelectNotificationProvider(sharedPrefs: UiSettingsFlow) {
                 LoadDistributors { currentDistributor, list, readableListWithExplainer ->
                     if (readableListWithExplainer.size > 1) {
                         SpinnerSelectionDialog(
-                            title = stringRes(id = R.string.select_push_server),
+                            title = stringRes(id = Res.string.select_push_server),
                             options = readableListWithExplainer,
                             onSelect = { index ->
                                 if (list[index] == "None") {
@@ -122,9 +132,9 @@ fun SelectNotificationProvider(sharedPrefs: UiSettingsFlow) {
                     } else {
                         AlertDialog(
                             onDismissRequest = { distributorPresent = true },
-                            title = { Text(stringRes(R.string.push_server_install_app)) },
+                            title = { Text(stringRes(Res.string.push_server_install_app)) },
                             text = {
-                                val content = stringRes(R.string.push_server_install_app_description)
+                                val content = stringRes(Res.string.push_server_install_app_description)
 
                                 val astNode =
                                     remember {
@@ -149,7 +159,7 @@ fun SelectNotificationProvider(sharedPrefs: UiSettingsFlow) {
                                             sharedPrefs.dontShowPushNotificationSelector()
                                         },
                                     ) {
-                                        Text(stringRes(R.string.quick_action_dont_show_again_button))
+                                        Text(stringRes(Res.string.quick_action_dont_show_again_button))
                                     }
                                     Button(
                                         onClick = { distributorPresent = true },
@@ -163,7 +173,7 @@ fun SelectNotificationProvider(sharedPrefs: UiSettingsFlow) {
                                                 contentDescription = null,
                                             )
                                             Spacer(Modifier.width(8.dp))
-                                            Text(stringRes(R.string.error_dialog_button_ok))
+                                            Text(stringRes(Res.string.error_dialog_button_ok))
                                         }
                                     }
                                 }
@@ -191,12 +201,12 @@ fun LoadDistributors(onInner: @Composable (String, ImmutableList<String>, Immuta
             .mapIndexed { index, name ->
                 TitleExplainer(
                     name,
-                    stringRes(id = R.string.push_server_uses_app_explainer, list[index]),
+                    stringRes(id = Res.string.push_server_uses_app_explainer, list[index]),
                 )
             }.plus(
                 TitleExplainer(
-                    stringRes(id = R.string.push_server_none),
-                    stringRes(id = R.string.push_server_none_explainer),
+                    stringRes(id = Res.string.push_server_none),
+                    stringRes(id = Res.string.push_server_none_explainer),
                 ),
             ).toImmutableList()
 
@@ -217,8 +227,8 @@ fun PushNotificationProviderTile(sharedPrefs: UiSettingsFlow) {
         val selectedIndex = list.indexOf(currentDistributor).coerceAtLeast(0)
         SettingsBlockTile(
             icon = MaterialSymbols.CloudSync,
-            title = stringRes(R.string.push_server_title),
-            description = stringRes(R.string.push_server_explainer),
+            title = stringRes(Res.string.push_server_title),
+            description = stringRes(Res.string.push_server_explainer),
         ) {
             TextSpinner(
                 label = null,

amethyst/src/main/AndroidManifest.xml

@@ -16,6 +16,69 @@
         <intent>
             <action android:name="android.intent.action.TTS_SERVICE" />
         </intent>
+
+        <!-- NIP-A3 payment targets. Android 11+ package visibility means
+             queryIntentActivities returns NOTHING for a scheme not declared here,
+             so without these the zap picker's pay-to chip is invisible on every
+             modern device. Specific <intent> filters rather than
+             QUERY_ALL_PACKAGES, which is policy-restricted on Play.
+             Unknown target types all fall back to payto://<type>/<authority>,
+             so the single payto entry covers the open-ended tail.
+             No <category>: a category here narrows visibility the same way it
+             narrows an intent match, and would hide any app whose filter declares
+             only DEFAULT - which is what our ACTION_VIEW hand-off actually uses. -->
+        <intent>
+            <action android:name="android.intent.action.VIEW" />
+            <data android:scheme="payto" />
+        </intent>
+        <intent>
+            <action android:name="android.intent.action.VIEW" />
+            <data android:scheme="bitcoin" />
+        </intent>
+        <intent>
+            <action android:name="android.intent.action.VIEW" />
+            <data android:scheme="lightning" />
+        </intent>
+        <intent>
+            <action android:name="android.intent.action.VIEW" />
+            <data android:scheme="liquidnetwork" />
+        </intent>
+        <intent>
+            <action android:name="android.intent.action.VIEW" />
+            <data android:scheme="ethereum" />
+        </intent>
+        <intent>
+            <action android:name="android.intent.action.VIEW" />
+            <data android:scheme="monero" />
+        </intent>
+        <intent>
+            <action android:name="android.intent.action.VIEW" />
+            <data android:scheme="dash" />
+        </intent>
+        <intent>
+            <action android:name="android.intent.action.VIEW" />
+            <data android:scheme="zcash" />
+        </intent>
+        <intent>
+            <action android:name="android.intent.action.VIEW" />
+            <data android:scheme="bitcoincash" />
+        </intent>
+        <intent>
+            <action android:name="android.intent.action.VIEW" />
+            <data android:scheme="litecoin" />
+        </intent>
+        <intent>
+            <action android:name="android.intent.action.VIEW" />
+            <data android:scheme="dogecoin" />
+        </intent>
+        <intent>
+            <action android:name="android.intent.action.VIEW" />
+            <data android:scheme="solana" />
+        </intent>
+        <intent>
+            <action android:name="android.intent.action.VIEW" />
+            <data android:scheme="tron" />
+        </intent>
     </queries>
 
 
@@ -52,6 +115,7 @@
     <uses-permission android:name="android.permission.FOREGROUND_SERVICE_MEDIA_PLAYBACK" />
     <uses-permission android:name="android.permission.FOREGROUND_SERVICE_MICROPHONE" />
     <uses-permission android:name="android.permission.FOREGROUND_SERVICE_CAMERA" />
+    <uses-permission android:name="android.permission.FOREGROUND_SERVICE_MEDIA_PROJECTION" />
     <uses-permission android:name="android.permission.FOREGROUND_SERVICE_PHONE_CALL" />
     <uses-permission android:name="android.permission.FOREGROUND_SERVICE_SPECIAL_USE" />
     <uses-permission android:name="android.permission.FOREGROUND_SERVICE_DATA_SYNC" />
@@ -453,7 +517,7 @@
 
         <service
             android:name=".service.call.CallForegroundService"
-            android:foregroundServiceType="microphone|camera|phoneCall"
+            android:foregroundServiceType="microphone|camera|phoneCall|mediaProjection"
             android:stopWithTask="false"
             android:exported="false" />
 
@@ -579,6 +643,17 @@
             android:excludeFromRecents="true"
             android:launchMode="singleTop"
             android:theme="@android:style/Theme.Translucent.NoTitleBar" />
+        <!-- Invisible host that runs the system file picker for an embedded WebView surface. The
+             `:napplet` providers are windowless services with no Activity of their own, so the main
+             process collects the pick and relays the URIs back to the sandbox. -->
+        <!-- Standard launch mode on purpose: two embedded surfaces can each have a pick in flight, and
+             singleTop would collapse the second onto the first and strand its page's file input. -->
+        <activity
+            android:name=".napplet.WebFileChooserActivity"
+            android:exported="false"
+            android:excludeFromRecents="true"
+            android:configChanges="orientation|screenSize|screenLayout|smallestScreenSize|keyboardHidden|keyboard|uiMode|navigation|fontScale|density"
+            android:theme="@android:style/Theme.Translucent.NoTitleBar" />
         <!-- First-connect "Connect to Nostr" dialog. -->
         <activity
             android:name=".connectedApps.consent.SignerConnectActivity"

amethyst/src/main/java/com/vitorpamplona/amethyst/Amethyst.kt

@@ -23,12 +23,15 @@ package com.vitorpamplona.amethyst
 import android.app.Application
 import android.content.ComponentCallbacks2
 import android.os.Build
+import com.vitorpamplona.amethyst.commons.service.http.HttpClientEnvironment
+import com.vitorpamplona.amethyst.commons.service.http.MediaCallEventListener
 import com.vitorpamplona.amethyst.favorites.BrowserHistoryRegistry
 import com.vitorpamplona.amethyst.favorites.BrowserIconRegistry
 import com.vitorpamplona.amethyst.favorites.FavoriteAppsRegistry
 import com.vitorpamplona.amethyst.napplet.WebAppNetworkRegistry
 import com.vitorpamplona.amethyst.service.logging.Logging
 import com.vitorpamplona.amethyst.service.nests.AppForegroundRecycleHook
+import com.vitorpamplona.amethyst.service.okhttp.isEmulator
 import com.vitorpamplona.amethyst.service.priority.WorkerThreadPriorityGovernor
 import com.vitorpamplona.amethyst.ui.screen.loggedIn.embed.EmbeddedTabHost
 import com.vitorpamplona.quartz.utils.Log
@@ -57,6 +60,9 @@ import java.io.File
  */
 class Amethyst : Application() {
     init {
+        // Deliberately in init, not onCreate: this runs in EVERY process, including the
+        // :napplet sandbox, whose onCreate early-returns. Moving it would leave that
+        // process on the wrapper's DEBUG default.
         Log.minLevel = DEFAULT_LOG_LEVEL
         Log.d("AmethystApp") { "Creating App $this" }
     }
@@ -82,9 +88,14 @@ class Amethyst : Application() {
          */
         val DEFAULT_LOG_LEVEL: LogLevel =
             when {
-                !BuildConfig.DEBUG -> LogLevel.WARN
-                VERBOSE_LOGS -> LogLevel.DEBUG
-                else -> LogLevel.INFO
+                // `isDebug` also covers the `benchmark` build type — a release build (R8 + AOT)
+                // that exists purely to be measured and is never shipped. Treating it as a release
+                // build left it at WARN, which drops every INFO milestone the boot narrative is
+                // made of (account load timings, Tor status transitions, the relay census), so the
+                // one variant whose numbers are trustworthy was also the one we could not read.
+                VERBOSE_LOGS && isDebug -> LogLevel.DEBUG
+                isDebug -> LogLevel.INFO
+                else -> LogLevel.WARN
             }
 
         lateinit var instance: AppModules
@@ -118,6 +129,12 @@ class Amethyst : Application() {
 
         Log.i("AmethystApp") { "Amethyst ${BuildConfig.VERSION_NAME} starting in main process (log level ${Log.minLevel})" }
 
+        // Both flags MUST be set before AppModules: its constructor eagerly builds the
+        // OkHttp factories, whose dispatchers read isEmulator at construction time —
+        // set afterwards, the emulator-safe limits are never applied.
+        MediaCallEventListener.verboseLogging = isDebug
+        HttpClientEnvironment.isEmulator = isEmulator()
+
         instance = AppModules(this)
 
         // Keeps the ~650 relay/ingest worker threads a cold start spawns from starving the UI

amethyst/src/main/java/com/vitorpamplona/amethyst/AppModules.kt

@@ -28,11 +28,26 @@ import androidx.security.crypto.EncryptedSharedPreferences
 import coil3.disk.DiskCache
 import coil3.memory.MemoryCache
 import com.vitorpamplona.amethyst.commons.model.NoteState
+import com.vitorpamplona.amethyst.commons.model.nip03Timestamp.BitcoinExplorerEndpoint
+import com.vitorpamplona.amethyst.commons.model.nip03Timestamp.TorAwareOkHttpOtsResolverBuilder
 import com.vitorpamplona.amethyst.commons.napplet.permissions.NappletPermissionLedger
 import com.vitorpamplona.amethyst.commons.relayClient.BlockedRelayFilteringClient
+import com.vitorpamplona.amethyst.commons.relayClient.diagnostics.BootRelayDiagnostics
+import com.vitorpamplona.amethyst.commons.relayClient.event.EventFinderQueryState
+import com.vitorpamplona.amethyst.commons.relayClient.speedLogger.RelaySpeedLogger
+import com.vitorpamplona.amethyst.commons.relayClient.user.UserFinderQueryState
+import com.vitorpamplona.amethyst.commons.relays.health.TorCircuitHealthTracker
 import com.vitorpamplona.amethyst.commons.richtext.CachedRichTextParser
 import com.vitorpamplona.amethyst.commons.robohash.CachedRobohash
 import com.vitorpamplona.amethyst.commons.scheduledposts.ScheduledPostStore
+import com.vitorpamplona.amethyst.commons.scheduledposts.ScheduledPostWorkGate
+import com.vitorpamplona.amethyst.commons.service.connectivity.ConnectivityStatus
+import com.vitorpamplona.amethyst.commons.service.http.BlossomReadAuthInterceptor
+import com.vitorpamplona.amethyst.commons.service.http.BlossomReadAuthTokenProvider
+import com.vitorpamplona.amethyst.commons.service.http.DualHttpClientManager
+import com.vitorpamplona.amethyst.commons.service.http.DualHttpClientManagerForRelays
+import com.vitorpamplona.amethyst.commons.service.http.EncryptionKeyCache
+import com.vitorpamplona.amethyst.commons.service.http.OnionLocationCache
 import com.vitorpamplona.amethyst.commons.service.lnurl.OkHttpLnurlEndpointResolver
 import com.vitorpamplona.amethyst.commons.service.pow.PoWPolicy
 import com.vitorpamplona.amethyst.commons.service.pow.PoWPublishQueue
@@ -43,18 +58,18 @@ import com.vitorpamplona.amethyst.model.Account
 import com.vitorpamplona.amethyst.model.LocalCache
 import com.vitorpamplona.amethyst.model.UiSettings
 import com.vitorpamplona.amethyst.model.accountsCache.AccountCacheState
-import com.vitorpamplona.amethyst.model.nip03Timestamp.BitcoinExplorerEndpoint
 import com.vitorpamplona.amethyst.model.nip03Timestamp.IncomingOtsEventVerifier
-import com.vitorpamplona.amethyst.model.nip03Timestamp.TorAwareOkHttpOtsResolverBuilder
 import com.vitorpamplona.amethyst.model.nip11RelayInfo.Nip11CachedRetriever
 import com.vitorpamplona.amethyst.model.preferences.BuzzAttestationPreferences
 import com.vitorpamplona.amethyst.model.preferences.BuzzChannelStarPreferences
 import com.vitorpamplona.amethyst.model.preferences.BuzzWorkspacePreferences
+import com.vitorpamplona.amethyst.model.preferences.DrawerSectionCollapsePreferences
 import com.vitorpamplona.amethyst.model.preferences.NamecoinSharedPreferences
 import com.vitorpamplona.amethyst.model.preferences.OtsSharedPreferences
 import com.vitorpamplona.amethyst.model.preferences.RelayGroupDeletionPreferences
 import com.vitorpamplona.amethyst.model.preferences.TorSharedPreferences
 import com.vitorpamplona.amethyst.model.preferences.UiSharedPreferences
+import com.vitorpamplona.amethyst.model.preferences.sharedPreferencesDataStore
 import com.vitorpamplona.amethyst.model.privacyOptions.RoleBasedHttpClientBuilder
 import com.vitorpamplona.amethyst.model.torState.AccountsTorStateConnector
 import com.vitorpamplona.amethyst.model.torState.TorRelayState
@@ -63,7 +78,6 @@ import com.vitorpamplona.amethyst.service.calendar.CalendarReminderPrefs
 import com.vitorpamplona.amethyst.service.calendar.CalendarReminderWorker
 import com.vitorpamplona.amethyst.service.cast.CastRegistry
 import com.vitorpamplona.amethyst.service.connectivity.ConnectivityManager
-import com.vitorpamplona.amethyst.service.connectivity.ConnectivityStatus
 import com.vitorpamplona.amethyst.service.crashreports.CrashReportCache
 import com.vitorpamplona.amethyst.service.crashreports.UnexpectedCrashSaver
 import com.vitorpamplona.amethyst.service.eventCache.MemoryTrimmingService
@@ -75,13 +89,7 @@ import com.vitorpamplona.amethyst.service.notifications.AlwaysOnNotificationServ
 import com.vitorpamplona.amethyst.service.notifications.NotificationDispatcher
 import com.vitorpamplona.amethyst.service.notifications.NwcPaymentNotificationWatcher
 import com.vitorpamplona.amethyst.service.notifications.PokeyReceiver
-import com.vitorpamplona.amethyst.service.okhttp.BlossomReadAuthInterceptor
-import com.vitorpamplona.amethyst.service.okhttp.BlossomReadAuthTokenProvider
-import com.vitorpamplona.amethyst.service.okhttp.DualHttpClientManager
-import com.vitorpamplona.amethyst.service.okhttp.DualHttpClientManagerForRelays
-import com.vitorpamplona.amethyst.service.okhttp.EncryptionKeyCache
 import com.vitorpamplona.amethyst.service.okhttp.OkHttpWebSocket
-import com.vitorpamplona.amethyst.service.okhttp.OnionLocationCache
 import com.vitorpamplona.amethyst.service.playback.diskCache.VideoCache
 import com.vitorpamplona.amethyst.service.playback.diskCache.VideoCacheFactory
 import com.vitorpamplona.amethyst.service.playback.pip.BackgroundMedia
@@ -91,15 +99,10 @@ import com.vitorpamplona.amethyst.service.pow.PowJobStore
 import com.vitorpamplona.amethyst.service.pow.PowMiningForegroundService
 import com.vitorpamplona.amethyst.service.relayClient.CacheClientConnector
 import com.vitorpamplona.amethyst.service.relayClient.RelayProxyClientConnector
-import com.vitorpamplona.amethyst.service.relayClient.TorCircuitHealthTracker
 import com.vitorpamplona.amethyst.service.relayClient.authCommand.model.AuthCoordinator
-import com.vitorpamplona.amethyst.service.relayClient.diagnostics.BootRelayDiagnostics
 import com.vitorpamplona.amethyst.service.relayClient.notifyCommand.model.NotifyCoordinator
 import com.vitorpamplona.amethyst.service.relayClient.reqCommand.RelaySubscriptionsCoordinator
 import com.vitorpamplona.amethyst.service.relayClient.reqCommand.account.AccountSubscriptionRegistry
-import com.vitorpamplona.amethyst.service.relayClient.reqCommand.event.EventFinderQueryState
-import com.vitorpamplona.amethyst.service.relayClient.reqCommand.user.UserFinderQueryState
-import com.vitorpamplona.amethyst.service.relayClient.speedLogger.RelaySpeedLogger
 import com.vitorpamplona.amethyst.service.resourceusage.BatteryDrainSampler
 import com.vitorpamplona.amethyst.service.resourceusage.ForegroundTimeIntegrator
 import com.vitorpamplona.amethyst.service.resourceusage.ForegroundTracker
@@ -117,7 +120,6 @@ import com.vitorpamplona.amethyst.service.resourceusage.SessionTimeIntegrator
 import com.vitorpamplona.amethyst.service.resourceusage.UsageCountingInterceptor
 import com.vitorpamplona.amethyst.service.resourceusage.UsageKeys
 import com.vitorpamplona.amethyst.service.safeCacheDir
-import com.vitorpamplona.amethyst.service.scheduledposts.ScheduledPostWorkGate
 import com.vitorpamplona.amethyst.service.scheduledposts.ScheduledPostWorker
 import com.vitorpamplona.amethyst.service.uploads.blossom.BlossomMirrorQueue
 import com.vitorpamplona.amethyst.service.uploads.blossom.BlossomSyncForegroundService
@@ -130,7 +132,6 @@ import com.vitorpamplona.amethyst.ui.screen.AccountState
 import com.vitorpamplona.amethyst.ui.screen.UiSettingsState
 import com.vitorpamplona.amethyst.ui.tor.TorManager
 import com.vitorpamplona.amethyst.ui.tor.TorService
-import com.vitorpamplona.amethyst.ui.tor.TorServiceStatus
 import com.vitorpamplona.quartz.nip01Core.core.Address
 import com.vitorpamplona.quartz.nip01Core.core.Event
 import com.vitorpamplona.quartz.nip01Core.relay.client.INostrClient
@@ -208,6 +209,19 @@ class AppModules(
 
     val applicationIOScope = CoroutineScope(Dispatchers.IO + SupervisorJob() + exceptionHandler)
 
+    /**
+     * Mints and caches BUD-01 read-auth tokens for auth-gated Blossom hosts.
+     * Shared by the OkHttp interceptor (which only reads the cache) and Coil's
+     * [com.vitorpamplona.amethyst.commons.service.image.BlossomReadAuthFetcher] (which
+     * awaits a signature), so both see one token and one in-flight signature per
+     * host. Signing runs on [applicationIOScope], never on an OkHttp thread.
+     */
+    val blossomReadAuthTokens =
+        BlossomReadAuthTokenProvider(
+            signerProvider = { sessionManager.loggedInAccount()?.signer },
+            scope = applicationIOScope,
+        )
+
     private val _trimLevelEvents = MutableSharedFlow<Int>(extraBufferCapacity = 1, onBufferOverflow = BufferOverflow.DROP_OLDEST)
     val trimLevelEvents = _trimLevelEvents.asSharedFlow()
 
@@ -269,7 +283,7 @@ class AppModules(
         UiSettingsState(uiPrefs.value, connManager.isMobileOrFalse, applicationIOScope)
     }
 
-    private val torService = TorService(appContext)
+    private val torService = TorService(appContext, applicationIOScope)
     val torManager = TorManager(torPrefs, torService, applicationIOScope)
 
     // Network identity change (wifi↔cellular, regained from offline, captive portal
@@ -292,6 +306,11 @@ class AppModules(
     // kind-44100 for it (device-global; a delete is authoritative and terminal for everyone).
     val relayGroupDeletionPrefs = RelayGroupDeletionPreferences(appContext, applicationIOScope)
 
+    // Restore + persist which drawer section headings the user has folded away, so the side menu
+    // opens the way they left it (device-global: a collapsed heading is a per-device view choice,
+    // not an account setting worth syncing, unlike the hidden rows beside it in the drawer).
+    val drawerSectionCollapsePrefs = DrawerSectionCollapsePreferences(appContext.sharedPreferencesDataStore, applicationIOScope)
+
     // Service that will run at all times to receive events from Pokey
     val pokeyReceiver = PokeyReceiver()
 
@@ -401,7 +420,11 @@ class AppModules(
     init {
         applicationIOScope.launch {
             torService.status
-                .map { it is TorServiceStatus.Active }
+                // Battery ledger: Tor is doing work from the moment the client exists — the
+                // directory download is the most expensive part of a launch — so this tracks
+                // "running", not "bootstrapped". Keying it on Active alone would silently omit the
+                // 12-34s download from every cold start.
+                .map { it.socksPort != null }
                 .distinctUntilChanged()
                 .collect { torSession.setActive(it) }
         }
@@ -448,9 +471,8 @@ class AppModules(
             // tracks the logged-in account.
             blossomReadAuth =
                 BlossomReadAuthInterceptor(
-                    BlossomReadAuthTokenProvider(
-                        signerProvider = { sessionManager.loggedInAccount()?.signer },
-                    )::authHeader,
+                    cachedHeaderProvider = blossomReadAuthTokens::cachedHeader,
+                    onAuthRequired = blossomReadAuthTokens::warm,
                 ),
         )
 
@@ -635,7 +657,7 @@ class AppModules(
             // proxy during bootstrap. RelayProxyClientConnector reconnects them (with
             // ignoreRetryDelays=true) the instant Tor flips to Active.
             canDial = { url ->
-                !torEvaluatorFlow.shouldUseTorForRelay(url) || torManager.isSocksReady()
+                !torEvaluatorFlow.shouldUseTorForRelay(url) || torManager.isTorReady()
             },
         )
 
@@ -704,7 +726,7 @@ class AppModules(
         TorCircuitHealthTracker(
             client = client,
             isTorRouted = { torEvaluatorFlow.shouldUseTorForRelay(it) },
-            isTorActive = { torManager.isSocksReady() },
+            isTorActive = { torManager.isTorReady() },
             isConnectivityActive = { connManager.status.value is ConnectivityStatus.Active },
             onCircuitsDead = { torManager.onTorCircuitsDead() },
         ).also { it.register() }
@@ -1083,6 +1105,7 @@ class AppModules(
             callFactory = { roleBasedHttpClientBuilder.okHttpClientForImage(it) },
             thumbnailCache = thumbnailDiskCache,
             backgroundScope = applicationIOScope,
+            readAuth = blossomReadAuthTokens,
         )
     }
 

amethyst/src/main/java/com/vitorpamplona/amethyst/LocalPreferences.kt

@@ -25,16 +25,16 @@ import android.content.Context
 import android.content.SharedPreferences
 import androidx.compose.runtime.Immutable
 import androidx.core.content.edit
+import com.vitorpamplona.amethyst.commons.model.HomeFeedType
 import com.vitorpamplona.amethyst.commons.model.chats.ChatFeedType
 import com.vitorpamplona.amethyst.commons.model.clink.ClinkDebitWalletEntry
 import com.vitorpamplona.amethyst.commons.model.concord.ConcordViewMode
 import com.vitorpamplona.amethyst.commons.model.nip29RelayGroups.RelayGroupViewMode
 import com.vitorpamplona.amethyst.commons.model.nip47WalletConnect.NwcWalletEntry
 import com.vitorpamplona.amethyst.commons.model.nip47WalletConnect.NwcWalletEntryNorm
+import com.vitorpamplona.amethyst.commons.model.topNavFeeds.TopFilter
 import com.vitorpamplona.amethyst.commons.relayauth.RelayAuthPolicy
 import com.vitorpamplona.amethyst.model.AccountSettings
-import com.vitorpamplona.amethyst.model.HomeFeedType
-import com.vitorpamplona.amethyst.model.TopFilter
 import com.vitorpamplona.amethyst.model.UiSettings
 import com.vitorpamplona.amethyst.service.checkNotInMainThread
 import com.vitorpamplona.amethyst.ui.actions.mediaServers.DEFAULT_MEDIA_SERVERS

amethyst/src/main/java/com/vitorpamplona/amethyst/connectedApps/consent/SignerConnectActivity.kt

@@ -65,6 +65,19 @@ import com.vitorpamplona.amethyst.commons.favorites.FavoriteAppIcon
 import com.vitorpamplona.amethyst.commons.icons.symbols.Icon
 import com.vitorpamplona.amethyst.commons.icons.symbols.MaterialSymbol
 import com.vitorpamplona.amethyst.commons.icons.symbols.MaterialSymbols
+import com.vitorpamplona.amethyst.commons.resources.Res
+import com.vitorpamplona.amethyst.commons.resources.napplet_connect_block
+import com.vitorpamplona.amethyst.commons.resources.napplet_connect_button
+import com.vitorpamplona.amethyst.commons.resources.napplet_connect_how_handle
+import com.vitorpamplona.amethyst.commons.resources.napplet_connect_subtitle
+import com.vitorpamplona.amethyst.commons.resources.napplet_policy_full_trust
+import com.vitorpamplona.amethyst.commons.resources.napplet_policy_full_trust_desc
+import com.vitorpamplona.amethyst.commons.resources.napplet_policy_paranoid
+import com.vitorpamplona.amethyst.commons.resources.napplet_policy_paranoid_desc
+import com.vitorpamplona.amethyst.commons.resources.napplet_policy_reasonable
+import com.vitorpamplona.amethyst.commons.resources.napplet_policy_reasonable_desc
+import com.vitorpamplona.amethyst.commons.resources.nip46_connect_requests_title
+import com.vitorpamplona.amethyst.ui.stringRes
 import com.vitorpamplona.amethyst.ui.theme.AmethystTheme
 
 class SignerConnectActivity : ComponentActivity() {
@@ -164,7 +177,7 @@ private fun SignerConnectScreen(
                         textAlign = TextAlign.Center,
                     )
                     Text(
-                        stringResource(R.string.napplet_connect_subtitle),
+                        stringRes(Res.string.napplet_connect_subtitle),
                         style = MaterialTheme.typography.bodyMedium,
                         color = MaterialTheme.colorScheme.onSurfaceVariant,
                         textAlign = TextAlign.Center,
@@ -193,7 +206,7 @@ private fun SignerConnectScreen(
                     ) {
                         Column(modifier = Modifier.padding(14.dp), verticalArrangement = Arrangement.spacedBy(6.dp)) {
                             Text(
-                                stringResource(R.string.nip46_connect_requests_title),
+                                stringRes(Res.string.nip46_connect_requests_title),
                                 style = MaterialTheme.typography.labelLarge,
                             )
                             info.requestedPermissions.forEach { perm ->
@@ -216,7 +229,7 @@ private fun SignerConnectScreen(
                 Spacer(Modifier.height(12.dp))
 
                 Text(
-                    stringResource(R.string.napplet_connect_how_handle),
+                    stringRes(Res.string.napplet_connect_how_handle),
                     style = MaterialTheme.typography.bodyMedium,
                     modifier = Modifier.fillMaxWidth().padding(horizontal = 24.dp),
                 )
@@ -230,22 +243,22 @@ private fun SignerConnectScreen(
                     PolicyOption(
                         selected = selected == AppSignerPolicy.FULL_TRUST,
                         symbol = MaterialSymbols.LockOpen,
-                        label = stringResource(R.string.napplet_policy_full_trust),
-                        description = stringResource(R.string.napplet_policy_full_trust_desc),
+                        label = stringRes(Res.string.napplet_policy_full_trust),
+                        description = stringRes(Res.string.napplet_policy_full_trust_desc),
                         onClick = { selected = AppSignerPolicy.FULL_TRUST },
                     )
                     PolicyOption(
                         selected = selected == AppSignerPolicy.REASONABLE,
                         symbol = MaterialSymbols.Shield,
-                        label = stringResource(R.string.napplet_policy_reasonable),
-                        description = stringResource(R.string.napplet_policy_reasonable_desc),
+                        label = stringRes(Res.string.napplet_policy_reasonable),
+                        description = stringRes(Res.string.napplet_policy_reasonable_desc),
                         onClick = { selected = AppSignerPolicy.REASONABLE },
                     )
                     PolicyOption(
                         selected = selected == AppSignerPolicy.PARANOID,
                         symbol = MaterialSymbols.Lock,
-                        label = stringResource(R.string.napplet_policy_paranoid),
-                        description = stringResource(R.string.napplet_policy_paranoid_desc),
+                        label = stringRes(Res.string.napplet_policy_paranoid),
+                        description = stringRes(Res.string.napplet_policy_paranoid_desc),
                         onClick = { selected = AppSignerPolicy.PARANOID },
                     )
                 }
@@ -262,7 +275,7 @@ private fun SignerConnectScreen(
                         Text(stringResource(R.string.cancel))
                     }
                     Button(onClick = { onConnect(selected) }, modifier = Modifier.weight(1f)) {
-                        Text(stringResource(R.string.napplet_connect_button))
+                        Text(stringRes(Res.string.napplet_connect_button))
                     }
                 }
 
@@ -272,7 +285,7 @@ private fun SignerConnectScreen(
                     colors = ButtonDefaults.outlinedButtonColors(contentColor = MaterialTheme.colorScheme.error),
                 ) {
                     Text(
-                        stringResource(R.string.napplet_connect_block, info.domain),
+                        stringRes(Res.string.napplet_connect_block, info.domain),
                         style = MaterialTheme.typography.bodyMedium,
                     )
                 }

amethyst/src/main/java/com/vitorpamplona/amethyst/connectedApps/consent/SignerConsentActivity.kt

@@ -75,11 +75,31 @@ import com.vitorpamplona.amethyst.commons.favorites.FavoriteApp
 import com.vitorpamplona.amethyst.commons.favorites.FavoriteAppIcon
 import com.vitorpamplona.amethyst.commons.icons.symbols.Icon
 import com.vitorpamplona.amethyst.commons.icons.symbols.MaterialSymbols
+import com.vitorpamplona.amethyst.commons.resources.Res
+import com.vitorpamplona.amethyst.commons.resources.napplet_consent_allow_always
+import com.vitorpamplona.amethyst.commons.resources.napplet_consent_fewer_options
+import com.vitorpamplona.amethyst.commons.resources.napplet_consent_hide_event
+import com.vitorpamplona.amethyst.commons.resources.napplet_consent_more_options
+import com.vitorpamplona.amethyst.commons.resources.napplet_consent_show_event
+import com.vitorpamplona.amethyst.commons.resources.napplet_consent_wants_to
+import com.vitorpamplona.amethyst.commons.resources.napplet_signer_allow_24h
+import com.vitorpamplona.amethyst.commons.resources.napplet_signer_allow_30d
+import com.vitorpamplona.amethyst.commons.resources.napplet_signer_allow_all
+import com.vitorpamplona.amethyst.commons.resources.napplet_signer_allow_once
+import com.vitorpamplona.amethyst.commons.resources.napplet_signer_allow_session
+import com.vitorpamplona.amethyst.commons.resources.napplet_signer_deny_once
+import com.vitorpamplona.amethyst.commons.resources.napplet_signer_deny_op
+import com.vitorpamplona.amethyst.commons.resources.nip46_signer_batch_allow
+import com.vitorpamplona.amethyst.commons.resources.nip46_signer_batch_deny
+import com.vitorpamplona.amethyst.commons.resources.nip46_signer_batch_remember
+import com.vitorpamplona.amethyst.commons.resources.nip46_signer_batch_signing_as
+import com.vitorpamplona.amethyst.commons.resources.nip46_signer_messages_with
 import com.vitorpamplona.amethyst.model.LocalCache
 import com.vitorpamplona.amethyst.service.call.CallSessionBridge
 import com.vitorpamplona.amethyst.ui.components.RobohashFallbackAsyncImage
 import com.vitorpamplona.amethyst.ui.navigation.navs.EmptyNav
 import com.vitorpamplona.amethyst.ui.note.NoteCompose
+import com.vitorpamplona.amethyst.ui.stringRes
 import com.vitorpamplona.amethyst.ui.theme.AmethystTheme
 import com.vitorpamplona.quartz.nip01Core.core.Event
 import com.vitorpamplona.quartz.nip59Giftwrap.rumors.RumorAssembler
@@ -184,7 +204,7 @@ private fun SignerConsentDialog(
                         textAlign = TextAlign.Center,
                     )
                     Text(
-                        stringResource(R.string.napplet_consent_wants_to, info.operationSummary),
+                        stringRes(Res.string.napplet_consent_wants_to, info.operationSummary),
                         style = MaterialTheme.typography.bodyMedium,
                         color = MaterialTheme.colorScheme.onSurfaceVariant,
                         textAlign = TextAlign.Center,
@@ -197,7 +217,7 @@ private fun SignerConsentDialog(
                     // that person as an avatar + name, never as nothing.
                     if (info.counterpartyName != null) {
                         Text(
-                            stringResource(R.string.nip46_signer_messages_with),
+                            stringRes(Res.string.nip46_signer_messages_with),
                             style = MaterialTheme.typography.labelSmall,
                             color = MaterialTheme.colorScheme.onSurfaceVariant,
                         )
@@ -230,14 +250,14 @@ private fun SignerConsentDialog(
                         onClick = { onGrant(SignerOpGrant.AllowForOp(info.op)) },
                         modifier = Modifier.fillMaxWidth().padding(horizontal = 24.dp),
                     ) {
-                        Text(stringResource(R.string.napplet_consent_allow_always))
+                        Text(stringRes(Res.string.napplet_consent_allow_always))
                     }
                 } else {
                     Button(
                         onClick = { onGrant(SignerOpGrant.AllowForOp(info.op)) },
                         modifier = Modifier.fillMaxWidth().padding(horizontal = 24.dp),
                     ) {
-                        Text(stringResource(R.string.napplet_consent_allow_always))
+                        Text(stringRes(Res.string.napplet_consent_allow_always))
                     }
                 }
 
@@ -246,7 +266,7 @@ private fun SignerConsentDialog(
                     onClick = { onGrant(SignerOpGrant.AllowOnce) },
                     modifier = Modifier.fillMaxWidth().padding(horizontal = 24.dp),
                 ) {
-                    Text(stringResource(R.string.napplet_signer_allow_once))
+                    Text(stringRes(Res.string.napplet_signer_allow_once))
                 }
 
                 // "More options" toggle: session and time-bound grants
@@ -261,9 +281,9 @@ private fun SignerConsentDialog(
                     ) {
                         Text(
                             if (showMoreOptions) {
-                                stringResource(R.string.napplet_consent_fewer_options)
+                                stringRes(Res.string.napplet_consent_fewer_options)
                             } else {
-                                stringResource(R.string.napplet_consent_more_options)
+                                stringRes(Res.string.napplet_consent_more_options)
                             },
                             style = MaterialTheme.typography.bodyMedium,
                         )
@@ -280,25 +300,25 @@ private fun SignerConsentDialog(
                         onClick = { onGrant(SignerOpGrant.AllowForSession(info.op)) },
                         modifier = Modifier.fillMaxWidth().padding(horizontal = 24.dp),
                     ) {
-                        Text(stringResource(R.string.napplet_signer_allow_session))
+                        Text(stringRes(Res.string.napplet_signer_allow_session))
                     }
                     OutlinedButton(
                         onClick = { onGrant(SignerOpGrant.AllowUntil(info.op, TimeUtils.now() + 86_400L)) },
                         modifier = Modifier.fillMaxWidth().padding(horizontal = 24.dp),
                     ) {
-                        Text(stringResource(R.string.napplet_signer_allow_24h))
+                        Text(stringRes(Res.string.napplet_signer_allow_24h))
                     }
                     OutlinedButton(
                         onClick = { onGrant(SignerOpGrant.AllowUntil(info.op, TimeUtils.now() + 30L * 86_400L)) },
                         modifier = Modifier.fillMaxWidth().padding(horizontal = 24.dp),
                     ) {
-                        Text(stringResource(R.string.napplet_signer_allow_30d))
+                        Text(stringRes(Res.string.napplet_signer_allow_30d))
                     }
                     OutlinedButton(
                         onClick = { onGrant(SignerOpGrant.AllowAll) },
                         modifier = Modifier.fillMaxWidth().padding(horizontal = 24.dp),
                     ) {
-                        Text(stringResource(R.string.napplet_signer_allow_all))
+                        Text(stringRes(Res.string.napplet_signer_allow_all))
                     }
                 }
 
@@ -311,14 +331,14 @@ private fun SignerConsentDialog(
                     modifier = Modifier.fillMaxWidth().padding(horizontal = 24.dp),
                     colors = ButtonDefaults.outlinedButtonColors(contentColor = MaterialTheme.colorScheme.error),
                 ) {
-                    Text(stringResource(R.string.napplet_signer_deny_once))
+                    Text(stringRes(Res.string.napplet_signer_deny_once))
                 }
                 OutlinedButton(
                     onClick = { onGrant(SignerOpGrant.DenyForOp(info.op)) },
                     modifier = Modifier.fillMaxWidth().padding(horizontal = 24.dp),
                     colors = ButtonDefaults.outlinedButtonColors(contentColor = MaterialTheme.colorScheme.error),
                 ) {
-                    Text(stringResource(R.string.napplet_signer_deny_op, info.operationSummary))
+                    Text(stringRes(Res.string.napplet_signer_deny_op, info.operationSummary))
                 }
             }
         }
@@ -390,9 +410,9 @@ private fun SignerConsentPreview(info: SignerConsentInfo) {
                 ) {
                     Text(
                         if (showRawData) {
-                            stringResource(R.string.napplet_consent_hide_event)
+                            stringRes(Res.string.napplet_consent_hide_event)
                         } else {
-                            stringResource(R.string.napplet_consent_show_event)
+                            stringRes(Res.string.napplet_consent_show_event)
                         },
                         style = MaterialTheme.typography.labelSmall,
                     )
@@ -468,7 +488,7 @@ private fun BatchedConsentDialog(
                         )
                         account.accountName?.let { name ->
                             Text(
-                                stringResource(R.string.nip46_signer_batch_signing_as, name),
+                                stringRes(Res.string.nip46_signer_batch_signing_as, name),
                                 style = MaterialTheme.typography.labelMedium,
                                 color = MaterialTheme.colorScheme.onSurfaceVariant,
                                 maxLines = 1,
@@ -553,7 +573,7 @@ private fun BatchedConsentDialog(
                 ) {
                     Switch(checked = rememberChoice, onCheckedChange = { rememberChoice = it })
                     Text(
-                        stringResource(R.string.nip46_signer_batch_remember),
+                        stringRes(Res.string.nip46_signer_batch_remember),
                         style = MaterialTheme.typography.bodyMedium,
                     )
                 }
@@ -575,7 +595,7 @@ private fun BatchedConsentDialog(
                     enabled = selected.isNotEmpty(),
                     modifier = Modifier.fillMaxWidth().padding(horizontal = 24.dp),
                 ) {
-                    Text(stringResource(R.string.nip46_signer_batch_allow, selected.size))
+                    Text(stringRes(Res.string.nip46_signer_batch_allow, selected.size))
                 }
                 OutlinedButton(
                     onClick = { onResolve(pending.filter { it.token in selected }.map { it.token }, SignerOpGrant.DenyOnce) },
@@ -583,7 +603,7 @@ private fun BatchedConsentDialog(
                     modifier = Modifier.fillMaxWidth().padding(horizontal = 24.dp),
                     colors = ButtonDefaults.outlinedButtonColors(contentColor = MaterialTheme.colorScheme.error),
                 ) {
-                    Text(stringResource(R.string.nip46_signer_batch_deny, selected.size))
+                    Text(stringRes(Res.string.nip46_signer_batch_deny, selected.size))
                 }
             }
         }

amethyst/src/main/java/com/vitorpamplona/amethyst/favorites/BrowserHistoryRegistry.kt

@@ -21,12 +21,12 @@
 package com.vitorpamplona.amethyst.favorites
 
 import android.content.Context
-import android.util.Log
 import androidx.datastore.preferences.core.edit
 import androidx.datastore.preferences.core.stringPreferencesKey
 import androidx.datastore.preferences.preferencesDataStore
 import com.vitorpamplona.amethyst.commons.browser.OmniboxInput
 import com.vitorpamplona.quartz.nip01Core.core.JsonMapper
+import com.vitorpamplona.quartz.utils.Log
 import kotlinx.coroutines.CoroutineScope
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.SupervisorJob

amethyst/src/main/java/com/vitorpamplona/amethyst/favorites/BrowserIconRegistry.kt

@@ -21,7 +21,7 @@
 package com.vitorpamplona.amethyst.favorites
 
 import android.content.Context
-import android.util.Log
+import com.vitorpamplona.quartz.utils.Log
 import kotlinx.coroutines.CoroutineScope
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.SupervisorJob

amethyst/src/main/java/com/vitorpamplona/amethyst/favorites/FavoriteAppLauncher.kt

@@ -24,7 +24,6 @@ import android.app.Activity
 import android.content.Context
 import android.content.res.Configuration
 import android.os.Bundle
-import android.util.Log
 import android.widget.Toast
 import com.vitorpamplona.amethyst.Amethyst
 import com.vitorpamplona.amethyst.R
@@ -41,6 +40,7 @@ import com.vitorpamplona.quartz.nip5aStaticWebsites.NamedSiteEvent
 import com.vitorpamplona.quartz.nip5aStaticWebsites.RootSiteEvent
 import com.vitorpamplona.quartz.nip5dNapplets.NamedNappletEvent
 import com.vitorpamplona.quartz.nip5dNapplets.RootNappletEvent
+import com.vitorpamplona.quartz.utils.Log
 
 /**
  * Turns a [FavoriteApp] back into a running app. The two cases map to the two launch paths in the
@@ -145,7 +145,7 @@ object FavoriteAppLauncher {
                     profile = HostProfile.WEBSITE,
                 )
             else -> {
-                Log.w("FavoriteAppLauncher", "Favorited app not resolvable yet: $coordinate")
+                Log.w("FavoriteAppLauncher") { "Favorited app not resolvable yet: $coordinate" }
                 Toast.makeText(context, R.string.favorite_app_still_loading, Toast.LENGTH_SHORT).show()
             }
         }

amethyst/src/main/java/com/vitorpamplona/amethyst/favorites/FavoriteAppsRegistry.kt

@@ -21,12 +21,12 @@
 package com.vitorpamplona.amethyst.favorites
 
 import android.content.Context
-import android.util.Log
 import androidx.datastore.preferences.core.edit
 import androidx.datastore.preferences.core.stringPreferencesKey
 import androidx.datastore.preferences.preferencesDataStore
 import com.vitorpamplona.amethyst.commons.favorites.FavoriteApp
 import com.vitorpamplona.quartz.nip01Core.core.JsonMapper
+import com.vitorpamplona.quartz.utils.Log
 import kotlinx.coroutines.CoroutineScope
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.SupervisorJob

amethyst/src/main/java/com/vitorpamplona/amethyst/favorites/FavoriteNostrAppPreloader.kt

@@ -23,9 +23,9 @@ package com.vitorpamplona.amethyst.favorites
 import androidx.compose.runtime.Composable
 import androidx.compose.runtime.remember
 import com.vitorpamplona.amethyst.commons.favorites.FavoriteApp
+import com.vitorpamplona.amethyst.commons.relayClient.event.EventFinderQueryState
 import com.vitorpamplona.amethyst.commons.relayClient.subscriptions.LifecycleAwareKeyDataSourceSubscription
 import com.vitorpamplona.amethyst.model.LocalCache
-import com.vitorpamplona.amethyst.service.relayClient.reqCommand.event.EventFinderQueryState
 import com.vitorpamplona.amethyst.ui.screen.loggedIn.AccountViewModel
 
 /**
@@ -40,7 +40,7 @@ import com.vitorpamplona.amethyst.ui.screen.loggedIn.AccountViewModel
  * which is why opening that feed and coming back made a favorite suddenly launchable.
  *
  * This subscribes each favorited coordinate to the shared
- * [EventFinder][com.vitorpamplona.amethyst.service.relayClient.reqCommand.event.EventFinderFilterAssembler]
+ * [EventFinder][com.vitorpamplona.amethyst.commons.relayClient.event.EventFinderFilterAssembler]
  * — the same lifecycle-aware loader [observeNote][com.vitorpamplona.amethyst.service.relayClient.reqCommand.event.observeNote]
  * uses — so the manifests fetch (via the author's outbox relays) as soon as the launcher opens and are
  * already in [LocalCache] by the time the user taps. The loader drops each coordinate from its filter

amethyst/src/main/java/com/vitorpamplona/amethyst/model/Account.kt

@@ -31,16 +31,21 @@ import com.vitorpamplona.amethyst.commons.connectedApps.signers.InMemoryNostrSig
 import com.vitorpamplona.amethyst.commons.connectedApps.signers.NostrSignerPermissionLedger
 import com.vitorpamplona.amethyst.commons.connectedApps.signers.NostrSignerPermissionStore
 import com.vitorpamplona.amethyst.commons.defaults.Constants
-import com.vitorpamplona.amethyst.commons.defaults.DefaultIndexerRelayList
 import com.vitorpamplona.amethyst.commons.marmot.MarmotManager
+import com.vitorpamplona.amethyst.commons.model.AddressableNote
 import com.vitorpamplona.amethyst.commons.model.IAccount
+import com.vitorpamplona.amethyst.commons.model.Note
+import com.vitorpamplona.amethyst.commons.model.User
+import com.vitorpamplona.amethyst.commons.model.VideoPostKind
 import com.vitorpamplona.amethyst.commons.model.buzz.BuzzChannelStars
 import com.vitorpamplona.amethyst.commons.model.buzz.BuzzHeldAttestations
 import com.vitorpamplona.amethyst.commons.model.buzz.BuzzRelayDialect
 import com.vitorpamplona.amethyst.commons.model.buzz.BuzzWorkspaces
+import com.vitorpamplona.amethyst.commons.model.cache.filter
 import com.vitorpamplona.amethyst.commons.model.concord.ConcordChannel
 import com.vitorpamplona.amethyst.commons.model.concord.ConcordChannelListState
 import com.vitorpamplona.amethyst.commons.model.concord.ConcordSessionManager
+import com.vitorpamplona.amethyst.commons.model.edits.PrivateStorageRelayListDecryptionCache
 import com.vitorpamplona.amethyst.commons.model.emphChat.EphemeralChatChannel
 import com.vitorpamplona.amethyst.commons.model.emphChat.EphemeralChatListDecryptionCache
 import com.vitorpamplona.amethyst.commons.model.emphChat.EphemeralChatListState
@@ -54,7 +59,12 @@ import com.vitorpamplona.amethyst.commons.model.nip29RelayGroups.RelayGroupListD
 import com.vitorpamplona.amethyst.commons.model.nip29RelayGroups.RelayGroupListState
 import com.vitorpamplona.amethyst.commons.model.nip30CustomEmojis.EmojiPackState
 import com.vitorpamplona.amethyst.commons.model.nip38UserStatuses.UserStatusAction
+import com.vitorpamplona.amethyst.commons.model.nip47WalletConnect.NwcInfoCache
+import com.vitorpamplona.amethyst.commons.model.nip51Lists.BookmarkListState
+import com.vitorpamplona.amethyst.commons.model.nip51Lists.GitRepositoryListState
+import com.vitorpamplona.amethyst.commons.model.nip51Lists.OldBookmarkListState
 import com.vitorpamplona.amethyst.commons.model.nip51Lists.favoriteAlgoFeedsLists.FavoriteAlgoFeedsListDecryptionCache
+import com.vitorpamplona.amethyst.commons.model.nip51Lists.geohashLists.GeohashListDecryptionCache
 import com.vitorpamplona.amethyst.commons.model.nip51Lists.hashtagLists.HashtagListDecryptionCache
 import com.vitorpamplona.amethyst.commons.model.nip51Lists.muteList.MuteListDecryptionCache
 import com.vitorpamplona.amethyst.commons.model.nip51Lists.peopleList.PeopleListDecryptionCache
@@ -63,7 +73,21 @@ import com.vitorpamplona.amethyst.commons.model.nip72Communities.CommunityListDe
 import com.vitorpamplona.amethyst.commons.model.nip85TrustedAssertions.ContactCardDecryptionCache
 import com.vitorpamplona.amethyst.commons.model.nip85TrustedAssertions.ContactCardsState
 import com.vitorpamplona.amethyst.commons.model.nip85TrustedAssertions.TrustProviderListDecryptionCache
+import com.vitorpamplona.amethyst.commons.model.privateChatLastReadRoute
 import com.vitorpamplona.amethyst.commons.model.privateChats.hasEncryptedContent
+import com.vitorpamplona.amethyst.commons.model.topNavFeeds.FeedDecryptionCaches
+import com.vitorpamplona.amethyst.commons.model.topNavFeeds.IFeedTopNavFilter
+import com.vitorpamplona.amethyst.commons.model.topNavFeeds.OutboxLoaderState
+import com.vitorpamplona.amethyst.commons.model.topNavFeeds.TopFilter
+import com.vitorpamplona.amethyst.commons.nipACWebRtcCalls.CallManager
+import com.vitorpamplona.amethyst.commons.relayClient.auth.InMemoryRelayAuthPermissionStore
+import com.vitorpamplona.amethyst.commons.relayClient.auth.RelayAuthPermissionCache
+import com.vitorpamplona.amethyst.commons.relayClient.auth.RelayAuthPermissionLedger
+import com.vitorpamplona.amethyst.commons.relayClient.auth.RelayAuthSessionGrants
+import com.vitorpamplona.amethyst.commons.relayClient.auth.RelayAuthVenues
+import com.vitorpamplona.amethyst.commons.relayClient.chatDelivery.ChatDeliveryTracker
+import com.vitorpamplona.amethyst.commons.relayClient.nip47WalletConnect.NWCPaymentFilterAssembler
+import com.vitorpamplona.amethyst.commons.relayClient.notify.NotifyRequestsCache
 import com.vitorpamplona.amethyst.commons.relayClient.user.UserFinderAccount
 import com.vitorpamplona.amethyst.commons.relayauth.RelayAuthCustomToggles
 import com.vitorpamplona.amethyst.commons.relayauth.RelayAuthPermissionStore
@@ -76,10 +100,12 @@ import com.vitorpamplona.amethyst.commons.service.pow.PoWPublishQueue
 import com.vitorpamplona.amethyst.commons.service.pow.PoWReplay
 import com.vitorpamplona.amethyst.commons.viewmodels.ReplyMode
 import com.vitorpamplona.amethyst.logTime
+import com.vitorpamplona.amethyst.model.AccountMarmotActions
+import com.vitorpamplona.amethyst.model.AccountRelayGroupActions
+import com.vitorpamplona.amethyst.model.EventBroadcaster
 import com.vitorpamplona.amethyst.model.algoFeeds.FavoriteAlgoFeedsOrchestrator
 import com.vitorpamplona.amethyst.model.bolt12Offers.Bolt12OfferListState
 import com.vitorpamplona.amethyst.model.buzz.ChannelInvitesState
-import com.vitorpamplona.amethyst.model.edits.PrivateStorageRelayListDecryptionCache
 import com.vitorpamplona.amethyst.model.edits.PrivateStorageRelayListState
 import com.vitorpamplona.amethyst.model.localRelays.ForwardKind0ToLocalRelayState
 import com.vitorpamplona.amethyst.model.localRelays.LocalRelayListState
@@ -100,12 +126,8 @@ import com.vitorpamplona.amethyst.model.nip17Dms.DmInboxRelayState
 import com.vitorpamplona.amethyst.model.nip17Dms.DmRelayListState
 import com.vitorpamplona.amethyst.model.nip30CustomEmojis.OwnedEmojiPacksState
 import com.vitorpamplona.amethyst.model.nip46Signer.Nip46SignerState
-import com.vitorpamplona.amethyst.model.nip47WalletConnect.NwcInfoCache
 import com.vitorpamplona.amethyst.model.nip47WalletConnect.NwcSignerState
-import com.vitorpamplona.amethyst.model.nip51Lists.BookmarkListState
-import com.vitorpamplona.amethyst.model.nip51Lists.GitRepositoryListState
 import com.vitorpamplona.amethyst.model.nip51Lists.HiddenUsersState
-import com.vitorpamplona.amethyst.model.nip51Lists.OldBookmarkListState
 import com.vitorpamplona.amethyst.model.nip51Lists.PinListState
 import com.vitorpamplona.amethyst.model.nip51Lists.blockPeopleList.BlockPeopleListState
 import com.vitorpamplona.amethyst.model.nip51Lists.blockedRelays.BlockedRelayListDecryptionCache
@@ -113,7 +135,6 @@ import com.vitorpamplona.amethyst.model.nip51Lists.blockedRelays.BlockedRelayLis
 import com.vitorpamplona.amethyst.model.nip51Lists.broadcastRelays.BroadcastRelayListDecryptionCache
 import com.vitorpamplona.amethyst.model.nip51Lists.broadcastRelays.BroadcastRelayListState
 import com.vitorpamplona.amethyst.model.nip51Lists.favoriteAlgoFeedsLists.FavoriteAlgoFeedsListState
-import com.vitorpamplona.amethyst.model.nip51Lists.geohashLists.GeohashListDecryptionCache
 import com.vitorpamplona.amethyst.model.nip51Lists.geohashLists.GeohashListState
 import com.vitorpamplona.amethyst.model.nip51Lists.hashtagLists.HashtagListState
 import com.vitorpamplona.amethyst.model.nip51Lists.indexerRelays.IndexerRelayListDecryptionCache
@@ -138,25 +159,16 @@ import com.vitorpamplona.amethyst.model.nip78AppSpecific.AppSpecificState
 import com.vitorpamplona.amethyst.model.nip89AppHandlers.AppRecommendationsState
 import com.vitorpamplona.amethyst.model.nipA3PaymentTargets.NipA3PaymentTargetsState
 import com.vitorpamplona.amethyst.model.nipB7Blossom.BlossomServerListState
+import com.vitorpamplona.amethyst.model.nipBCOnchainZaps.OnchainWalletState
+import com.vitorpamplona.amethyst.model.serverList.AssumedRelayListsState
 import com.vitorpamplona.amethyst.model.serverList.MergedFollowListsState
 import com.vitorpamplona.amethyst.model.serverList.MergedFollowPlusMineRelayListsState
 import com.vitorpamplona.amethyst.model.serverList.MergedFollowPlusMineWithIndexRelayListsState
 import com.vitorpamplona.amethyst.model.serverList.MergedFollowPlusMineWithSearchRelayListsState
 import com.vitorpamplona.amethyst.model.serverList.TrustedRelayListsState
-import com.vitorpamplona.amethyst.model.topNavFeeds.FeedDecryptionCaches
 import com.vitorpamplona.amethyst.model.topNavFeeds.FeedTopNavFilterState
-import com.vitorpamplona.amethyst.model.topNavFeeds.IFeedTopNavFilter
-import com.vitorpamplona.amethyst.model.topNavFeeds.OutboxLoaderState
 import com.vitorpamplona.amethyst.model.trustedAssertions.TrustProviderListState
 import com.vitorpamplona.amethyst.service.location.LocationState
-import com.vitorpamplona.amethyst.service.relayClient.authCommand.model.InMemoryRelayAuthPermissionStore
-import com.vitorpamplona.amethyst.service.relayClient.authCommand.model.RelayAuthPermissionCache
-import com.vitorpamplona.amethyst.service.relayClient.authCommand.model.RelayAuthPermissionLedger
-import com.vitorpamplona.amethyst.service.relayClient.authCommand.model.RelayAuthSessionGrants
-import com.vitorpamplona.amethyst.service.relayClient.authCommand.model.RelayAuthVenues
-import com.vitorpamplona.amethyst.service.relayClient.chatDelivery.ChatDeliveryTracker
-import com.vitorpamplona.amethyst.service.relayClient.notifyCommand.model.NotifyRequestsCache
-import com.vitorpamplona.amethyst.service.relayClient.reqCommand.nwc.NWCPaymentFilterAssembler
 import com.vitorpamplona.amethyst.service.uploads.FileHeader
 import com.vitorpamplona.amethyst.ui.actions.NewMessageTagger
 import com.vitorpamplona.amethyst.ui.navigation.bottombars.BottomBarEntry
@@ -384,12 +396,16 @@ class Account(
     // doubles as the attribution pubkey for ExplainedFilter.accountPubKeys.
     override val userFinderPubkeyHex: HexKey get() = userProfile().pubkeyHex
 
-    override fun indexRelays(): Set<NormalizedRelayUrl> = indexerRelayList.flow.value.ifEmpty { DefaultIndexerRelayList }
+    // No ifEmpty here on purpose: an empty kind:10086 is the user asking for no indexers, and
+    // IndexerRelayListState already substitutes the defaults for the only case we may override —
+    // never having seen the event. Re-substituting here would undo that choice.
+    override fun indexRelays(): Set<NormalizedRelayUrl> = indexerRelayList.flow.value
 
     override fun outboxHomeRelays(): Set<NormalizedRelayUrl> = nip65RelayList.allFlowNoDefaults.value + privateStorageRelayList.flow.value + localRelayList.flow.value
 
-    // searchRelayList.flow already applies the DefaultSearchRelayList fallback internally
-    // (SearchRelayListState.normalizeSearchRelayListWithBackup), so no ifEmpty needed here.
+    // searchRelayList.flow applies DefaultSearchRelayList internally when no kind:10007 has ever
+    // been seen (SearchRelayListState.normalizeSearchRelayListWithBackup); an empty published list
+    // stays empty. No ifEmpty here either way.
     override fun searchRelays(): Set<NormalizedRelayUrl> = (trustedRelayList.flow.value + searchRelayList.flow.value).toSet()
 
     override fun searchOnlyRelays(): Set<NormalizedRelayUrl> = searchRelayList.flow.value
@@ -775,6 +791,18 @@ class Account(
     // ([CashuWalletHistoryEoseManager]) binds its orchestrator to these.
     val cashuHistory = RelayLoadingCursors()
 
+    /**
+     * NIP-BC on-chain wallet balance for this account's Taproot address. Cached
+     * (one Esplora round trip per minute at most) so the zap picker can ask
+     * synchronously whether an amount is payable on-chain before offering it.
+     */
+    val onchainWalletState =
+        OnchainWalletState(
+            pubKey = signer.pubKey,
+            scope = scope,
+            backend = { cache.onchainBackend },
+        )
+
     val cashuWalletState =
         com.vitorpamplona.amethyst.model.nip60Cashu.CashuWalletState(
             pubKey = signer.pubKey,
@@ -809,6 +837,9 @@ class Account(
 
     val trustedRelays = TrustedRelayListsState(nip65RelayList, privateStorageRelayList, localRelayList, dmRelayList, searchRelayList, indexerRelayList, proxyRelayList, trustedRelayList, broadcastRelayList, scope)
 
+    /** Relays guessed on the user's behalf until their own lists arrive. Read only by Tor routing. */
+    val assumedRelays = AssumedRelayListsState(nip65RelayList, searchRelayList, indexerRelayList, scope)
+
     // Follows Relays
     val followOutboxesOrProxy = FollowListOutboxOrProxyRelays(kind3FollowList, blockedRelayList, proxyRelayList, cache, scope)
 
@@ -840,6 +871,30 @@ class Account(
 
     val newNotesPreProcessor = EventProcessor(this, cache)
 
+    /**
+     * Owns the WebRTC call state machine.
+     *
+     * Account-scoped on purpose: a call outlives the main UI. It runs in its own
+     * [com.vitorpamplona.amethyst.ui.call.CallActivity] (a separate task, since MainActivity is
+     * `singleInstance`) backed by a foreground service, so Android is free to destroy the
+     * backgrounded MainActivity while the call is up — which it does routinely, e.g. a few hundred
+     * milliseconds after CallActivity enters picture-in-picture on HOME. While this lived on
+     * `AccountViewModel` (and ran on `viewModelScope`), that destruction cleared the ViewModel and
+     * reset the call to Idle, hanging up mid-conversation.
+     *
+     * Torn down with the account: [scope] is cancelled by
+     * `AccountCacheState.removeAccount`, which also calls [CallManager.dispose] for the
+     * independent watchdog scope.
+     */
+    val callManager =
+        CallManager(
+            signer = signer,
+            scope = scope,
+            isFollowing = { isFollowing(it) },
+            publishEvent = { wrap -> scope.launch { publishCallSignaling(wrap) } },
+            isCallsEnabled = { settings.callsEnabled.value },
+        )
+
     // Per-message publish acceptance (relay OKs), feeding the delivery ticks on
     // own chat bubbles.
     val chatDeliveryTracker = ChatDeliveryTracker(client)
@@ -3501,6 +3556,15 @@ class Account(
 
     suspend fun saveBlockedRelayList(blockedRelays: List<NormalizedRelayUrl>) = sendMyPublicAndPrivateOutbox(blockedRelayList.saveRelayList(blockedRelays))
 
+    /**
+     * Blocks a single relay, leaving the rest of the kind-10006 list alone.
+     *
+     * Once published, [com.vitorpamplona.amethyst.commons.relayClient.BlockedRelayFilteringClient]
+     * strips the relay from every REQ, COUNT and publish, so the pool drops the socket as soon as
+     * the subscriptions that wanted it are recomputed.
+     */
+    suspend fun blockRelay(relay: NormalizedRelayUrl) = sendMyPublicAndPrivateOutbox(blockedRelayList.addRelay(relay))
+
     /**
      * Returns all known signed replaceable events that configure this account
      * (profile, contact list, relay lists, mute list, bookmarks, etc.). Events
@@ -3624,9 +3688,13 @@ class Account(
     init {
         Log.d("AccountRegisterObservers", "Init")
 
+        // Route incoming call signaling into the state machine as soon as the account exists, so
+        // offers are not missed while no UI is mounted.
+        newNotesPreProcessor.callManager = callManager
+
         // Blocking a relay has to forget any "just for now" login to it, or unblocking later would
         // silently resume authenticating off an answer given before the block. Blocking is the
-        // strongest signal available here — the weaker "never allow" already drops the grant via
+        // strongest signal available here — the weaker per-relay "never" answer already drops the grant via
         // RelayAuthPermissionLedger.setDecision, so it would be odd for the stronger one not to.
         //
         // Observed rather than hooked onto the local block action because the kind-10006 list is

amethyst/src/main/java/com/vitorpamplona/amethyst/model/AccountConcordActions.kt

@@ -24,6 +24,9 @@ import com.vitorpamplona.amethyst.commons.actions.ConcordActions
 import com.vitorpamplona.amethyst.commons.actions.ConcordModeration
 import com.vitorpamplona.amethyst.commons.actions.ConcordReceive
 import com.vitorpamplona.amethyst.commons.actions.ConcordSubscriptionPlanner
+import com.vitorpamplona.amethyst.commons.model.ConcordInviteResult
+import com.vitorpamplona.amethyst.commons.model.Note
+import com.vitorpamplona.amethyst.commons.model.cache.filter
 import com.vitorpamplona.amethyst.commons.model.concord.ConcordChannel
 import com.vitorpamplona.amethyst.commons.model.concord.ConcordCommunitySession
 import com.vitorpamplona.amethyst.commons.viewmodels.ReplyMode
@@ -1381,7 +1384,7 @@ class AccountConcordActions(
             val bannedHere = authority.isBanned(account.signer.pubKey)
             val merged = ConcordActions.recoverStranded(entry, bundle, bannedHere) ?: continue
             if (!adoptedConcordRotations.add("${entry.id}:${merged.rootEpoch}")) continue
-            Log.i("Concord", "Stranded recovery: ${entry.id} ${entry.rootEpoch} -> ${merged.rootEpoch}")
+            Log.i("Concord") { "Stranded recovery: ${entry.id} ${entry.rootEpoch} -> ${merged.rootEpoch}" }
             account.sendMyPublicAndPrivateOutbox(account.concordChannelList.follow(merged))
             announceConcordGuestbookJoin(merged, inviteCreator = null, inviteLabel = null)
         }
@@ -1521,11 +1524,10 @@ class AccountConcordActions(
         val events = account.client.fetchAll(filters = relays.associateWith { listOf(filter) }, idleTimeoutMs = 30_000L)
         val newest = events.filterIsInstance<ConcordCommunityListEvent>().maxByOrNull { it.createdAt }
         val entryCount = newest?.let { runCatching { it.decrypt(account.signer).size }.getOrElse { -1 } } ?: 0
-        Log.d(
-            "Concord",
+        Log.d("Concord") {
             "importConcordCommunities: queried ${relays.size} relays, fetched ${events.size} 13302 event(s), " +
-                "newest=${newest?.id?.take(8)}@${newest?.createdAt}, decoded $entryCount entr${if (entryCount == 1) "y" else "ies"}",
-        )
+                "newest=${newest?.id?.take(8)}@${newest?.createdAt}, decoded $entryCount entr${if (entryCount == 1) "y" else "ies"}"
+        }
         newest?.let { account.cache.justConsumeMyOwnEvent(it) }
     }
 
@@ -1600,6 +1602,6 @@ class AccountConcordActions(
         val byRelay = authorsByRelay.mapValues { (_, authors) -> listOf(ConcordActions.planeFilterFor(authors.toList())) }
         var drained = 0
         account.client.fetchAllPagesFromPool(filters = byRelay) { _, _ -> drained++ }
-        Log.d("Concord", "syncConcordControlPlanes: paged ${authorsByRelay.size} relay(s), drained $drained control wrap(s)")
+        Log.d("Concord") { "syncConcordControlPlanes: paged ${authorsByRelay.size} relay(s), drained $drained control wrap(s)" }
     }
 }

amethyst/src/main/java/com/vitorpamplona/amethyst/model/AccountSettings.kt

@@ -22,17 +22,21 @@ package com.vitorpamplona.amethyst.model
 
 import androidx.compose.runtime.Stable
 import com.vitorpamplona.amethyst.commons.audio.VisualizerStyle
+import com.vitorpamplona.amethyst.commons.model.HomeFeedType
+import com.vitorpamplona.amethyst.commons.model.cache.filter
 import com.vitorpamplona.amethyst.commons.model.chats.ChatFeedType
 import com.vitorpamplona.amethyst.commons.model.clink.ClinkDebitWalletEntryNorm
 import com.vitorpamplona.amethyst.commons.model.concord.ConcordListRepository
 import com.vitorpamplona.amethyst.commons.model.concord.ConcordViewMode
 import com.vitorpamplona.amethyst.commons.model.emphChat.EphemeralChatRepository
+import com.vitorpamplona.amethyst.commons.model.mergeMutedPublicChats
 import com.vitorpamplona.amethyst.commons.model.nip28PublicChats.PublicChatListRepository
 import com.vitorpamplona.amethyst.commons.model.nip29RelayGroups.RelayGroupRepository
 import com.vitorpamplona.amethyst.commons.model.nip29RelayGroups.RelayGroupViewMode
 import com.vitorpamplona.amethyst.commons.model.nip47WalletConnect.NwcWalletEntryNorm
 import com.vitorpamplona.amethyst.commons.model.payments.PaymentSource
 import com.vitorpamplona.amethyst.commons.model.payments.PaymentSourceResolver
+import com.vitorpamplona.amethyst.commons.model.topNavFeeds.TopFilter
 import com.vitorpamplona.amethyst.commons.relayauth.RelayAuthPolicy
 import com.vitorpamplona.amethyst.commons.service.pow.PoWCategory
 import com.vitorpamplona.amethyst.model.nip60Cashu.CashuPreferences
@@ -98,96 +102,6 @@ val DefaultSignerPermissions =
         Permission(CommandType.DECRYPT_ZAP_EVENT),
     )
 
-@Serializable
-sealed class TopFilter(
-    val code: String,
-) {
-    interface AddressableTopFilter {
-        val address: Address
-    }
-
-    @Serializable
-    object Global : TopFilter(" Global ")
-
-    /**
-     * Notifications-only curated mode: like [Global] it admits authors the
-     * user doesn't follow, but it also applies per-kind relevance heuristics
-     * to remove less interesting notes (reactions/reposts that don't target
-     * the user's own notes, unrelated thread replies, etc.). In Notifications,
-     * [Global] shows every event that p-tags the user instead.
-     */
-    @Serializable
-    object Selected : TopFilter(" Selected ")
-
-    @Serializable
-    object AllFollows : TopFilter(" All Follows ")
-
-    @Serializable
-    object AllUserFollows : TopFilter(" All User Follows ")
-
-    @Serializable
-    object DefaultFollows : TopFilter(" Main User Follows ")
-
-    @Serializable
-    object AroundMe : TopFilter(" Around Me ")
-
-    /**
-     * Not a real selection: a sentinel for the "Teleport" chip in the top-nav filter.
-     * The spinner intercepts it to open the map picker and then applies the chosen
-     * [Geohash] instead — it is never persisted or dispatched to a feed flow.
-     */
-    @Serializable
-    object TeleportPicker : TopFilter(" Teleport ")
-
-    @Serializable
-    object Mine : TopFilter(" Mine ")
-
-    @Serializable
-    class PeopleList(
-        override val address: Address,
-    ) : TopFilter(address.toValue()),
-        AddressableTopFilter
-
-    @Serializable
-    class MuteList(
-        override val address: Address,
-    ) : TopFilter(address.toValue()),
-        AddressableTopFilter
-
-    @Serializable
-    class Community(
-        override val address: Address,
-    ) : TopFilter("Community/${address.toValue()}"),
-        AddressableTopFilter
-
-    @Serializable
-    class Hashtag(
-        val tag: String,
-    ) : TopFilter("Hashtag/$tag")
-
-    @Serializable
-    class Geohash(
-        val tag: String,
-    ) : TopFilter("Geohash/$tag")
-
-    @Serializable
-    class Relay(
-        val url: String,
-    ) : TopFilter("Relay/$url")
-
-    @Serializable
-    class FavoriteAlgoFeed(
-        val address: Address,
-    ) : TopFilter("FavoriteAlgoFeed/${address.toValue()}")
-
-    @Serializable object AllFavoriteAlgoFeeds : TopFilter(" All Favourite DVMs ")
-
-    @Serializable
-    class InterestSet(
-        val address: Address,
-    ) : TopFilter("InterestSet/${address.toValue()}")
-}
-
 @Stable
 class AccountSettings(
     val keyPair: KeyPair,
@@ -788,6 +702,62 @@ class AccountSettings(
     // list names
     // ---
 
+    /**
+     * All per-screen persisted feed filters paired with their factory default.
+     * Deleting a list (NIP-51 people list / follow pack) must reset any screen whose
+     * filter still points at the deleted address — otherwise the screen keeps a
+     * dangling [TopFilter.PeopleList] that re-creates an empty AddressableNote shell
+     * on every start and shows the list's dTag/UUID in the top bar instead of a name.
+     */
+    private val feedFiltersWithDefaults: List<Pair<MutableStateFlow<TopFilter>, TopFilter>> =
+        listOf(
+            defaultHomeFollowList to TopFilter.AllFollows,
+            defaultStoriesFollowList to TopFilter.Global,
+            defaultNotificationFollowList to TopFilter.Selected,
+            defaultDiscoveryFollowList to TopFilter.Global,
+            defaultPollsFollowList to TopFilter.Global,
+            defaultPicturesFollowList to TopFilter.Global,
+            defaultNappletsFollowList to TopFilter.Global,
+            defaultNsitesFollowList to TopFilter.Global,
+            defaultWorkoutsFollowList to TopFilter.Global,
+            defaultGitRepositoriesFollowList to TopFilter.Global,
+            defaultHighlightsFollowList to TopFilter.Global,
+            defaultCalendarsFollowList to TopFilter.Global,
+            defaultProductsFollowList to TopFilter.AroundMe,
+            defaultShortsFollowList to TopFilter.Global,
+            defaultPublicChatsFollowList to TopFilter.Global,
+            defaultLiveStreamsFollowList to TopFilter.Global,
+            defaultNestsFollowList to TopFilter.Global,
+            defaultLongsFollowList to TopFilter.Global,
+            defaultArticlesFollowList to TopFilter.AllFollows,
+            defaultMusicTracksFollowList to TopFilter.Global,
+            defaultMusicPlaylistsFollowList to TopFilter.Global,
+            defaultPodcastEpisodesFollowList to TopFilter.Global,
+            defaultPodcastsFollowList to TopFilter.Global,
+            defaultSoftwareAppsFollowList to TopFilter.Global,
+            defaultBadgesFollowList to TopFilter.Mine,
+            defaultBrowseEmojiSetsFollowList to TopFilter.Global,
+            defaultCommunitiesFollowList to TopFilter.AllFollows,
+            defaultFollowPacksFollowList to TopFilter.Global,
+            defaultAppRecommendationsFollowList to TopFilter.Global,
+            defaultRelayGroupsDiscoveryFollowList to TopFilter.Mine,
+        )
+
+    /** Resets every persisted feed filter that points at the deleted list's address. */
+    fun resetFeedFiltersPointingTo(address: Address) {
+        var changed = false
+
+        feedFiltersWithDefaults.forEach { (flow, default) ->
+            val current = flow.value
+            if (current is TopFilter.AddressableTopFilter && current.address == address) {
+                flow.tryEmit(default)
+                changed = true
+            }
+        }
+
+        if (changed) saveAccountSettings()
+    }
+
     fun changeDefaultHomeFollowList(name: FeedDefinition) {
         changeDefaultHomeFollowList(name.code)
     }

amethyst/src/main/java/com/vitorpamplona/amethyst/model/AccountZapActions.kt

@@ -21,6 +21,8 @@
 package com.vitorpamplona.amethyst.model
 
 import com.vitorpamplona.amethyst.R
+import com.vitorpamplona.amethyst.commons.model.Note
+import com.vitorpamplona.amethyst.commons.model.User
 import com.vitorpamplona.amethyst.commons.onchain.OnchainZapSendError
 import com.vitorpamplona.amethyst.commons.onchain.OnchainZapSendResult
 import com.vitorpamplona.amethyst.commons.onchain.OnchainZapSendStage
@@ -99,18 +101,20 @@ class AccountZapActions(
 
     suspend fun sendNwcRequest(
         request: Request,
+        onTimeout: () -> Unit = {},
         onResponse: (Response?) -> Unit,
     ) {
-        val (event, relay) = account.nip47SignerState.sendNwcRequest(request, onResponse)
+        val (event, relay) = account.nip47SignerState.sendNwcRequest(request, onTimeout, onResponse)
         account.client.publish(event, setOf(relay))
     }
 
     suspend fun sendNwcRequestToWallet(
         walletUri: Nip47WalletConnect.Nip47URINorm,
         request: Request,
+        onTimeout: () -> Unit = {},
         onResponse: (Response?) -> Unit,
     ): HexKey {
-        val (event, relay) = account.nip47SignerState.sendNwcRequestToWallet(walletUri, request, onResponse)
+        val (event, relay) = account.nip47SignerState.sendNwcRequestToWallet(walletUri, request, onTimeout, onResponse)
         account.client.publish(event, setOf(relay))
         return event.id
     }
@@ -127,12 +131,20 @@ class AccountZapActions(
      */
     fun cleanupNwcRequest(requestId: HexKey) = LocalCache.paymentTracker.cleanup(requestId)
 
+    /**
+     * @param onTimeout invoked when no kind-23195 reply arrives before
+     *   [NwcSignerState.NWC_RESPONSE_TIMEOUT_MS]. Pass one on any path with a user
+     *   watching: without it a response lost in transit is indistinguishable from
+     *   the action never having happened.
+     */
     suspend fun sendZapPaymentRequestFor(
         bolt11: String,
         zappedNote: Note?,
+        onTimeout: () -> Unit = {},
+        metadata: Map<String, Any?>? = null,
         onResponse: (Response?) -> Unit,
     ) {
-        val (event, relay) = account.nip47SignerState.sendZapPaymentRequestFor(bolt11, zappedNote, onResponse)
+        val (event, relay) = account.nip47SignerState.sendZapPaymentRequestFor(bolt11, zappedNote, onTimeout, metadata, onResponse)
         account.client.publish(event, setOf(relay))
     }
 
@@ -283,16 +295,18 @@ class AccountZapActions(
         val backend =
             account.cache.onchainBackend
                 ?: return onchainBackendNotConfigured()
-        return OnchainZapSender.send(
-            backend = backend,
-            signer = account.signer,
-            senderPubKey = account.signer.pubKey,
-            recipientPubKey = recipientPubKey,
-            amountSats = amountSats,
-            feeRateSatPerVByte = feeRateSatPerVByte,
-            comment = comment,
-            zappedEvent = zappedEvent,
-        ) { template -> account.broadcaster.signAndComputeBroadcast(template) }
+        return OnchainZapSender
+            .send(
+                backend = backend,
+                signer = account.signer,
+                senderPubKey = account.signer.pubKey,
+                recipientPubKey = recipientPubKey,
+                amountSats = amountSats,
+                feeRateSatPerVByte = feeRateSatPerVByte,
+                comment = comment,
+                zappedEvent = zappedEvent,
+            ) { template -> account.broadcaster.signAndComputeBroadcast(template) }
+            .alsoRefreshBalanceIfSpent()
     }
 
     /**
@@ -308,14 +322,15 @@ class AccountZapActions(
         val backend =
             account.cache.onchainBackend
                 ?: return onchainBackendNotConfigured()
-        return OnchainZapSender.sendToAddress(
-            backend = backend,
-            signer = account.signer,
-            senderPubKey = account.signer.pubKey,
-            recipientAddress = recipientAddress,
-            amountSats = amountSats,
-            feeRateSatPerVByte = feeRateSatPerVByte,
-        )
+        return OnchainZapSender
+            .sendToAddress(
+                backend = backend,
+                signer = account.signer,
+                senderPubKey = account.signer.pubKey,
+                recipientAddress = recipientAddress,
+                amountSats = amountSats,
+                feeRateSatPerVByte = feeRateSatPerVByte,
+            ).alsoRefreshBalanceIfSpent()
     }
 
     /**
@@ -332,14 +347,30 @@ class AccountZapActions(
         val backend =
             account.cache.onchainBackend
                 ?: return onchainBackendNotConfigured()
-        return OnchainZapSender.sendSplit(
-            backend = backend,
-            signer = account.signer,
-            senderPubKey = account.signer.pubKey,
-            recipients = recipients,
-            feeRateSatPerVByte = feeRateSatPerVByte,
-            comment = comment,
-            zappedEvent = zappedEvent,
-        ) { template -> account.broadcaster.signAndComputeBroadcast(template) }
+        return OnchainZapSender
+            .sendSplit(
+                backend = backend,
+                signer = account.signer,
+                senderPubKey = account.signer.pubKey,
+                recipients = recipients,
+                feeRateSatPerVByte = feeRateSatPerVByte,
+                comment = comment,
+                zappedEvent = zappedEvent,
+            ) { template -> account.broadcaster.signAndComputeBroadcast(template) }
+            .alsoRefreshBalanceIfSpent()
+    }
+
+    /**
+     * Once a transaction is on the chain the cached balance is wrong — and it is
+     * what the zap picker gates the on-chain rail on, so leaving it would keep
+     * offering amounts the wallet just spent. Covers the failure case too: a
+     * receipt that fails to publish still broadcast the payment.
+     */
+    private fun OnchainZapSendResult.alsoRefreshBalanceIfSpent(): OnchainZapSendResult {
+        val broadcast =
+            this is OnchainZapSendResult.Success ||
+                (this is OnchainZapSendResult.Failure && broadcastTxid != null)
+        if (broadcast) account.onchainWalletState.invalidate()
+        return this
     }
 }

amethyst/src/main/java/com/vitorpamplona/amethyst/model/CachePruner.kt

@@ -20,7 +20,10 @@
  */
 package com.vitorpamplona.amethyst.model
 
+import com.vitorpamplona.amethyst.commons.model.AddressableNote
 import com.vitorpamplona.amethyst.commons.model.Channel
+import com.vitorpamplona.amethyst.commons.model.Note
+import com.vitorpamplona.amethyst.commons.model.cache.filter
 import com.vitorpamplona.amethyst.commons.model.nip53LiveActivities.LiveActivitiesChannel
 import com.vitorpamplona.amethyst.service.checkNotInMainThread
 import com.vitorpamplona.quartz.buzz.stream.StreamMessageEditEvent

amethyst/src/main/java/com/vitorpamplona/amethyst/model/CacheSearch.kt

@@ -20,6 +20,9 @@
  */
 package com.vitorpamplona.amethyst.model
 
+import com.vitorpamplona.amethyst.commons.model.Note
+import com.vitorpamplona.amethyst.commons.model.User
+import com.vitorpamplona.amethyst.commons.model.cache.filter
 import com.vitorpamplona.amethyst.commons.model.emphChat.EphemeralChatChannel
 import com.vitorpamplona.amethyst.commons.model.nip28PublicChats.PublicChatChannel
 import com.vitorpamplona.amethyst.commons.model.nip53LiveActivities.LiveActivitiesChannel

amethyst/src/main/java/com/vitorpamplona/amethyst/model/EventBroadcaster.kt

@@ -20,6 +20,9 @@
  */
 package com.vitorpamplona.amethyst.model
 
+import com.vitorpamplona.amethyst.commons.model.Note
+import com.vitorpamplona.amethyst.commons.model.User
+import com.vitorpamplona.amethyst.commons.model.cache.filter
 import com.vitorpamplona.quartz.nip01Core.core.AddressableEvent
 import com.vitorpamplona.quartz.nip01Core.core.Event
 import com.vitorpamplona.quartz.nip01Core.core.HexKey

amethyst/src/main/java/com/vitorpamplona/amethyst/model/LocalCache.kt

@@ -25,8 +25,14 @@ package com.vitorpamplona.amethyst.model
 import androidx.compose.runtime.Stable
 import com.vitorpamplona.amethyst.Amethyst
 import com.vitorpamplona.amethyst.commons.cashu.MintDirectoryIndex
+import com.vitorpamplona.amethyst.commons.model.AddressableNote
 import com.vitorpamplona.amethyst.commons.model.Channel
+import com.vitorpamplona.amethyst.commons.model.Dao
+import com.vitorpamplona.amethyst.commons.model.Note
 import com.vitorpamplona.amethyst.commons.model.OnchainZapStatus
+import com.vitorpamplona.amethyst.commons.model.RelayGroupTargetCandidate
+import com.vitorpamplona.amethyst.commons.model.User
+import com.vitorpamplona.amethyst.commons.model.UserContext
 import com.vitorpamplona.amethyst.commons.model.buzz.BuzzCommunityMembership
 import com.vitorpamplona.amethyst.commons.model.buzz.BuzzDmRegistry
 import com.vitorpamplona.amethyst.commons.model.buzz.BuzzPresenceState
@@ -35,6 +41,7 @@ import com.vitorpamplona.amethyst.commons.model.buzz.BuzzTypingState
 import com.vitorpamplona.amethyst.commons.model.buzz.BuzzWorkspaceStates
 import com.vitorpamplona.amethyst.commons.model.cache.ICacheProvider
 import com.vitorpamplona.amethyst.commons.model.cache.LargeSoftCache
+import com.vitorpamplona.amethyst.commons.model.cache.filter
 import com.vitorpamplona.amethyst.commons.model.concord.ConcordChannel
 import com.vitorpamplona.amethyst.commons.model.emphChat.EphemeralChatChannel
 import com.vitorpamplona.amethyst.commons.model.geohashChat.GeohashChatChannel
@@ -49,11 +56,12 @@ import com.vitorpamplona.amethyst.commons.model.observables.NewEventMatchingFilt
 import com.vitorpamplona.amethyst.commons.model.observables.NoteListMatchingFilter
 import com.vitorpamplona.amethyst.commons.model.observables.Observable
 import com.vitorpamplona.amethyst.commons.model.privateChats.ChatroomList
+import com.vitorpamplona.amethyst.commons.model.redirectStrayRelayGroupContent
+import com.vitorpamplona.amethyst.commons.service.BundledInsert
 import com.vitorpamplona.amethyst.commons.service.nwc.NwcPaymentTracker
 import com.vitorpamplona.amethyst.isDebug
 import com.vitorpamplona.amethyst.model.LocalCache.observeEvents
 import com.vitorpamplona.amethyst.model.nipBCOnchainZaps.OnchainZapResolver
-import com.vitorpamplona.amethyst.service.BundledInsert
 import com.vitorpamplona.amethyst.service.checkNotInMainThread
 import com.vitorpamplona.amethyst.ui.note.dateFormatter
 import com.vitorpamplona.quartz.buzz.aeEngrams.EngramEvent
@@ -825,6 +833,12 @@ object LocalCache : ILocalCache, ICacheProvider, Dao {
             false
         }
 
+    /**
+     * Checks if a kind-5 event from the addressable's own author has deleted this
+     * address. Works for empty addressable shells whose event is not loaded yet.
+     */
+    fun hasBeenDeleted(address: Address): Boolean = deletionIndex.hasBeenDeleted(address, address.pubKeyHex)
+
     fun getOrAddAliasNote(
         idHex: String,
         note: Note,
@@ -952,7 +966,7 @@ object LocalCache : ILocalCache, ICacheProvider, Dao {
         return Hex.isHex64(key)
     }
 
-    fun checkGetOrCreateAddressableNote(key: String): AddressableNote? =
+    override fun checkGetOrCreateAddressableNote(key: String): AddressableNote? =
         try {
             val addr = Address.parse(key)
             if (addr != null) {
@@ -1272,6 +1286,22 @@ object LocalCache : ILocalCache, ICacheProvider, Dao {
                 event.tagsWithoutCitations().filter { it != event.repository()?.toTag() }.mapNotNull { checkGetOrCreateNote(it) }
             }
 
+            is GitPullRequestUpdateEvent -> {
+                // Link the update to its parent PR so it lands in the PR's
+                // replies collection (and picks up its target for threading).
+                // The repository ATag isn't a reply target — skip it.
+                listOfNotNull(event.parentPullRequestId()?.let { checkGetOrCreateNote(it) })
+            }
+
+            is GitStatusEvent -> {
+                // A status event roots itself at a patch/PR/issue via a
+                // marked-`root` `e` tag; link only that so the transition
+                // appears in the target's replies (GitStatusIndex reduces the
+                // observed stream separately and doesn't need this wiring, but
+                // ThreadFeedView and the notifications-tab reply chain do).
+                listOfNotNull(event.rootEventId()?.let { checkGetOrCreateNote(it) })
+            }
+
             is TextNoteEvent -> {
                 event.tagsWithoutCitations().mapNotNull { checkGetOrCreateNote(it) }
             }
@@ -3102,6 +3132,16 @@ object LocalCache : ILocalCache, ICacheProvider, Dao {
         wasVerified: Boolean,
     ): Boolean {
         val requestId = event.requestId()
+
+        // Duplicate delivery, checked before the tracker so the warnings below mean one
+        // thing each. Some NWC relays replay every cached kind-23195 whenever the REQ
+        // filter changes (see NWCPaymentFilterAssembler), so an already-answered response
+        // arrives again and again. Its first copy consumed the pending request, so the
+        // replays would otherwise be reported as "no pending request is registered" —
+        // the same line a genuinely late response produces, which made the two
+        // indistinguishable in the field.
+        if (getNoteIfExists(event.id)?.event != null) return false
+
         val pending =
             when (val match = paymentTracker.onResponseReceived(requestId, event.pubKey)) {
                 is NwcPaymentTracker.MatchResult.Matched -> {
@@ -3121,9 +3161,12 @@ object LocalCache : ILocalCache, ICacheProvider, Dao {
                 }
 
                 NwcPaymentTracker.MatchResult.NoMatch -> {
+                    // Not a replay — those are filtered above — so this is the first time we
+                    // have seen this response and nothing is waiting for it.
                     Log.w("LocalCache") {
                         "NWC response ${event.id} from ${event.pubKey} references request e=$requestId but no pending request is registered. " +
-                            "The response was either delivered after timeout, the user holds a stale subscription, or the wallet service set the wrong e tag."
+                            "The response arrived after the client gave up waiting, the user holds a stale subscription, " +
+                            "or the wallet service set the wrong e tag."
                     }
                     return false
                 }
@@ -3137,7 +3180,8 @@ object LocalCache : ILocalCache, ICacheProvider, Dao {
         val note = getOrCreateNote(event.id)
         val author = getOrCreateUser(event.pubKey)
 
-        // Already processed this event.
+        // Backstop for a concurrent delivery that loaded the event between the replay
+        // check above and here. Same outcome, no warning: it is not a protocol problem.
         if (note.event != null) return false
 
         if (wasVerified || justVerify(event)) {

amethyst/src/main/java/com/vitorpamplona/amethyst/model/Note.kt

@@ -1,26 +0,0 @@
-/*
- * Copyright (c) 2025 Vitor Pamplona
- *
- * Permission is hereby granted, free of charge, to any person obtaining a copy of
- * this software and associated documentation files (the "Software"), to deal in
- * the Software without restriction, including without limitation the rights to use,
- * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
- * Software, and to permit persons to whom the Software is furnished to do so,
- * subject to the following conditions:
- *
- * The above copyright notice and this permission notice shall be included in all
- * copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
- * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
- * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
- * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
- * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
- */
-package com.vitorpamplona.amethyst.model
-
-// Re-export from commons for backwards compatibility
-typealias Note = com.vitorpamplona.amethyst.commons.model.Note
-typealias AddressableNote = com.vitorpamplona.amethyst.commons.model.AddressableNote
-typealias NoteState = com.vitorpamplona.amethyst.commons.model.NoteState

amethyst/src/main/java/com/vitorpamplona/amethyst/model/ParticipantListBuilder.kt

@@ -20,6 +20,8 @@
  */
 package com.vitorpamplona.amethyst.model
 
+import com.vitorpamplona.amethyst.commons.model.Note
+import com.vitorpamplona.amethyst.commons.model.User
 import com.vitorpamplona.quartz.nip01Core.core.HexKey
 
 class ParticipantListBuilder {

amethyst/src/main/java/com/vitorpamplona/amethyst/model/UiSettings.kt

@@ -60,6 +60,11 @@ data class UiSettings(
     // on-chain rail in the Send Payment screen. Defaults to true (shown) so the
     // behavior is unchanged for everyone who doesn't turn it off.
     val showOnchainWallet: Boolean = true,
+    // Whether the zap picker offers a NIP-A3 pay-to hand-off chip when the sender
+    // and recipient share a payment protocol. Defaults to false: those targets can
+    // be bank or Venmo handles carrying legal names, and this puts them one tap
+    // from every note in the feed.
+    val showPayToZapChip: Boolean = true,
 )
 
 enum class ThemeType(

amethyst/src/main/java/com/vitorpamplona/amethyst/model/UiSettingsFlow.kt

@@ -56,6 +56,7 @@ class UiSettingsFlow(
     val fontSize: MutableStateFlow<FontSizeType> = MutableStateFlow(FontSizeType.NORMAL),
     val composeSignature: MutableStateFlow<String> = MutableStateFlow(""),
     val showOnchainWallet: MutableStateFlow<Boolean> = MutableStateFlow(true),
+    val showPayToZapChip: MutableStateFlow<Boolean> = MutableStateFlow(true),
 ) {
     val listOfFlows: List<Flow<Any?>> =
         listOf<Flow<Any?>>(
@@ -88,6 +89,7 @@ class UiSettingsFlow(
             fontSize,
             composeSignature,
             showOnchainWallet,
+            showPayToZapChip,
         )
 
     // emits at every change in any of the propertyes.
@@ -124,6 +126,7 @@ class UiSettingsFlow(
                 flows[26] as FontSizeType,
                 flows[27] as String,
                 flows[28] as Boolean,
+                flows[29] as Boolean,
             )
         }
 
@@ -158,6 +161,7 @@ class UiSettingsFlow(
             fontSize.value,
             composeSignature.value,
             showOnchainWallet.value,
+            showPayToZapChip.value,
         )
 
     fun update(torSettings: UiSettings): Boolean {
@@ -279,6 +283,10 @@ class UiSettingsFlow(
             showOnchainWallet.tryEmit(torSettings.showOnchainWallet)
             any = true
         }
+        if (showPayToZapChip.value != torSettings.showPayToZapChip) {
+            showPayToZapChip.tryEmit(torSettings.showPayToZapChip)
+            any = true
+        }
 
         return any
     }
@@ -333,6 +341,7 @@ class UiSettingsFlow(
                 MutableStateFlow(uiSettings.fontSize),
                 MutableStateFlow(uiSettings.composeSignature),
                 MutableStateFlow(uiSettings.showOnchainWallet),
+                MutableStateFlow(uiSettings.showPayToZapChip),
             )
     }
 }

amethyst/src/main/java/com/vitorpamplona/amethyst/model/accountsCache/AccountCacheState.kt

@@ -26,6 +26,8 @@ import com.vitorpamplona.amethyst.commons.connectedApps.nip46.InMemoryNip46Clien
 import com.vitorpamplona.amethyst.commons.connectedApps.nip46.Nip46ClientStore
 import com.vitorpamplona.amethyst.commons.connectedApps.signers.InMemoryNostrSignerPermissionStore
 import com.vitorpamplona.amethyst.commons.connectedApps.signers.NostrSignerPermissionStore
+import com.vitorpamplona.amethyst.commons.marmot.InMemoryMlsGroupStateStore
+import com.vitorpamplona.amethyst.commons.relayClient.nip47WalletConnect.NWCPaymentFilterAssembler
 import com.vitorpamplona.amethyst.commons.service.pow.PoWPublishQueue
 import com.vitorpamplona.amethyst.model.Account
 import com.vitorpamplona.amethyst.model.AccountSettings
@@ -33,10 +35,8 @@ import com.vitorpamplona.amethyst.model.LocalCache
 import com.vitorpamplona.amethyst.model.marmot.AndroidKeyPackageBundleStore
 import com.vitorpamplona.amethyst.model.marmot.AndroidMarmotMessageStore
 import com.vitorpamplona.amethyst.model.marmot.AndroidMlsGroupStateStore
-import com.vitorpamplona.amethyst.model.marmot.InMemoryMlsGroupStateStore
 import com.vitorpamplona.amethyst.service.location.LocationState
 import com.vitorpamplona.amethyst.service.relayClient.authCommand.model.DataStoreRelayAuthPermissionStore
-import com.vitorpamplona.amethyst.service.relayClient.reqCommand.nwc.NWCPaymentFilterAssembler
 import com.vitorpamplona.quartz.nip01Core.core.HexKey
 import com.vitorpamplona.quartz.nip01Core.core.toHexKey
 import com.vitorpamplona.quartz.nip01Core.relay.client.INostrClient
@@ -90,6 +90,9 @@ class AccountCacheState(
         accounts.update { existingAccounts ->
             val oldValue = existingAccounts[pubkey]
             oldValue?.scope?.cancel()
+            // CallManager keeps its own watchdog scope, independent of the account scope
+            // cancelled above, so it has to be disposed explicitly.
+            oldValue?.callManager?.dispose()
             // Unregisters the tracker's persistent listener from the shared
             // client; without this every removed account leaks a listener.
             oldValue?.chatDeliveryTracker?.destroy()
@@ -111,7 +114,7 @@ class AccountCacheState(
                 loadAccount(accountSettings)
             } catch (e: Exception) {
                 if (e is kotlinx.coroutines.CancellationException) throw e
-                Log.w("AccountCacheState", "Failed to preload account ${savedAccount.npub}: ${e.message}", e)
+                Log.w("AccountCacheState", "Failed to preload account ${savedAccount.npub}", e)
             }
         }
     }
@@ -144,7 +147,7 @@ class AccountCacheState(
     fun deleteAccountFiles(pubkey: HexKey) {
         val dir = File(accountsRootDir(), pubkey)
         if (dir.exists() && !dir.deleteRecursively()) {
-            Log.w("AccountCacheState", "Failed to delete account directory ${dir.absolutePath}")
+            Log.w("AccountCacheState") { "Failed to delete account directory ${dir.absolutePath}" }
         }
     }
 
@@ -160,7 +163,7 @@ class AccountCacheState(
                 if (child.deleteRecursively()) {
                     Log.d("AccountCacheState") { "Pruned orphan account dir ${child.name.take(8)}…" }
                 } else {
-                    Log.w("AccountCacheState", "Failed to prune orphan account dir ${child.absolutePath}")
+                    Log.w("AccountCacheState") { "Failed to prune orphan account dir ${child.absolutePath}" }
                 }
             }
         }
@@ -282,7 +285,7 @@ class AccountCacheState(
                     Dispatchers.IO +
                         SupervisorJob() +
                         CoroutineExceptionHandler { _, throwable ->
-                            Log.e("AccountCacheState", "Account ${signer.pubKey} caught exception: ${throwable.message}", throwable)
+                            Log.e("AccountCacheState", "Account ${signer.pubKey} caught exception", throwable)
                         },
                 ),
             mlsGroupStateStore = mlsStore,

amethyst/src/main/java/com/vitorpamplona/amethyst/model/bolt12Offers/Bolt12OfferListState.kt

@@ -20,9 +20,9 @@
  */
 package com.vitorpamplona.amethyst.model.bolt12Offers
 
+import com.vitorpamplona.amethyst.commons.model.NoteState
 import com.vitorpamplona.amethyst.model.AccountSettings
 import com.vitorpamplona.amethyst.model.LocalCache
-import com.vitorpamplona.amethyst.model.NoteState
 import com.vitorpamplona.quartz.nip01Core.signers.NostrSigner
 import com.vitorpamplona.quartz.nipB1Bolt12Zaps.offer.Bolt12OfferListEvent
 import com.vitorpamplona.quartz.utils.Log

amethyst/src/main/java/com/vitorpamplona/amethyst/model/buzz/BuzzMembershipNotices.kt

@@ -20,11 +20,11 @@
  */
 package com.vitorpamplona.amethyst.model.buzz
 
+import com.vitorpamplona.amethyst.commons.model.Note
 import com.vitorpamplona.amethyst.commons.model.buzz.ChannelClassification
 import com.vitorpamplona.amethyst.commons.model.buzz.MembershipNotice
+import com.vitorpamplona.amethyst.commons.model.cache.filterIntoSet
 import com.vitorpamplona.amethyst.model.LocalCache
-import com.vitorpamplona.amethyst.model.Note
-import com.vitorpamplona.amethyst.model.filterIntoSet
 import com.vitorpamplona.amethyst.service.relayClient.reqCommand.account.buzz.MembershipNotificationKinds
 import com.vitorpamplona.quartz.buzz.notifications.MemberAddedNotificationEvent
 import com.vitorpamplona.quartz.buzz.notifications.MemberRemovedNotificationEvent

amethyst/src/main/java/com/vitorpamplona/amethyst/model/edits/PrivateStorageRelayListState.kt

@@ -20,10 +20,11 @@
  */
 package com.vitorpamplona.amethyst.model.edits
 
+import com.vitorpamplona.amethyst.commons.model.Note
+import com.vitorpamplona.amethyst.commons.model.NoteState
+import com.vitorpamplona.amethyst.commons.model.edits.PrivateStorageRelayListDecryptionCache
 import com.vitorpamplona.amethyst.model.AccountSettings
 import com.vitorpamplona.amethyst.model.LocalCache
-import com.vitorpamplona.amethyst.model.Note
-import com.vitorpamplona.amethyst.model.NoteState
 import com.vitorpamplona.quartz.nip01Core.relay.normalizer.NormalizedRelayUrl
 import com.vitorpamplona.quartz.nip01Core.signers.NostrSigner
 import com.vitorpamplona.quartz.nip37Drafts.privateOutbox.PrivateOutboxRelayListEvent

amethyst/src/main/java/com/vitorpamplona/amethyst/model/marmot/KeyPackageRelayListState.kt

@@ -20,10 +20,10 @@
  */
 package com.vitorpamplona.amethyst.model.marmot
 
+import com.vitorpamplona.amethyst.commons.model.Note
+import com.vitorpamplona.amethyst.commons.model.NoteState
 import com.vitorpamplona.amethyst.model.AccountSettings
 import com.vitorpamplona.amethyst.model.LocalCache
-import com.vitorpamplona.amethyst.model.Note
-import com.vitorpamplona.amethyst.model.NoteState
 import com.vitorpamplona.quartz.marmot.mip00KeyPackages.KeyPackageRelayListEvent
 import com.vitorpamplona.quartz.nip01Core.relay.normalizer.NormalizedRelayUrl
 import com.vitorpamplona.quartz.nip01Core.signers.NostrSigner

amethyst/src/main/java/com/vitorpamplona/amethyst/model/nip02FollowLists/DeclaredFollowsPerOutboxRelay.kt

@@ -20,8 +20,8 @@
  */
 package com.vitorpamplona.amethyst.model.nip02FollowLists
 
+import com.vitorpamplona.amethyst.commons.model.topNavFeeds.OutboxRelayLoader
 import com.vitorpamplona.amethyst.model.LocalCache
-import com.vitorpamplona.amethyst.model.topNavFeeds.OutboxRelayLoader
 import com.vitorpamplona.quartz.nip01Core.core.HexKey
 import com.vitorpamplona.quartz.nip01Core.relay.normalizer.NormalizedRelayUrl
 import kotlinx.coroutines.CoroutineScope

amethyst/src/main/java/com/vitorpamplona/amethyst/model/nip02FollowLists/DeclaredFollowsPerUsingRelay.kt

@@ -20,8 +20,8 @@
  */
 package com.vitorpamplona.amethyst.model.nip02FollowLists
 
+import com.vitorpamplona.amethyst.commons.model.topNavFeeds.UsingRelayUnwrapper
 import com.vitorpamplona.amethyst.model.LocalCache
-import com.vitorpamplona.amethyst.model.topNavFeeds.UsingRelayUnwrapper
 import com.vitorpamplona.quartz.nip01Core.core.HexKey
 import com.vitorpamplona.quartz.nip01Core.relay.normalizer.NormalizedRelayUrl
 import kotlinx.coroutines.CoroutineScope

amethyst/src/main/java/com/vitorpamplona/amethyst/model/nip02FollowLists/FollowListOutboxOrProxyRelays.kt

@@ -20,10 +20,10 @@
  */
 package com.vitorpamplona.amethyst.model.nip02FollowLists
 
+import com.vitorpamplona.amethyst.commons.model.topNavFeeds.OutboxRelayLoader
 import com.vitorpamplona.amethyst.model.LocalCache
 import com.vitorpamplona.amethyst.model.nip51Lists.blockedRelays.BlockedRelayListState
 import com.vitorpamplona.amethyst.model.nip51Lists.proxyRelays.ProxyRelayListState
-import com.vitorpamplona.amethyst.model.topNavFeeds.OutboxRelayLoader
 import com.vitorpamplona.quartz.nip01Core.relay.normalizer.NormalizedRelayUrl
 import kotlinx.coroutines.CoroutineScope
 import kotlinx.coroutines.Dispatchers

amethyst/src/main/java/com/vitorpamplona/amethyst/model/nip02FollowLists/FollowListReusedOutboxOrProxyRelays.kt

@@ -20,10 +20,10 @@
  */
 package com.vitorpamplona.amethyst.model.nip02FollowLists
 
+import com.vitorpamplona.amethyst.commons.model.topNavFeeds.OutboxRelayLoader
 import com.vitorpamplona.amethyst.model.LocalCache
 import com.vitorpamplona.amethyst.model.nip51Lists.blockedRelays.BlockedRelayListState
 import com.vitorpamplona.amethyst.model.nip51Lists.proxyRelays.ProxyRelayListState
-import com.vitorpamplona.amethyst.model.topNavFeeds.OutboxRelayLoader
 import com.vitorpamplona.quartz.nip01Core.relay.normalizer.NormalizedRelayUrl
 import kotlinx.coroutines.CoroutineScope
 import kotlinx.coroutines.Dispatchers

amethyst/src/main/java/com/vitorpamplona/amethyst/model/nip02FollowLists/FollowsPerOutboxRelay.kt

@@ -20,10 +20,10 @@
  */
 package com.vitorpamplona.amethyst.model.nip02FollowLists
 
+import com.vitorpamplona.amethyst.commons.model.topNavFeeds.OutboxRelayLoader
 import com.vitorpamplona.amethyst.model.LocalCache
 import com.vitorpamplona.amethyst.model.nip51Lists.blockedRelays.BlockedRelayListState
 import com.vitorpamplona.amethyst.model.nip51Lists.proxyRelays.ProxyRelayListState
-import com.vitorpamplona.amethyst.model.topNavFeeds.OutboxRelayLoader
 import com.vitorpamplona.quartz.nip01Core.core.HexKey
 import com.vitorpamplona.quartz.nip01Core.relay.normalizer.NormalizedRelayUrl
 import kotlinx.coroutines.CoroutineScope

amethyst/src/main/java/com/vitorpamplona/amethyst/model/nip02FollowLists/Kind3FollowListState.kt

@@ -22,9 +22,9 @@ package com.vitorpamplona.amethyst.model.nip02FollowLists
 
 import androidx.compose.runtime.Immutable
 import com.vitorpamplona.amethyst.commons.model.NoteState
+import com.vitorpamplona.amethyst.commons.model.User
 import com.vitorpamplona.amethyst.model.AccountSettings
 import com.vitorpamplona.amethyst.model.LocalCache
-import com.vitorpamplona.amethyst.model.User
 import com.vitorpamplona.quartz.nip01Core.core.HexKey
 import com.vitorpamplona.quartz.nip01Core.signers.NostrSigner
 import com.vitorpamplona.quartz.nip02FollowList.ContactListEvent

amethyst/src/main/java/com/vitorpamplona/amethyst/model/nip03Timestamp/IncomingOtsEventVerifier.kt

@@ -20,8 +20,9 @@
  */
 package com.vitorpamplona.amethyst.model.nip03Timestamp
 
+import com.vitorpamplona.amethyst.commons.model.Note
+import com.vitorpamplona.amethyst.commons.model.nip03Timestamp.cacheVerifyOts
 import com.vitorpamplona.amethyst.model.LocalCache
-import com.vitorpamplona.amethyst.model.Note
 import com.vitorpamplona.quartz.nip03Timestamp.OtsEvent
 import com.vitorpamplona.quartz.nip03Timestamp.OtsResolverBuilder
 import kotlinx.coroutines.CoroutineScope

amethyst/src/main/java/com/vitorpamplona/amethyst/model/nip03Timestamp/OtsState.kt

@@ -20,9 +20,9 @@
  */
 package com.vitorpamplona.amethyst.model.nip03Timestamp
 
+import com.vitorpamplona.amethyst.commons.model.Note
 import com.vitorpamplona.amethyst.model.AccountSettings
 import com.vitorpamplona.amethyst.model.LocalCache
-import com.vitorpamplona.amethyst.model.Note
 import com.vitorpamplona.quartz.nip01Core.core.Event
 import com.vitorpamplona.quartz.nip01Core.signers.NostrSigner
 import com.vitorpamplona.quartz.nip03Timestamp.OtsEvent

amethyst/src/main/java/com/vitorpamplona/amethyst/model/nip17Dms/DmRelayListState.kt

@@ -20,10 +20,10 @@
  */
 package com.vitorpamplona.amethyst.model.nip17Dms
 
+import com.vitorpamplona.amethyst.commons.model.Note
+import com.vitorpamplona.amethyst.commons.model.NoteState
 import com.vitorpamplona.amethyst.model.AccountSettings
 import com.vitorpamplona.amethyst.model.LocalCache
-import com.vitorpamplona.amethyst.model.Note
-import com.vitorpamplona.amethyst.model.NoteState
 import com.vitorpamplona.quartz.nip01Core.relay.normalizer.NormalizedRelayUrl
 import com.vitorpamplona.quartz.nip01Core.signers.NostrSigner
 import com.vitorpamplona.quartz.nip17Dm.settings.ChatMessageRelayListEvent

amethyst/src/main/java/com/vitorpamplona/amethyst/model/nip30CustomEmojis/OwnedEmojiPacksState.kt

@@ -20,16 +20,16 @@
  */
 package com.vitorpamplona.amethyst.model.nip30CustomEmojis
 
+import com.vitorpamplona.amethyst.commons.model.AddressableNote
+import com.vitorpamplona.amethyst.commons.model.Note
 import com.vitorpamplona.amethyst.commons.model.anyNotNullEvent
+import com.vitorpamplona.amethyst.commons.model.cache.filter
 import com.vitorpamplona.amethyst.commons.model.eventIdSet
 import com.vitorpamplona.amethyst.commons.model.events
 import com.vitorpamplona.amethyst.commons.model.nip30CustomEmojis.OwnedEmojiPack
 import com.vitorpamplona.amethyst.commons.model.updateFlow
 import com.vitorpamplona.amethyst.model.Account
-import com.vitorpamplona.amethyst.model.AddressableNote
 import com.vitorpamplona.amethyst.model.LocalCache
-import com.vitorpamplona.amethyst.model.Note
-import com.vitorpamplona.amethyst.model.filter
 import com.vitorpamplona.quartz.nip01Core.signers.NostrSigner
 import com.vitorpamplona.quartz.nip01Core.signers.SignerExceptions
 import com.vitorpamplona.quartz.nip01Core.signers.update

amethyst/src/main/java/com/vitorpamplona/amethyst/model/nip47WalletConnect/NwcSignerState.kt

@@ -21,11 +21,12 @@
 package com.vitorpamplona.amethyst.model.nip47WalletConnect
 
 import com.vitorpamplona.amethyst.commons.model.INwcSignerState
+import com.vitorpamplona.amethyst.commons.model.Note
+import com.vitorpamplona.amethyst.commons.model.nip47WalletConnect.NwcInfoCache
+import com.vitorpamplona.amethyst.commons.relayClient.nip47WalletConnect.NWCPaymentFilterAssembler
+import com.vitorpamplona.amethyst.commons.relayClient.nip47WalletConnect.NWCPaymentQueryState
 import com.vitorpamplona.amethyst.model.AccountSettings
 import com.vitorpamplona.amethyst.model.LocalCache
-import com.vitorpamplona.amethyst.model.Note
-import com.vitorpamplona.amethyst.service.relayClient.reqCommand.nwc.NWCPaymentFilterAssembler
-import com.vitorpamplona.amethyst.service.relayClient.reqCommand.nwc.NWCPaymentQueryState
 import com.vitorpamplona.quartz.nip01Core.core.HexKey
 import com.vitorpamplona.quartz.nip01Core.core.hexToByteArray
 import com.vitorpamplona.quartz.nip01Core.crypto.KeyPair
@@ -37,11 +38,15 @@ import com.vitorpamplona.quartz.nip47WalletConnect.cache.NostrWalletConnectReque
 import com.vitorpamplona.quartz.nip47WalletConnect.cache.NostrWalletConnectResponseCache
 import com.vitorpamplona.quartz.nip47WalletConnect.events.LnZapPaymentRequestEvent
 import com.vitorpamplona.quartz.nip47WalletConnect.events.LnZapPaymentResponseEvent
+import com.vitorpamplona.quartz.nip47WalletConnect.events.NwcInfoEvent
 import com.vitorpamplona.quartz.nip47WalletConnect.events.NwcNotificationEvent
 import com.vitorpamplona.quartz.nip47WalletConnect.rpc.NwcTransaction
+import com.vitorpamplona.quartz.nip47WalletConnect.rpc.PayInvoiceMethod
 import com.vitorpamplona.quartz.nip47WalletConnect.rpc.PaymentReceivedNotification
 import com.vitorpamplona.quartz.nip47WalletConnect.rpc.Request
 import com.vitorpamplona.quartz.nip47WalletConnect.rpc.Response
+import com.vitorpamplona.quartz.nip47WalletConnect.tags.ExtensionsTag
+import com.vitorpamplona.quartz.utils.Log
 import kotlinx.coroutines.CancellationException
 import kotlinx.coroutines.CoroutineScope
 import kotlinx.coroutines.Dispatchers
@@ -60,6 +65,7 @@ import kotlinx.coroutines.flow.flowOn
 import kotlinx.coroutines.flow.map
 import kotlinx.coroutines.flow.stateIn
 import kotlinx.coroutines.launch
+import kotlinx.coroutines.withTimeoutOrNull
 
 /**
  * Manages NIP-47 (Nostr Wallet Connect) related signing operations and decryption cache for a given account.
@@ -135,17 +141,58 @@ class NwcSignerState(
     }
 
     /**
-     * Non-blocking read of the negotiated encryption preference for a wallet.
-     * NIP-47 says a client "should always prefer nip44 if supported by the wallet
-     * service". Returns true only when the cached info event advertises `nip44_v2`;
-     * otherwise NIP-04 (the legacy default). Also nudges a background refresh so a
-     * stale/expired entry self-heals for the next transaction without blocking this
-     * one.
+     * The negotiated encryption preference for a wallet. NIP-47 says a client
+     * "should always prefer nip44 if supported by the wallet service", so a false
+     * here has to mean "the wallet does not offer NIP-44" — not "we have not asked
+     * yet". [walletInfo] is what makes that distinction true.
      */
-    private fun prefersNip44(uri: Nip47WalletConnect.Nip47URINorm?): Boolean {
-        uri ?: return false
-        infoCache?.refreshIfStale(uri)
-        return infoCache?.current(uri)?.encryptionSchemes()?.any { it.equals("nip44_v2", ignoreCase = true) } ?: false
+    private fun prefersNip44(info: NwcInfoEvent?): Boolean = info?.encryptionSchemes()?.any { it.equals("nip44_v2", ignoreCase = true) } == true
+
+    /**
+     * The wallet's advertised capabilities: the one place a send waits on them, and
+     * it waits AT MOST ONCE.
+     *
+     * WAITING IS THE POINT. The info cache is per-account and in memory only, so it
+     * starts empty on every app launch, and reading it without waiting makes "not
+     * fetched yet" indistinguishable from "not supported". That shipped twice: the
+     * first transaction to each wallet after a launch fell back to NIP-04 against a
+     * wallet advertising `nip44_v2`, and a payment to a wallet that had been
+     * advertising NWC-06 for twenty minutes still went out bare — with nothing, on
+     * either side, reporting an error.
+     *
+     * ONCE, because both questions read the same event. Each used to fetch for
+     * itself, which is free on a warm cache and doubles the stall on a cold one:
+     * [NwcInfoCache] deliberately does not cache a FAILED fetch, so with the relay
+     * down both waits ran in full and a 3s worst case became 6s.
+     *
+     * BOUNDED, because this sits in front of a payment the user has already tapped
+     * and the no-response timer does not start until it returns. On expiry the
+     * answer is null — read as NIP-04 and as no-metadata, both of them the safe
+     * direction — while the fetch keeps running in the cache's own scope so the next
+     * request gets the negotiated scheme. Never bound the fetch itself instead: a
+     * null from it is cached as a definitive "no info event" for the whole TTL,
+     * which would pin the wallet to NIP-04 for days.
+     */
+    private suspend fun walletInfo(uri: Nip47WalletConnect.Nip47URINorm?): NwcInfoEvent? {
+        uri ?: return null
+        return withTimeoutOrNull(NIP44_NEGOTIATION_WAIT_MS) { infoCache?.currentOrFetch(uri) }
+    }
+
+    /**
+     * Strips NWC-06 `metadata` from a request bound for a wallet that never said it
+     * understands the field — [MetadataCarrying] has the reason that matters.
+     *
+     * APPLIED WHERE THE REQUEST IS BUILT rather than at each call site, so populating
+     * `metadata` anywhere upstream is safe by construction.
+     *
+     * MUTATES the request in place — see the callers' KDoc. Requests are built per
+     * send and not reused, and stripping a copy would mean rebuilding a params object
+     * whose field list would then drift from the original.
+     */
+    private fun Request.dropMetadataIfUnsupported(info: NwcInfoEvent?) {
+        val carrier = metadataCarrier ?: return
+        if (carrier.metadata == null || info?.supportsExtension(ExtensionsTag.METADATA_CONVENTIONS) == true) return
+        carrier.metadata = null
     }
 
     fun hasWalletConnectSetup(): Boolean = settings.nwcWallets.value.isNotEmpty()
@@ -203,21 +250,30 @@ class NwcSignerState(
      */
     suspend fun sendNwcRequest(
         request: Request,
+        onTimeout: () -> Unit = {},
         onResponse: (Response?) -> Unit,
-    ): Pair<LnZapPaymentRequestEvent, NormalizedRelayUrl> = sendNwcRequestToWallet(defaultWalletUri.value, request, onResponse)
+    ): Pair<LnZapPaymentRequestEvent, NormalizedRelayUrl> = sendNwcRequestToWallet(defaultWalletUri.value, request, onTimeout, onResponse)
 
     /**
      * Sends a generic NIP-47 request to a specific wallet.
+     *
+     * [request] MAY BE MUTATED: NWC-06 `metadata` is stripped in place when the
+     * wallet has not advertised support for it. Build a fresh request per send
+     * rather than retaining or re-reading this one.
      */
     suspend fun sendNwcRequestToWallet(
         walletUri: Nip47WalletConnect.Nip47URINorm?,
         request: Request,
+        onTimeout: () -> Unit = {},
         onResponse: (Response?) -> Unit,
     ): Pair<LnZapPaymentRequestEvent, NormalizedRelayUrl> {
         val walletService = walletUri ?: throw IllegalArgumentException("No NIP47 setup")
         val walletSigner = buildSigner(walletService) ?: signer
 
-        val event = LnZapPaymentRequestEvent.createRequest(request, walletService.pubKeyHex, walletSigner, useNip44 = prefersNip44(walletService))
+        val info = walletInfo(walletService)
+        request.dropMetadataIfUnsupported(info)
+
+        val event = LnZapPaymentRequestEvent.createRequest(request, walletService.pubKeyHex, walletSigner, useNip44 = prefersNip44(info))
 
         val filter =
             NWCPaymentQueryState(
@@ -234,14 +290,7 @@ class NwcSignerState(
         // be missed.
         assembler.subscribeAndFlush(filter)
 
-        // Safety net: drop the filter after 60s if the wallet never replies.
-        // The happy path (response arrives) cancels this job and unsubscribes
-        // through assembler.unsubscribeSoon, which debounces.
-        val timeoutJob =
-            scope.launch(Dispatchers.IO) {
-                delay(60000)
-                assembler.unsubscribe(filter)
-            }
+        val timeoutJob = launchGiveUpTimer(assembler, filter, event.id, onTimeout)
 
         val responseCache = NostrWalletConnectResponseCache(walletSigner)
         cache.consume(event, null, true, walletService.relayUri) {
@@ -255,15 +304,30 @@ class NwcSignerState(
 
     /**
      * Sends a zap payment request to the default wallet.
+     *
+     * [metadata] is NWC-06's per-payment blob and is dropped unless the wallet
+     * advertises `06`; see [dropMetadataIfUnsupported].
      */
     suspend fun sendZapPaymentRequestFor(
         bolt11: String,
         zappedNote: Note?,
+        onTimeout: () -> Unit = {},
+        metadata: Map<String, Any?>? = null,
         onResponse: (Response?) -> Unit,
     ): Pair<LnZapPaymentRequestEvent, NormalizedRelayUrl> {
         val walletService = defaultWalletUri.value ?: throw IllegalArgumentException("No NIP47 setup")
 
-        val event = LnZapPaymentRequestEvent.create(bolt11, walletService.pubKeyHex, nip47Signer.value, useNip44 = prefersNip44(walletService))
+        val info = walletInfo(walletService)
+        val request = PayInvoiceMethod.create(bolt11, metadata)
+        request.dropMetadataIfUnsupported(info)
+
+        val event =
+            LnZapPaymentRequestEvent.createRequest(
+                request,
+                walletService.pubKeyHex,
+                nip47Signer.value,
+                useNip44 = prefersNip44(info),
+            )
 
         val filter =
             NWCPaymentQueryState(
@@ -278,14 +342,7 @@ class NwcSignerState(
         // See sendNwcRequestToWallet above for the rationale.
         assembler.subscribeAndFlush(filter)
 
-        // Safety net: drop the filter after 60s if the wallet never replies.
-        // The happy path (response arrives) cancels this job and instead
-        // hands off to assembler.unsubscribeSoon, which debounces.
-        val timeoutJob =
-            scope.launch(Dispatchers.IO) {
-                delay(60000) // waits 1 minute to complete payment.
-                assembler.unsubscribe(filter)
-            }
+        val timeoutJob = launchGiveUpTimer(assembler, filter, event.id, onTimeout)
 
         cache.consume(event, zappedNote, true, walletService.relayUri) {
             timeoutJob.cancel()
@@ -295,4 +352,59 @@ class NwcSignerState(
 
         return Pair(event, walletService.relayUri)
     }
+
+    /**
+     * Safety net for a wallet that never replies: drops the subscription filter and retires
+     * the request. The happy path cancels this job and unsubscribes through
+     * [NWCPaymentFilterAssembler.unsubscribeSoon] instead, which debounces.
+     */
+    private fun launchGiveUpTimer(
+        assembler: NWCPaymentFilterAssembler,
+        filter: NWCPaymentQueryState,
+        requestId: HexKey,
+        onTimeout: () -> Unit,
+    ) = scope.launch(Dispatchers.IO) {
+        delay(NWC_RESPONSE_TIMEOUT_MS)
+        assembler.unsubscribe(filter)
+        giveUpWaiting(requestId, onTimeout)
+    }
+
+    /**
+     * Retires a request whose response never arrived: removes the tracker entry so it
+     * does not leak, and tells the caller so the user hears about it. A silent give-up
+     * is the worst outcome for a payment UI — the action just appears not to have
+     * happened, which is indistinguishable from a refusal the wallet did send.
+     *
+     * A `cleanup` that returns false means a response beat us to the tracker entry,
+     * so the response path is already reporting and this must stay quiet.
+     */
+    private fun giveUpWaiting(
+        requestId: HexKey,
+        onTimeout: () -> Unit,
+    ) {
+        val wasStillPending = cache.paymentTracker.cleanup(requestId)
+        if (wasStillPending) {
+            Log.w("NwcSignerState") {
+                "No NIP-47 response for request $requestId after ${NWC_RESPONSE_TIMEOUT_MS}ms; giving up and dropping the subscription."
+            }
+            onTimeout()
+        }
+    }
+
+    companion object {
+        /**
+         * How long a NIP-47 request waits for its kind-23195 reply before the client
+         * gives up. Exposed in seconds so the UI can name the number it shows the user.
+         */
+        const val NWC_RESPONSE_TIMEOUT_SECONDS = 60
+
+        const val NWC_RESPONSE_TIMEOUT_MS = NWC_RESPONSE_TIMEOUT_SECONDS * 1000L
+
+        /**
+         * How long a request will wait for a cold info cache before falling back to
+         * NIP-04. Comfortably over a healthy single-relay round trip, far under the
+         * 30s the fetch itself would otherwise allow in front of a payment tap.
+         */
+        const val NIP44_NEGOTIATION_WAIT_MS = 3_000L
+    }
 }

amethyst/src/main/java/com/vitorpamplona/amethyst/model/nip51Lists/PinListState.kt

@@ -21,9 +21,9 @@
 package com.vitorpamplona.amethyst.model.nip51Lists
 
 import androidx.compose.runtime.Stable
+import com.vitorpamplona.amethyst.commons.model.Note
+import com.vitorpamplona.amethyst.commons.model.NoteState
 import com.vitorpamplona.amethyst.model.LocalCache
-import com.vitorpamplona.amethyst.model.Note
-import com.vitorpamplona.amethyst.model.NoteState
 import com.vitorpamplona.quartz.nip01Core.signers.NostrSigner
 import com.vitorpamplona.quartz.nip51Lists.PinListEvent
 import com.vitorpamplona.quartz.nip51Lists.bookmarkList.tags.EventBookmark

amethyst/src/main/java/com/vitorpamplona/amethyst/model/nip51Lists/blockPeopleList/BlockPeopleListState.kt

@@ -20,10 +20,10 @@
  */
 package com.vitorpamplona.amethyst.model.nip51Lists.blockPeopleList
 
+import com.vitorpamplona.amethyst.commons.model.Note
+import com.vitorpamplona.amethyst.commons.model.NoteState
 import com.vitorpamplona.amethyst.commons.model.nip51Lists.peopleList.PeopleListDecryptionCache
 import com.vitorpamplona.amethyst.model.LocalCache
-import com.vitorpamplona.amethyst.model.Note
-import com.vitorpamplona.amethyst.model.NoteState
 import com.vitorpamplona.quartz.nip01Core.signers.NostrSigner
 import com.vitorpamplona.quartz.nip51Lists.muteList.tags.MuteTag
 import com.vitorpamplona.quartz.nip51Lists.muteList.tags.UserTag

amethyst/src/main/java/com/vitorpamplona/amethyst/model/nip51Lists/blockedRelays/BlockedRelayListDecryptionCache.kt

@@ -20,7 +20,7 @@
  */
 package com.vitorpamplona.amethyst.model.nip51Lists.blockedRelays
 
-import com.vitorpamplona.amethyst.model.nip51Lists.relayLists.GenericRelayListCache
+import com.vitorpamplona.amethyst.commons.model.nip51Lists.relayLists.GenericRelayListCache
 import com.vitorpamplona.quartz.nip01Core.signers.NostrSigner
 import com.vitorpamplona.quartz.nip51Lists.relayLists.BlockedRelayListEvent
 

amethyst/src/main/java/com/vitorpamplona/amethyst/model/nip51Lists/blockedRelays/BlockedRelayListState.kt

@@ -20,10 +20,10 @@
  */
 package com.vitorpamplona.amethyst.model.nip51Lists.blockedRelays
 
+import com.vitorpamplona.amethyst.commons.model.Note
+import com.vitorpamplona.amethyst.commons.model.NoteState
 import com.vitorpamplona.amethyst.model.AccountSettings
 import com.vitorpamplona.amethyst.model.LocalCache
-import com.vitorpamplona.amethyst.model.Note
-import com.vitorpamplona.amethyst.model.NoteState
 import com.vitorpamplona.quartz.nip01Core.relay.normalizer.NormalizedRelayUrl
 import com.vitorpamplona.quartz.nip01Core.signers.NostrSigner
 import com.vitorpamplona.quartz.nip01Core.signers.SignerExceptions
@@ -73,6 +73,20 @@ class BlockedRelayListState(
                 emptySet(),
             )
 
+    /**
+     * Adds [relay] to the kind-10006 list, keeping whatever is already there.
+     *
+     * Callers that only want to block one relay (the NOTIFY prompt's "Block Relay" button, for
+     * instance) must not rebuild the list from a snapshot they captured earlier: the list is
+     * shared across clients and may have grown since. Reading the current note here keeps the
+     * add additive.
+     */
+    suspend fun addRelay(relay: NormalizedRelayUrl): BlockedRelayListEvent {
+        val current = normalizeBlockedRelayListWithBackup(blockedListNote).toMutableList()
+        if (relay !in current) current.add(relay)
+        return saveRelayList(current)
+    }
+
     suspend fun saveRelayList(blockedRelays: List<NormalizedRelayUrl>): BlockedRelayListEvent {
         if (!signer.isWriteable()) throw SignerExceptions.ReadOnlyException()
         val relayListForBlocked = getBlockedRelayList()

amethyst/src/main/java/com/vitorpamplona/amethyst/model/nip51Lists/broadcastRelays/BroadcastRelayListDecryptionCache.kt

@@ -20,7 +20,7 @@
  */
 package com.vitorpamplona.amethyst.model.nip51Lists.broadcastRelays
 
-import com.vitorpamplona.amethyst.model.nip51Lists.relayLists.GenericRelayListCache
+import com.vitorpamplona.amethyst.commons.model.nip51Lists.relayLists.GenericRelayListCache
 import com.vitorpamplona.quartz.nip01Core.signers.NostrSigner
 import com.vitorpamplona.quartz.nip51Lists.relayLists.BroadcastRelayListEvent
 

amethyst/src/main/java/com/vitorpamplona/amethyst/model/nip51Lists/broadcastRelays/BroadcastRelayListState.kt

@@ -20,10 +20,10 @@
  */
 package com.vitorpamplona.amethyst.model.nip51Lists.broadcastRelays
 
+import com.vitorpamplona.amethyst.commons.model.Note
+import com.vitorpamplona.amethyst.commons.model.NoteState
 import com.vitorpamplona.amethyst.model.AccountSettings
 import com.vitorpamplona.amethyst.model.LocalCache
-import com.vitorpamplona.amethyst.model.Note
-import com.vitorpamplona.amethyst.model.NoteState
 import com.vitorpamplona.quartz.nip01Core.relay.normalizer.NormalizedRelayUrl
 import com.vitorpamplona.quartz.nip01Core.signers.NostrSigner
 import com.vitorpamplona.quartz.nip51Lists.relayLists.BroadcastRelayListEvent

amethyst/src/main/java/com/vitorpamplona/amethyst/model/nip51Lists/favoriteAlgoFeedsLists/FavoriteAlgoFeedsListState.kt

@@ -20,12 +20,12 @@
  */
 package com.vitorpamplona.amethyst.model.nip51Lists.favoriteAlgoFeedsLists
 
+import com.vitorpamplona.amethyst.commons.model.AddressableNote
+import com.vitorpamplona.amethyst.commons.model.Note
+import com.vitorpamplona.amethyst.commons.model.NoteState
 import com.vitorpamplona.amethyst.commons.model.nip51Lists.favoriteAlgoFeedsLists.FavoriteAlgoFeedsListDecryptionCache
 import com.vitorpamplona.amethyst.model.AccountSettings
-import com.vitorpamplona.amethyst.model.AddressableNote
 import com.vitorpamplona.amethyst.model.LocalCache
-import com.vitorpamplona.amethyst.model.Note
-import com.vitorpamplona.amethyst.model.NoteState
 import com.vitorpamplona.quartz.nip01Core.core.Address
 import com.vitorpamplona.quartz.nip01Core.signers.NostrSigner
 import com.vitorpamplona.quartz.nip51Lists.bookmarkList.tags.AddressBookmark

amethyst/src/main/java/com/vitorpamplona/amethyst/model/nip51Lists/geohashLists/GeohashListState.kt

@@ -20,10 +20,11 @@
  */
 package com.vitorpamplona.amethyst.model.nip51Lists.geohashLists
 
+import com.vitorpamplona.amethyst.commons.model.Note
+import com.vitorpamplona.amethyst.commons.model.NoteState
+import com.vitorpamplona.amethyst.commons.model.nip51Lists.geohashLists.GeohashListDecryptionCache
 import com.vitorpamplona.amethyst.model.AccountSettings
 import com.vitorpamplona.amethyst.model.LocalCache
-import com.vitorpamplona.amethyst.model.Note
-import com.vitorpamplona.amethyst.model.NoteState
 import com.vitorpamplona.quartz.nip01Core.signers.NostrSigner
 import com.vitorpamplona.quartz.nip51Lists.geohashList.GeohashListEvent
 import com.vitorpamplona.quartz.utils.Log

amethyst/src/main/java/com/vitorpamplona/amethyst/model/nip51Lists/hashtagLists/HashtagListState.kt

@@ -20,11 +20,11 @@
  */
 package com.vitorpamplona.amethyst.model.nip51Lists.hashtagLists
 
+import com.vitorpamplona.amethyst.commons.model.Note
+import com.vitorpamplona.amethyst.commons.model.NoteState
 import com.vitorpamplona.amethyst.commons.model.nip51Lists.hashtagLists.HashtagListDecryptionCache
 import com.vitorpamplona.amethyst.model.AccountSettings
 import com.vitorpamplona.amethyst.model.LocalCache
-import com.vitorpamplona.amethyst.model.Note
-import com.vitorpamplona.amethyst.model.NoteState
 import com.vitorpamplona.quartz.nip01Core.signers.NostrSigner
 import com.vitorpamplona.quartz.nip51Lists.hashtagList.HashtagListEvent
 import com.vitorpamplona.quartz.utils.Log

amethyst/src/main/java/com/vitorpamplona/amethyst/model/nip51Lists/indexerRelays/IndexerRelayListDecryptionCache.kt

@@ -20,7 +20,7 @@
  */
 package com.vitorpamplona.amethyst.model.nip51Lists.indexerRelays
 
-import com.vitorpamplona.amethyst.model.nip51Lists.relayLists.GenericRelayListCache
+import com.vitorpamplona.amethyst.commons.model.nip51Lists.relayLists.GenericRelayListCache
 import com.vitorpamplona.quartz.nip01Core.signers.NostrSigner
 import com.vitorpamplona.quartz.nip51Lists.relayLists.IndexerRelayListEvent
 

amethyst/src/main/java/com/vitorpamplona/amethyst/model/nip51Lists/indexerRelays/IndexerRelayListState.kt

@@ -21,10 +21,10 @@
 package com.vitorpamplona.amethyst.model.nip51Lists.indexerRelays
 
 import com.vitorpamplona.amethyst.commons.defaults.DefaultIndexerRelayList
+import com.vitorpamplona.amethyst.commons.model.Note
+import com.vitorpamplona.amethyst.commons.model.NoteState
 import com.vitorpamplona.amethyst.model.AccountSettings
 import com.vitorpamplona.amethyst.model.LocalCache
-import com.vitorpamplona.amethyst.model.Note
-import com.vitorpamplona.amethyst.model.NoteState
 import com.vitorpamplona.quartz.nip01Core.relay.normalizer.NormalizedRelayUrl
 import com.vitorpamplona.quartz.nip01Core.signers.NostrSigner
 import com.vitorpamplona.quartz.nip51Lists.relayLists.IndexerRelayListEvent
@@ -58,7 +58,11 @@ class IndexerRelayListState(
 
     fun indexListEvent(note: Note) = note.event as? IndexerRelayListEvent ?: settings.backupIndexRelayList
 
-    suspend fun normalizeIndexerRelayListWithBackup(note: Note): Set<NormalizedRelayUrl> = indexListEvent(note)?.let { decryptionCache.relays(it) }?.ifEmpty { null } ?: DefaultIndexerRelayList
+    suspend fun normalizeIndexerRelayListWithBackup(note: Note): Set<NormalizedRelayUrl> {
+        val event = indexListEvent(note) ?: return DefaultIndexerRelayList
+        // Fully decrypted here, so empty means the user listed nothing — not "not decrypted yet".
+        return decryptionCache.relays(event)
+    }
 
     suspend fun normalizeIndexerRelayListWithBackupNoDefaults(note: Note): Set<NormalizedRelayUrl> = indexListEvent(note)?.let { decryptionCache.relays(it) } ?: emptySet()
 
@@ -73,12 +77,26 @@ class IndexerRelayListState(
      */
     fun normalizeIndexerRelayListPrecached(note: Note): Set<NormalizedRelayUrl> = indexListEvent(note)?.let { decryptionCache.cachedRelays(it) }?.ifEmpty { null } ?: DefaultIndexerRelayList
 
+    /** See `Nip65RelayListState.assumedDefaults`. Empty as soon as any kind:10086 exists. */
+    fun assumedDefaults(note: Note): Set<NormalizedRelayUrl> = if (indexListEvent(note) == null) DefaultIndexerRelayList else emptySet()
+
+    val assumedDefaultsFlow =
+        getIndexerRelayListFlow()
+            .map { assumedDefaults(it.note) }
+            .onStart { emit(assumedDefaults(indexerListNote)) }
+            .flowOn(Dispatchers.IO)
+            .stateIn(
+                scope,
+                SharingStarted.Eagerly,
+                assumedDefaults(indexerListNote),
+            )
+
     /**
-     * The account's indexer relays, **never empty** — [normalizeIndexerRelayListWithBackup]
-     * substitutes [DefaultIndexerRelayList] both when there is no kind:10086 and when the
-     * one we have decodes to zero relays. Callers assembling metadata / relay-list REQs read
-     * this and can rely on getting a usable set; use [flowNoDefaults] instead to show or diff
-     * what the user actually configured.
+     * The account's indexer relays. [normalizeIndexerRelayListWithBackup] substitutes
+     * [DefaultIndexerRelayList] when there is no kind:10086 at all — but **not** when the one we
+     * have decodes to zero relays, which is the user saying "no indexers" and is honored. Callers
+     * assembling metadata / relay-list REQs must therefore tolerate an empty set; use
+     * [flowNoDefaults] to show or diff what the user actually configured.
      *
      * Seeded via [normalizeIndexerRelayListPrecached] rather than `emptySet()`, for the same
      * reason as the search list: `flowOn(IO)` makes the first real emission asynchronous, so an

amethyst/src/main/java/com/vitorpamplona/amethyst/model/nip51Lists/interestSets/InterestSetsState.kt

@@ -20,16 +20,16 @@
  */
 package com.vitorpamplona.amethyst.model.nip51Lists.interestSets
 
+import com.vitorpamplona.amethyst.commons.model.AddressableNote
+import com.vitorpamplona.amethyst.commons.model.Note
 import com.vitorpamplona.amethyst.commons.model.anyNotNullEvent
+import com.vitorpamplona.amethyst.commons.model.cache.filter
 import com.vitorpamplona.amethyst.commons.model.eventIdSet
 import com.vitorpamplona.amethyst.commons.model.events
 import com.vitorpamplona.amethyst.commons.model.nip51Lists.interestSets.InterestSet
 import com.vitorpamplona.amethyst.commons.model.updateFlow
 import com.vitorpamplona.amethyst.model.Account
-import com.vitorpamplona.amethyst.model.AddressableNote
 import com.vitorpamplona.amethyst.model.LocalCache
-import com.vitorpamplona.amethyst.model.Note
-import com.vitorpamplona.amethyst.model.filter
 import com.vitorpamplona.quartz.nip01Core.signers.NostrSigner
 import com.vitorpamplona.quartz.nip09Deletions.DeletionEvent
 import com.vitorpamplona.quartz.nip51Lists.interestSet.InterestSetEvent

amethyst/src/main/java/com/vitorpamplona/amethyst/model/nip51Lists/labeledBookmarkLists/LabeledBookmarkListsState.kt

@@ -20,16 +20,16 @@
  */
 package com.vitorpamplona.amethyst.model.nip51Lists.labeledBookmarkLists
 
+import com.vitorpamplona.amethyst.commons.model.AddressableNote
+import com.vitorpamplona.amethyst.commons.model.Note
 import com.vitorpamplona.amethyst.commons.model.anyNotNullEvent
+import com.vitorpamplona.amethyst.commons.model.cache.filter
 import com.vitorpamplona.amethyst.commons.model.eventIdSet
 import com.vitorpamplona.amethyst.commons.model.events
 import com.vitorpamplona.amethyst.commons.model.nip51Lists.labeledBookmarkLists.LabeledBookmarkList
 import com.vitorpamplona.amethyst.commons.model.updateFlow
 import com.vitorpamplona.amethyst.model.Account
-import com.vitorpamplona.amethyst.model.AddressableNote
 import com.vitorpamplona.amethyst.model.LocalCache
-import com.vitorpamplona.amethyst.model.Note
-import com.vitorpamplona.amethyst.model.filter
 import com.vitorpamplona.quartz.nip01Core.core.Address
 import com.vitorpamplona.quartz.nip01Core.signers.NostrSigner
 import com.vitorpamplona.quartz.nip01Core.signers.update

amethyst/src/main/java/com/vitorpamplona/amethyst/model/nip51Lists/muteList/MuteListState.kt

@@ -20,11 +20,11 @@
  */
 package com.vitorpamplona.amethyst.model.nip51Lists.muteList
 
+import com.vitorpamplona.amethyst.commons.model.Note
+import com.vitorpamplona.amethyst.commons.model.NoteState
 import com.vitorpamplona.amethyst.commons.model.nip51Lists.muteList.MuteListDecryptionCache
 import com.vitorpamplona.amethyst.model.AccountSettings
 import com.vitorpamplona.amethyst.model.LocalCache
-import com.vitorpamplona.amethyst.model.Note
-import com.vitorpamplona.amethyst.model.NoteState
 import com.vitorpamplona.quartz.nip01Core.core.HexKey
 import com.vitorpamplona.quartz.nip01Core.signers.NostrSigner
 import com.vitorpamplona.quartz.nip51Lists.muteList.MuteListEvent

amethyst/src/main/java/com/vitorpamplona/amethyst/model/nip51Lists/peopleList/FollowListsState.kt

@@ -20,16 +20,16 @@
  */
 package com.vitorpamplona.amethyst.model.nip51Lists.peopleList
 
+import com.vitorpamplona.amethyst.commons.model.AddressableNote
+import com.vitorpamplona.amethyst.commons.model.Note
+import com.vitorpamplona.amethyst.commons.model.User
 import com.vitorpamplona.amethyst.commons.model.anyNotNullEvent
+import com.vitorpamplona.amethyst.commons.model.cache.filter
 import com.vitorpamplona.amethyst.commons.model.eventIdSet
 import com.vitorpamplona.amethyst.commons.model.events
 import com.vitorpamplona.amethyst.commons.model.updateFlow
 import com.vitorpamplona.amethyst.model.Account
-import com.vitorpamplona.amethyst.model.AddressableNote
 import com.vitorpamplona.amethyst.model.LocalCache
-import com.vitorpamplona.amethyst.model.Note
-import com.vitorpamplona.amethyst.model.User
-import com.vitorpamplona.amethyst.model.filter
 import com.vitorpamplona.quartz.nip01Core.core.HexKey
 import com.vitorpamplona.quartz.nip01Core.signers.NostrSigner
 import com.vitorpamplona.quartz.nip01Core.signers.update
@@ -71,7 +71,15 @@ class FollowListsState(
 ) {
     val user = cache.getOrCreateUser(signer.pubKey)
 
-    fun existingPeopleListNotes() = cache.addressables.filter(FollowListEvent.KIND, user.pubkeyHex)
+    // Hides shells that a kind-5 deletion event from the list's author has already
+    // deleted (e.g. a persisted TopFilter re-creates an empty shell for the deleted
+    // address after a restart, and its name falls back to the dTag/UUID). Shells that
+    // are merely not loaded yet stay in the list so the UI can subscribe and fetch
+    // them from relays.
+    fun existingPeopleListNotes() =
+        cache.addressables
+            .filter(FollowListEvent.KIND, user.pubkeyHex)
+            .filter { it.event != null || !cache.hasBeenDeleted(it.address) }
 
     val followListVersions = MutableStateFlow(0)
 
@@ -255,6 +263,10 @@ class FollowListsState(
         val followListEvent = getPeopleList(identifierTag)
         val deletionEvent = account.signer.sign(DeletionEvent.build(listOf(followListEvent)))
         account.sendMyPublicAndPrivateOutbox(deletionEvent)
+        // Any screen whose persisted feed filter still points at this follow pack would
+        // keep re-creating an empty shell for its address (and render the dTag/UUID in
+        // the top bar) — reset those filters to their default.
+        account.settings.resetFeedFiltersPointingTo(followListEvent.address())
     }
 
     suspend fun addUserToSet(

amethyst/src/main/java/com/vitorpamplona/amethyst/model/nip51Lists/peopleList/PeopleList.kt

@@ -21,7 +21,7 @@
 package com.vitorpamplona.amethyst.model.nip51Lists.peopleList
 
 import androidx.compose.runtime.Stable
-import com.vitorpamplona.amethyst.model.User
+import com.vitorpamplona.amethyst.commons.model.User
 import kotlinx.collections.immutable.ImmutableList
 import kotlinx.collections.immutable.toPersistentList
 

amethyst/src/main/java/com/vitorpamplona/amethyst/model/nip51Lists/peopleList/PeopleListsState.kt

@@ -20,17 +20,17 @@
  */
 package com.vitorpamplona.amethyst.model.nip51Lists.peopleList
 
+import com.vitorpamplona.amethyst.commons.model.AddressableNote
+import com.vitorpamplona.amethyst.commons.model.Note
+import com.vitorpamplona.amethyst.commons.model.User
 import com.vitorpamplona.amethyst.commons.model.anyNotNullEvent
+import com.vitorpamplona.amethyst.commons.model.cache.filter
 import com.vitorpamplona.amethyst.commons.model.eventIdSet
 import com.vitorpamplona.amethyst.commons.model.events
 import com.vitorpamplona.amethyst.commons.model.nip51Lists.peopleList.PeopleListDecryptionCache
 import com.vitorpamplona.amethyst.commons.model.updateFlow
 import com.vitorpamplona.amethyst.model.Account
-import com.vitorpamplona.amethyst.model.AddressableNote
 import com.vitorpamplona.amethyst.model.LocalCache
-import com.vitorpamplona.amethyst.model.Note
-import com.vitorpamplona.amethyst.model.User
-import com.vitorpamplona.amethyst.model.filter
 import com.vitorpamplona.quartz.nip01Core.core.HexKey
 import com.vitorpamplona.quartz.nip01Core.signers.NostrSigner
 import com.vitorpamplona.quartz.nip01Core.signers.update
@@ -69,10 +69,17 @@ class PeopleListsState(
 ) {
     val user = cache.getOrCreateUser(signer.pubKey)
 
+    // Hides the fixed-dTag block-list shell when it is not loaded (it has no
+    // meaningful name until it exists) and shells that a kind-5 deletion event from
+    // the list's author has already deleted (e.g. a persisted TopFilter re-creates an
+    // empty shell for the deleted address after a restart, and its name falls back to
+    // the dTag/UUID). Shells that are merely not loaded yet stay in the list so the UI
+    // can subscribe and fetch them from relays.
     fun existingPeopleListNotes() =
         cache.addressables
             .filter(PeopleListEvent.KIND, user.pubkeyHex)
             .filter { it.dTag() != PeopleListEvent.BLOCK_LIST_D_TAG || it.event != null }
+            .filter { it.event != null || !cache.hasBeenDeleted(it.address) }
 
     val peopleListVersions = MutableStateFlow(0)
 
@@ -262,6 +269,10 @@ class PeopleListsState(
         val followListEvent = getPeopleList(identifierTag)
         val deletionEvent = account.signer.sign(DeletionEvent.build(listOf(followListEvent)))
         account.sendMyPublicAndPrivateOutbox(deletionEvent)
+        // Any screen whose persisted feed filter still points at this list would keep
+        // re-creating an empty shell for its address (and render the dTag/UUID in the
+        // top bar) — reset those filters to their default.
+        account.settings.resetFeedFiltersPointingTo(followListEvent.address())
     }
 
     suspend fun addUserToSet(

amethyst/src/main/java/com/vitorpamplona/amethyst/model/nip51Lists/proxyRelays/ProxyRelayListDecryptionCache.kt

@@ -20,7 +20,7 @@
  */
 package com.vitorpamplona.amethyst.model.nip51Lists.proxyRelays
 
-import com.vitorpamplona.amethyst.model.nip51Lists.relayLists.GenericRelayListCache
+import com.vitorpamplona.amethyst.commons.model.nip51Lists.relayLists.GenericRelayListCache
 import com.vitorpamplona.quartz.nip01Core.signers.NostrSigner
 import com.vitorpamplona.quartz.nip51Lists.relayLists.ProxyRelayListEvent
 

amethyst/src/main/java/com/vitorpamplona/amethyst/model/nip51Lists/proxyRelays/ProxyRelayListState.kt

@@ -20,10 +20,10 @@
  */
 package com.vitorpamplona.amethyst.model.nip51Lists.proxyRelays
 
+import com.vitorpamplona.amethyst.commons.model.Note
+import com.vitorpamplona.amethyst.commons.model.NoteState
 import com.vitorpamplona.amethyst.model.AccountSettings
 import com.vitorpamplona.amethyst.model.LocalCache
-import com.vitorpamplona.amethyst.model.Note
-import com.vitorpamplona.amethyst.model.NoteState
 import com.vitorpamplona.quartz.nip01Core.relay.normalizer.NormalizedRelayUrl
 import com.vitorpamplona.quartz.nip01Core.signers.NostrSigner
 import com.vitorpamplona.quartz.nip51Lists.relayLists.ProxyRelayListEvent

amethyst/src/main/java/com/vitorpamplona/amethyst/model/nip51Lists/relayFeeds/RelayFeedListState.kt

@@ -20,10 +20,10 @@
  */
 package com.vitorpamplona.amethyst.model.nip51Lists.relayFeeds
 
+import com.vitorpamplona.amethyst.commons.model.Note
+import com.vitorpamplona.amethyst.commons.model.NoteState
 import com.vitorpamplona.amethyst.model.AccountSettings
 import com.vitorpamplona.amethyst.model.LocalCache
-import com.vitorpamplona.amethyst.model.Note
-import com.vitorpamplona.amethyst.model.NoteState
 import com.vitorpamplona.quartz.nip01Core.relay.normalizer.NormalizedRelayUrl
 import com.vitorpamplona.quartz.nip01Core.signers.NostrSigner
 import com.vitorpamplona.quartz.nip51Lists.relayLists.RelayFeedsListEvent

amethyst/src/main/java/com/vitorpamplona/amethyst/model/nip51Lists/relayFeeds/RelayFeedsListDecryptionCache.kt

@@ -20,7 +20,7 @@
  */
 package com.vitorpamplona.amethyst.model.nip51Lists.relayFeeds
 
-import com.vitorpamplona.amethyst.model.nip51Lists.relayLists.GenericRelayListCache
+import com.vitorpamplona.amethyst.commons.model.nip51Lists.relayLists.GenericRelayListCache
 import com.vitorpamplona.quartz.nip01Core.signers.NostrSigner
 import com.vitorpamplona.quartz.nip51Lists.relayLists.RelayFeedsListEvent
 

amethyst/src/main/java/com/vitorpamplona/amethyst/model/nip51Lists/searchRelays/SearchRelayListDecryptionCache.kt

@@ -20,7 +20,7 @@
  */
 package com.vitorpamplona.amethyst.model.nip51Lists.searchRelays
 
-import com.vitorpamplona.amethyst.model.nip51Lists.relayLists.GenericRelayListCache
+import com.vitorpamplona.amethyst.commons.model.nip51Lists.relayLists.GenericRelayListCache
 import com.vitorpamplona.quartz.nip01Core.signers.NostrSigner
 import com.vitorpamplona.quartz.nip50Search.SearchRelayListEvent
 

amethyst/src/main/java/com/vitorpamplona/amethyst/model/nip51Lists/searchRelays/SearchRelayListState.kt

@@ -21,10 +21,10 @@
 package com.vitorpamplona.amethyst.model.nip51Lists.searchRelays
 
 import com.vitorpamplona.amethyst.commons.defaults.DefaultSearchRelayList
+import com.vitorpamplona.amethyst.commons.model.Note
+import com.vitorpamplona.amethyst.commons.model.NoteState
 import com.vitorpamplona.amethyst.model.AccountSettings
 import com.vitorpamplona.amethyst.model.LocalCache
-import com.vitorpamplona.amethyst.model.Note
-import com.vitorpamplona.amethyst.model.NoteState
 import com.vitorpamplona.quartz.nip01Core.relay.normalizer.NormalizedRelayUrl
 import com.vitorpamplona.quartz.nip01Core.signers.NostrSigner
 import com.vitorpamplona.quartz.nip50Search.SearchRelayListEvent
@@ -58,7 +58,11 @@ class SearchRelayListState(
 
     fun searchListEvent(note: Note) = note.event as? SearchRelayListEvent ?: settings.backupSearchRelayList
 
-    suspend fun normalizeSearchRelayListWithBackup(note: Note): Set<NormalizedRelayUrl> = searchListEvent(note)?.let { decryptionCache.relays(it) }?.ifEmpty { null } ?: DefaultSearchRelayList
+    suspend fun normalizeSearchRelayListWithBackup(note: Note): Set<NormalizedRelayUrl> {
+        val event = searchListEvent(note) ?: return DefaultSearchRelayList
+        // Fully decrypted here, so empty means the user listed nothing — not "not decrypted yet".
+        return decryptionCache.relays(event)
+    }
 
     suspend fun normalizeSearchRelayListWithBackupNoDefaults(note: Note): Set<NormalizedRelayUrl> = searchListEvent(note)?.let { decryptionCache.relays(it) } ?: emptySet()
 
@@ -74,16 +78,31 @@ class SearchRelayListState(
      */
     fun normalizeSearchRelayListPrecached(note: Note): Set<NormalizedRelayUrl> = searchListEvent(note)?.let { decryptionCache.cachedRelays(it) }?.ifEmpty { null } ?: DefaultSearchRelayList
 
+    /** See `Nip65RelayListState.assumedDefaults`. Empty as soon as any kind:10007 exists. */
+    fun assumedDefaults(note: Note): Set<NormalizedRelayUrl> = if (searchListEvent(note) == null) DefaultSearchRelayList else emptySet()
+
+    val assumedDefaultsFlow =
+        getSearchRelayListFlow()
+            .map { assumedDefaults(it.note) }
+            .onStart { emit(assumedDefaults(searchListNote)) }
+            .flowOn(Dispatchers.IO)
+            .stateIn(
+                scope,
+                SharingStarted.Eagerly,
+                assumedDefaults(searchListNote),
+            )
+
     /**
-     * The account's search relays, **never empty** — [normalizeSearchRelayListWithBackup]
-     * substitutes [DefaultSearchRelayList] both when there is no kind:10007 and when the
-     * one we have decodes to zero relays. Callers assembling NIP-50 REQs read this and can
+     * The account's search relays. [normalizeSearchRelayListWithBackup] substitutes
+     * [DefaultSearchRelayList] when there is no kind:10007 at all — but **not** when the one we
+     * have decodes to zero relays, which is the user saying "no search relays" and is honored.
+     * Callers assembling NIP-50 REQs must tolerate an empty set, and can
      * rely on getting a usable set; use [flowNoDefaults] instead to show or diff what the
      * user actually configured.
      *
      * Seeded via [normalizeSearchRelayListPrecached] rather than `emptySet()`: `flowOn(IO)` means
      * the first real emission can never be synchronous with `stateIn`, so an `emptySet()` seed
-     * left a window where `.value` contradicted the "never empty" contract above and search
+     * left a window where `.value` reported nothing before the event had been read at all, so search
      * silently queried nothing. That window is unbounded for a NIP-46 signer whose list has
      * private entries, since the first emission waits on a remote decrypt.
      */

amethyst/src/main/java/com/vitorpamplona/amethyst/model/nip51Lists/trustedRelays/TrustedRelayListDecryptionCache.kt

@@ -20,7 +20,7 @@
  */
 package com.vitorpamplona.amethyst.model.nip51Lists.trustedRelays
 
-import com.vitorpamplona.amethyst.model.nip51Lists.relayLists.GenericRelayListCache
+import com.vitorpamplona.amethyst.commons.model.nip51Lists.relayLists.GenericRelayListCache
 import com.vitorpamplona.quartz.nip01Core.signers.NostrSigner
 import com.vitorpamplona.quartz.nip51Lists.relayLists.TrustedRelayListEvent