diff --git a/.env.example b/.env.example
index db5a7ea25c7..f0e27c97e42 100644
--- a/.env.example
+++ b/.env.example
@@ -34,6 +34,10 @@ REDIS_URL=redis://localhost:6379
 # Max connections in the relay's shared Redis pool (default 16).
 # BUZZ_REDIS_POOL_SIZE=16
 
+# Max connections in each of the relay's Postgres pools — writer and, when
+# READ_DATABASE_URL is set, reader (default 50).
+# BUZZ_DB_POOL_SIZE=50
+
 # -----------------------------------------------------------------------------
 # Typesense (search)
 # -----------------------------------------------------------------------------
@@ -47,6 +51,11 @@ TYPESENSE_URL=http://localhost:8108
 BUZZ_BIND_ADDR=0.0.0.0:3000
 # Public WebSocket URL — used in NIP-42 auth challenges
 RELAY_URL=ws://localhost:3000
+# Optional URL path prefix to serve the relay under. Empty (the default) mounts
+# everything at /. Set this only when a gateway routes to the relay by path
+# instead of by hostname — the WebSocket then answers on ws://host/<prefix> and
+# every HTTP route lives under it. RELAY_URL must include the same prefix.
+# BUZZ_BASE_PATH=/relay
 # Stable relay signing key. Set this in dev if you want REST-created forum posts
 # to keep resolving to the original author across relay restarts.
 # BUZZ_RELAY_PRIVATE_KEY=<32-byte hex private key>
@@ -105,7 +114,10 @@ RELAY_URL=ws://localhost:3000
 # -----------------------------------------------------------------------------
 # Logging / Tracing
 # -----------------------------------------------------------------------------
-RUST_LOG=buzz_relay=debug,buzz_db=debug,buzz_auth=debug,buzz_pubsub=debug,tower_http=debug
+RUST_LOG=buzz_relay=debug,buzz_datastore=info,buzz_db=debug,buzz_auth=debug,buzz_pubsub=debug,tower_http=debug
+# Optional OpenTelemetry-only target filter. This is deliberately independent
+# from RUST_LOG so log verbosity changes cannot break trace parentage.
+# BUZZ_OTEL_FILTER=buzz_relay=info,buzz_datastore=info
 
 # OTLP tracing endpoint (optional — leave unset to disable)
 # OTEL_EXPORTER_OTLP_ENDPOINT=http://localhost:4317
diff --git a/.gitattributes b/.gitattributes
new file mode 100644
index 00000000000..f36b1615d06
--- /dev/null
+++ b/.gitattributes
@@ -0,0 +1,8 @@
+# Git for Windows defaults to core.autocrlf=true, so without this every text
+# file lands in the working copy with CRLF. Biome formats with LF
+# (biome.json sets no lineEnding override), which fails `biome check` on
+# effectively every file, and
+# desktop/src/features/messages/ui/virtuaWheelModePatch.test.mjs asserts on
+# patches/*.patch with `\n`-joined patterns. Normalize to LF in the working
+# copy on every platform; the stored blobs are already LF.
+* text=auto eol=lf
diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md
index 325a485102a..238878c7493 100644
--- a/.github/PULL_REQUEST_TEMPLATE.md
+++ b/.github/PULL_REQUEST_TEMPLATE.md
@@ -5,4 +5,4 @@
 <!-- Fixes #1234, or N/A. Before opening: search existing issues/PRs for duplicates — link the closest one, or say "none found". -->
 
 ### Testing
-<!-- How was this verified? -->
+<!-- How was this verified? UI change? Include before/after screenshots (or a short recording). -->
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index acdf5237bd8..d4826d985f5 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -48,15 +48,21 @@ jobs:
               - 'scripts/run-tests.sh'
               - 'justfile'
             desktop:
+              - 'scripts/check-file-sizes-core.mjs'
+              - 'scripts/check-file-sizes-core.test.mjs'
               - 'desktop/**'
               - '!desktop/src-tauri/**'
               - 'pnpm-lock.yaml'
             desktop-rust:
               - 'desktop/src-tauri/**'
             web:
+              - 'scripts/check-file-sizes-core.mjs'
+              - 'scripts/check-file-sizes-core.test.mjs'
               - 'web/**'
               - 'pnpm-lock.yaml'
             mobile:
+              - 'scripts/check-file-sizes-core.mjs'
+              - 'scripts/check-file-sizes-core.test.mjs'
               - 'mobile/**'
               - 'scripts/mobile-release.sh'
               - 'scripts/mobile-worktree-overrides.sh'
@@ -76,6 +82,8 @@ jobs:
           scripts/test-mobile-release-candidate-publisher.sh
       - name: Mobile worktree identity contract
         run: scripts/test-mobile-worktree-overrides.sh
+      - name: File size ratchet unit tests
+        run: node --test scripts/check-file-sizes-core.test.mjs
 
   rust-lint:
     name: Rust Lint
@@ -130,6 +138,8 @@ jobs:
       contents: read
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        with:
+          fetch-depth: 2
       - uses: cashapp/activate-hermit@cea9af7913204a965fd488637a8d1811bba2e616 # v1
       - uses: rui314/setup-mold@9c9c13bf4c3f1adef0cc596abc155580bcb04444 # v1
       - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
@@ -213,7 +223,7 @@ jobs:
   desktop-smoke-e2e:
     name: Desktop Smoke E2E (${{ matrix.shard }})
     runs-on: ubuntu-latest
-    timeout-minutes: 20
+    timeout-minutes: 30
     needs: [changes]
     if: github.event_name == 'push' || needs.changes.outputs.desktop == 'true' || needs.changes.outputs.desktop-rust == 'true' || needs.changes.outputs.rust == 'true'
     strategy:
@@ -340,6 +350,7 @@ jobs:
           cargo build --profile ci -p buzz-relay -p git-credential-nostr
           cargo nextest archive \
             --cargo-profile ci \
+            -p buzz-db \
             -p buzz-relay \
             -p buzz-test-client \
             --lib \
@@ -671,11 +682,11 @@ jobs:
           done
           cat /tmp/buzz-relay.log
           exit 1
-      - name: Invite claim security tests
+      - name: Invite security tests
         run: |
           cargo nextest run \
             --archive-file target/ci/backend-integration-tests.tar.zst \
-            -E 'package(buzz-relay) and test(claim_)' \
+            -E '(package(buzz-db) and test(/relay_invite::tests/)) or (package(buzz-relay) and test(/api::invites::tests/))' \
             --run-ignored ignored-only
         env:
           DATABASE_URL: postgres://buzz:${{ env.BUZZ_TEST_POSTGRES_PASSWORD }}@localhost:5432/buzz
@@ -750,6 +761,8 @@ jobs:
       contents: read
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        with:
+          fetch-depth: 2
       - uses: cashapp/activate-hermit@cea9af7913204a965fd488637a8d1811bba2e616 # v1
       - name: Get pnpm store directory
         id: pnpm-cache
@@ -783,6 +796,8 @@ jobs:
       contents: read
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        with:
+          fetch-depth: 2
       - uses: cashapp/activate-hermit@cea9af7913204a965fd488637a8d1811bba2e616 # v1
       - name: Compute Hermit cache key
         id: hermit-bin-hash
@@ -821,6 +836,8 @@ jobs:
         with:
           path: ~/.pub-cache
           key: pub-${{ runner.os }}-${{ hashFiles('mobile/pubspec.lock') }}
+      - name: File size ratchet
+        run: node mobile/scripts/check-file-sizes.mjs
       - name: Format check
         run: cd mobile && dart format --output=none --set-exit-if-changed .
       - name: Analyze
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 31080652eaf..52f21b28bc3 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -1,6 +1,8 @@
 name: Docker image
 
-# Builds and publishes the public Buzz relay image as ghcr.io/block/buzz.
+# Builds and publishes the public Buzz relay images as ghcr.io/block/buzz.
+# Normal tags contain stripped binaries; matching debug-* tags contain the same
+# optimized binaries with line-table debug information for native profilers.
 #
 # Strategy: each architecture builds on its native runner (ubuntu-24.04 for
 # amd64, ubuntu-24.04-arm for arm64), pushes to GHCR by digest, then a final
@@ -15,8 +17,10 @@ name: Docker image
 #
 # Triggers:
 #   - push to main           → :main + :sha-<7>
+#                              + :debug-main + :debug-sha-<7>
 #   - push tags relay-v*.*.* → :{version} + :{major}.{minor} + :{major}
-#                              (+ :latest for stable, NOT for prereleases)
+#                              + matching :debug-* tags
+#                              (+ :latest/:debug-latest for stable releases)
 #   - pull_request           → build only (no push), cache stays warm
 #   - workflow_dispatch      → manual relay-tag rescue at the tag itself
 #
@@ -95,10 +99,6 @@ jobs:
             runner: ubuntu-24.04-arm
             arch: arm64
 
-    outputs:
-      # Used downstream by `merge` to stitch the manifest.
-      version: ${{ steps.meta.outputs.version }}
-
     steps:
       - name: Checkout
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
@@ -163,12 +163,13 @@ jobs:
             org.opencontainers.image.description=WebSocket relay server for the Buzz communications platform
             org.opencontainers.image.licenses=Apache-2.0
 
-      - name: Build and push by digest
-        id: build
+      - name: Build and push release image by digest
+        id: build-release
         uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf  # v7.2.0
         with:
           context: .
           file: ./Dockerfile
+          target: runtime
           platforms: ${{ matrix.platform }}
           labels: ${{ steps.meta.outputs.labels }}
           # Push by digest, not by tag — the merge job assembles the tags
@@ -180,25 +181,49 @@ jobs:
           cache-to: |
             ${{ (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && format('type=registry,ref={0}-buildcache:{1},mode=max,compression=zstd', env.IMAGE_NAME, matrix.arch) || '' }}
 
-      - name: Export digest
+      - name: Build and push debug image by digest
+        id: build-debug
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf  # v7.2.0
+        with:
+          context: .
+          file: ./Dockerfile
+          target: runtime-debug
+          platforms: ${{ matrix.platform }}
+          labels: ${{ steps.meta.outputs.labels }}
+          outputs: type=image,name=${{ env.IMAGE_NAME }},push-by-digest=true,name-canonical=true,push=${{ github.event_name != 'pull_request' }}
+          cache-from: |
+            type=registry,ref=${{ env.IMAGE_NAME }}-buildcache:${{ matrix.arch }}
+
+      - name: Export release and debug digests
         if: github.event_name != 'pull_request'
         env:
-          DIGEST: ${{ steps.build.outputs.digest }}
+          RELEASE_DIGEST: ${{ steps.build-release.outputs.digest }}
+          DEBUG_DIGEST: ${{ steps.build-debug.outputs.digest }}
         run: |
-          mkdir -p /tmp/digests
-          touch "/tmp/digests/${DIGEST#sha256:}"
+          mkdir -p /tmp/digests-release /tmp/digests-debug
+          touch "/tmp/digests-release/${RELEASE_DIGEST#sha256:}"
+          touch "/tmp/digests-debug/${DEBUG_DIGEST#sha256:}"
 
-      - name: Upload digest
+      - name: Upload release digest
         if: github.event_name != 'pull_request'
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
         with:
-          name: digests-${{ matrix.arch }}
-          path: /tmp/digests/*
+          name: digests-release-${{ matrix.arch }}
+          path: /tmp/digests-release/*
+          if-no-files-found: error
+          retention-days: 1
+
+      - name: Upload debug digest
+        if: github.event_name != 'pull_request'
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+        with:
+          name: digests-debug-${{ matrix.arch }}
+          path: /tmp/digests-debug/*
           if-no-files-found: error
           retention-days: 1
 
   merge:
-    name: Merge multi-arch manifest
+    name: Merge ${{ matrix.variant }} multi-arch manifest
     if: github.event_name != 'pull_request'
     runs-on: ubuntu-24.04
     needs: build
@@ -208,13 +233,21 @@ jobs:
       packages: write    # push the merged manifest
       id-token: write    # OIDC for provenance attestation on the manifest
       attestations: write
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - variant: release
+            tag_prefix: ""
+          - variant: debug
+            tag_prefix: debug-
 
     steps:
       - name: Download all per-arch digests
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
         with:
           path: /tmp/digests
-          pattern: digests-*
+          pattern: digests-${{ matrix.variant }}-*
           merge-multiple: true
 
       - name: Set up Docker Buildx
@@ -237,9 +270,12 @@ jobs:
           # the build job's `meta` step for why match=^relay-v(.*)$, why
           # value=${{ inputs.version }} carries the rescue-dispatch version,
           # and why :latest is left to flavor.latest=auto.
+          flavor: |
+            latest=auto
+            prefix=${{ matrix.tag_prefix }},onlatest=true
           tags: |
             type=ref,event=branch,enable=${{ github.event_name != 'workflow_dispatch' || inputs.version == '' }}
-            type=sha,prefix=sha-,format=short,enable=${{ github.event_name != 'workflow_dispatch' || inputs.version == '' }}
+            type=sha,prefix=${{ matrix.tag_prefix }}sha-,format=short,enable=${{ github.event_name != 'workflow_dispatch' || inputs.version == '' }}
             type=semver,pattern={{version}},match=^relay-v(.*)$,value=${{ inputs.version }}
             type=semver,pattern={{major}}.{{minor}},match=^relay-v(.*)$,value=${{ inputs.version }}
             type=semver,pattern={{major}},match=^relay-v(.*)$,value=${{ inputs.version }}
@@ -284,11 +320,12 @@ jobs:
       - name: Summary
         env:
           IMAGE_NAME: ${{ env.IMAGE_NAME }}
+          VARIANT: ${{ matrix.variant }}
           MERGED_DIGEST: ${{ steps.manifest.outputs.digest }}
           META_TAGS: ${{ steps.meta.outputs.tags }}
         run: |
           {
-            echo "### Published \`${IMAGE_NAME}\`"
+            echo "### Published \`${IMAGE_NAME}\` (${VARIANT})"
             echo
             echo "**Digest:** \`${MERGED_DIGEST}\`"
             echo
diff --git a/AGENTS.md b/AGENTS.md
index cb4843a9efc..7ff0eb4d477 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -343,9 +343,19 @@ Add specs to `desktop/tests/e2e/` and register them in `playwright.config.ts`
 (`smoke` project `testMatch`). Every test calls `installMockBridge(page)` for
 mock Tauri IPC. Mock pubkey, channel names, and UUIDs live in `e2eBridge.ts`.
 
+**Always build with `pnpm build:e2e`, never `pnpm run build`.** The mock Tauri
+bridge is compiled in only for `--mode e2e` (see `installE2eBridgeIfConfigured`
+in `desktop/src/main.tsx`). A plain `pnpm run build` strips it, so
+`window.__TAURI_INTERNALS__` is never defined and **every** mock-mode spec fails
+with `Cannot read properties of undefined (reading 'invoke')` — the app renders
+"Community connection failed" instead of the UI under test. That looks exactly
+like a product bug rather than a build mistake, so it burns real time.
+`pnpm test:e2e:smoke` and `pnpm test:e2e:integration` run the right build for
+you; prefer them over a manual build plus `playwright test`.
+
 **Stale server:** `reuseExistingServer: true` means a previous build's server
-serves old code. Kill port 4173 and `pnpm run build` before re-running tests
-after code changes.
+serves old code. Kill port 4173 and re-run `pnpm build:e2e` before re-running
+tests after code changes.
 
 **`addInitScript` before bridge:** `page.addInitScript` (localStorage seeding)
 must run BEFORE `installMockBridge(page)` — React reads state on mount, the
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 12239365046..956faa1ed36 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,81 @@
 # Changelog
 
+## v0.5.1
+
+- perf(desktop): move observer-feed archive and decrypt commands off main thread ([#3415](https://github.com/block/buzz/pull/3415)) ([`294c8c821`](https://github.com/block/buzz/commit/294c8c821de51442a8c384c0bdb66b1a10224ca0))
+- fix(desktop): preserve shared agent fidelity ([#3553](https://github.com/block/buzz/pull/3553)) ([`f7a3988ba`](https://github.com/block/buzz/commit/f7a3988ba13b590d9a55a7e8413fc3fb5ffbef18))
+- feat(agent): route Claude/GPT model families to their native gateway wire ([#3538](https://github.com/block/buzz/pull/3538)) ([`6438dedf8`](https://github.com/block/buzz/commit/6438dedf83a9dbe1853e484326911bf6c7f1618c))
+- Refine community invite limits ([#3529](https://github.com/block/buzz/pull/3529)) ([`24d90d128`](https://github.com/block/buzz/commit/24d90d1280a9325c6cbcf8eea30ac54db5afd2cb))
+- feat(agent): fix Anthropic prompt caching with Databricks (+ MCP proxy/TLS passthrough) ([#3463](https://github.com/block/buzz/pull/3463)) ([`c405ad1d4`](https://github.com/block/buzz/commit/c405ad1d4b1da061c11b3d26761252d41dcc62d3))
+- feat: add explicit entry for claude-opus-5 in model config ([#2831](https://github.com/block/buzz/pull/2831)) ([`90e058ebf`](https://github.com/block/buzz/commit/90e058ebf68137e048a409aec6616519379ff726))
+- fix(desktop): clear stale thread new-message pill ([#3411](https://github.com/block/buzz/pull/3411)) ([`55a3ed7b9`](https://github.com/block/buzz/commit/55a3ed7b9217cee5b23e0a5441947dc929b2a38c))
+- fix(ci): ratchet file sizes against the base tree ([#3352](https://github.com/block/buzz/pull/3352)) ([`9227bdf58`](https://github.com/block/buzz/commit/9227bdf58ad6664ae3c1078888f2181ec19c4da4))
+- feat(desktop): apply WebKit rendering workarounds at startup on Linux ([#3271](https://github.com/block/buzz/pull/3271)) ([`3ece4461d`](https://github.com/block/buzz/commit/3ece4461df8a7b9663a8e68327483b8377d4086d))
+- fix(desktop): stabilize flaky DM expansion E2E ordering assertions ([#2004](https://github.com/block/buzz/pull/2004)) ([`913d564ce`](https://github.com/block/buzz/commit/913d564ce0f35924291bf3eeab6508517a6d8d1f))
+- fix(desktop): paint community rail full height ([#3382](https://github.com/block/buzz/pull/3382)) ([`1d3b810ad`](https://github.com/block/buzz/commit/1d3b810ad70d6325718ed91e723f32c4a376d5e1))
+- feat(desktop): add custom harness inline from agent dialogs ([#3252](https://github.com/block/buzz/pull/3252)) ([`b0503d80c`](https://github.com/block/buzz/commit/b0503d80c298b1ece3b0a43b41d316829a3379e7))
+- feat(desktop): refine agent catalog sharing ([#2439](https://github.com/block/buzz/pull/2439)) ([`a35771fc4`](https://github.com/block/buzz/commit/a35771fc441cdc3c6f517f419037206783b502d2))
+- fix(desktop): keep drafts out of the Inbox All view ([#3217](https://github.com/block/buzz/pull/3217)) ([`3afa129ee`](https://github.com/block/buzz/commit/3afa129ee785cc74d921d0ba969254a8255c4cc0))
+- fix(desktop): restore the inbox icon in the sidebar ([#3341](https://github.com/block/buzz/pull/3341)) ([`00ede2e7a`](https://github.com/block/buzz/commit/00ede2e7aa7eb95571b7db3ebbd163adbf6cf74e))
+- fix(desktop): gate codex-acp on a minimum supported version ([#3254](https://github.com/block/buzz/pull/3254)) ([`4e3998f36`](https://github.com/block/buzz/commit/4e3998f36e36d68b9a93dcbd85f0864450bb8f5f))
+- feat(cli): add users set-status command for NIP-38 profile status ([#3253](https://github.com/block/buzz/pull/3253)) ([`60158fce3`](https://github.com/block/buzz/commit/60158fce3e670f11bb35d42627857ccaea50ff06))
+- fix(composer): scope multiline block formatting ([#3246](https://github.com/block/buzz/pull/3246)) ([`5457c947a`](https://github.com/block/buzz/commit/5457c947a74f5ba4b979f9c6411aa7626a858387))
+
+
+## v0.5.0
+
+- feat(invites): add use-limited invite links ([#3141](https://github.com/block/buzz/pull/3141)) ([`d500c2d5c`](https://github.com/block/buzz/commit/d500c2d5cf5d9aabe0ca4ebebfcafdbe5f5b7fd3))
+- fix(node): bump Buzz-supplied Node runtimes past OpenClaw's >=24.15.0 floor ([#3218](https://github.com/block/buzz/pull/3218)) ([`98a7b1334`](https://github.com/block/buzz/commit/98a7b1334823ee0be3e3fa5cab7a2e349e438dab))
+- fix(desktop): preserve thread anchor through layout reflow ([#3212](https://github.com/block/buzz/pull/3212)) ([`9810d8545`](https://github.com/block/buzz/commit/9810d8545937329f229ff40d8a19edc9e3e325c1))
+- feat(search): parse from:/in:/after:/before: and pass them in the filter ([#2871](https://github.com/block/buzz/pull/2871)) ([`cb2a265b5`](https://github.com/block/buzz/commit/cb2a265b5399426e808461c1a16713754c593258))
+- fix(desktop): fetch join policies through native networking ([#2862](https://github.com/block/buzz/pull/2862)) ([`0019f8076`](https://github.com/block/buzz/commit/0019f80765e96f056e81b57789b8b5fb80936f72))
+- fix(desktop): republish agent identity records when a persona rename propagates ([#2607](https://github.com/block/buzz/pull/2607)) ([`7ca0bbd94`](https://github.com/block/buzz/commit/7ca0bbd946fd82a7008132f94d069a97bb53f94b))
+- fix(desktop): keep project Inbox previews compact ([#3193](https://github.com/block/buzz/pull/3193)) ([`de1396050`](https://github.com/block/buzz/commit/de13960505fd798070e177cb33b1663100ac06bb))
+- Inbox refactor ([#2045](https://github.com/block/buzz/pull/2045)) ([`2bd4c24b7`](https://github.com/block/buzz/commit/2bd4c24b71335e7ce272ec6de6491f7f37f4b20d))
+- Fix composer selection formatting and drop overlay ([#3172](https://github.com/block/buzz/pull/3172)) ([`99da5b7eb`](https://github.com/block/buzz/commit/99da5b7ebb19e26453e075bfb949672122b31be3))
+- Refine pending message status ([#3153](https://github.com/block/buzz/pull/3153)) ([`75588eaff`](https://github.com/block/buzz/commit/75588eaff2354d620e554c055b80ec83735ddb0a))
+- fix(desktop): recover full local storage on startup ([#3182](https://github.com/block/buzz/pull/3182)) ([`174c38e4b`](https://github.com/block/buzz/commit/174c38e4bd1ed8498641546bc4fcb6d5a4c9cede))
+- fix(desktop): keep collapsed table separators out of spoilers ([#3169](https://github.com/block/buzz/pull/3169)) ([`4d8b676bb`](https://github.com/block/buzz/commit/4d8b676bb283a1917cec5850c3b7327fe122b0c1))
+- feat(desktop): redesign agent runtime settings ([#3093](https://github.com/block/buzz/pull/3093)) ([`d98da7389`](https://github.com/block/buzz/commit/d98da7389e60cfbd79b219aa411449fe2e53a18a))
+- fix(desktop): use forward slashes for git credential.helper on Windows ([#3023](https://github.com/block/buzz/pull/3023)) ([`899531684`](https://github.com/block/buzz/commit/8995316844f7ad50552fbae67fbd35119262796f))
+- chore(desktop): add AgentCreationPreview file-size override to unblock main CI ([#3154](https://github.com/block/buzz/pull/3154)) ([`b92a1f4bf`](https://github.com/block/buzz/commit/b92a1f4bf400e7da5ab7a010cdd81a69497d8191))
+- fix(desktop): make the test loader work on Windows ([#2758](https://github.com/block/buzz/pull/2758)) ([`8bb43d519`](https://github.com/block/buzz/commit/8bb43d51912894553f2670b2d285a96cf09cd472))
+- fix(desktop): make lint and unit-test gates work on Windows ([#2943](https://github.com/block/buzz/pull/2943)) ([`545bb46b8`](https://github.com/block/buzz/commit/545bb46b824a3fbf4401062f03b72531d832ebb9))
+- feat(desktop): add search to agent emoji picker ([#2630](https://github.com/block/buzz/pull/2630)) ([`313f793c8`](https://github.com/block/buzz/commit/313f793c8753d413c22ff8edfe420d5ee78708bc))
+- fix(desktop): keep identity key help dialog readable in dark mode ([#2854](https://github.com/block/buzz/pull/2854)) ([`be275cfc6`](https://github.com/block/buzz/commit/be275cfc6c7b80fe43e9d66c6d14b6d2bbe58a10))
+- feat(acp): title agent sessions from the agent and channel name ([#3028](https://github.com/block/buzz/pull/3028)) ([`f2fe3b63c`](https://github.com/block/buzz/commit/f2fe3b63c21be55907175715c076cd3a9195b74d))
+- feat(git): use agent display name as git author name ([#3040](https://github.com/block/buzz/pull/3040)) ([`18eef633d`](https://github.com/block/buzz/commit/18eef633d88ac465c61d98f12655fbf51dc3ca44))
+- fix(deps): bump nostr to 0.44.6 for RUSTSEC-2026-0216 (NIP-44 remote DoS) ([#3135](https://github.com/block/buzz/pull/3135)) ([`31e2de196`](https://github.com/block/buzz/commit/31e2de1966672e73e026af3c54f3a1a9a2f5e103))
+- fix(desktop): read the newest pair-scoped harness log ([#3134](https://github.com/block/buzz/pull/3134)) ([`654f38490`](https://github.com/block/buzz/commit/654f384906b5c720a60a199d85031a6f1cb6efc9))
+- feat(desktop): handle project work from Inbox ([#3117](https://github.com/block/buzz/pull/3117)) ([`c5c4f390b`](https://github.com/block/buzz/commit/c5c4f390b6713256e2efb8394c59823ebad73db6))
+- fix(desktop): clarify identity key button when key exists ([#2357](https://github.com/block/buzz/pull/2357)) ([`87b3fcd3c`](https://github.com/block/buzz/commit/87b3fcd3c0131683569dd4268b099d18b25dcd5e))
+- Restore Goose and Buzz Agent to onboarding harness selection ([#2731](https://github.com/block/buzz/pull/2731)) ([`7fc0cc82d`](https://github.com/block/buzz/commit/7fc0cc82db4d9dced9c258bbe8b530164a832a77))
+- fix(desktop): render rich project work item content ([#3100](https://github.com/block/buzz/pull/3100)) ([`afb272bb7`](https://github.com/block/buzz/commit/afb272bb7b8d7d45d7de676fa97dcd5a8eefacc7))
+- feat(acp): bring your own harness (BYOH) — generic ACP runtime seam + settings gallery ([#2773](https://github.com/block/buzz/pull/2773)) ([`95fdf9788`](https://github.com/block/buzz/commit/95fdf978800982389b120c66ff5e766d785419c7))
+- feat(desktop): use collective mesh routing for Auto ([#2825](https://github.com/block/buzz/pull/2825)) ([`16d4ec335`](https://github.com/block/buzz/commit/16d4ec335e210295a9d9f77f36c1e85a18b6814a))
+- fix(desktop): strip legacy baked team instructions from stored prompts ([#3035](https://github.com/block/buzz/pull/3035)) ([`aee631448`](https://github.com/block/buzz/commit/aee63144843854ee32ed9d36a2e7511c82ddc6b0))
+- feat(agents): lower default agent parallelism from 24 to 10 ([#3038](https://github.com/block/buzz/pull/3038)) ([`5d8ede446`](https://github.com/block/buzz/commit/5d8ede446f8fdc48146fe56d389cab6bf3500f92))
+- Polish community rail and mobile pairing ([#2972](https://github.com/block/buzz/pull/2972)) ([`e6c90bb7c`](https://github.com/block/buzz/commit/e6c90bb7c430d1b2af16508b634f9a5283b7fa3b))
+- fix(desktop): remove bundled libsystemd from AppImage ([#2353](https://github.com/block/buzz/pull/2353)) ([`a31fc4d2f`](https://github.com/block/buzz/commit/a31fc4d2f35d51cdf45ff8c61fc3a07f49c665e8))
+- fix(desktop): make agent definition authoritative for model/provider/prompt ([#1968](https://github.com/block/buzz/pull/1968)) ([`8c0e8cb16`](https://github.com/block/buzz/commit/8c0e8cb1656b04ad269bce3c2deeda2a943ae78a))
+- chore(desktop): delete dead persona catalog UI cluster ([#2886](https://github.com/block/buzz/pull/2886)) ([`8e67cf399`](https://github.com/block/buzz/commit/8e67cf399d0291bcdbc69cd0402983ca030f05bb))
+- fix(desktop): surface install failures hidden by curl-pipe exit codes ([#2892](https://github.com/block/buzz/pull/2892)) ([`166c6655e`](https://github.com/block/buzz/commit/166c6655e8bca87d83ad60c087fb70a32a026baf))
+- Refactor managed-agent runtime into cohesive modules ([#2974](https://github.com/block/buzz/pull/2974)) ([`74b63e184`](https://github.com/block/buzz/commit/74b63e1846212af6e6751a62cfc631f74b1dfe07))
+- fix(desktop): make Linux AppImage GStreamer work on non-Debian distros ([#2176](https://github.com/block/buzz/pull/2176)) ([`cc6c4d347`](https://github.com/block/buzz/commit/cc6c4d3471629fad018bcf645f9471a01b9ffe2f))
+- refactor(desktop): remove Agent directory section from Agents page ([#2290](https://github.com/block/buzz/pull/2290)) ([`5d1233e84`](https://github.com/block/buzz/commit/5d1233e841b0efa91470bb45467b2c8e4284ebf6))
+- fix(desktop): enable arboard Wayland backend so Linux copies reach the Wayland clipboard ([#2904](https://github.com/block/buzz/pull/2904)) ([`ab7aa8b12`](https://github.com/block/buzz/commit/ab7aa8b1200710dbc2d7a8661ed5aab95c4199c1))
+- fix(desktop): supervise and re-arm relay-mesh runtime ([#2823](https://github.com/block/buzz/pull/2823)) ([`aa51dab9d`](https://github.com/block/buzz/commit/aa51dab9da5fef7054d03cf1a1207986d0000684))
+- fix(agents): run live Databricks discovery instead of the fallback list ([#2890](https://github.com/block/buzz/pull/2890)) ([`8eb6e3eb6`](https://github.com/block/buzz/commit/8eb6e3eb601174249642373a6a367262fa476753))
+- fix(desktop): retire prepend mode on every reader wheel ([#2913](https://github.com/block/buzz/pull/2913)) ([`07d0265cf`](https://github.com/block/buzz/commit/07d0265cfc212ef02e1c26153bf58ff46ce5ffe6))
+- fix(desktop): consolidate prepend scroll correction ([#2855](https://github.com/block/buzz/pull/2855)) ([`25e7864b3`](https://github.com/block/buzz/commit/25e7864b35f4dfd1c0ff31304a38555230a85f8d))
+- fix(desktop): track concurrent agent turns up to the harness maximum ([#2882](https://github.com/block/buzz/pull/2882)) ([`20bff5910`](https://github.com/block/buzz/commit/20bff591023daffc5ee1032cff02b54b75da3567))
+- fix(relay): preserve reconnect backoff ([#2759](https://github.com/block/buzz/pull/2759)) ([`499c5d349`](https://github.com/block/buzz/commit/499c5d349dab13bc906b1af5fe1fcb09ce2afa81))
+- refactor(relay): expose reconnect timing policy ([#2310](https://github.com/block/buzz/pull/2310)) ([`2f0041595`](https://github.com/block/buzz/commit/2f0041595d72529c06885680d2bd07ddb6a0beb4))
+- fix(desktop): clear stale working badges on agent stop/restart ([#2803](https://github.com/block/buzz/pull/2803)) ([`a64cc71f6`](https://github.com/block/buzz/commit/a64cc71f6c1605279b1a6fbd0fe904a2984cbdb0))
+- fix(desktop): surface agent rename relay profile sync failure as a warning toast ([#2279](https://github.com/block/buzz/pull/2279)) ([`5e3d2e484`](https://github.com/block/buzz/commit/5e3d2e4849c0f2512330801d804fb96f4ab72d28))
+- fix(discovery): inject PATH into Codex adapter planning ([#2767](https://github.com/block/buzz/pull/2767)) ([`6ab3835f3`](https://github.com/block/buzz/commit/6ab3835f3fe89ee215819fe8d193463c0ae7472b))
+
+
 ## v0.4.26
 
 - Style mobile pairing QR codes ([#2775](https://github.com/block/buzz/pull/2775)) ([`50655ac09`](https://github.com/block/buzz/commit/50655ac097fbf1a7db1a5284dccc7e2a0b0f1bfc))
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 87c12bf29d8..db0aea637fe 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -43,7 +43,28 @@ Buzz is an agent platform, so AI-assisted PRs are welcome. No need to disclose t
 
 We squash-merge, so your PR title becomes the commit subject in `main`. Use [Conventional Commits](https://www.conventionalcommits.org/) format: `feat(mcp): add get_feed_actions tool`. The type prefix (`feat`, `fix`, `docs`, `refactor`, `test`, `chore`) is required. See the [Commit Messages](#commit-messages) section for the full reference.
 
-Every commit needs a Developer Certificate of Origin sign-off, so commit with `git commit -s` — it appends the `Signed-off-by` trailer that certifies you wrote the change and can contribute it. The required **DCO Check** blocks merge without it on every commit, and it's the most common reason new PRs stall. If you already pushed unsigned commits, run `git rebase --signoff main` and force-push. Running `just hooks` installs a `commit-msg` hook that adds the trailer to commits created by `git commit` and `git merge`; other flows need their own flag — `git rebase --signoff`, `git cherry-pick -s`.
+### Sign Your Commits
+
+```bash
+git commit -s
+```
+
+Every commit needs a Developer Certificate of Origin (DCO) sign-off. The `-s` flag appends a `Signed-off-by` trailer that certifies you wrote the change and can contribute it under the project license. The **DCO Check** will block your PR without it.
+
+#### Fix unsigned commits already pushed
+
+```bash
+git rebase --signoff main
+git push --force-with-lease
+```
+
+#### Auto-setup for future commits
+
+```bash
+just hooks
+```
+
+This installs a `commit-msg` hook that adds the sign-off trailer automatically for `git commit` and `git merge`. Other flows (`git rebase`, `git cherry-pick`) still need their own flag — `--signoff` and `-s` respectively.
 
 We review as capacity allows — focused PRs that follow this guide move fastest.
 
@@ -77,6 +98,37 @@ Hermit pins Rust, `just`, Node, pnpm, and other tools to the versions in
 upfront. If you don't use Hermit, ensure your toolchain meets the minimum
 versions in the table above.
 
+#### Linux: Tauri system libraries
+
+Hermit pins language toolchains, not system libraries. On Linux, the desktop
+app's Rust crates link against GTK and WebKitGTK, so `just ci` (and any
+`just desktop-tauri-*` recipe) needs these installed system-wide first. On
+Debian/Ubuntu:
+
+```bash
+sudo apt-get install -y --no-install-recommends \
+  build-essential curl file libasound2-dev libayatana-appindicator3-dev \
+  libgtk-3-dev librsvg2-dev libssl-dev libwebkit2gtk-4.1-dev libxdo-dev \
+  patchelf wget
+```
+
+This is the same list CI installs (see `.github/workflows/ci.yml`), so matching
+it locally keeps your results comparable to CI. Other distributions ship these
+under different package names — see the
+[Tauri prerequisites](https://tauri.app/start/prerequisites/) for the
+equivalents.
+
+Without them, `just ci` fails partway through `just check` with a pkg-config
+error such as:
+
+```
+The system library `gdk-pixbuf-2.0` required by crate `gdk-pixbuf-sys` was not found.
+```
+
+If you're only touching the relay, CLI, or other server-side crates, you can
+skip this and run the narrower recipes instead — `just fmt-check`, `just
+clippy`, `just test-unit`, and `just test` need no GTK.
+
 ### First-Time Setup
 
 ```bash
@@ -284,9 +336,34 @@ required. The scope (in parentheses) is optional but encouraged.
    - How to test it manually (if applicable)
    - Any follow-up work deferred to a future PR
 
-### Review Process
+6. **Shows the UI** — any PR that changes the desktop or mobile UI includes
+   before/after screenshots (or a short recording for interactions) in the
+   description. We can't run every branch locally — screenshots let us review
+   UI changes same-day instead of waiting for someone to build your branch.
+
+### PRs We're Unlikely to Merge
+
+Some kinds of PRs usually get closed — not because they're bad ideas, but
+because we can't safely review them without prior discussion:
+
+- **Large refactors or dependency swaps** without a prior issue agreeing on
+  the direction
+- **Cosmetic renames or style-only churn** that doesn't fix a bug or improve
+  clarity
+- **Entirely new features** with no prior discussion
+- **Drive-by changes bundled into an unrelated fix** — split them out
+
+If you're considering any of these, open an issue first and we'll tell you
+quickly whether it's a direction we'd merge. That saves your time as much as
+ours.
+
+### What to Expect After You Open a PR
 
-- We prioritize focused PRs that follow this guide and review as capacity allows.
+- Maintainers triage new PRs on a best-effort cadence. Focused PRs that
+  follow this guide move fastest.
+- Duplicates and PRs that skip this guide may be closed with a pointer here
+  rather than a full review. A close isn't a rejection of you or the idea —
+  address the gaps and reopen (or open a fresh PR) anytime.
 - Address review comments by pushing new commits (don't force-push during
   review; it makes it hard to see what changed).
 - Once approved, a maintainer will squash-merge your PR.
diff --git a/Cargo.lock b/Cargo.lock
index 9d0190868de..3b60dc4579f 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -925,6 +925,7 @@ dependencies = [
 name = "buzz-core"
 version = "0.1.0"
 dependencies = [
+ "base64",
  "chrono",
  "hex",
  "hmac 0.13.0",
@@ -949,6 +950,7 @@ dependencies = [
  "chrono",
  "hex",
  "nostr",
+ "rand 0.10.1",
  "serde",
  "serde_json",
  "sha2 0.11.0",
@@ -3039,11 +3041,9 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd"
 dependencies = [
  "cfg-if 1.0.4",
- "js-sys",
  "libc",
  "r-efi 5.3.0",
  "wasip2",
- "wasm-bindgen",
 ]
 
 [[package]]
@@ -5457,9 +5457,9 @@ dependencies = [
 
 [[package]]
 name = "nostr"
-version = "0.44.3"
+version = "0.44.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "08d8f0fe13526800300a36bf3b7c5f752e62e32ab81c74a8e5caa2865708625a"
+checksum = "e826dd648489de2c5b293920e20b92932ef820302007c1987c758d4d06eeb2cf"
 dependencies = [
  "base64",
  "bech32",
@@ -6823,15 +6823,16 @@ dependencies = [
 
 [[package]]
 name = "quinn-proto"
-version = "0.11.14"
+version = "0.11.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "434b42fec591c96ef50e21e886936e66d3cc3f737104fdb9b737c40ffb94c098"
+checksum = "2f4bfc015262b9df63c8845072ce59068853ff5872180c2ce2f13038b970e560"
 dependencies = [
  "aws-lc-rs",
  "bytes",
- "getrandom 0.3.4",
+ "getrandom 0.4.3",
  "lru-slab",
- "rand 0.9.4",
+ "rand 0.10.1",
+ "rand_pcg",
  "ring",
  "rustc-hash",
  "rustls",
diff --git a/Cargo.toml b/Cargo.toml
index 3499285f917..3ac7ee4cce1 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -96,6 +96,7 @@ reqwest = { version = "0.13", features = ["json", "rustls"], default-features =
 sha2      = "0.11"
 hex       = "0.4"
 hmac      = "0.13"
+base64    = "0.22"
 
 # Randomness
 rand = "0.10"
diff --git a/Dockerfile b/Dockerfile
index 661be6c3a7c..d883ac6b015 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -59,6 +59,9 @@ RUN apt-get update \
         ca-certificates \
         git \
     && rm -rf /var/lib/apt/lists/*
+# Keep enough DWARF for native profilers to resolve optimized code to source
+# locations. The normal runtime strips it below; runtime-debug retains it.
+ENV CARGO_PROFILE_RELEASE_DEBUG=line-tables-only
 COPY --from=planner /build/recipe.json recipe.json
 # Cook the full workspace recipe — relay deps include workspace siblings, so
 # scoping to -p buzz-relay misses transitive deps and re-builds them later.
@@ -66,8 +69,12 @@ RUN cargo chef cook --release --recipe-path recipe.json
 COPY . .
 RUN cargo build --release --locked -p buzz-relay --bin buzz-relay \
                                    -p buzz-admin --bin buzz-admin \
-                                   -p buzz-pair-relay --bin buzz-pair-relay \
-    && strip target/release/buzz-relay \
+                                   -p buzz-pair-relay --bin buzz-pair-relay
+
+# Derive the normal release binaries from the same optimized ELF files as the
+# debug image so the two variants cannot drift at code-generation time.
+FROM builder AS stripped-binaries
+RUN strip target/release/buzz-relay \
     && strip target/release/buzz-admin \
     && strip target/release/buzz-pair-relay
 
@@ -111,8 +118,8 @@ COPY web/ web/
 COPY admin-web/ admin-web/
 RUN pnpm -C web build && pnpm -C admin-web build
 
-# ─── Stage 5: runtime ───────────────────────────────────────────────────────
-FROM debian:${DEBIAN_VERSION}-slim AS runtime
+# ─── Stage 5: shared runtime ────────────────────────────────────────────────
+FROM debian:${DEBIAN_VERSION}-slim AS runtime-base
 
 # OCI annotations: required for GHCR to auto-link the image to this repo and
 # inherit its visibility. org.opencontainers.image.source is the load-bearing
@@ -135,9 +142,6 @@ RUN apt-get update \
     && useradd  --system --uid 1000 --gid 1000 --home-dir /var/lib/buzz \
                 --create-home --shell /usr/sbin/nologin buzz
 
-COPY --from=builder    /build/target/release/buzz-relay /usr/local/bin/buzz-relay
-COPY --from=builder    /build/target/release/buzz-admin /usr/local/bin/buzz-admin
-COPY --from=builder    /build/target/release/buzz-pair-relay /usr/local/bin/buzz-pair-relay
 COPY --from=web-builder /build/web/dist                 /srv/buzz/web
 COPY --from=web-builder /build/admin-web/dist           /srv/buzz/admin-web
 
@@ -157,3 +161,18 @@ USER buzz:buzz
 WORKDIR /var/lib/buzz
 
 ENTRYPOINT ["/usr/local/bin/buzz-relay"]
+
+# Optimized binaries with line-table debug information for native profiling.
+# Published under debug-* tags; runtime behavior otherwise matches the normal
+# image exactly.
+FROM runtime-base AS runtime-debug
+COPY --from=builder /build/target/release/buzz-relay /usr/local/bin/buzz-relay
+COPY --from=builder /build/target/release/buzz-admin /usr/local/bin/buzz-admin
+COPY --from=builder /build/target/release/buzz-pair-relay /usr/local/bin/buzz-pair-relay
+
+# Keep the stripped runtime as the final/default Dockerfile target so existing
+# `docker build .` callers and release tags retain their current behavior.
+FROM runtime-base AS runtime
+COPY --from=stripped-binaries /build/target/release/buzz-relay /usr/local/bin/buzz-relay
+COPY --from=stripped-binaries /build/target/release/buzz-admin /usr/local/bin/buzz-admin
+COPY --from=stripped-binaries /build/target/release/buzz-pair-relay /usr/local/bin/buzz-pair-relay
diff --git a/RELEASING.md b/RELEASING.md
index 9785122aadd..063b813e2ce 100644
--- a/RELEASING.md
+++ b/RELEASING.md
@@ -57,10 +57,13 @@ or mobile GitHub Release.
 2. **Merge the PR.** `auto-tag-on-release-pr-merge` pushes
    `relay-v<version>`.
 3. **The tag triggers `docker.yml`.** Stable releases update the version
-   aliases and `latest`; prereleases do not.
+   aliases and `latest`; prereleases do not. Each release also publishes an
+   optimized, symbol-bearing image under matching `debug-` tags (for example,
+   `debug-0.3.0` and `debug-latest`) for native profiling. The ordinary tags
+   remain stripped and are the default for deployments that do not need it.
 
 Every push to `main` continues to publish the rolling relay `:main` and
-`:sha-<7>` tags.
+`:sha-<7>` tags, plus matching `:debug-main` and `:debug-sha-<7>` variants.
 
 ### Mobile
 
diff --git a/admin-web/src/App.tsx b/admin-web/src/App.tsx
index 49202e9778d..f39ecc33c50 100644
--- a/admin-web/src/App.tsx
+++ b/admin-web/src/App.tsx
@@ -7,7 +7,12 @@ import {
   useState,
 } from "react";
 import { ApiFailure, request } from "./api";
-import type { FeedbackDetail, FeedbackSummary, Report } from "./types";
+import type {
+  FeedbackDetail,
+  FeedbackSummary,
+  Report,
+  ReportDetail as ReportDetailData,
+} from "./types";
 import { useResource } from "./useResource";
 
 function usePath() {
@@ -131,7 +136,10 @@ function Reports() {
 }
 
 function ReportDetail({ id }: { id: string }) {
-  const resource = useResource(() => request<Report>(`/reports/${id}`), id);
+  const resource = useResource(
+    () => request<ReportDetailData>(`/reports/${id}`),
+    id,
+  );
   return (
     <Page
       eyebrow="Moderation"
@@ -164,6 +172,32 @@ function ReportDetail({ id }: { id: string }) {
               <dd>
                 <code>{report.target}</code>
               </dd>
+              {report.targetKind === "event" ? (
+                <>
+                  <dt>Message</dt>
+                  <dd>
+                    {report.message ? (
+                      <div className="reported-message">
+                        {report.message.deletedAt ? (
+                          <span className="status">Deleted</span>
+                        ) : null}
+                        <p>{report.message.content}</p>
+                        <div className="reported-message-meta">
+                          <span>Author</span>
+                          <code>{report.message.authorPubkey}</code>
+                          <span>Created</span>
+                          <time>{date(report.message.createdAt)}</time>
+                        </div>
+                      </div>
+                    ) : (
+                      <p className="message-unavailable">
+                        Message content is unavailable. It may have expired or
+                        been removed from event storage.
+                      </p>
+                    )}
+                  </dd>
+                </>
+              ) : null}
               <dt>Note</dt>
               <dd className="sensitive">
                 {report.note ?? "No note provided."}
diff --git a/admin-web/src/styles.css b/admin-web/src/styles.css
index f72747c0a76..93ebceeb141 100644
--- a/admin-web/src/styles.css
+++ b/admin-web/src/styles.css
@@ -496,6 +496,38 @@ dd {
   margin: 0;
 }
 
+.reported-message {
+  display: grid;
+  justify-items: start;
+  gap: 1rem;
+  border-left: 3px solid #d7d72e;
+  border-radius: 0 0.8rem 0.8rem 0;
+  background: #f6f6f1;
+  padding: 1rem;
+}
+
+.reported-message p,
+.message-unavailable {
+  margin: 0;
+  overflow-wrap: anywhere;
+  line-height: 1.5;
+  white-space: pre-wrap;
+}
+
+.reported-message-meta {
+  display: grid;
+  grid-template-columns: auto minmax(0, 1fr);
+  gap: 0.4rem 0.75rem;
+  width: 100%;
+  color: rgb(35 30 30 / 48%);
+  font-size: 0.78rem;
+}
+
+.message-unavailable {
+  color: rgb(35 30 30 / 60%);
+  font-style: italic;
+}
+
 .sensitive {
   border-left: 3px solid #d7d72e;
   border-radius: 0 0.8rem 0.8rem 0;
diff --git a/admin-web/src/types.ts b/admin-web/src/types.ts
index 1aab0cb9ac8..6c108377589 100644
--- a/admin-web/src/types.ts
+++ b/admin-web/src/types.ts
@@ -12,6 +12,17 @@ export interface Report {
   createdAt: string;
 }
 
+export interface ReportedMessage {
+  authorPubkey: string;
+  content: string;
+  createdAt: string;
+  deletedAt: string | null;
+}
+
+export interface ReportDetail extends Report {
+  message: ReportedMessage | null;
+}
+
 export interface FeedbackSummary {
   id: string;
   communityId: string;
diff --git a/admin-web/tests/routes.spec.ts b/admin-web/tests/routes.spec.ts
index 002ce456b39..3c965dd2d85 100644
--- a/admin-web/tests/routes.spec.ts
+++ b/admin-web/tests/routes.spec.ts
@@ -58,6 +58,72 @@ test("report rows render the relay response contract", async ({ page }) => {
   await expect(page.getByText("Unknown date")).toHaveCount(0);
 });
 
+test("event report detail renders the reported message content", async ({
+  page,
+}) => {
+  const id = "0e6caad8-1e18-4cd7-84fa-7264103f0a08";
+  await page.route(`**/api/admin/v1/reports/${id}`, (route) =>
+    route.fulfill({
+      contentType: "application/json",
+      body: JSON.stringify({
+        id,
+        communityId: "6d474feb-c50a-44e4-a0b5-f30532df49bc",
+        communityHost: "design.buzz.xyz",
+        reporterPubkey: "21".repeat(32),
+        targetKind: "event",
+        target: "12".repeat(32),
+        reportType: "spam",
+        status: "open",
+        createdAt: "2026-07-17T17:30:00Z",
+        message: {
+          authorPubkey: "31".repeat(32),
+          content:
+            "This is the complete reported message.\nIt preserves lines.",
+          createdAt: "2026-07-17T17:25:00Z",
+          deletedAt: null,
+        },
+      }),
+    }),
+  );
+
+  await page.goto(`/reports/${id}`);
+  await expect(
+    page.getByText("This is the complete reported message.", { exact: false }),
+  ).toBeVisible();
+  await expect(page.getByText("31".repeat(32))).toBeVisible();
+  await expect(
+    page.getByText("Message content is unavailable", { exact: false }),
+  ).toHaveCount(0);
+});
+
+test("event report detail explains when message content is unavailable", async ({
+  page,
+}) => {
+  const id = "0e6caad8-1e18-4cd7-84fa-7264103f0a09";
+  await page.route(`**/api/admin/v1/reports/${id}`, (route) =>
+    route.fulfill({
+      contentType: "application/json",
+      body: JSON.stringify({
+        id,
+        communityId: "6d474feb-c50a-44e4-a0b5-f30532df49bc",
+        communityHost: "design.buzz.xyz",
+        reporterPubkey: "21".repeat(32),
+        targetKind: "event",
+        target: "12".repeat(32),
+        reportType: "spam",
+        status: "open",
+        createdAt: "2026-07-17T17:30:00Z",
+        message: null,
+      }),
+    }),
+  );
+
+  await page.goto(`/reports/${id}`);
+  await expect(
+    page.getByText("Message content is unavailable", { exact: false }),
+  ).toBeVisible();
+});
+
 test("feedback cards open the complete submission", async ({ page }) => {
   const id = "feed0000-0000-4000-8000-000000000001";
   const fullBody = `${"Long feedback ".repeat(30)}end of feedback`;
diff --git a/benchmarks/harbor-buzz-orchestra/scripts/benchmark.py b/benchmarks/harbor-buzz-orchestra/scripts/benchmark.py
index f1e91d022bf..b6f5601a82c 100755
--- a/benchmarks/harbor-buzz-orchestra/scripts/benchmark.py
+++ b/benchmarks/harbor-buzz-orchestra/scripts/benchmark.py
@@ -84,51 +84,75 @@ def parse_args(argv: list[str] | None = None) -> argparse.Namespace:
     )
     problems = parser.add_mutually_exclusive_group()
     problems.add_argument(
-        "--dataset", "-d", default=None,
+        "--dataset",
+        "-d",
+        default=None,
         help=f"Registry dataset (default: {DEFAULT_DATASET})",
     )
     problems.add_argument(
         "--path", "-p", type=Path, help="Local task or dataset directory"
     )
     parser.add_argument(
-        "--include-task", "-i", action="append", default=[],
+        "--include-task",
+        "-i",
+        action="append",
+        default=[],
         help="Task name to include (glob, repeatable)",
     )
     parser.add_argument(
-        "--exclude-task", "-x", action="append", default=[],
+        "--exclude-task",
+        "-x",
+        action="append",
+        default=[],
         help="Task name to exclude (glob, repeatable)",
     )
     parser.add_argument(
-        "--attempts", "-k", type=int, default=DEFAULT_ATTEMPTS,
+        "--attempts",
+        "-k",
+        type=int,
+        default=DEFAULT_ATTEMPTS,
         help=f"Runs per problem (default: {DEFAULT_ATTEMPTS}, the leaderboard requirement)",
     )
     parser.add_argument(
-        "--manifest", type=Path, default=DEFAULT_MANIFEST,
+        "--manifest",
+        type=Path,
+        default=DEFAULT_MANIFEST,
         help=f"Team manifest YAML (default: {DEFAULT_MANIFEST.name})",
     )
     parser.add_argument(
-        "--endpoint-config", type=Path, default=DEFAULT_ENDPOINTS,
+        "--endpoint-config",
+        type=Path,
+        default=DEFAULT_ENDPOINTS,
         help=f"Endpoint provider/API-key mapping (default: {DEFAULT_ENDPOINTS.name})",
     )
-    parser.add_argument("--n-concurrent", "-n", type=int, default=4, help="Concurrent trials")
+    parser.add_argument(
+        "--n-concurrent", "-n", type=int, default=4, help="Concurrent trials"
+    )
     parser.add_argument(
         "--jobs-dir", type=Path, default=PACKAGE_ROOT / "jobs", help="Job output root"
     )
-    parser.add_argument("--job-name", default=None, help="Job name (default: lb-<condition>-<UTC>)")
     parser.add_argument(
-        "--upload", action="store_true", help="Upload to Harbor Hub when the job finishes"
+        "--job-name", default=None, help="Job name (default: lb-<condition>-<UTC>)"
+    )
+    parser.add_argument(
+        "--upload",
+        action="store_true",
+        help="Upload to Harbor Hub when the job finishes",
     )
     parser.add_argument(
-        "--gui", action="store_true",
+        "--gui",
+        action="store_true",
         help="Open the Buzz desktop app as the benchmark user to watch the run live",
     )
     parser.add_argument(
-        "--fresh", action="store_true",
+        "--fresh",
+        action="store_true",
         help="Reset first: drop the stack's Docker volumes and the benchmark "
-             "GUI's app state (keys in state.json are kept)",
+        "GUI's app state (keys in state.json are kept)",
     )
     parser.add_argument(
-        "--dry-run", action="store_true",
+        "--dry-run",
+        action="store_true",
         help="Print the underlying harbor command and exit (no stack bring-up)",
     )
     return parser.parse_args(argv)
@@ -153,7 +177,6 @@ def load_state() -> dict[str, str]:
             "user_secret_key": user.secret_key,
             "postgres_password": secrets.token_urlsafe(24),
             "redis_password": secrets.token_urlsafe(24),
-            "typesense_api_key": secrets.token_hex(16),
             "s3_access_key": secrets.token_hex(10),
             "s3_secret_key": secrets.token_hex(20),
             "git_hook_hmac_secret": secrets.token_hex(32),
@@ -202,7 +225,6 @@ def write_env_file(state: dict[str, str]) -> Path:
         "POSTGRES_USER": "buzz",
         "POSTGRES_PASSWORD": state["postgres_password"],
         "REDIS_PASSWORD": state["redis_password"],
-        "TYPESENSE_API_KEY": state["typesense_api_key"],
         "BUZZ_S3_ACCESS_KEY": state["s3_access_key"],
         "BUZZ_S3_SECRET_KEY": state["s3_secret_key"],
         "BUZZ_S3_BUCKET": "buzz-media",
@@ -217,14 +239,11 @@ def write_env_file(state: dict[str, str]) -> Path:
 
 def postgres_dsn(state: dict[str, str]) -> str:
     return (
-        f"postgresql://buzz:{state['postgres_password']}"
-        f"@127.0.0.1:{PG_HOST_PORT}/buzz"
+        f"postgresql://buzz:{state['postgres_password']}@127.0.0.1:{PG_HOST_PORT}/buzz"
     )
 
 
-def write_provisioner_config(
-    state: dict[str, str], endpoint_config: Path
-) -> Path:
+def write_provisioner_config(state: dict[str, str], endpoint_config: Path) -> Path:
     """Resolve per-endpoint API keys from the environment and write the
     provisioner config: pinned user, keep-channels teardown."""
     endpoints = json.loads(endpoint_config.read_text())
@@ -262,10 +281,14 @@ def write_provisioner_config(
 
 def compose_command(*args: str) -> list[str]:
     command = [
-        "docker", "compose",
-        "--project-name", COMPOSE_PROJECT,
-        "--project-directory", str(STATE_DIR),
-        "--env-file", str(STATE_DIR / ".env"),
+        "docker",
+        "compose",
+        "--project-name",
+        COMPOSE_PROJECT,
+        "--project-directory",
+        str(STATE_DIR),
+        "--env-file",
+        str(STATE_DIR / ".env"),
     ]
     for file in COMPOSE_FILES:
         command += ["-f", str(file)]
@@ -360,7 +383,9 @@ def linux_triple() -> str:
     """The musl triple matching the Docker engine that runs task containers."""
     arch = subprocess.run(
         ["docker", "version", "--format", "{{.Server.Arch}}"],
-        capture_output=True, text=True, check=True,
+        capture_output=True,
+        text=True,
+        check=True,
     ).stdout.strip()
     try:
         return {
@@ -385,22 +410,32 @@ def ensure_agent_binaries() -> Path:
     targets = AGENT_BINARIES + (FORWARDER_BINARY,)
     if all((bin_dir / name).is_file() for name in targets):
         return bin_dir
-    print(f"Linux agent binaries missing — cross-building for {triple} "
-          f"in {RUST_IMAGE} (first run only, ~2 min)...")
+    print(
+        f"Linux agent binaries missing — cross-building for {triple} "
+        f"in {RUST_IMAGE} (first run only, ~2 min)..."
+    )
     LINUX_TARGET_DIR.mkdir(parents=True, exist_ok=True)
     (STATE_DIR / "cargo-registry").mkdir(exist_ok=True)
     packages = [arg for name in AGENT_BINARIES for arg in ("-p", name)]
     forwarder_src = FORWARDER_SOURCE.relative_to(REPO_ROOT)
     subprocess.run(
         [
-            "docker", "run", "--rm",
-            "-v", f"{REPO_ROOT}:/src:ro",
-            "-v", f"{LINUX_TARGET_DIR}:/target",
-            "-v", f"{STATE_DIR / 'cargo-registry'}:/usr/local/cargo/registry",
-            "-e", "CARGO_TARGET_DIR=/target",
-            "-w", "/src",
+            "docker",
+            "run",
+            "--rm",
+            "-v",
+            f"{REPO_ROOT}:/src:ro",
+            "-v",
+            f"{LINUX_TARGET_DIR}:/target",
+            "-v",
+            f"{STATE_DIR / 'cargo-registry'}:/usr/local/cargo/registry",
+            "-e",
+            "CARGO_TARGET_DIR=/target",
+            "-w",
+            "/src",
             RUST_IMAGE,
-            "sh", "-c",
+            "sh",
+            "-c",
             "apk add --no-cache musl-dev >/dev/null && "
             f"cargo build --release --locked --target {triple} "
             + " ".join(packages)
@@ -429,8 +464,13 @@ def launch_gui(state: dict[str, str]) -> subprocess.Popen:
     """
     subprocess.run(
         compose_command(
-            "exec", "-T", "relay",
-            "buzz-admin", "add-member", "--pubkey", state["user_pubkey"],
+            "exec",
+            "-T",
+            "relay",
+            "buzz-admin",
+            "add-member",
+            "--pubkey",
+            state["user_pubkey"],
         ),
         check=True,
     )
@@ -445,12 +485,20 @@ def launch_gui(state: dict[str, str]) -> subprocess.Popen:
         ["rustc", "-vV"], capture_output=True, text=True, check=True
     ).stdout
     triple = next(
-        line.split(": ", 1)[1] for line in target.splitlines() if line.startswith("host: ")
+        line.split(": ", 1)[1]
+        for line in target.splitlines()
+        if line.startswith("host: ")
     )
     sidecar_dir = desktop_dir / "src-tauri" / "binaries"
     sidecar_dir.mkdir(parents=True, exist_ok=True)
     binaries = ensure_binaries()
-    for name in ("buzz-acp", "buzz-agent", "buzz-dev-mcp", "git-credential-nostr", "buzz"):
+    for name in (
+        "buzz-acp",
+        "buzz-agent",
+        "buzz-dev-mcp",
+        "git-credential-nostr",
+        "buzz",
+    ):
         stub = sidecar_dir / f"{name}-{triple}"
         if not stub.exists():
             stub.touch()
@@ -498,21 +546,30 @@ def leaderboard_argv(
     for pattern in args.exclude_task:
         argv += ["--exclude-task", pattern]
     argv += [
-        "--attempts", str(args.attempts),
-        "--manifest", str(args.manifest),
-        "--endpoint-config", str(args.endpoint_config),
-        "--provisioner-config", str(provisioner_config),
-        "--agent-bin-dir", str(agent_bin_dir),
+        "--attempts",
+        str(args.attempts),
+        "--manifest",
+        str(args.manifest),
+        "--endpoint-config",
+        str(args.endpoint_config),
+        "--provisioner-config",
+        str(provisioner_config),
+        "--agent-bin-dir",
+        str(agent_bin_dir),
         # The relay as reachable from inside a task container: Docker's
         # host alias, bridged to the canonical localhost address by the
         # uploaded forwarder. Override the alias with
         # BUZZ_BENCHMARK_DOCKER_HOST if your engine exposes the host
         # differently.
         "--relay-gateway",
-        f"{os.environ.get('BUZZ_BENCHMARK_DOCKER_HOST', 'host.docker.internal')}"
-        f":{RELAY_HTTP_PORT}",
-        "--n-concurrent", str(args.n_concurrent),
-        "--jobs-dir", str(args.jobs_dir),
+        (
+            f"{os.environ.get('BUZZ_BENCHMARK_DOCKER_HOST', 'host.docker.internal')}"
+            f":{RELAY_HTTP_PORT}"
+        ),
+        "--n-concurrent",
+        str(args.n_concurrent),
+        "--jobs-dir",
+        str(args.jobs_dir),
     ]
     if args.job_name:
         argv += ["--job-name", args.job_name]
diff --git a/benchmarks/harbor-buzz-orchestra/scripts/run_leaderboard.py b/benchmarks/harbor-buzz-orchestra/scripts/run_leaderboard.py
index 6fd43ea6fbc..6eaf8d6af0f 100755
--- a/benchmarks/harbor-buzz-orchestra/scripts/run_leaderboard.py
+++ b/benchmarks/harbor-buzz-orchestra/scripts/run_leaderboard.py
@@ -45,64 +45,101 @@
 # host-header tenant-bound, so agents must present its canonical Host).
 FORWARDER_BINARY = "relay-forwarder"
 
-PROVIDER_ORGS = {"anthropic": "Anthropic", "openai": "OpenAI", "databricks": "Databricks"}
+PROVIDER_ORGS = {
+    "anthropic": "Anthropic",
+    "openai": "OpenAI",
+    "databricks": "Databricks",
+}
 
 
 def parse_args(argv: list[str] | None = None) -> argparse.Namespace:
     parser = argparse.ArgumentParser(
-        description=__doc__.splitlines()[0], formatter_class=argparse.RawDescriptionHelpFormatter
+        description=__doc__.splitlines()[0],
+        formatter_class=argparse.RawDescriptionHelpFormatter,
     )
     problems = parser.add_mutually_exclusive_group(required=True)
     problems.add_argument(
-        "--dataset", "-d", help="Registry dataset (e.g. terminal-bench/terminal-bench-2-1)"
+        "--dataset",
+        "-d",
+        help="Registry dataset (e.g. terminal-bench/terminal-bench-2-1)",
     )
     problems.add_argument(
         "--path", "-p", type=Path, help="Local task or dataset directory"
     )
     parser.add_argument(
-        "--include-task", "-i", action="append", default=[],
+        "--include-task",
+        "-i",
+        action="append",
+        default=[],
         help="Task name to include from the dataset (glob, repeatable)",
     )
     parser.add_argument(
-        "--exclude-task", "-x", action="append", default=[],
+        "--exclude-task",
+        "-x",
+        action="append",
+        default=[],
         help="Task name to exclude from the dataset (glob, repeatable)",
     )
     parser.add_argument(
-        "--attempts", "-k", type=int, required=True,
+        "--attempts",
+        "-k",
+        type=int,
+        required=True,
         help="Runs per problem (leaderboards require 5)",
     )
-    parser.add_argument("--manifest", type=Path, required=True, help="Team manifest YAML")
     parser.add_argument(
-        "--endpoint-config", type=Path, required=True,
+        "--manifest", type=Path, required=True, help="Team manifest YAML"
+    )
+    parser.add_argument(
+        "--endpoint-config",
+        type=Path,
+        required=True,
         help="JSON mapping manifest endpoint names to providers/API keys",
     )
     parser.add_argument(
-        "--provisioner-config", type=Path, required=True,
+        "--provisioner-config",
+        type=Path,
+        required=True,
         help="JSON config for the Buzz relay/Postgres provisioner",
     )
     parser.add_argument(
-        "--buzz-bin-dir", type=Path, default=None,
+        "--buzz-bin-dir",
+        type=Path,
+        default=None,
         help="Directory with the host buzz CLI (default: repo target/release, then target/debug)",
     )
     parser.add_argument(
-        "--agent-bin-dir", type=Path, required=True,
+        "--agent-bin-dir",
+        type=Path,
+        required=True,
         help="Directory with Linux builds of buzz-acp/buzz-agent/buzz-dev-mcp "
         "to upload into each task container",
     )
     parser.add_argument(
-        "--relay-gateway", default="",
+        "--relay-gateway",
+        default="",
         help="host:port of the benchmark relay as reachable from inside the "
         "task container (e.g. host.docker.internal:3600). When set, a "
         "loopback forwarder from --agent-bin-dir bridges the canonical "
         "relay address to this gateway",
     )
-    parser.add_argument("--n-concurrent", "-n", type=int, default=4, help="Concurrent trials")
-    parser.add_argument("--jobs-dir", type=Path, default=Path("jobs"), help="Job output root")
-    parser.add_argument("--job-name", default=None, help="Job name (default: lb-<condition>-<UTC>)")
     parser.add_argument(
-        "--upload", action="store_true", help="Upload to Harbor Hub when the job finishes"
+        "--n-concurrent", "-n", type=int, default=4, help="Concurrent trials"
+    )
+    parser.add_argument(
+        "--jobs-dir", type=Path, default=Path("jobs"), help="Job output root"
+    )
+    parser.add_argument(
+        "--job-name", default=None, help="Job name (default: lb-<condition>-<UTC>)"
+    )
+    parser.add_argument(
+        "--upload",
+        action="store_true",
+        help="Upload to Harbor Hub when the job finishes",
+    )
+    parser.add_argument(
+        "--dry-run", action="store_true", help="Print the harbor command and exit"
     )
-    parser.add_argument("--dry-run", action="store_true", help="Print the harbor command and exit")
     return parser.parse_args(argv)
 
 
@@ -110,7 +147,9 @@ def find_binaries(bin_dir: Path | None) -> dict[str, Path]:
     candidates = (
         [bin_dir]
         if bin_dir is not None
-        else [PACKAGE_ROOT.parents[1] / "target" / kind for kind in ("release", "debug")]
+        else [
+            PACKAGE_ROOT.parents[1] / "target" / kind for kind in ("release", "debug")
+        ]
     )
     for candidate in candidates:
         found = {name: candidate / name for name in BINARIES}
@@ -146,11 +185,17 @@ def build_command(
     resource override would fail leaderboard static validation, so none are
     accepted or forwarded."""
     command = [
-        "harbor", "run", "--yes",
-        "--job-name", args.job_name,
-        "--jobs-dir", str(args.jobs_dir),
-        "-k", str(args.attempts),
-        "--n-concurrent", str(args.n_concurrent),
+        "harbor",
+        "run",
+        "--yes",
+        "--job-name",
+        args.job_name,
+        "--jobs-dir",
+        str(args.jobs_dir),
+        "-k",
+        str(args.attempts),
+        "--n-concurrent",
+        str(args.n_concurrent),
     ]
     if args.dataset:
         command += ["--dataset", args.dataset]
@@ -250,7 +295,7 @@ def main(argv: list[str] | None = None) -> int:
             f"{PACKAGE_ROOT / 'testbed'} {Path(__file__).resolve()} ..."
         )
 
-    result = subprocess.run(command)
+    result = subprocess.run(command, check=False)
     job_dir = args.jobs_dir / args.job_name
     if result.returncode != 0:
         print(f"harbor run failed (exit {result.returncode}); job dir: {job_dir}")
diff --git a/benchmarks/harbor-buzz-orchestra/src/harbor_buzz_orchestra/__init__.py b/benchmarks/harbor-buzz-orchestra/src/harbor_buzz_orchestra/__init__.py
index b423e8aa475..1b79d233b9e 100644
--- a/benchmarks/harbor-buzz-orchestra/src/harbor_buzz_orchestra/__init__.py
+++ b/benchmarks/harbor-buzz-orchestra/src/harbor_buzz_orchestra/__init__.py
@@ -1,25 +1,25 @@
 """Buzz orchestra custom agent for Harbor."""
 
 from .agent import BuzzOrchestraAgent
-from .manifest import ExperimentManifest, ManifestError
-from .provisioning import AgentCredential, TrialHandle, TrialProvisioner
-from .runtime import OrchestraRuntime, RuntimeResult
 from .container_runtime import (
     BuzzContainerRuntime,
     EndpointLaunchConfig,
     RuntimeLaunchError,
 )
+from .manifest import ExperimentManifest, ManifestError
+from .provisioning import AgentCredential, TrialHandle, TrialProvisioner
+from .runtime import OrchestraRuntime, RuntimeResult
 
 __all__ = [
     "AgentCredential",
-    "BuzzOrchestraAgent",
     "BuzzContainerRuntime",
+    "BuzzOrchestraAgent",
     "EndpointLaunchConfig",
     "ExperimentManifest",
     "ManifestError",
     "OrchestraRuntime",
-    "RuntimeResult",
     "RuntimeLaunchError",
+    "RuntimeResult",
     "TrialHandle",
     "TrialProvisioner",
 ]
diff --git a/benchmarks/harbor-buzz-orchestra/src/harbor_buzz_orchestra/agent.py b/benchmarks/harbor-buzz-orchestra/src/harbor_buzz_orchestra/agent.py
index 6354e9a587b..3d1c81364f5 100644
--- a/benchmarks/harbor-buzz-orchestra/src/harbor_buzz_orchestra/agent.py
+++ b/benchmarks/harbor-buzz-orchestra/src/harbor_buzz_orchestra/agent.py
@@ -9,10 +9,10 @@
 from harbor.environments.base import BaseEnvironment
 from harbor.models.agent.context import AgentContext
 
+from .container_runtime import BuzzContainerRuntime, EndpointLaunchConfig
 from .manifest import ExperimentManifest
 from .provisioning import TrialProvisioner
 from .runtime import OrchestraRuntime
-from .container_runtime import BuzzContainerRuntime, EndpointLaunchConfig
 
 
 class BuzzOrchestraAgent(BaseAgent):
@@ -83,7 +83,7 @@ def _load_mapping(
         except (OSError, json.JSONDecodeError) as error:
             raise ValueError(f"cannot load JSON config {path}: {error}") from error
         if not isinstance(value, dict):
-            raise ValueError(f"JSON config {path} must contain an object")
+            raise TypeError(f"JSON config {path} must contain an object")
         return value
 
     @classmethod
diff --git a/benchmarks/harbor-buzz-orchestra/src/harbor_buzz_orchestra/container_runtime.py b/benchmarks/harbor-buzz-orchestra/src/harbor_buzz_orchestra/container_runtime.py
index 3909f081f5b..149a5295a7a 100644
--- a/benchmarks/harbor-buzz-orchestra/src/harbor_buzz_orchestra/container_runtime.py
+++ b/benchmarks/harbor-buzz-orchestra/src/harbor_buzz_orchestra/container_runtime.py
@@ -24,7 +24,6 @@
 from .provisioning import AgentCredential, TrialHandle
 from .runtime import RuntimeResult
 
-
 DEFAULT_MAX_AGENT_ROUNDS = 32
 # Container-side layout for the uploaded Buzz stack.
 REMOTE_ROOT = "/opt/buzz"
@@ -128,12 +127,20 @@ async def run(
             if forwarder is not None:
                 infra.append(forwarder)
             await self._buzz_json(
-                trial.user, trial, "users", "set-profile", "--name",
+                trial.user,
+                trial,
+                "users",
+                "set-profile",
+                "--name",
                 trial.user.agent_id,
             )
             for credential in trial.credentials:
                 await self._buzz_json(
-                    credential, trial, "users", "set-profile", "--name",
+                    credential,
+                    trial,
+                    "users",
+                    "set-profile",
+                    "--name",
                     credential.agent_id,
                 )
                 agents.append(
@@ -244,11 +251,17 @@ async def _start_forwarder(
             ) from error
         forwarder = _Agent(
             AgentCredential(
-                agent_id="relay-forwarder", role="infra",
-                nostr_secret_key="", nostr_pubkey="", nostr_auth_tag="",
-                llm_endpoint="", llm_api_key="",
+                agent_id="relay-forwarder",
+                role="infra",
+                nostr_secret_key="",
+                nostr_pubkey="",
+                nostr_auth_tag="",
+                llm_endpoint="",
+                llm_api_key="",
             ),
-            pid, log, log,
+            pid,
+            log,
+            log,
         )
         deadline = asyncio.get_running_loop().time() + self.readiness_timeout_seconds
         while True:
@@ -418,9 +431,14 @@ async def _wait_for_done(
                 await self._raise_for_dead_agents(environment, agents)
             polls += 1
             messages = await self._buzz_json(
-                trial.user, trial,
-                "messages", "get", "--channel", trial.channel_id,
-                "--limit", "100",
+                trial.user,
+                trial,
+                "messages",
+                "get",
+                "--channel",
+                trial.channel_id,
+                "--limit",
+                "100",
             )
             for message in messages:
                 if message.get("pubkey") == orchestrator.nostr_pubkey and str(
@@ -451,9 +469,7 @@ async def _raise_for_dead_agents(
             )
 
     @staticmethod
-    async def _stop_agents(
-        environment: BaseEnvironment, agents: list[_Agent]
-    ) -> None:
+    async def _stop_agents(environment: BaseEnvironment, agents: list[_Agent]) -> None:
         """Terminate every process of the uploaded stack (acp, agent, mcp)."""
         if not agents:
             return
@@ -461,14 +477,14 @@ async def _stop_agents(
         # to exist in task images, the /proc filesystem is.
         sweep = (
             "for d in /proc/[0-9]*; do "
-            f"grep -aq {REMOTE_BIN} \"$d/cmdline\" 2>/dev/null "
-            "&& kill -TERM \"${d#/proc/}\" 2>/dev/null; done; true"
+            f'grep -aq {REMOTE_BIN} "$d/cmdline" 2>/dev/null '
+            '&& kill -TERM "${d#/proc/}" 2>/dev/null; done; true'
         )
         try:
             await environment.exec(sweep)
             await asyncio.sleep(2)
             await environment.exec(sweep.replace("-TERM", "-KILL"))
-        except Exception:  # noqa: BLE001 — environment may already be gone
+        except Exception:  # noqa: S110, BLE001 — environment may already be gone
             pass
 
     async def _collect_logs(
@@ -476,7 +492,7 @@ async def _collect_logs(
     ) -> None:
         try:
             await environment.download_dir(REMOTE_LOGS, trial_dir)
-        except Exception:  # noqa: BLE001 — best effort; env may be torn down
+        except Exception:  # noqa: S110, BLE001 — best effort; env may be torn down
             pass
 
     # -- Buzz CLI as the trial user / provisioning identities -------------------
@@ -506,9 +522,14 @@ async def _send(
         self, credential: AgentCredential, trial: TrialHandle, content: str
     ) -> None:
         await self._buzz_json(
-            credential, trial,
-            "messages", "send", "--channel", trial.channel_id,
-            "--content", content,
+            credential,
+            trial,
+            "messages",
+            "send",
+            "--channel",
+            trial.channel_id,
+            "--content",
+            content,
         )
 
     async def _buzz_json(
@@ -614,9 +635,11 @@ def _compose_system_prompt(
             "",
             f"You are `{credential.agent_id}` (pubkey `{credential.nostr_pubkey}`).",
             f"The team coordinates in Buzz channel `{trial.channel_id}`.",
-            f"Tasks come from the user `{trial.user.agent_id}` "
-            f"(pubkey `{trial.user.nostr_pubkey}`); address your final report "
-            "to them.",
+            (
+                f"Tasks come from the user `{trial.user.agent_id}` "
+                f"(pubkey `{trial.user.nostr_pubkey}`); address your final report "
+                "to them."
+            ),
             "",
             "| Name | Role | Pubkey |",
             "|------|------|--------|",
@@ -625,8 +648,7 @@ def _compose_system_prompt(
             if teammate.agent_id == credential.agent_id:
                 continue
             lines.append(
-                f"| {teammate.agent_id} | {teammate.role} "
-                f"| `{teammate.nostr_pubkey}` |"
+                f"| {teammate.agent_id} | {teammate.role} | `{teammate.nostr_pubkey}` |"
             )
         composed = persona + "\n".join(lines) + "\n"
         path = trial_dir / f"{credential.agent_id}.system-prompt.md"
diff --git a/benchmarks/harbor-buzz-orchestra/testbed/src/harbor_buzz_testbed/buzz_cli.py b/benchmarks/harbor-buzz-orchestra/testbed/src/harbor_buzz_testbed/buzz_cli.py
index ed2bb31cc9e..bd11f193cae 100644
--- a/benchmarks/harbor-buzz-orchestra/testbed/src/harbor_buzz_testbed/buzz_cli.py
+++ b/benchmarks/harbor-buzz-orchestra/testbed/src/harbor_buzz_testbed/buzz_cli.py
@@ -38,6 +38,7 @@ def run(self, *args: str) -> Any:
                 capture_output=True,
                 text=True,
                 timeout=self._timeout,
+                check=False,
                 env={
                     "BUZZ_RELAY_URL": self._relay_url,
                     "BUZZ_PRIVATE_KEY": self._secret_key,
diff --git a/benchmarks/harbor-buzz-orchestra/testbed/src/harbor_buzz_testbed/provisioner.py b/benchmarks/harbor-buzz-orchestra/testbed/src/harbor_buzz_testbed/provisioner.py
index cfda6b59fa4..d8f380387d3 100644
--- a/benchmarks/harbor-buzz-orchestra/testbed/src/harbor_buzz_testbed/provisioner.py
+++ b/benchmarks/harbor-buzz-orchestra/testbed/src/harbor_buzz_testbed/provisioner.py
@@ -44,7 +44,7 @@ class TestbedConfig:
     archive_on_teardown: bool = True
 
 
-def provisioner_from_dict(config: dict[str, object]) -> "BuzzTrialProvisioner":
+def provisioner_from_dict(config: dict[str, object]) -> BuzzTrialProvisioner:
     """Harbor CLI factory for a JSON-decoded testbed configuration."""
     return BuzzTrialProvisioner(TestbedConfig(**config))
 
@@ -100,7 +100,7 @@ def teardown(self, handle: TrialHandle) -> None:
         cli = self._cli_for(handle.credentials[0])
         try:
             cli.archive_channel(handle.channel_id)
-        except Exception as error:  # noqa: BLE001 — idempotent re-teardown
+        except Exception as error:
             if "archived" not in str(error).lower():
                 raise
         with psycopg.connect(self._config.postgres_dsn) as conn:
diff --git a/benchmarks/harbor-buzz-orchestra/testbed/tests/test_benchmark.py b/benchmarks/harbor-buzz-orchestra/testbed/tests/test_benchmark.py
index 2d88e339f55..e0c6d32ec44 100644
--- a/benchmarks/harbor-buzz-orchestra/testbed/tests/test_benchmark.py
+++ b/benchmarks/harbor-buzz-orchestra/testbed/tests/test_benchmark.py
@@ -37,8 +37,19 @@ def test_defaults_are_leaderboard_eligible():
 
 def test_selectors_pass_through():
     args = benchmark.parse_args(
-        ["--path", "/tmp/task", "-i", "cobol*", "-x", "flaky*", "-k", "1",
-         "--job-name", "smoke", "--dry-run"]
+        [
+            "--path",
+            "/tmp/task",
+            "-i",
+            "cobol*",
+            "-x",
+            "flaky*",
+            "-k",
+            "1",
+            "--job-name",
+            "smoke",
+            "--dry-run",
+        ]
     )
     argv = benchmark.leaderboard_argv(args, Path("p.json"), Path("b"))
     assert argv[argv.index("--path") + 1] == "/tmp/task"
@@ -59,11 +70,15 @@ def test_state_is_generated_once_and_reused(state_dir):
     assert "user_pubkey" not in stored  # derived, never persisted
 
 
-def test_provisioner_config_pins_user_and_keeps_channels(state_dir, tmp_path, monkeypatch):
+def test_provisioner_config_pins_user_and_keeps_channels(
+    state_dir, tmp_path, monkeypatch
+):
     monkeypatch.setenv("FAKE_KEY_ENV", "sk-test")
     endpoints = tmp_path / "endpoints.json"
     endpoints.write_text(
-        json.dumps({"model-a": {"provider": "anthropic", "api_key_env": "FAKE_KEY_ENV"}})
+        json.dumps(
+            {"model-a": {"provider": "anthropic", "api_key_env": "FAKE_KEY_ENV"}}
+        )
     )
     state = benchmark.load_state()
     path = benchmark.write_provisioner_config(state, endpoints)
@@ -78,7 +93,9 @@ def test_provisioner_config_pins_user_and_keeps_channels(state_dir, tmp_path, mo
     assert config["relay_http_url"].startswith("http://localhost:")
 
 
-def test_provisioner_config_missing_api_key_is_explicit(state_dir, tmp_path, monkeypatch):
+def test_provisioner_config_missing_api_key_is_explicit(
+    state_dir, tmp_path, monkeypatch
+):
     monkeypatch.delenv("MISSING_KEY_ENV", raising=False)
     endpoints = tmp_path / "endpoints.json"
     endpoints.write_text(
@@ -91,9 +108,7 @@ def test_provisioner_config_missing_api_key_is_explicit(state_dir, tmp_path, mon
 def test_env_file_wires_owner_and_ports(state_dir):
     state = benchmark.load_state()
     env_path = benchmark.write_env_file(state)
-    env = dict(
-        line.split("=", 1) for line in env_path.read_text().splitlines() if line
-    )
+    env = dict(line.split("=", 1) for line in env_path.read_text().splitlines() if line)
     assert env["RELAY_OWNER_PUBKEY"] == state["owner_pubkey"]
     assert env["BUZZ_HTTP_PORT"] == str(benchmark.RELAY_HTTP_PORT)
     assert env["BUZZ_PG_HOST_PORT"] == str(benchmark.PG_HOST_PORT)
diff --git a/benchmarks/harbor-buzz-orchestra/testbed/tests/test_keys.py b/benchmarks/harbor-buzz-orchestra/testbed/tests/test_keys.py
index 0f825783690..0ac794e0fa9 100644
--- a/benchmarks/harbor-buzz-orchestra/testbed/tests/test_keys.py
+++ b/benchmarks/harbor-buzz-orchestra/testbed/tests/test_keys.py
@@ -6,6 +6,7 @@
 import json
 
 import coincurve
+
 from harbor_buzz_testbed.keys import (
     compute_auth_tag,
     encode_nsec,
@@ -21,8 +22,10 @@
     "auth",
     "f9308a019258c31049344f85f89d5229b531c845836f99b08601f113bce036f9",
     "",
-    "20105c618d6e5d8f559cffb6f0d7a7b4f44f3a567e1be94c96378d45ac3625da"
-    "34c2e7357ea1d3ce980978334546b3e740c155e81b833ebe140d519d39ed8867",
+    (
+        "20105c618d6e5d8f559cffb6f0d7a7b4f44f3a567e1be94c96378d45ac3625da"
+        "34c2e7357ea1d3ce980978334546b3e740c155e81b833ebe140d519d39ed8867"
+    ),
 ]
 
 
diff --git a/benchmarks/harbor-buzz-orchestra/testbed/tests/test_provisioner_live.py b/benchmarks/harbor-buzz-orchestra/testbed/tests/test_provisioner_live.py
index 5a6b40d8cff..711b877ab48 100644
--- a/benchmarks/harbor-buzz-orchestra/testbed/tests/test_provisioner_live.py
+++ b/benchmarks/harbor-buzz-orchestra/testbed/tests/test_provisioner_live.py
@@ -14,6 +14,7 @@
 
 import psycopg
 import pytest
+
 from harbor_buzz_testbed.buzz_cli import BuzzCli, BuzzCliError
 from harbor_buzz_testbed.provisioner import (
     BuzzTrialProvisioner,
diff --git a/benchmarks/harbor-buzz-orchestra/testbed/tests/test_provisioner_unit.py b/benchmarks/harbor-buzz-orchestra/testbed/tests/test_provisioner_unit.py
index 9620be4bc80..e784de58256 100644
--- a/benchmarks/harbor-buzz-orchestra/testbed/tests/test_provisioner_unit.py
+++ b/benchmarks/harbor-buzz-orchestra/testbed/tests/test_provisioner_unit.py
@@ -7,6 +7,7 @@
 
 import coincurve
 import pytest
+
 from harbor_buzz_testbed.provisioner import (
     BuzzTrialProvisioner,
     ProvisioningError,
@@ -17,13 +18,13 @@
 
 
 def config(**overrides) -> TestbedConfig:
-    defaults = dict(
-        relay_http_url="http://localhost:3000",
-        relay_ws_url="ws://host.docker.internal:3000",
-        owner_secret_key=OWNER_SECRET,
-        postgres_dsn="postgresql://unused",
-        llm_api_keys={"databricks/glm": "glm-key", "databricks/opus": "opus-key"},
-    )
+    defaults = {
+        "relay_http_url": "http://localhost:3000",
+        "relay_ws_url": "ws://host.docker.internal:3000",
+        "owner_secret_key": OWNER_SECRET,
+        "postgres_dsn": "postgresql://unused",
+        "llm_api_keys": {"databricks/glm": "glm-key", "databricks/opus": "opus-key"},
+    }
     defaults.update(overrides)
     return TestbedConfig(**defaults)
 
diff --git a/benchmarks/harbor-buzz-orchestra/tests/conftest.py b/benchmarks/harbor-buzz-orchestra/tests/conftest.py
index bd0bcaf2ddf..b1de094d76a 100644
--- a/benchmarks/harbor-buzz-orchestra/tests/conftest.py
+++ b/benchmarks/harbor-buzz-orchestra/tests/conftest.py
@@ -1,4 +1,5 @@
 from typing import Any
+
 import pytest
 
 
diff --git a/benchmarks/harbor-buzz-orchestra/tests/test_agent.py b/benchmarks/harbor-buzz-orchestra/tests/test_agent.py
index 62c6047ab30..b305344c51c 100644
--- a/benchmarks/harbor-buzz-orchestra/tests/test_agent.py
+++ b/benchmarks/harbor-buzz-orchestra/tests/test_agent.py
@@ -1,7 +1,9 @@
 from types import SimpleNamespace
 from uuid import uuid4
+
 import pytest
 from harbor.models.agent.context import AgentContext
+
 from harbor_buzz_orchestra import (
     AgentCredential,
     BuzzOrchestraAgent,
@@ -73,9 +75,7 @@ async def run(self, **kwargs):
 
 async def test_agent_lifecycle_and_context(tmp_path, manifest_data):
     provisioner, runtime, context_id = Provisioner(), Runtime(), uuid4()
-    environment = SimpleNamespace(
-        context_id=context_id, environment_name="hello-world"
-    )
+    environment = SimpleNamespace(context_id=context_id, environment_name="hello-world")
     agent = BuzzOrchestraAgent(
         logs_dir=tmp_path,
         manifest=manifest_data,
diff --git a/benchmarks/harbor-buzz-orchestra/tests/test_container_runtime.py b/benchmarks/harbor-buzz-orchestra/tests/test_container_runtime.py
index 8669fe980c5..ebf0eb4b5d2 100644
--- a/benchmarks/harbor-buzz-orchestra/tests/test_container_runtime.py
+++ b/benchmarks/harbor-buzz-orchestra/tests/test_container_runtime.py
@@ -8,8 +8,6 @@
 import pytest
 from harbor.environments.base import ExecResult
 
-from harbor_buzz_orchestra.manifest import ExperimentManifest
-from harbor_buzz_orchestra.provisioning import AgentCredential, TrialHandle
 from harbor_buzz_orchestra.container_runtime import (
     REMOTE_BIN,
     REMOTE_LOGS,
@@ -17,6 +15,8 @@
     EndpointLaunchConfig,
     RuntimeLaunchError,
 )
+from harbor_buzz_orchestra.manifest import ExperimentManifest
+from harbor_buzz_orchestra.provisioning import AgentCredential, TrialHandle
 
 
 def write_manifest(tmp_path: Path) -> ExperimentManifest:
@@ -33,10 +33,20 @@ def write_manifest(tmp_path: Path) -> ExperimentManifest:
         {
             "condition": "test",
             "roster": [
-                {"id": "orch", "kind": "orchestrator", "role": "lead",
-                 "endpoint": "orch-model", **roster_entry},
-                {"id": "worker", "kind": "worker", "role": "implementer",
-                 "endpoint": "worker-model", **roster_entry},
+                {
+                    "id": "orch",
+                    "kind": "orchestrator",
+                    "role": "lead",
+                    "endpoint": "orch-model",
+                    **roster_entry,
+                },
+                {
+                    "id": "worker",
+                    "kind": "worker",
+                    "role": "implementer",
+                    "endpoint": "worker-model",
+                    **roster_entry,
+                },
             ],
             "prices": {
                 name: {
@@ -162,10 +172,7 @@ def test_user_relay_url_prefers_host_view(tmp_path):
         == "http://localhost:3600"
     )
     # pre-v1.2 handles fall back to deriving http from the agents' ws view.
-    assert (
-        rt._user_relay_url(trial_handle(()))
-        == "http://host.docker.internal:3600"
-    )
+    assert rt._user_relay_url(trial_handle(())) == "http://host.docker.internal:3600"
     with pytest.raises(RuntimeLaunchError, match="ws://"):
         rt._cli_relay_url("http://relay")
 
@@ -209,16 +216,21 @@ async def test_forwarder_bridges_the_canonical_relay_address(tmp_path):
         forwarder_binary=str(forwarder),
     )
     trial = TrialHandle(
-        run_id="run", trial_id="trial", manifest_hash="hash",
-        relay_ws_url="ws://localhost:3600", channel_id="channel",
-        credentials=(), user=user_credential(),
+        run_id="run",
+        trial_id="trial",
+        manifest_hash="hash",
+        relay_ws_url="ws://localhost:3600",
+        channel_id="channel",
+        credentials=(),
+        user=user_credential(),
     )
     environment = Environment(
         responses={
             FORWARDER: ExecResult(stdout="99\n", stderr="", return_code=0),
             "cat ": ExecResult(
                 stdout="forwarding 127.0.0.1:3600 -> host.docker.internal:3600",
-                stderr="", return_code=0,
+                stderr="",
+                return_code=0,
             ),
         }
     )
@@ -295,9 +307,7 @@ class ReadyEnvironment(Environment):
         async def exec(self, command, env=None, **kwargs):
             if command.startswith("cat "):
                 agent_id = re.search(r"([\w-]+)\.stdout\.log", command).group(1)
-                return ExecResult(
-                    stdout=logs[agent_id], stderr="", return_code=0
-                )
+                return ExecResult(stdout=logs[agent_id], stderr="", return_code=0)
             return ExecResult(stdout="", stderr="", return_code=0)
 
     from harbor_buzz_orchestra.container_runtime import _Agent
@@ -326,9 +336,7 @@ async def exec(self, command, env=None, **kwargs):
 async def test_dead_agent_processes_fail_the_trial(tmp_path):
     from harbor_buzz_orchestra.container_runtime import _Agent
 
-    agents = [
-        _Agent(credential("worker-1", "worker", "worker-model"), 7, "o", "e")
-    ]
+    agents = [_Agent(credential("worker-1", "worker", "worker-model"), 7, "o", "e")]
     environment = Environment(
         responses={
             "kill -0": ExecResult(stdout="DEAD:worker-1\n", stderr="", return_code=0)
diff --git a/benchmarks/harbor-buzz-orchestra/tests/test_manifest.py b/benchmarks/harbor-buzz-orchestra/tests/test_manifest.py
index 36533db3bf9..f8230036b31 100644
--- a/benchmarks/harbor-buzz-orchestra/tests/test_manifest.py
+++ b/benchmarks/harbor-buzz-orchestra/tests/test_manifest.py
@@ -1,6 +1,8 @@
 import copy
+
 import pytest
 import yaml
+
 from harbor_buzz_orchestra import ExperimentManifest, ManifestError
 
 
diff --git a/benchmarks/harbor-buzz-orchestra/tests/test_run_leaderboard.py b/benchmarks/harbor-buzz-orchestra/tests/test_run_leaderboard.py
index ed048ee5d93..451de72e79b 100644
--- a/benchmarks/harbor-buzz-orchestra/tests/test_run_leaderboard.py
+++ b/benchmarks/harbor-buzz-orchestra/tests/test_run_leaderboard.py
@@ -109,8 +109,16 @@ def test_forbidden_flags_are_not_accepted(tmp_path):
     for flag in FORBIDDEN_FLAGS:
         with pytest.raises(SystemExit):
             run_leaderboard.parse_args(
-                ["--dataset", "d", "--attempts", "5",
-                 "--agent-bin-dir", str(tmp_path), flag, "1"]
+                [
+                    "--dataset",
+                    "d",
+                    "--attempts",
+                    "5",
+                    "--agent-bin-dir",
+                    str(tmp_path),
+                    flag,
+                    "1",
+                ]
             )
 
 
diff --git a/bin/.node-24.14.0.pkg b/bin/.node-24.15.0.pkg
similarity index 100%
rename from bin/.node-24.14.0.pkg
rename to bin/.node-24.15.0.pkg
diff --git a/bin/corepack b/bin/corepack
index 07e8834efbf..4df063726ce 120000
--- a/bin/corepack
+++ b/bin/corepack
@@ -1 +1 @@
-.node-24.14.0.pkg
\ No newline at end of file
+.node-24.15.0.pkg
\ No newline at end of file
diff --git a/bin/node b/bin/node
index 07e8834efbf..4df063726ce 120000
--- a/bin/node
+++ b/bin/node
@@ -1 +1 @@
-.node-24.14.0.pkg
\ No newline at end of file
+.node-24.15.0.pkg
\ No newline at end of file
diff --git a/bin/npm b/bin/npm
index 07e8834efbf..4df063726ce 120000
--- a/bin/npm
+++ b/bin/npm
@@ -1 +1 @@
-.node-24.14.0.pkg
\ No newline at end of file
+.node-24.15.0.pkg
\ No newline at end of file
diff --git a/bin/npx b/bin/npx
index 07e8834efbf..4df063726ce 120000
--- a/bin/npx
+++ b/bin/npx
@@ -1 +1 @@
-.node-24.14.0.pkg
\ No newline at end of file
+.node-24.15.0.pkg
\ No newline at end of file
diff --git a/crates/buzz-acp/src/acp.rs b/crates/buzz-acp/src/acp.rs
index 78db7ff718b..8a698954a03 100644
--- a/crates/buzz-acp/src/acp.rs
+++ b/crates/buzz-acp/src/acp.rs
@@ -187,6 +187,17 @@ pub struct AcpClient {
     /// Other agents may leave this unset — readers must treat `None` as
     /// "no active run to steer into" and fall back to cancel+merge.
     active_run_id: Option<String>,
+    /// Whether the agent advertised `_meta.steering.supported: true` in its
+    /// `initialize` response, meaning it implements the cross-adapter
+    /// [`ACP_STEER_METHOD`] extension.
+    ///
+    /// Set once by [`initialize`](Self::initialize); `false` for agents that
+    /// omit the key. This is the **only** gate on writing an
+    /// [`ACP_STEER_METHOD`] request. It must never be replaced by error-code
+    /// probing: codex-acp answers unrecognized extension methods with `{}` —
+    /// a JSON-RPC *success*, not `-32601` — which the main loop would read as
+    /// a delivered steer and drop the user's message from the queue.
+    steering_supported: bool,
     /// Per-turn channel for receiving goose-native non-cancelling steer
     /// requests from the main loop. Installed by
     /// [`install_steer_rx`](Self::install_steer_rx) at dispatch and
@@ -344,6 +355,38 @@ pub(crate) fn build_codex_config_env(
     Ok(Some(serde_json::Value::Object(base).to_string()))
 }
 
+/// goose's non-standard mid-turn steer method. Requires `expectedRunId`, so it
+/// is only usable once a `session_info_update` has supplied
+/// `_meta.goose.activeRunId`. Emitted by goose and buzz-agent only.
+const GOOSE_STEER_METHOD: &str = "_goose/unstable/session/steer";
+
+/// The cross-adapter mid-turn steer method, shipped by claude-agent-acp
+/// (`src/acp-agent.ts:200`) and codex-acp (`src/AcpExtensions.ts:11`).
+/// Params are `{sessionId, prompt}` — no run id — and the result is
+/// `{outcome}`. Gated on [`AcpClient::steering_supported`].
+const ACP_STEER_METHOD: &str = "_session/steering";
+
+/// `outcome` value meaning the steer was applied to the turn Buzz is waiting
+/// on, which therefore keeps running.
+const STEER_OUTCOME_INJECTED: &str = "injected";
+
+/// `outcome` value meaning the turn Buzz was steering had already finished, so
+/// the adapter began a fresh turn carrying the message. Still a delivery
+/// success, but the awaited turn is over — see the steer-response arm for why
+/// this must not renew the hard deadline.
+const STEER_OUTCOME_STARTED_NEW_TURN: &str = "startedNewTurn";
+
+/// Which wire method carried an in-flight steer request, recorded so the
+/// response arm decodes the shape that method actually returns.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+enum SteerTransport {
+    /// [`GOOSE_STEER_METHOD`] — any success result is a delivered steer.
+    Goose,
+    /// [`ACP_STEER_METHOD`] — success carries an `outcome` that must be
+    /// positively recognized before the steer counts as delivered.
+    AcpExtension,
+}
+
 fn build_client_capabilities() -> serde_json::Value {
     serde_json::json!({
         // Signal to ACP adapters that Buzz can hand users to terminal-native
@@ -447,12 +490,22 @@ impl AcpClient {
         // entry falls through to the standard operator-wins treatment below.
         let codex_merge_active = codex_config_value.is_some();
 
+        // Per-runtime environment defaults (e.g. Hermes MCP-startup isolation).
+        // Applied first so both persona `extra_env` (below, via `Command::env`
+        // key replacement) and inherited parent env (via the parent-presence
+        // check) override them.
+        for &(key, value) in crate::config::default_agent_env(command) {
+            if std::env::var_os(key).is_none() {
+                cmd.env(key, value);
+            }
+        }
+
         for (key, value) in extra_env {
             if key == "CODEX_CONFIG" && codex_merge_active {
                 // Handled by build_codex_config_env; skip here to avoid double-setting.
                 continue;
             }
-            if std::env::var(key).is_err() {
+            if std::env::var_os(key).is_none() {
                 cmd.env(key, value);
             }
         }
@@ -494,6 +547,7 @@ impl AcpClient {
             observer_agent_index: None,
             observer_context: ObserverContext::default(),
             active_run_id: None,
+            steering_supported: false,
             steer_rx: None,
             goose_usage: UsageTracker::default(),
         })
@@ -536,11 +590,20 @@ impl AcpClient {
     ///
     /// Must be called exactly once, before any other ACP method.
     /// The caller may inspect `agentCapabilities` in the returned value.
+    ///
+    /// Records `_meta.steering.supported` into
+    /// [`steering_supported`](Self::steering_supported) so the read loop's steer
+    /// arm can choose [`ACP_STEER_METHOD`] for adapters that implement it.
+    /// Parsed here rather than at each call site so no caller can forget it.
     pub async fn initialize(&mut self) -> Result<serde_json::Value, AcpError> {
         // Requesting version 2 is an intentional temporary pin — we are squatting
         // on ACP v2 ahead of the upstream ACP RFD. Revisit when that RFD merges.
         let params = build_initialize_params();
         let result = self.send_request("initialize", params).await?;
+        self.steering_supported = result
+            .pointer("/_meta/steering/supported")
+            .and_then(|v| v.as_bool())
+            .unwrap_or(false);
         tracing::debug!(target: "acp::init", "initialize response: {result}");
         Ok(result)
     }
@@ -558,6 +621,9 @@ impl AcpClient {
     /// `cwd` must be an absolute path. `mcp_servers` may be empty.
     /// `system_prompt` is included in the request when `Some` — agents that
     /// support the field will use it; others ignore unknown fields per JSON-RPC.
+    /// `session_title` rides in `_meta.sessionTitle` when `Some`; `_meta` is
+    /// omitted entirely otherwise, since adapters may distinguish an absent
+    /// member from a null one.
     /// Callers use [`extract_model_config_options`] and [`extract_model_state`]
     /// to pull model info from the raw result.
     pub async fn session_new_full(
@@ -565,6 +631,7 @@ impl AcpClient {
         cwd: &str,
         mcp_servers: Vec<McpServer>,
         system_prompt: Option<&str>,
+        session_title: Option<&str>,
     ) -> Result<SessionNewResponse, AcpError> {
         let mut params = serde_json::json!({
             "cwd": cwd,
@@ -573,6 +640,9 @@ impl AcpClient {
         if let Some(sp) = system_prompt {
             params["systemPrompt"] = serde_json::Value::String(sp.to_owned());
         }
+        if let Some(title) = session_title {
+            params["_meta"] = serde_json::json!({ "sessionTitle": title });
+        }
         let result = self.send_request("session/new", params).await?;
         let session_id = result["sessionId"]
             .as_str()
@@ -594,9 +664,10 @@ impl AcpClient {
         cwd: &str,
         mcp_servers: Vec<McpServer>,
         system_prompt: Option<&str>,
+        session_title: Option<&str>,
     ) -> Result<String, AcpError> {
         Ok(self
-            .session_new_full(cwd, mcp_servers, system_prompt)
+            .session_new_full(cwd, mcp_servers, system_prompt, session_title)
             .await?
             .session_id)
     }
@@ -770,6 +841,15 @@ impl AcpClient {
         self.active_run_id.as_deref()
     }
 
+    /// Whether the agent advertised the [`ACP_STEER_METHOD`] extension at
+    /// `initialize` time (`_meta.steering.supported`).
+    ///
+    /// The read loop's steer arm reads the field directly; this accessor exists
+    /// for the supervisor's post-initialize log line.
+    pub fn steering_supported(&self) -> bool {
+        self.steering_supported
+    }
+
     /// Consume and return the per-turn usage record computed from the most
     /// recent `_goose/unstable/session/update` notification.
     ///
@@ -1211,14 +1291,18 @@ impl AcpClient {
         // so the ack_tx oneshot is never leaked silently).
         let mut steer_rx = self.steer_rx.take();
 
-        // Tracks the in-flight steer write: `(request_id, ack_tx)`. While
-        // `Some`, the steer arm is gated off so we don't stack writes,
+        // Tracks the in-flight steer write: `(request_id, transport, ack_tx)`.
+        // While `Some`, the steer arm is gated off so we don't stack writes,
         // and a response matching `id` is routed to the ack_tx instead
-        // of being treated as the prompt result. Drained on every return
-        // path with `PromptCompletedNeutral` so callers are never left
-        // hanging.
-        let mut pending_steer: Option<(u64, tokio::sync::oneshot::Sender<crate::pool::SteerAck>)> =
-            None;
+        // of being treated as the prompt result. `transport` records which
+        // method was written so the response arm decodes the result shape
+        // that method actually returns. Drained on every return path with
+        // `PromptCompletedNeutral` so callers are never left hanging.
+        let mut pending_steer: Option<(
+            u64,
+            SteerTransport,
+            tokio::sync::oneshot::Sender<crate::pool::SteerAck>,
+        )> = None;
 
         let now = Instant::now();
         let mut idle_deadline = now + idle_timeout;
@@ -1243,7 +1327,7 @@ impl AcpClient {
             // exists). Check the classified deadline here so a steady-
             // stream agent is still bounded.
             if Instant::now() >= next_deadline {
-                if let Some((_, ack_tx)) = pending_steer.take() {
+                if let Some((_, _, ack_tx)) = pending_steer.take() {
                     // Prompt is timing out — release the withheld event via
                     // PromptCompletedNeutral (no fallback signal: there is
                     // no in-flight turn to signal once we return, and
@@ -1278,39 +1362,64 @@ impl AcpClient {
                         None => None,
                     }
                 }, if pending_steer.is_none() => {
-                    // Selected: build steer params at write time using the
-                    // lexical `session_id` and the freshest `active_run_id`.
+                    // Selected: choose the steer transport and build its
+                    // params at write time using the lexical `session_id`
+                    // and the freshest `active_run_id`.
                     //
                     // `active_run_id` is updated by `session/update`
                     // notifications inside this very loop; reading it here
                     // (rather than snapshotting at dispatch) guarantees the
                     // value matches what goose's run-id check will compare
-                    // against. If it's `None`, no `session/update` has
-                    // arrived yet so we cannot form a valid `expectedRunId`
-                    // — ack `ExpectedRunIdMissing` and drop the request
-                    // without writing anything. The main loop maps this to
-                    // the universal cancel+merge `Steer` fallback.
-                    match self.active_run_id.clone() {
+                    // against.
+                    //
+                    // Transport precedence:
+                    //   Some(run_id)              → GOOSE_STEER_METHOD. goose
+                    //     wins whenever a run id exists: `expectedRunId` is
+                    //     strictly more precise about *which* run is steered.
+                    //   None + steering_supported → ACP_STEER_METHOD, the
+                    //     cross-adapter extension (claude-agent-acp,
+                    //     codex-acp), which takes no run id.
+                    //   None + !steering_supported → write nothing and ack
+                    //     `ExpectedRunIdMissing`; the main loop maps this to
+                    //     the universal cancel+merge `Steer` fallback.
+                    //
+                    // The capability flag is the ONLY gate on writing
+                    // ACP_STEER_METHOD. Probing an unknown method is unsafe:
+                    // codex-acp answers unrecognized extension methods with
+                    // `{}` — a JSON-RPC success — which would be read as a
+                    // delivered steer and silently drop the user's message.
+                    let prompt_block_refs: Vec<&str> =
+                        req.prompt_blocks.iter().map(String::as_str).collect();
+                    let selected = match (&self.active_run_id, self.steering_supported) {
+                        (Some(run_id), _) => Some((
+                            SteerTransport::Goose,
+                            GOOSE_STEER_METHOD,
+                            build_goose_steer_params(session_id, run_id, &prompt_block_refs),
+                        )),
+                        (None, true) => Some((
+                            SteerTransport::AcpExtension,
+                            ACP_STEER_METHOD,
+                            build_acp_steer_params(session_id, &prompt_block_refs),
+                        )),
+                        (None, false) => None,
+                    };
+                    match selected {
                         None => {
                             tracing::warn!(
-                                "goose-native steer: no active_run_id at write time \
-                                 (no session/update seen yet) — falling back to cancel+merge"
+                                "steer: no active_run_id and agent did not advertise \
+                                 {ACP_STEER_METHOD} — falling back to cancel+merge"
                             );
                             let _ = req.ack_tx.send(crate::pool::SteerAck::Err(
                                 crate::pool::SteerError::ExpectedRunIdMissing,
                             ));
                         }
-                        Some(run_id) => {
+                        Some((transport, method, params)) => {
                             let id = self.next_id;
                             self.next_id += 1;
-                            let prompt_block_refs: Vec<&str> =
-                                req.prompt_blocks.iter().map(String::as_str).collect();
-                            let params =
-                                build_steer_params(session_id, &run_id, &prompt_block_refs);
                             let msg = serde_json::json!({
                                 "jsonrpc": "2.0",
                                 "id": id,
-                                "method": "_goose/unstable/session/steer",
+                                "method": method,
                                 "params": params,
                             });
                             tracing::debug!(
@@ -1320,11 +1429,11 @@ impl AcpClient {
                             );
                             match self.write_ndjson(&msg).await {
                                 Ok(()) => {
-                                    pending_steer = Some((id, req.ack_tx));
+                                    pending_steer = Some((id, transport, req.ack_tx));
                                 }
                                 Err(e) => {
                                     tracing::warn!(
-                                        "goose-native steer write failed: {e} — releasing withheld event"
+                                        "steer write failed ({method}): {e} — releasing withheld event"
                                     );
                                     let _ = req.ack_tx.send(crate::pool::SteerAck::Err(
                                         crate::pool::SteerError::Transport(e.to_string()),
@@ -1343,7 +1452,7 @@ impl AcpClient {
                     // would catch this anyway, but firing the deadline arm
                     // here makes the wakeup immediate (no extra reader poll
                     // round-trip when stdout is idle).
-                    if let Some((_, ack_tx)) = pending_steer.take() {
+                    if let Some((_, _, ack_tx)) = pending_steer.take() {
                         let _ = ack_tx.send(crate::pool::SteerAck::PromptCompletedNeutral);
                     }
                     if idle_fires_first {
@@ -1367,13 +1476,13 @@ impl AcpClient {
 
             match read_result {
                 None => {
-                    if let Some((_, ack_tx)) = pending_steer.take() {
+                    if let Some((_, _, ack_tx)) = pending_steer.take() {
                         let _ = ack_tx.send(crate::pool::SteerAck::PromptCompletedNeutral);
                     }
                     return Err(AcpError::AgentExited);
                 }
                 Some(Err(LinesCodecError::MaxLineLengthExceeded)) => {
-                    if let Some((_, ack_tx)) = pending_steer.take() {
+                    if let Some((_, _, ack_tx)) = pending_steer.take() {
                         let _ = ack_tx.send(crate::pool::SteerAck::PromptCompletedNeutral);
                     }
                     return Err(AcpError::Protocol(
@@ -1381,7 +1490,7 @@ impl AcpClient {
                     ));
                 }
                 Some(Err(e)) => {
-                    if let Some((_, ack_tx)) = pending_steer.take() {
+                    if let Some((_, _, ack_tx)) = pending_steer.take() {
                         let _ = ack_tx.send(crate::pool::SteerAck::PromptCompletedNeutral);
                     }
                     return Err(AcpError::Io(std::io::Error::other(e)));
@@ -1424,13 +1533,14 @@ impl AcpClient {
                     // share the `no method` guard.
                     if let Some(id) = msg.get("id") {
                         if msg.get("method").is_none() {
-                            if let Some((steer_id, _)) = pending_steer.as_ref() {
+                            if let Some((steer_id, _, _)) = pending_steer.as_ref() {
                                 if *id == serde_json::json!(*steer_id) {
                                     // Take the ack_tx out and route the
                                     // response. We do not return — keep
                                     // reading until the prompt response
                                     // arrives.
-                                    let (_, ack_tx) = pending_steer.take().expect("just checked");
+                                    let (_, transport, ack_tx) =
+                                        pending_steer.take().expect("just checked");
                                     let ack = if let Some(error) = msg.get("error") {
                                         let code = error
                                             .get("code")
@@ -1441,16 +1551,83 @@ impl AcpClient {
                                             crate::pool::SteerError::AgentError { code, message },
                                         )
                                     } else {
-                                        let renew_now = Instant::now();
-                                        let new_deadline = renew_now + max_duration;
-                                        if new_deadline > hard_deadline {
-                                            hard_deadline = new_deadline;
-                                            self.current_hard_deadline = Some(new_deadline);
-                                            tracing::info!(
-                                                "steer success: renewed hard deadline ({max_duration:?} from now)"
-                                            );
+                                        // Success result. Whether it counts as
+                                        // a delivered steer — and whether the
+                                        // turn Buzz awaits is still running —
+                                        // depends on the transport.
+                                        let outcome = match transport {
+                                            // goose returns no outcome field;
+                                            // a success response means the
+                                            // steer landed in the live run.
+                                            SteerTransport::Goose => Some(STEER_OUTCOME_INJECTED),
+                                            // The outcome must be positively
+                                            // recognized. An unknown or absent
+                                            // value (codex-acp answers
+                                            // unrecognized ext methods with a
+                                            // bare `{}`) is a rejection, never
+                                            // a delivery — treating it as
+                                            // success would drop the event.
+                                            SteerTransport::AcpExtension => msg
+                                                .pointer("/result/outcome")
+                                                .and_then(|v| v.as_str())
+                                                .filter(|o| {
+                                                    *o == STEER_OUTCOME_INJECTED
+                                                        || *o == STEER_OUTCOME_STARTED_NEW_TURN
+                                                }),
+                                        };
+                                        match outcome {
+                                            Some(STEER_OUTCOME_STARTED_NEW_TURN) => {
+                                                // Delivered, but into a NEW
+                                                // turn: the one this read loop
+                                                // is awaiting had already
+                                                // finished. Renewing the hard
+                                                // deadline here would extend
+                                                // the clock on a settled turn,
+                                                // so leave it alone and let the
+                                                // prompt response land on its
+                                                // original budget.
+                                                tracing::info!(
+                                                    "steer accepted as {STEER_OUTCOME_STARTED_NEW_TURN}: \
+                                                     awaited turn had ended — hard deadline not renewed"
+                                                );
+                                                crate::pool::SteerAck::Success
+                                            }
+                                            Some(_) => {
+                                                let renew_now = Instant::now();
+                                                let new_deadline = renew_now + max_duration;
+                                                if new_deadline > hard_deadline {
+                                                    hard_deadline = new_deadline;
+                                                    self.current_hard_deadline = Some(new_deadline);
+                                                    tracing::info!(
+                                                        "steer success: renewed hard deadline ({max_duration:?} from now)"
+                                                    );
+                                                }
+                                                crate::pool::SteerAck::Success
+                                            }
+                                            None => {
+                                                // Report the raw string when
+                                                // there is one, so logs read
+                                                // `failed` not `"failed"`;
+                                                // fall back to the JSON for a
+                                                // non-string value.
+                                                let reported = match msg.pointer("/result/outcome")
+                                                {
+                                                    None => "<absent>".to_string(),
+                                                    Some(serde_json::Value::String(s)) => s.clone(),
+                                                    Some(other) => other.to_string(),
+                                                };
+                                                tracing::warn!(
+                                                    "steer rejected: {ACP_STEER_METHOD} returned \
+                                                     unrecognized outcome {reported} — releasing \
+                                                     withheld event for cancel+merge"
+                                                );
+                                                crate::pool::SteerAck::Err(
+                                                    crate::pool::SteerError::OutcomeRejected {
+                                                        outcome: reported,
+                                                    },
+                                                )
+                                            }
                                         }
-                                        crate::pool::SteerAck::Success
                                     };
                                     let _ = ack_tx.send(ack);
                                     continue;
@@ -1458,13 +1635,13 @@ impl AcpClient {
                             }
                             if *id == serde_json::json!(expected_id) {
                                 if let Some(error) = msg.get("error") {
-                                    if let Some((_, ack_tx)) = pending_steer.take() {
+                                    if let Some((_, _, ack_tx)) = pending_steer.take() {
                                         let _ = ack_tx
                                             .send(crate::pool::SteerAck::PromptCompletedNeutral);
                                     }
                                     return Err(agent_error_from_json(error));
                                 }
-                                if let Some((_, ack_tx)) = pending_steer.take() {
+                                if let Some((_, _, ack_tx)) = pending_steer.take() {
                                     let _ =
                                         ack_tx.send(crate::pool::SteerAck::PromptCompletedNeutral);
                                 }
@@ -1523,7 +1700,10 @@ impl AcpClient {
     /// Takes `&mut self` (not `&self`) because some updates carry agent state
     /// the client must observe — notably goose's `session_info_update` with
     /// `_meta.goose.activeRunId`, which seeds [`active_run_id`](Self::active_run_id)
-    /// so callers can target `_goose/unstable/session/steer` at the correct run.
+    /// so the steer arm can target `_goose/unstable/session/steer` at the
+    /// correct run. Agents that never emit it (claude-agent-acp, codex-acp)
+    /// leave it `None` and are steered via `_session/steering` instead, which
+    /// needs no run id.
     fn handle_session_update(&mut self, msg: &serde_json::Value) -> bool {
         let update = &msg["params"]["update"];
         let update_type = update
@@ -1654,6 +1834,11 @@ impl AcpClient {
                         session_id = %notif.session_id,
                         input = payload.accumulated_input_tokens,
                         output = payload.accumulated_output_tokens,
+                        // A subset of `input`, logged so downstream accounting can
+                        // price it at the provider's cached rate. Always emitted,
+                        // including as 0, so a parser can tell "no cache hits"
+                        // apart from "this build predates the field".
+                        cached = payload.accumulated_cached_input_tokens,
                         "goose usage update"
                     );
                     self.goose_usage.record(&notif.session_id, payload);
@@ -1788,22 +1973,44 @@ fn build_prompt_params(session_id: &str, prompt_blocks: &[&str]) -> serde_json::
 /// matches goose's *current* run (it advances on each `session/update`).
 /// See [`crate::pool::SteerRequest`] for why this is the read loop's job
 /// and not the main loop's.
-fn build_steer_params(
+fn build_goose_steer_params(
     session_id: &str,
     expected_run_id: &str,
     prompt_blocks: &[&str],
 ) -> serde_json::Value {
-    let blocks: Vec<serde_json::Value> = prompt_blocks
-        .iter()
-        .map(|text| serde_json::json!({ "type": "text", "text": text }))
-        .collect();
     serde_json::json!({
         "sessionId": session_id,
         "expectedRunId": expected_run_id,
-        "prompt": blocks,
+        "prompt": steer_prompt_blocks(prompt_blocks),
     })
 }
 
+/// Build the params for an [`ACP_STEER_METHOD`] request.
+///
+/// Wire shape:
+/// ```json
+/// { "sessionId": "...", "prompt": [{"type":"text","text":"..."}, ...] }
+/// ```
+///
+/// Deliberately carries **no** `expectedRunId`: the cross-adapter method
+/// steers whatever turn is currently running and neither claude-agent-acp nor
+/// codex-acp emits a run id to target.
+fn build_acp_steer_params(session_id: &str, prompt_blocks: &[&str]) -> serde_json::Value {
+    serde_json::json!({
+        "sessionId": session_id,
+        "prompt": steer_prompt_blocks(prompt_blocks),
+    })
+}
+
+/// Render steer body strings as ACP `text` content blocks. Shared by both
+/// steer transports so the prompt shape cannot drift between them.
+fn steer_prompt_blocks(prompt_blocks: &[&str]) -> Vec<serde_json::Value> {
+    prompt_blocks
+        .iter()
+        .map(|text| serde_json::json!({ "type": "text", "text": text }))
+        .collect()
+}
+
 /// Build a JSON-RPC permission response with `outcome: "selected"`.
 fn permission_response_selected(id: &serde_json::Value, option_id: &str) -> serde_json::Value {
     serde_json::json!({
@@ -1846,7 +2053,8 @@ pub enum ModelSwitchMethod {
 
 /// Extract `configOptions` entries with `category == "model"` from a `session/new` result.
 ///
-/// Returns the raw JSON array entries. Each entry has `configId`, `displayName`,
+/// Returns the raw JSON array entries. Each entry has `configId` (spelled `id`
+/// by some adapters, e.g. claude-agent-acp), `displayName`,
 /// `options: [{ value, displayName }]`, etc.
 pub fn extract_model_config_options(result: &serde_json::Value) -> Vec<serde_json::Value> {
     result["configOptions"]
@@ -1880,7 +2088,14 @@ pub fn resolve_model_switch_method(
     // 1. Search stable configOptions for a "model"-category entry whose
     //    options contain a value matching desired_model.
     for config_opt in extract_model_config_options(session_new_result) {
-        let config_id = match config_opt.get("configId").and_then(|v| v.as_str()) {
+        // Adapters disagree on the key: the ACP spec says `configId`, but
+        // claude-agent-acp emits `id`. Accept both; the set request always
+        // uses `configId` on the wire.
+        let config_id = match config_opt
+            .get("configId")
+            .or_else(|| config_opt.get("id"))
+            .and_then(|v| v.as_str())
+        {
             Some(id) => id,
             None => continue,
         };
@@ -2456,6 +2671,36 @@ mod tests {
         );
     }
 
+    #[test]
+    fn resolve_accepts_id_keyed_config_options() {
+        // claude-agent-acp (observed on v0.61.0) keys config options with
+        // `id` instead of the spec's `configId`. Payload mirrors its real
+        // `session/new` response.
+        let result = serde_json::json!({
+            "configOptions": [{
+                "id": "model",
+                "name": "Model",
+                "category": "model",
+                "type": "select",
+                "currentValue": "default",
+                "options": [
+                    { "value": "default", "name": "Default" },
+                    { "value": "opus[1m]", "name": "Opus" },
+                    { "value": "sonnet", "name": "Sonnet" }
+                ]
+            }],
+            "models": null
+        });
+        let method = super::resolve_model_switch_method(&result, "opus[1m]");
+        assert_eq!(
+            method,
+            Some(super::ModelSwitchMethod::ConfigOption {
+                config_id: "model".to_string(),
+                option_value: "opus[1m]".to_string(),
+            })
+        );
+    }
+
     #[test]
     fn resolve_falls_back_to_unstable() {
         let result = serde_json::json!({
@@ -2607,6 +2852,78 @@ mod tests {
             .expect("failed to spawn test script")
     }
 
+    /// Spawn a probe script whose file name carries a runtime identity (e.g.
+    /// `hermes-acp`) and return the value of `var` as the child observed it.
+    /// `<unset>` means the child did not receive the var.
+    #[cfg(unix)]
+    async fn spawn_named_and_read_child_env(
+        file_name: &str,
+        var: &str,
+        extra_env: &[(String, String)],
+    ) -> String {
+        use std::os::unix::fs::PermissionsExt;
+
+        let dir = std::env::temp_dir().join(format!("buzz-acp-env-probe-{}", uuid::Uuid::new_v4()));
+        std::fs::create_dir_all(&dir).expect("create env probe dir");
+        let path = dir.join(file_name);
+        std::fs::write(
+            &path,
+            format!("#!/bin/sh\nprintf '%s\\n' \"${{{var}:-<unset>}}\"\n"),
+        )
+        .expect("write env probe script");
+        let mut permissions = std::fs::metadata(&path).expect("stat probe").permissions();
+        permissions.set_mode(0o700);
+        std::fs::set_permissions(&path, permissions).expect("chmod probe");
+
+        let mut client = AcpClient::spawn(
+            path.to_str().expect("probe path is UTF-8"),
+            &[],
+            extra_env,
+            false,
+        )
+        .await
+        .expect("spawn env probe script");
+        let observed = client
+            .reader
+            .next()
+            .await
+            .unwrap_or_else(|| panic!("child produced no output for {var}"))
+            .expect("child stdout was not readable");
+        client.shutdown().await;
+        std::fs::remove_dir_all(&dir).expect("remove env probe dir");
+        observed
+    }
+
+    /// Buzz-owned Hermes processes get the configured-MCP isolation default,
+    /// and an explicit persona entry still overrides it (defaults are applied
+    /// before `extra_env`, so the later `Command::env` write wins).
+    #[cfg(unix)]
+    #[tokio::test]
+    async fn spawn_applies_runtime_env_defaults_with_extra_env_precedence() {
+        const VAR: &str = "HERMES_ACP_SKIP_CONFIGURED_MCP";
+        if std::env::var_os(VAR).is_some() {
+            // Inherited parent values win over both layers; the default and
+            // override behavior below is unobservable in such an environment.
+            return;
+        }
+
+        assert_eq!(
+            spawn_named_and_read_child_env("hermes-acp", VAR, &[]).await,
+            "1",
+            "Hermes spawns must default {VAR}=1"
+        );
+        assert_eq!(
+            spawn_named_and_read_child_env("hermes-acp", VAR, &[(VAR.into(), "0".into())]).await,
+            "0",
+            "an explicit extra_env entry must override the runtime default"
+        );
+        assert_eq!(
+            spawn_named_and_read_child_env("other-agent", VAR, &[]).await,
+            "<unset>",
+            "non-Hermes spawns must not receive Hermes defaults"
+        );
+    }
+
     #[tokio::test]
     async fn idle_timeout_fires_on_silent_process() {
         let mut client = spawn_script("sleep 10").await;
@@ -2954,7 +3271,7 @@ mod tests {
             .expect("initialize should succeed");
 
         let resp = client
-            .session_new_full("/tmp", vec![], Some("Custom system prompt"))
+            .session_new_full("/tmp", vec![], Some("Custom system prompt"), None)
             .await
             .expect("session_new_full should succeed");
 
@@ -3039,7 +3356,7 @@ mod tests {
             .expect("initialize should succeed");
 
         let resp = client
-            .session_new_full("/tmp", vec![], None)
+            .session_new_full("/tmp", vec![], None, None)
             .await
             .expect("session_new_full should succeed");
 
@@ -3051,6 +3368,61 @@ mod tests {
         );
     }
 
+    #[tokio::test]
+    async fn session_new_full_sends_session_title_in_meta_when_some() {
+        let script = r#"
+            read -t 2 _init
+            echo '{"jsonrpc":"2.0","id":0,"result":{"protocolVersion":1,"agentCapabilities":{}}}'
+            read -t 2 REQ
+            echo '{"jsonrpc":"2.0","id":1,"result":{"sessionId":"ses_test","_receivedRequest":'"$REQ"'}}'
+            sleep 1
+        "#;
+        let mut client = spawn_script(script).await;
+        client
+            .initialize()
+            .await
+            .expect("initialize should succeed");
+
+        let resp = client
+            .session_new_full("/tmp", vec![], None, Some("Fizz · #buzz-dev"))
+            .await
+            .expect("session_new_full should succeed");
+
+        let received = &resp.raw["_receivedRequest"];
+        assert_eq!(
+            received["params"]["_meta"]["sessionTitle"].as_str(),
+            Some("Fizz · #buzz-dev"),
+            "title should ride in _meta.sessionTitle, out of band from the prompt"
+        );
+    }
+
+    #[tokio::test]
+    async fn session_new_full_omits_meta_when_session_title_none() {
+        let script = r#"
+            read -t 2 _init
+            echo '{"jsonrpc":"2.0","id":0,"result":{"protocolVersion":1,"agentCapabilities":{}}}'
+            read -t 2 REQ
+            echo '{"jsonrpc":"2.0","id":1,"result":{"sessionId":"ses_test","_receivedRequest":'"$REQ"'}}'
+            sleep 1
+        "#;
+        let mut client = spawn_script(script).await;
+        client
+            .initialize()
+            .await
+            .expect("initialize should succeed");
+
+        let resp = client
+            .session_new_full("/tmp", vec![], None, None)
+            .await
+            .expect("session_new_full should succeed");
+
+        let received = &resp.raw["_receivedRequest"];
+        assert!(
+            received["params"].get("_meta").is_none(),
+            "_meta should be absent entirely, not an empty object or null"
+        );
+    }
+
     // ── Goose-native steer scaffold (PR follow-up to #1160) ──────────────
 
     /// Helper: spawn an inert `cat` subprocess so we have a real AcpClient
@@ -3364,6 +3736,412 @@ mod tests {
         }
     }
 
+    // ── Cross-harness steer transport tests ───────────────────────────────
+    //
+    // These cover the `_session/steering` transport added alongside the
+    // goose-native method: capability capture at `initialize`, write-time
+    // transport selection, and outcome decoding. Wire-shape assertions read
+    // the actual serialized request bytes via `capture_steer_request` rather
+    // than inferring the shape from response-id routing.
+
+    /// Spawn a client whose script captures the first line written to its
+    /// stdin into `capture_path`, then emits `response` (already-serialized
+    /// JSON-RPC) and idles.
+    ///
+    /// The steer request is the first thing this read loop writes, so the
+    /// captured line IS the steer request bytes.
+    async fn spawn_steer_capture_script(
+        capture_path: &std::path::Path,
+        response: &str,
+    ) -> AcpClient {
+        let script = format!(
+            "read -r line; printf '%s' \"$line\" > {capture}; \
+             printf '%s\\n' '{response}'; sleep 10",
+            capture = capture_path.display(),
+            response = response,
+        );
+        spawn_script(&script).await
+    }
+
+    /// Drive one steer through the read loop and return
+    /// `(captured_request_bytes, ack)`.
+    ///
+    /// `capture_path` may be absent afterwards when the arm wrote nothing —
+    /// callers assert on that. The read loop is expected to exit via a
+    /// timeout or EOF; the ack is what these tests care about.
+    async fn run_one_steer(
+        client: &mut AcpClient,
+        capture_path: &std::path::Path,
+    ) -> (Option<String>, crate::pool::SteerAck) {
+        let (steer_tx, steer_rx) = tokio::sync::mpsc::channel::<crate::pool::SteerRequest>(1);
+        client.install_steer_rx(steer_rx);
+
+        let (ack_tx, ack_rx) = tokio::sync::oneshot::channel::<crate::pool::SteerAck>();
+        let send_task = tokio::spawn(async move {
+            steer_tx
+                .send(crate::pool::SteerRequest {
+                    prompt_blocks: vec!["steer body".into()],
+                    ack_tx,
+                })
+                .await
+                .expect("steer_tx send should succeed");
+        });
+
+        let idle = std::time::Duration::from_millis(800);
+        let max_dur = std::time::Duration::from_secs(10);
+        let hard_deadline = tokio::time::Instant::now() + max_dur;
+        let _ = client
+            .read_until_response_with_idle_timeout("sess-test", 999, idle, hard_deadline, max_dur)
+            .await;
+        send_task.await.expect("send_task should complete");
+
+        let ack = ack_rx
+            .await
+            .expect("ack oneshot must have received a SteerAck");
+        (std::fs::read_to_string(capture_path).ok(), ack)
+    }
+
+    /// Unique temp path for one test's captured request bytes.
+    fn capture_path(name: &str) -> std::path::PathBuf {
+        let dir = std::env::temp_dir().join("buzz-acp-steer-capture");
+        std::fs::create_dir_all(&dir).expect("create capture dir");
+        let path = dir.join(format!("{name}.json"));
+        let _ = std::fs::remove_file(&path);
+        path
+    }
+
+    /// Mark a client as having advertised `_meta.steering.supported` without
+    /// running a real `initialize` handshake. The capability-parsing tests
+    /// cover the handshake itself.
+    fn set_steering_supported(client: &mut AcpClient) {
+        client.steering_supported = true;
+    }
+
+    /// Run `initialize` against a script that replies with `init_result` as
+    /// the JSON-RPC result, and return the resulting `steering_supported`.
+    async fn steering_supported_after_initialize(init_result: &str) -> bool {
+        let script = format!(
+            "read -r _init; printf '%s\\n' '{{\"jsonrpc\":\"2.0\",\"id\":0,\"result\":{result}}}'; \
+             sleep 5",
+            result = init_result,
+        );
+        let mut client = spawn_script(&script).await;
+        client
+            .initialize()
+            .await
+            .expect("initialize should succeed");
+        client.steering_supported()
+    }
+
+    /// Test 1a: an adapter advertising `_meta.steering.supported: true`
+    /// (claude-agent-acp `src/acp-agent.ts:1444`, codex-acp
+    /// `src/CodexAcpServer.ts:247`) is recorded as steering-capable.
+    #[tokio::test]
+    async fn initialize_records_steering_supported_when_advertised() {
+        let supported = steering_supported_after_initialize(
+            r#"{"protocolVersion":2,"agentCapabilities":{},"_meta":{"steering":{"supported":true}}}"#,
+        )
+        .await;
+        assert!(
+            supported,
+            "_meta.steering.supported: true must set steering_supported"
+        );
+    }
+
+    /// Test 1b: no `_meta` at all (goose, buzz-agent, any older adapter) must
+    /// leave the capability off — this is what keeps a steer off the wire for
+    /// agents that never implemented it.
+    #[tokio::test]
+    async fn initialize_leaves_steering_unsupported_when_meta_absent() {
+        let supported =
+            steering_supported_after_initialize(r#"{"protocolVersion":2,"agentCapabilities":{}}"#)
+                .await;
+        assert!(
+            !supported,
+            "absent _meta must leave steering_supported false"
+        );
+    }
+
+    /// Test 1c: an explicit `supported: false` is respected, not treated as
+    /// "the key exists so it must work".
+    #[tokio::test]
+    async fn initialize_leaves_steering_unsupported_when_explicitly_false() {
+        let supported = steering_supported_after_initialize(
+            r#"{"protocolVersion":2,"_meta":{"steering":{"supported":false}}}"#,
+        )
+        .await;
+        assert!(
+            !supported,
+            "_meta.steering.supported: false must leave steering_supported false"
+        );
+    }
+
+    /// Test 2: no `active_run_id` + capability advertised → the bytes on the
+    /// wire are an `_session/steering` request carrying `sessionId` and
+    /// `prompt`, and carrying **no** `expectedRunId` (the adapters reject
+    /// unknown required fields, and there is no run id to report anyway).
+    #[tokio::test]
+    async fn acp_steer_request_omits_expected_run_id_and_carries_session_and_prompt() {
+        let capture = capture_path("acp_shape");
+        let mut client = spawn_steer_capture_script(
+            &capture,
+            r#"{"jsonrpc":"2.0","id":0,"result":{"outcome":"injected"}}"#,
+        )
+        .await;
+        set_steering_supported(&mut client);
+        assert!(
+            client.active_run_id().is_none(),
+            "precondition: no active_run_id"
+        );
+
+        let (written, ack) = run_one_steer(&mut client, &capture).await;
+
+        let written = written.expect("steer request must have been written");
+        let msg: serde_json::Value =
+            serde_json::from_str(&written).expect("written line must be valid JSON");
+        assert_eq!(
+            msg["method"].as_str(),
+            Some(ACP_STEER_METHOD),
+            "must use the cross-adapter steer method; wrote: {written}"
+        );
+        assert_eq!(msg["params"]["sessionId"].as_str(), Some("sess-test"));
+        assert_eq!(
+            msg["params"]["prompt"][0]["text"].as_str(),
+            Some("steer body"),
+            "prompt must carry the steer body as a text block"
+        );
+        assert!(
+            msg["params"].get("expectedRunId").is_none(),
+            "_session/steering must not carry expectedRunId; wrote: {written}"
+        );
+        assert!(
+            matches!(ack, crate::pool::SteerAck::Success),
+            "injected outcome must ack Success, got {ack:?}"
+        );
+    }
+
+    /// Test 3: goose keeps priority. With both an `active_run_id` and the
+    /// advertised capability, the goose method wins — `expectedRunId` is
+    /// strictly more precise about which run is being steered.
+    #[tokio::test]
+    async fn goose_transport_wins_when_both_run_id_and_capability_present() {
+        let capture = capture_path("goose_priority");
+        let mut client =
+            spawn_steer_capture_script(&capture, r#"{"jsonrpc":"2.0","id":0,"result":{}}"#).await;
+        set_steering_supported(&mut client);
+        let update = session_info_update_msg(Some(serde_json::json!("run-77")));
+        let _ = client.handle_session_update(&update);
+
+        let (written, ack) = run_one_steer(&mut client, &capture).await;
+
+        let written = written.expect("steer request must have been written");
+        let msg: serde_json::Value =
+            serde_json::from_str(&written).expect("written line must be valid JSON");
+        assert_eq!(
+            msg["method"].as_str(),
+            Some(GOOSE_STEER_METHOD),
+            "goose method must win when a run id exists; wrote: {written}"
+        );
+        assert_eq!(msg["params"]["expectedRunId"].as_str(), Some("run-77"));
+        // A bare `{}` result is a success on the goose transport (goose sends
+        // no `outcome`) — the OutcomeRejected guard applies only to
+        // `_session/steering`.
+        assert!(
+            matches!(ack, crate::pool::SteerAck::Success),
+            "goose success result must ack Success, got {ack:?}"
+        );
+    }
+
+    /// Test 7: codex-acp's third outcome, `failed`
+    /// (`src/AcpExtensions.ts:92`), is a delivery rejection despite being a
+    /// JSON-RPC success — release the event and fall back.
+    #[tokio::test]
+    async fn acp_steer_failed_outcome_acks_outcome_rejected() {
+        let capture = capture_path("outcome_failed");
+        let mut client = spawn_steer_capture_script(
+            &capture,
+            r#"{"jsonrpc":"2.0","id":0,"result":{"outcome":"failed"}}"#,
+        )
+        .await;
+        set_steering_supported(&mut client);
+
+        let (_written, ack) = run_one_steer(&mut client, &capture).await;
+
+        match ack {
+            crate::pool::SteerAck::Err(crate::pool::SteerError::OutcomeRejected { outcome }) => {
+                assert_eq!(
+                    outcome, "failed",
+                    "rejected outcome must report what the agent said, unquoted"
+                );
+            }
+            other => panic!("expected Err(OutcomeRejected), got {other:?}"),
+        }
+    }
+
+    /// Test 8: **codex `extMethod` silent-loss regression guard.** codex-acp's
+    /// ext dispatcher answers unrecognized methods with a bare `{}` — a
+    /// JSON-RPC *success*, not `-32601` (`src/CodexAcpServer.ts:255-258`).
+    /// Buzz maps `SteerAck::Success` to `queue.remove_event`, so decoding
+    /// `{}` as success would delete the user's message with no error, no
+    /// fallback, and no log. An absent `outcome` must therefore be a
+    /// rejection, which releases the event and fires cancel+merge.
+    #[tokio::test]
+    async fn acp_steer_missing_outcome_acks_outcome_rejected_and_never_drops_event() {
+        let capture = capture_path("outcome_absent");
+        let mut client =
+            spawn_steer_capture_script(&capture, r#"{"jsonrpc":"2.0","id":0,"result":{}}"#).await;
+        set_steering_supported(&mut client);
+
+        let (_written, ack) = run_one_steer(&mut client, &capture).await;
+
+        match ack {
+            crate::pool::SteerAck::Err(crate::pool::SteerError::OutcomeRejected { outcome }) => {
+                assert_eq!(
+                    outcome, "<absent>",
+                    "a result with no outcome field must be reported as absent"
+                );
+            }
+            other => panic!(
+                "expected Err(OutcomeRejected) for a bare {{}} success — \
+                 anything else risks dropping the event, got {other:?}"
+            ),
+        }
+    }
+
+    /// Test 5: `injected` renews the hard deadline, so the turn survives past
+    /// its original one. Mirrors
+    /// `steer_success_renews_hard_deadline_and_survives_past_original` for
+    /// the `_session/steering` transport.
+    ///
+    /// Timeline: original hard deadline at t≈1s; steer response at t≈0.5s
+    /// renews it to t≈3.5s; prompt response at t≈1.5s lands inside it.
+    #[tokio::test]
+    async fn acp_steer_injected_renews_hard_deadline_and_survives_past_original() {
+        let script = "sleep 0.5; \
+                      echo '{\"jsonrpc\":\"2.0\",\"id\":0,\"result\":{\"outcome\":\"injected\"}}'; \
+                      sleep 1; \
+                      echo '{\"jsonrpc\":\"2.0\",\"id\":999,\"result\":{\"done\":true}}'";
+        let mut client = spawn_script(script).await;
+        set_steering_supported(&mut client);
+
+        let (steer_tx, steer_rx) = tokio::sync::mpsc::channel::<crate::pool::SteerRequest>(1);
+        client.install_steer_rx(steer_rx);
+        let (ack_tx, ack_rx) = tokio::sync::oneshot::channel::<crate::pool::SteerAck>();
+        let send_task = tokio::spawn(async move {
+            steer_tx
+                .send(crate::pool::SteerRequest {
+                    prompt_blocks: vec!["steer body".into()],
+                    ack_tx,
+                })
+                .await
+                .expect("steer_tx send should succeed");
+        });
+
+        let idle = std::time::Duration::from_secs(10);
+        let max_dur = std::time::Duration::from_secs(3);
+        let hard_deadline = tokio::time::Instant::now() + std::time::Duration::from_secs(1);
+        let result = client
+            .read_until_response_with_idle_timeout("sess-test", 999, idle, hard_deadline, max_dur)
+            .await;
+        send_task.await.expect("send_task should complete");
+
+        assert!(
+            result.is_ok(),
+            "injected must renew the deadline so the prompt response still lands, got {result:?}"
+        );
+        assert_eq!(result.unwrap()["done"], serde_json::json!(true));
+        let ack = ack_rx.await.expect("ack must be received");
+        assert!(
+            matches!(ack, crate::pool::SteerAck::Success),
+            "injected must ack Success, got {ack:?}"
+        );
+    }
+
+    /// Test 6: **red/green for the no-renewal rule.** `startedNewTurn` means
+    /// the turn Buzz was steering had already ended and the adapter began a
+    /// fresh, detached one. It acks `Success` (the message WAS delivered, so
+    /// the event must not be redelivered) but must NOT renew the hard
+    /// deadline — that clock belongs to a turn which is already settled.
+    ///
+    /// Same timeline as the `injected` test, so the only difference is the
+    /// outcome string: original hard deadline at t≈1s, steer response at
+    /// t≈0.5s, prompt response at t≈1.5s. With renewal the prompt response
+    /// would land and this returns `Ok`; without renewal the original
+    /// deadline fires first and we get `HardTimeout`.
+    #[tokio::test]
+    async fn acp_steer_started_new_turn_acks_success_without_renewing_hard_deadline() {
+        let script = "sleep 0.5; \
+             echo '{\"jsonrpc\":\"2.0\",\"id\":0,\"result\":{\"outcome\":\"startedNewTurn\"}}'; \
+             sleep 1; \
+             echo '{\"jsonrpc\":\"2.0\",\"id\":999,\"result\":{\"done\":true}}'";
+        let mut client = spawn_script(script).await;
+        set_steering_supported(&mut client);
+
+        let (steer_tx, steer_rx) = tokio::sync::mpsc::channel::<crate::pool::SteerRequest>(1);
+        client.install_steer_rx(steer_rx);
+        let (ack_tx, ack_rx) = tokio::sync::oneshot::channel::<crate::pool::SteerAck>();
+        let send_task = tokio::spawn(async move {
+            steer_tx
+                .send(crate::pool::SteerRequest {
+                    prompt_blocks: vec!["steer body".into()],
+                    ack_tx,
+                })
+                .await
+                .expect("steer_tx send should succeed");
+        });
+
+        let idle = std::time::Duration::from_secs(10);
+        let max_dur = std::time::Duration::from_secs(3);
+        let hard_deadline = tokio::time::Instant::now() + std::time::Duration::from_secs(1);
+        let result = client
+            .read_until_response_with_idle_timeout("sess-test", 999, idle, hard_deadline, max_dur)
+            .await;
+        send_task.await.expect("send_task should complete");
+
+        // The original deadline must still fire — renewal here would extend
+        // the clock on a turn the adapter has already finished.
+        assert!(
+            matches!(result, Err(AcpError::HardTimeout { .. })),
+            "startedNewTurn must NOT renew the hard deadline, so the original \
+             one must still fire; got {result:?}"
+        );
+        // Delivery still succeeded, so the withheld event must be dropped
+        // rather than released — hence Success, not an Err.
+        let ack = ack_rx.await.expect("ack must be received");
+        assert!(
+            matches!(ack, crate::pool::SteerAck::Success),
+            "startedNewTurn is a delivery success, got {ack:?}"
+        );
+    }
+
+    /// Test 4 (companion to the existing
+    /// `native_steer_with_no_active_run_id_acks_expected_run_id_missing`):
+    /// no run id AND no advertised capability means nothing is written at
+    /// all. This is the gate that keeps a steer off the wire for adapters
+    /// that never implemented either method.
+    #[tokio::test]
+    async fn steer_writes_nothing_when_no_run_id_and_capability_absent() {
+        let capture = capture_path("no_transport");
+        let mut client =
+            spawn_steer_capture_script(&capture, r#"{"jsonrpc":"2.0","id":0,"result":{}}"#).await;
+        assert!(!client.steering_supported(), "precondition: not advertised");
+        assert!(
+            client.active_run_id().is_none(),
+            "precondition: no active_run_id"
+        );
+
+        let (written, ack) = run_one_steer(&mut client, &capture).await;
+
+        assert!(
+            written.is_none(),
+            "no transport available must write nothing; wrote: {written:?}"
+        );
+        match ack {
+            crate::pool::SteerAck::Err(crate::pool::SteerError::ExpectedRunIdMissing) => {}
+            other => panic!("expected Err(ExpectedRunIdMissing), got {other:?}"),
+        }
+    }
+
     // ── Goose usage notification integration ──────────────────────────────
 
     /// Build a `_goose/unstable/session/update` JSON-RPC notification.
diff --git a/crates/buzz-acp/src/config.rs b/crates/buzz-acp/src/config.rs
index a38d6faa14b..dab61be30a0 100644
--- a/crates/buzz-acp/src/config.rs
+++ b/crates/buzz-acp/src/config.rs
@@ -240,7 +240,7 @@ pub struct CliArgs {
     #[arg(long, env = "BUZZ_RELAY_URL", default_value = "ws://localhost:3000")]
     pub relay_url: String,
 
-    #[arg(long, env = "BUZZ_PRIVATE_KEY")]
+    #[arg(long, env = "BUZZ_PRIVATE_KEY", hide_env_values = true)]
     pub private_key: String,
 
     /// Agent owner pubkey (64-char hex). Used for --respond-to=owner-only gate.
@@ -423,6 +423,12 @@ pub struct CliArgs {
     #[arg(long, env = "BUZZ_ACP_MODEL")]
     pub model: Option<String>,
 
+    /// Title for the agent's ACP sessions, passed out-of-band in `session/new`
+    /// `_meta`. Adapters that recognize it name the session after this value;
+    /// others ignore it. Never enters the prompt.
+    #[arg(long, env = "BUZZ_ACP_SESSION_TITLE")]
+    pub session_title: Option<String>,
+
     /// Permission mode for agents that support `session/set_config_option`
     /// with `configId: "mode"` (e.g. `claude-agent-acp`).
     ///
@@ -522,6 +528,9 @@ pub struct Config {
     pub memory_enabled: bool,
     /// Desired LLM model ID. Applied after every `session_new_full()`.
     pub model: Option<String>,
+    /// Sanitized session title, sent as `_meta.sessionTitle` on `session/new`.
+    /// `None` when unset or when the configured value sanitized to empty.
+    pub session_title: Option<String>,
     /// Permission mode to apply after session creation. `Default` = skip.
     pub permission_mode: PermissionMode,
     /// Inbound author gate mode.
@@ -554,6 +563,68 @@ pub struct Config {
     pub base_prompt_content: Option<String>,
 }
 
+/// Maximum length, in characters, of a session title sent to the adapter.
+const SESSION_TITLE_MAX_CHARS: usize = 80;
+
+/// Normalize a configured session title into something safe to hand an adapter.
+///
+/// Control characters are dropped, runs of whitespace collapse to a single
+/// space, and the result is trimmed and capped at
+/// [`SESSION_TITLE_MAX_CHARS`]. Returns `None` when nothing printable is left.
+///
+/// Buzz is the only guard here: Codex's own `normalize_thread_name` merely
+/// trims, so an unbounded display name would be persisted verbatim into its
+/// thread store.
+fn sanitize_session_title(raw: &str) -> Option<String> {
+    let collapsed = raw
+        .split_whitespace()
+        .map(|word| word.chars().filter(|c| !c.is_control()).collect::<String>())
+        .filter(|word| !word.is_empty())
+        .collect::<Vec<_>>()
+        .join(" ");
+    // Truncate by chars, not bytes, so a multi-byte name can't be cut mid-UTF-8.
+    let title: String = collapsed
+        .chars()
+        .take(SESSION_TITLE_MAX_CHARS)
+        .collect::<String>()
+        .trim_end()
+        .to_string();
+    if title.is_empty() {
+        None
+    } else {
+        Some(title)
+    }
+}
+
+/// Separator between the agent name and the channel in a composed title.
+/// U+00B7 MIDDLE DOT, spaces on both sides.
+const SESSION_TITLE_SEPARATOR: &str = " · ";
+
+/// Compose a per-session title as `Agent · #channel`.
+///
+/// One agent in five channels gets five sessions; a bare agent name would show
+/// five identical rows in the adapter's thread list. Only the channel part is
+/// truncated to fit [`SESSION_TITLE_MAX_CHARS`], so the agent name always
+/// survives. Returns the bare agent name when there is no channel, the channel
+/// name is blank, or no room is left for it.
+pub(crate) fn compose_session_title(agent: &str, channel_name: Option<&str>) -> String {
+    let Some(channel) = channel_name.and_then(sanitize_session_title) else {
+        return agent.to_string();
+    };
+    // Reserve the separator and the `#` sigil alongside the agent name.
+    let reserved = agent.chars().count() + SESSION_TITLE_SEPARATOR.chars().count() + 1;
+    let channel: String = channel
+        .chars()
+        .take(SESSION_TITLE_MAX_CHARS.saturating_sub(reserved))
+        .collect::<String>()
+        .trim_end()
+        .to_string();
+    if channel.is_empty() {
+        return agent.to_string();
+    }
+    format!("{agent}{SESSION_TITLE_SEPARATOR}#{channel}")
+}
+
 /// Validate and deduplicate allowlist entries: each must be exactly 64 hex chars.
 fn validate_allowlist(entries: &[String]) -> Result<HashSet<String>, ConfigError> {
     let mut validated = HashSet::new();
@@ -605,7 +676,12 @@ pub(crate) fn normalize_agent_command_identity(command: &str) -> String {
         .next()
         .expect("rsplit always yields at least one element");
     let lower = basename.to_ascii_lowercase();
-    let stem = lower.strip_suffix(".exe").unwrap_or(&lower);
+    // Windows resolves commands through `.exe` binaries and npm's `.cmd`/`.bat`
+    // shims; all three name the same runtime identity.
+    let stem = [".exe", ".cmd", ".bat"]
+        .iter()
+        .find_map(|extension| lower.strip_suffix(extension))
+        .unwrap_or(&lower);
     stem.chars()
         .map(|character| match character {
             ' ' | '_' => '-',
@@ -623,6 +699,25 @@ fn default_agent_args(command: &str) -> Option<Vec<String>> {
     }
 }
 
+/// Per-runtime environment defaults applied when Buzz owns the agent process.
+///
+/// Mirrors [`default_agent_args`]: keyed on the normalized command identity,
+/// with the merge (in `AcpClient::spawn`) giving explicit persona env and
+/// inherited parent env precedence over these defaults.
+///
+/// Hermes: ACP hosts supply session MCP servers explicitly through
+/// `session/new`, but Hermes otherwise starts every profile-configured MCP
+/// server before it responds to `initialize` — which can exhaust the host's
+/// startup budget (see block/buzz#3355). Skip that unrelated global startup
+/// by default; an operator or persona can still opt back in by setting the
+/// variable explicitly.
+pub(crate) fn default_agent_env(command: &str) -> &'static [(&'static str, &'static str)] {
+    match normalize_agent_command_identity(command).as_str() {
+        "hermes" | "hermes-agent" | "hermes-acp" => &[("HERMES_ACP_SKIP_CONFIGURED_MCP", "1")],
+        _ => &[],
+    }
+}
+
 /// Build the `CODEX_CONFIG` environment variable that enables full outbound
 /// network access in Codex's macOS Seatbelt sandbox.
 ///
@@ -992,6 +1087,10 @@ impl Config {
             typing_enabled: !args.no_typing,
             memory_enabled: args.memory && !args.no_memory,
             model,
+            session_title: args
+                .session_title
+                .as_deref()
+                .and_then(sanitize_session_title),
             permission_mode: args.permission_mode,
             respond_to: args.respond_to,
             respond_to_allowlist,
@@ -1361,6 +1460,7 @@ mod tests {
             typing_enabled: true,
             memory_enabled: true,
             model: None,
+            session_title: None,
             permission_mode: PermissionMode::BypassPermissions,
             respond_to: RespondTo::Anyone,
             respond_to_allowlist: HashSet::new(),
@@ -1513,6 +1613,15 @@ mod tests {
             "claude-code"
         );
         assert_eq!(normalize_agent_command_identity("Goose.EXE"), "goose");
+        // Windows npm shims resolve to `.cmd`/`.bat` wrappers.
+        assert_eq!(
+            normalize_agent_command_identity(r"C:\Users\test\AppData\Roaming\npm\hermes-acp.cmd"),
+            "hermes-acp"
+        );
+        assert_eq!(
+            normalize_agent_command_identity(r"C:\Tools\Hermes\HERMES-AGENT.BAT"),
+            "hermes-agent"
+        );
         // Non-ASCII must not panic.
         assert_eq!(normalize_agent_command_identity("my-agënt"), "my-agënt");
         // Edge cases: empty, whitespace-only, bare separators.
@@ -1522,6 +1631,30 @@ mod tests {
         assert_eq!(normalize_agent_command_identity("///"), "");
     }
 
+    #[test]
+    fn default_agent_env_recognizes_hermes_identities() {
+        for command in [
+            "hermes",
+            "hermes-agent",
+            "hermes-acp",
+            "/opt/hermes/bin/hermes-acp",
+            r"C:\Users\test\bin\HERMES_ACP.EXE",
+            r"C:\Users\test\AppData\Roaming\npm\hermes-acp.cmd",
+        ] {
+            assert_eq!(
+                default_agent_env(command),
+                &[("HERMES_ACP_SKIP_CONFIGURED_MCP", "1")],
+                "unexpected env defaults for {command}"
+            );
+        }
+        for command in ["goose", "codex-acp", "claude-agent-acp", "buzz-agent", ""] {
+            assert!(
+                default_agent_env(command).is_empty(),
+                "non-Hermes command must have no env defaults: {command}"
+            );
+        }
+    }
+
     #[test]
     fn strips_legacy_acp_arg_case_insensitively() {
         assert_eq!(
@@ -2706,4 +2839,93 @@ channels = "ALL"
             assert!(MAX_TURN_DURATION_CEILING_SECS < u64::MAX - 100);
         }
     }
+
+    #[test]
+    fn sanitize_session_title_collapses_whitespace_and_strips_control_chars() {
+        assert_eq!(
+            sanitize_session_title("  Fizz\t\tthe\n Bot\u{7}  "),
+            Some("Fizz the Bot".to_string())
+        );
+    }
+
+    #[test]
+    fn sanitize_session_title_returns_none_when_nothing_printable_remains() {
+        assert_eq!(sanitize_session_title("   \n\t "), None);
+        assert_eq!(sanitize_session_title(""), None);
+        assert_eq!(sanitize_session_title("\u{1}\u{2}"), None);
+    }
+
+    #[test]
+    fn sanitize_session_title_caps_length_without_splitting_multibyte_chars() {
+        let raw = "\u{1f41d}".repeat(SESSION_TITLE_MAX_CHARS + 10);
+        let title = sanitize_session_title(&raw).expect("emoji title survives sanitizing");
+        assert_eq!(title.chars().count(), SESSION_TITLE_MAX_CHARS);
+        assert!(title.chars().all(|c| c == '\u{1f41d}'));
+    }
+
+    #[test]
+    fn sanitize_session_title_does_not_leave_a_trailing_space_after_the_cap() {
+        // The cap lands mid-word, so trimming must not leave a dangling space.
+        let raw = format!("{} tail", "a".repeat(SESSION_TITLE_MAX_CHARS - 1));
+        let title = sanitize_session_title(&raw).expect("title survives sanitizing");
+        assert_eq!(title, "a".repeat(SESSION_TITLE_MAX_CHARS - 1));
+    }
+
+    #[test]
+    fn compose_session_title_qualifies_the_agent_name_with_the_channel() {
+        assert_eq!(
+            compose_session_title("Fizz", Some("buzz-dev")),
+            "Fizz · #buzz-dev"
+        );
+    }
+
+    #[test]
+    fn compose_session_title_falls_back_to_bare_agent_name_without_a_channel() {
+        assert_eq!(compose_session_title("Fizz", None), "Fizz");
+        assert_eq!(compose_session_title("Fizz", Some("   ")), "Fizz");
+    }
+
+    #[test]
+    fn compose_session_title_truncates_the_channel_and_keeps_the_agent_name() {
+        let channel = "c".repeat(200);
+        let title = compose_session_title("Fizz", Some(&channel));
+        assert_eq!(title.chars().count(), SESSION_TITLE_MAX_CHARS);
+        assert!(title.starts_with("Fizz · #c"));
+    }
+
+    #[test]
+    fn compose_session_title_drops_the_channel_when_the_agent_name_fills_the_cap() {
+        let agent = "a".repeat(SESSION_TITLE_MAX_CHARS);
+        assert_eq!(compose_session_title(&agent, Some("buzz-dev")), agent);
+    }
+
+    /// Every arg whose env var name contains KEY/SECRET/TOKEN/PASSWORD/CRED/AUTH
+    /// must set `hide_env_values = true` to prevent credential leakage in --help.
+    #[test]
+    fn secret_env_args_hide_their_values_in_help() {
+        use clap::CommandFactory;
+
+        const SECRET_PATTERNS: &[&str] = &["KEY", "SECRET", "TOKEN", "PASSWORD", "CRED", "AUTH"];
+
+        let cmd = CliArgs::command();
+        let violations: Vec<String> = cmd
+            .get_arguments()
+            .filter_map(|arg| {
+                let env_key = arg.get_env()?;
+                let env_name = env_key.to_string_lossy().to_uppercase();
+                let is_secret = SECRET_PATTERNS.iter().any(|pat| env_name.contains(pat));
+                if is_secret && !arg.is_hide_env_values_set() {
+                    Some(env_name)
+                } else {
+                    None
+                }
+            })
+            .collect();
+
+        assert!(
+            violations.is_empty(),
+            "Found secret-bearing env args without hide_env_values=true. \
+             Add `hide_env_values = true` to each: {violations:?}"
+        );
+    }
 }
diff --git a/crates/buzz-acp/src/lib.rs b/crates/buzz-acp/src/lib.rs
index 0230ea0875f..d63f720c651 100644
--- a/crates/buzz-acp/src/lib.rs
+++ b/crates/buzz-acp/src/lib.rs
@@ -1140,9 +1140,7 @@ fn any_respawn_in_flight(crash_history: &[SlotCircuit]) -> bool {
 /// Result of a background respawn task.
 struct RespawnResult {
     index: usize,
-    /// Tuple: (initialized client, protocol version, supports_goose_steer).
-    /// The third element is always `true` — the supervisor uses
-    /// try-and-tolerate for the steer extension.
+    /// Tuple: (initialized client, protocol version, agent name).
     result: Result<(AcpClient, u32, String)>,
 }
 
@@ -1535,6 +1533,7 @@ async fn tokio_main() -> Result<()> {
         turn_liveness_interval: Duration::from_secs(config.turn_liveness_secs),
         dedup_mode: config.dedup_mode,
         system_prompt: config.system_prompt.clone(),
+        session_title: config.session_title.clone(),
         team_instructions: config.team_instructions.clone(),
         base_prompt: if config.no_base_prompt {
             None
@@ -2227,18 +2226,18 @@ async fn tokio_main() -> Result<()> {
                                     owner_cache.get(),
                                 );
                                 if let Some(signal) = signal {
-                                    // Try-and-tolerate fork: when the mode
-                                    // wants a Steer, attempt the non-cancelling
-                                    // path first for any agent. On accept,
+                                    // Non-cancelling fork: when the mode
+                                    // wants a Steer, attempt the
+                                    // non-cancelling path first. On accept,
                                     // withhold the queued event and spawn an
                                     // ack watcher; the main loop's
                                     // `PoolEvent::SteerAck` arm decides
                                     // success/release/fallback. On reject
-                                    // (including `-32601 method_not_found`
-                                    // from agents that don't implement the
-                                    // extension), fall through to the universal
-                                    // cancel+merge `Steer` signal so the event
-                                    // still reaches the agent.
+                                    // (including agents that advertise no
+                                    // steer transport at all), fall through
+                                    // to the universal cancel+merge `Steer`
+                                    // signal so the event still reaches the
+                                    // agent.
                                     let native_attempted = matches!(signal, ControlSignal::Steer)
                                         && try_native_steer(
                                             &mut pool,
@@ -2418,14 +2417,26 @@ async fn tokio_main() -> Result<()> {
                 event_id,
                 ack,
             })) => {
-                // Goose-native steer attempt resolved. Locked semantics
-                // (Eva + Max + Perci, unanimous on Option X):
+                // Mid-turn steer attempt resolved (either transport:
+                // `_goose/unstable/session/steer` or `_session/steering`).
+                // Locked semantics (Eva + Max + Perci, unanimous on Option X):
                 //
                 //   Success
                 //     The agent received the steer via the non-cancelling
                 //     path. Drop the withheld event so normal dispatch
                 //     never redelivers it.
                 //
+                //     Also covers `_session/steering`'s `startedNewTurn`
+                //     outcome: the message was delivered, but into a fresh
+                //     turn because the one being steered had already
+                //     finished. Delivery is what this arm keys on, so the
+                //     event is still dropped. The read loop deliberately
+                //     does NOT renew its hard deadline in that case (the
+                //     awaited turn is settled), while
+                //     `extend_in_flight_deadline` below still applies —
+                //     the agent really is running more work, so the
+                //     channel's in-flight budget should reflect it.
+                //
                 //   Err(_) where the write never landed (Transport /
                 //   ExpectedRunIdMissing):
                 //     Delivery state of the underlying message is "never
@@ -2433,6 +2444,16 @@ async fn tokio_main() -> Result<()> {
                 //     queue front AND issue the cancel+merge fallback so
                 //     the message still reaches the agent.
                 //
+                //   Err(OutcomeRejected { .. })
+                //     A `_session/steering` request returned a JSON-RPC
+                //     success whose `outcome` was not `injected` or
+                //     `startedNewTurn` (codex's `failed`, an unknown value,
+                //     or a bare `{}` with no `outcome` at all). The steer
+                //     did not land, so this is treated exactly like a write
+                //     that never happened: release withheld AND fire the
+                //     cancel+merge fallback. Handled by the catch-all
+                //     `Err(_)` arm below.
+                //
                 //   Err(AgentError { code: -32601, .. })
                 //     The agent returned method_not_found — it does not
                 //     implement the steer extension. Release withheld AND
@@ -2489,9 +2510,9 @@ async fn tokio_main() -> Result<()> {
                     Ok(pool::SteerAck::Err(pool::SteerError::AgentError { .. })) => {
                         (true, false, false)
                     }
-                    // Transport / ExpectedRunIdMissing: write never landed.
-                    // Release and fire the cancel+merge fallback so the
-                    // message still reaches the agent.
+                    // Transport / ExpectedRunIdMissing / OutcomeRejected: the
+                    // steer did not land. Release and fire the cancel+merge
+                    // fallback so the message still reaches the agent.
                     Ok(pool::SteerAck::Err(_)) => (true, false, true),
                     Ok(pool::SteerAck::PromptCompletedNeutral) => (true, false, false),
                     Err(_recv_err) => (true, false, false),
@@ -2925,15 +2946,15 @@ fn dispatch_pending(
         let ctx_clone = Arc::clone(ctx);
         let agent_index = agent.index;
 
-        // Goose-native non-cancelling steer seam: snapshot capability before
-        // the agent moves into `run_prompt_task`, and install the per-turn
-        // steer receiver on the read loop so the main loop's mode-gate fork
+        // Mid-turn non-cancelling steer seam: install the per-turn steer
+        // receiver on the read loop so the main loop's mode-gate fork
         // (see the `if accepted && queue.is_channel_in_flight(...)` block
         // in the relay event branch of the main `select!` loop) can drive
         // it via the matching sender stored in `TaskMeta.steer_tx`.
-        // Install the steer channel for every prompt task — the supervisor
-        // uses try-and-tolerate: it attempts the steer for any agent and
-        // treats `-32601 method_not_found` as "fall back to cancel+merge".
+        // Installed for every prompt task: the read loop picks the steer
+        // transport at write time from `active_run_id` and the agent's
+        // advertised `_session/steering` capability, and acks
+        // `ExpectedRunIdMissing` (→ cancel+merge) when it has neither.
         let (tx, rx) = tokio::sync::mpsc::channel::<pool::SteerRequest>(1);
         agent.acp.install_steer_rx(rx);
         let steer_tx = Some(tx);
@@ -3782,7 +3803,8 @@ async fn initialize_agent_pool(
                                 .and_then(|info| info.get("name"))
                                 .and_then(|v| v.as_str())
                                 .unwrap_or("unknown"),
-                            "agent initialized — non-cancelling steer enabled (try-and-tolerate)"
+                            steering_supported = acp.steering_supported(),
+                            "agent initialized"
                         );
                         acp.observe(
                             "agent_initialized",
@@ -4026,7 +4048,7 @@ async fn run_models(args: ModelsArgs) -> Result<()> {
     // so shutdown() runs on all paths (success, error, timeout).
     let protocol_result = tokio::time::timeout(MODELS_TIMEOUT, async {
         let init = client.initialize().await?;
-        let session = client.session_new_full(&cwd, vec![], None).await?;
+        let session = client.session_new_full(&cwd, vec![], None, None).await?;
         Ok::<_, acp::AcpError>((init, session))
     })
     .await;
@@ -4178,6 +4200,18 @@ fn build_mcp_servers(config: &Config) -> Vec<McpServer> {
                     });
                 }
             }
+            // Forward the agent's display name so dev-mcp can use it as the git
+            // author name instead of the raw npub. Read from the process env
+            // rather than Config: this is a pass-through of a contract owned
+            // upstream, and absent simply means dev-mcp falls back to the npub.
+            if let Ok(display_name) = std::env::var("BUZZ_ACP_DISPLAY_NAME") {
+                if !display_name.is_empty() {
+                    env.push(EnvVar {
+                        name: "BUZZ_ACP_DISPLAY_NAME".into(),
+                        value: display_name,
+                    });
+                }
+            }
             env
         },
     }]
@@ -4973,6 +5007,7 @@ mod build_mcp_servers_tests {
             typing_enabled: true,
             memory_enabled: false,
             model: None,
+            session_title: None,
             permission_mode: config::PermissionMode::BypassPermissions,
             respond_to: config::RespondTo::Anyone,
             respond_to_allowlist: std::collections::HashSet::new(),
@@ -5036,6 +5071,60 @@ mod build_mcp_servers_tests {
         assert!(!has_auth_tag, "empty BUZZ_AUTH_TAG should not be forwarded");
     }
 
+    #[test]
+    fn test_display_name_set_is_forwarded_to_mcp_server() {
+        let _guard = ENV_LOCK.lock().unwrap();
+        std::env::set_var("BUZZ_ACP_DISPLAY_NAME", "Duncan");
+        let config = test_config();
+        let servers = build_mcp_servers(&config);
+        std::env::remove_var("BUZZ_ACP_DISPLAY_NAME");
+
+        let entry = servers[0]
+            .env
+            .iter()
+            .find(|e| e.name == "BUZZ_ACP_DISPLAY_NAME");
+        assert_eq!(
+            entry.map(|e| e.value.as_str()),
+            Some("Duncan"),
+            "a set display name should reach the MCP server verbatim"
+        );
+    }
+
+    #[test]
+    fn test_display_name_unset_omits_the_key_entirely() {
+        let _guard = ENV_LOCK.lock().unwrap();
+        std::env::remove_var("BUZZ_ACP_DISPLAY_NAME");
+        let config = test_config();
+        let servers = build_mcp_servers(&config);
+
+        // Absent, not empty-valued: dev-mcp distinguishes the two and only
+        // falls back to the npub when the key is missing or blank.
+        assert!(
+            !servers[0]
+                .env
+                .iter()
+                .any(|e| e.name == "BUZZ_ACP_DISPLAY_NAME"),
+            "unset display name should not add the key"
+        );
+    }
+
+    #[test]
+    fn test_display_name_empty_omits_the_key_entirely() {
+        let _guard = ENV_LOCK.lock().unwrap();
+        std::env::set_var("BUZZ_ACP_DISPLAY_NAME", "");
+        let config = test_config();
+        let servers = build_mcp_servers(&config);
+        std::env::remove_var("BUZZ_ACP_DISPLAY_NAME");
+
+        assert!(
+            !servers[0]
+                .env
+                .iter()
+                .any(|e| e.name == "BUZZ_ACP_DISPLAY_NAME"),
+            "empty display name should not be forwarded"
+        );
+    }
+
     #[test]
     fn empty_mcp_command_returns_no_servers() {
         let mut config = test_config();
@@ -5139,6 +5228,7 @@ mod error_outcome_emission_tests {
             typing_enabled: true,
             memory_enabled: false,
             model: None,
+            session_title: None,
             permission_mode: config::PermissionMode::BypassPermissions,
             respond_to: config::RespondTo::Anyone,
             respond_to_allowlist: HashSet::new(),
diff --git a/crates/buzz-acp/src/pool.rs b/crates/buzz-acp/src/pool.rs
index cc537f86830..038f8a714c1 100644
--- a/crates/buzz-acp/src/pool.rs
+++ b/crates/buzz-acp/src/pool.rs
@@ -32,7 +32,7 @@ use crate::acp::{
     extract_model_config_options, extract_model_state, model_in_catalog,
     resolve_model_switch_method, AcpClient, AcpError, McpServer, ModelSwitchMethod, StopReason,
 };
-use crate::config::{DedupMode, PermissionMode};
+use crate::config::{compose_session_title, DedupMode, PermissionMode};
 use crate::observer;
 use crate::queue::{
     CancelReason, ContextMessage, ConversationContext, FlushBatch, PromptChannelInfo,
@@ -309,10 +309,13 @@ pub enum ControlSignal {
 /// for that — only a function parameter pass-through.
 ///
 /// If `active_run_id` is `None` at write time (no `session/update` seen yet
-/// — e.g. agents that never emit run-id metadata), the steer cannot form a
-/// valid `expectedRunId` and the read loop acks
-/// [`SteerError::ExpectedRunIdMissing`]. The main loop maps this to the
-/// "Err-before-pending" bucket: no withhold/mark was established at
+/// — e.g. agents that never emit run-id metadata), the goose-native method
+/// cannot form a valid `expectedRunId`, and the read loop falls back to the
+/// cross-adapter `_session/steering` method when the agent advertised
+/// `_meta.steering.supported` at `initialize`. That method takes no run id, so
+/// no freshness concern applies to it. When neither transport is available the
+/// read loop acks [`SteerError::ExpectedRunIdMissing`]. The main loop maps that
+/// to the "Err-before-pending" bucket: no withhold/mark was established at
 /// `pool::send_steer` time because the request was rejected before any
 /// write, so the watcher only needs to release nothing and fall back to the
 /// universal `ControlSignal::Steer` cancel+merge path.
@@ -326,7 +329,8 @@ pub struct SteerRequest {
     pub ack_tx: tokio::sync::oneshot::Sender<SteerAck>,
 }
 
-/// Why a goose-native steer failed.
+/// Why a mid-turn steer failed, on either transport
+/// (`_goose/unstable/session/steer` or `_session/steering`).
 ///
 /// String and integer fields are intentionally `Debug`-only — read by
 /// `tracing` macros in the main loop's `PoolEvent::SteerAck` arm via
@@ -349,14 +353,28 @@ pub enum SteerError {
     /// Transport-level failure: write error, read EOF, JSON-RPC framing
     /// violation, etc. The string carries the underlying `AcpError`'s display.
     Transport(String),
-    /// At steer-write time `AcpClient::active_run_id` was `None`, so the
-    /// read loop couldn't form a valid `expectedRunId`. The read loop drops
-    /// the request without writing anything; the main loop should release
-    /// any withheld event and fall back to the universal cancel+merge
+    /// At steer-write time neither steer transport was available: no
+    /// `expectedRunId` (`AcpClient::active_run_id` was `None`, so the
+    /// goose-native method could not be formed) and the agent did not
+    /// advertise the cross-adapter `_session/steering` extension. The read
+    /// loop drops the request without writing anything; the main loop should
+    /// release any withheld event and fall back to the universal cancel+merge
     /// `ControlSignal::Steer` path. This is in the same "Err-before-pending"
     /// bucket as `Transport` write failures: no in-process state was
     /// established, so no in-process cleanup is needed.
     ExpectedRunIdMissing,
+    /// A `_session/steering` request returned a JSON-RPC *success* whose
+    /// `outcome` was not one of the two recognized delivery outcomes
+    /// (`injected`, `startedNewTurn`) — including `failed` (codex-acp) and a
+    /// missing `outcome` entirely. `outcome` carries what the agent actually
+    /// reported, for logs.
+    ///
+    /// The steer did NOT land, so the main loop must release the withheld
+    /// event and fire the cancel+merge fallback — exactly like a write that
+    /// never happened. Treating an unrecognized success as delivery would
+    /// drop the user's message: codex-acp answers unrecognized extension
+    /// methods with a bare `{}` success rather than `-32601`.
+    OutcomeRejected { outcome: String },
     /// The read loop never got to dispatch the steer because the prompt
     /// completed first. Delivery state for the underlying message is
     /// unknown after prompt completion — the main loop must treat this as
@@ -369,7 +387,7 @@ pub enum SteerError {
     PromptCompleted,
 }
 
-/// Outcome of a goose-native steer, sent from the read loop back to the
+/// Outcome of a mid-turn steer, sent from the read loop back to the
 /// main loop's ack watcher.
 #[derive(Debug)]
 pub enum SteerAck {
@@ -490,6 +508,9 @@ pub struct PromptContext {
     pub turn_liveness_interval: Duration,
     pub dedup_mode: DedupMode,
     pub system_prompt: Option<String>,
+    /// Sanitized title for each new ACP session, sent as `_meta.sessionTitle`
+    /// on `session/new`. Never part of the prompt.
+    pub session_title: Option<String>,
     pub team_instructions: Option<String>,
     pub heartbeat_prompt: Option<String>,
     /// Base prompt content, or `None` if `--no-base-prompt` was passed.
@@ -795,6 +816,49 @@ const CONTROL_CANCEL_GRACE: Duration = Duration::from_secs(5);
 /// Timeout for permission-mode requests (`session/set_config_option` with `configId: "mode"`).
 const PERMISSION_MODE_TIMEOUT: Duration = Duration::from_secs(5);
 
+/// Placeholder [`fetch_channel_info`] substitutes when a channel's metadata
+/// event carries no `name` tag. Not a real channel name — consumers that need
+/// an identifying name must treat it as absent.
+const UNKNOWN_CHANNEL_NAME: &str = "unknown";
+
+/// Channel-derived inputs for a new session — `(is_dm, title_channel)` — from
+/// **one** metadata resolve.
+///
+/// Both new-session consumers need the same lookup: the canvas block skips DMs
+/// (and fails closed when the channel type can't be determined), and the
+/// session title is qualified with the channel name. Resolving once is
+/// load-bearing rather than tidy: [`ChannelInfoResolver`] caches only `Some`,
+/// so two calls against an unresolvable channel pay the whole
+/// [`fetch_channel_info`] retry sequence twice — two `CONTEXT_FETCH_TIMEOUT`
+/// attempts plus `CONTEXT_FETCH_RETRY_DELAY` each, in front of `session/new`,
+/// precisely when the relay is already degraded.
+///
+/// `title_channel` is `None` whenever the channel can't usefully identify the
+/// session: an unresolved channel, a DM (no meaningful name), or the literal
+/// `"unknown"` that [`fetch_channel_info`] substitutes for a metadata event
+/// with no `name` tag. Composing that sentinel would title every unnamed
+/// channel identically (`Agent · #unknown`) — reintroducing the collision the
+/// suffix exists to remove, while naming a channel something it isn't. The
+/// startup cache already refuses `channel_type == "unknown"` for the same
+/// reason.
+///
+/// Renames do not retitle live sessions, and a **channel** rename is stickier
+/// than an agent rename: `invalidate_channel` drops the session but not the
+/// resolver's cached entry, so a renamed channel keeps its old suffix until the
+/// process restarts. An agent rename lands on the next spawn (the desktop
+/// restart badge covers it — see `spawn_config_hash`).
+async fn resolve_new_session_channel_context(
+    channel_info: &ChannelInfoResolver,
+    channel_id: Uuid,
+) -> (bool, Option<String>) {
+    let Some(info) = channel_info.resolve(channel_id).await else {
+        return (true, None);
+    };
+    let is_dm = info.channel_type == "dm";
+    let title_channel = (!is_dm && info.name != UNKNOWN_CHANNEL_NAME).then_some(info.name);
+    (is_dm, title_channel)
+}
+
 /// Create a new ACP session via `session_new_full()`, populate model capabilities
 /// on the agent (first session only), and apply `desired_model` if set.
 ///
@@ -806,6 +870,7 @@ async fn create_session_and_apply_model(
     ctx: &PromptContext,
     agent_core: Option<&str>,
     agent_canvas: Option<&str>,
+    channel_name: Option<&str>,
 ) -> Result<String, AcpError> {
     // Build base_prompt + system_prompt + agent core + canvas metadata into a
     // single prompt. Standard protocol-v2 agents receive it in `session/new`;
@@ -825,6 +890,11 @@ async fn create_session_and_apply_model(
         agent_canvas,
     );
 
+    let session_title = ctx
+        .session_title
+        .as_deref()
+        .map(|agent_name| compose_session_title(agent_name, channel_name));
+
     let resp = agent
         .acp
         .session_new_full(
@@ -835,6 +905,7 @@ async fn create_session_and_apply_model(
                 agent.protocol_version,
                 combined_system_prompt.as_deref(),
             ),
+            session_title.as_deref(),
         )
         .await?;
 
@@ -1427,18 +1498,20 @@ pub async fn run_prompt_task(
     // prevents a stale revision A surviving a failed create and being re-used by
     // the next attempt after the canvas was cleared.
     let mut pending_canvas: Option<(Uuid, String)> = None;
+    // Channel name for the session title, from the same single resolve the
+    // canvas DM check uses — see `resolve_new_session_channel_context`.
+    let mut title_channel: Option<String> = None;
     if let PromptSource::Channel(cid) = &source {
         let is_new_channel_session = !agent.state.sessions.contains_key(cid);
-        if is_new_channel_session && !agent.state.canvas_sections.contains_key(cid) {
-            // Resolve DM status: prefer the startup cache, lazy-fetch as fallback.
-            // Unknown → treat as DM (fail-closed).
-            let is_dm = ctx
-                .channel_info
-                .resolve(*cid)
-                .await
-                .map(|ci| ci.channel_type == "dm")
-                .unwrap_or(true);
-            if !is_dm {
+        let needs_canvas = is_new_channel_session && !agent.state.canvas_sections.contains_key(cid);
+        let needs_title = is_new_channel_session && ctx.session_title.is_some();
+        if needs_canvas || needs_title {
+            let (is_dm, resolved_channel) =
+                resolve_new_session_channel_context(&ctx.channel_info, *cid).await;
+            title_channel = resolved_channel;
+            // A confirmed DM never receives a canvas section; an undeterminable
+            // channel type fails closed as a DM for the same reason.
+            if needs_canvas && !is_dm {
                 if let Some(section) = fetch_canvas_section(*cid, &ctx.rest_client).await {
                     pending_canvas = Some((*cid, section));
                 }
@@ -1470,12 +1543,16 @@ pub async fn run_prompt_task(
             if let Some(sid) = agent.state.sessions.get(cid) {
                 (sid.clone(), false)
             } else {
-                // Create new session with model application.
+                // The title is channel-qualified (`Agent · #channel`) so one
+                // agent in several channels doesn't produce identical session
+                // rows; `title_channel` comes from the single resolve above and
+                // is `None` for DM, unresolved, and unnamed channels.
                 match create_session_and_apply_model(
                     &mut agent,
                     &ctx,
                     agent_core.as_deref(),
                     agent_canvas.as_deref(),
+                    title_channel.as_deref(),
                 )
                 .await
                 {
@@ -1523,7 +1600,7 @@ pub async fn run_prompt_task(
             if let Some(sid) = &agent.state.heartbeat_session {
                 (sid.clone(), false)
             } else {
-                match create_session_and_apply_model(&mut agent, &ctx, None, None).await {
+                match create_session_and_apply_model(&mut agent, &ctx, None, None, None).await {
                     Ok(sid) => {
                         tracing::info!(
                             target: "pool::session",
@@ -1820,6 +1897,18 @@ pub async fn run_prompt_task(
         None => prompt_sections.iter().map(String::as_str).collect(),
     };
 
+    // Turn start, labelled exactly as `log_stop_reason` labels the end, so a
+    // log reads as start/stop pairs. Purely observational: an unpaired start is
+    // the only durable evidence that a turn was entered and never returned, and
+    // without it a stalled agent and an agent nobody woke leave identical logs —
+    // zero completions either way, so anything reading them afterwards has to
+    // guess which happened.
+    tracing::info!(
+        target: "pool::prompt",
+        "turn starting for {}",
+        prompt_label(&source)
+    );
+
     // When control_rx is Some (channel tasks), wrap the prompt in select! so
     // the main loop can cancel, interrupt, or rotate it. Heartbeats
     // (control_rx=None) take the simple await path — they are not controllable.
@@ -2268,7 +2357,7 @@ pub(crate) async fn fetch_channel_info(
                 }
                 let channel_type = crate::relay::channel_type_from_tags(tags);
                 Some(PromptChannelInfo {
-                    name: name.unwrap_or("unknown").to_string(),
+                    name: name.unwrap_or(UNKNOWN_CHANNEL_NAME).to_string(),
                     channel_type,
                 })
             }
@@ -3054,12 +3143,19 @@ fn classify_control_cancel_failure(
     }
 }
 
-/// Log a stop reason at the appropriate tracing level.
-fn log_stop_reason(source: &PromptSource, stop_reason: &StopReason) {
-    let label = match source {
+/// How a turn's source is named in the `pool::prompt` log lines.
+///
+/// Shared by the turn-start and turn-stop lines so a log can be read as pairs.
+fn prompt_label(source: &PromptSource) -> String {
+    match source {
         PromptSource::Channel(cid) => format!("channel {cid}"),
         PromptSource::Heartbeat => "heartbeat".to_string(),
-    };
+    }
+}
+
+/// Log a stop reason at the appropriate tracing level.
+fn log_stop_reason(source: &PromptSource, stop_reason: &StopReason) {
+    let label = prompt_label(source);
     match stop_reason {
         StopReason::EndTurn => {
             tracing::info!(target: "pool::prompt", "turn complete for {label}: end_turn");
@@ -3781,6 +3877,9 @@ mod tests {
 
     #[test]
     fn test_framed_system_prompt_both_present_carries_both_headers() {
+        // Also the regression guard against #2372: the session title travels
+        // out of band in `_meta.sessionTitle`, so this exact-bytes assertion is
+        // what pins the framing against a `[Session]` section reappearing here.
         let framed = framed_system_prompt("/", Some("base text"), Some("persona text"))
             .expect("both present yields Some");
         assert_eq!(framed, "[Base]\nbase text\n\n[System]\npersona text");
@@ -5280,6 +5379,7 @@ mod tests {
             turn_liveness_interval: Duration::ZERO,
             dedup_mode: DedupMode::Drop,
             system_prompt: None,
+            session_title: None,
             team_instructions: None,
             heartbeat_prompt: None,
             base_prompt: None,
@@ -5617,4 +5717,142 @@ mod tests {
             "timestamp must not use +00:00 offset"
         );
     }
+
+    // ── new-session channel context (one resolve, two consumers) ─────────────
+
+    /// A [`ChannelInfoResolver`] whose lazy REST fallback is served by a local
+    /// HTTP server, plus a counter of the requests that actually reached it.
+    /// Counting real requests is the point: the composition tests are pure and
+    /// cannot see duplicated I/O.
+    async fn counting_resolver(
+        response: serde_json::Value,
+    ) -> (
+        ChannelInfoResolver,
+        std::sync::Arc<std::sync::atomic::AtomicUsize>,
+        tokio::task::JoinHandle<()>,
+    ) {
+        use std::sync::atomic::{AtomicUsize, Ordering};
+        use tokio::io::{AsyncReadExt, AsyncWriteExt};
+
+        let listener = tokio::net::TcpListener::bind("127.0.0.1:0")
+            .await
+            .expect("bind test HTTP server");
+        let base_url = format!("http://{}", listener.local_addr().unwrap());
+        let requests = std::sync::Arc::new(AtomicUsize::new(0));
+        let server_requests = requests.clone();
+        let body = response.to_string();
+        let server = tokio::spawn(async move {
+            while let Ok((mut socket, _)) = listener.accept().await {
+                let mut buf = vec![0; 8192];
+                let _ = socket.read(&mut buf).await;
+                server_requests.fetch_add(1, Ordering::SeqCst);
+                let response = format!(
+                    "HTTP/1.1 200 OK\r\nContent-Type: application/json\r\nContent-Length: {}\r\nConnection: close\r\n\r\n{}",
+                    body.len(),
+                    body
+                );
+                let _ = socket.write_all(response.as_bytes()).await;
+            }
+        });
+        let rest = crate::relay::RestClient {
+            http: reqwest::Client::new(),
+            base_url,
+            keys: nostr::Keys::generate(),
+            auth_tag_json: None,
+        };
+        (
+            ChannelInfoResolver::new(std::collections::HashMap::new(), rest),
+            requests,
+            server,
+        )
+    }
+
+    fn channel_metadata_response(id: Uuid, tags: &[[&str; 2]]) -> serde_json::Value {
+        let mut event_tags = vec![json!(["d", id.to_string()])];
+        event_tags.extend(tags.iter().map(|[k, v]| json!([k, v])));
+        json!([{ "tags": event_tags }])
+    }
+
+    /// A normal channel yields a non-DM (canvas allowed) and its name for the
+    /// title suffix — and the second consumer reads it from cache, not the wire.
+    #[tokio::test]
+    async fn test_new_session_channel_context_qualifies_a_normal_channel() {
+        use std::sync::atomic::Ordering;
+
+        let id = Uuid::new_v4();
+        let response = channel_metadata_response(id, &[["name", "buzz-dev"], ["t", "stream"]]);
+        let (resolver, requests, server) = counting_resolver(response).await;
+
+        let (is_dm, title_channel) = resolve_new_session_channel_context(&resolver, id).await;
+        assert!(!is_dm, "a stream channel is not a DM");
+        assert_eq!(title_channel.as_deref(), Some("buzz-dev"));
+        assert_eq!(requests.load(Ordering::SeqCst), 1);
+
+        let (_, again) = resolve_new_session_channel_context(&resolver, id).await;
+        assert_eq!(again.as_deref(), Some("buzz-dev"));
+        assert_eq!(
+            requests.load(Ordering::SeqCst),
+            1,
+            "a resolved channel is cached — no second lookup"
+        );
+        server.abort();
+    }
+
+    /// A DM carries no useful name, so it gets the bare agent title (and no
+    /// canvas section).
+    #[tokio::test]
+    async fn test_new_session_channel_context_leaves_a_dm_unqualified() {
+        let id = Uuid::new_v4();
+        let response = channel_metadata_response(id, &[["name", "DM"], ["t", "dm"]]);
+        let (resolver, _requests, server) = counting_resolver(response).await;
+
+        let (is_dm, title_channel) = resolve_new_session_channel_context(&resolver, id).await;
+        assert!(is_dm);
+        assert_eq!(
+            title_channel, None,
+            "a DM name must never reach the session title"
+        );
+        server.abort();
+    }
+
+    /// The `"unknown"` placeholder `fetch_channel_info` substitutes for a
+    /// metadata event with no `name` tag is not a channel name: qualifying with
+    /// it would title every unnamed channel `Agent · #unknown`.
+    #[tokio::test]
+    async fn test_new_session_channel_context_treats_the_unknown_name_as_absent() {
+        let id = Uuid::new_v4();
+        let response = channel_metadata_response(id, &[["t", "stream"]]);
+        let (resolver, _requests, server) = counting_resolver(response).await;
+
+        let (is_dm, title_channel) = resolve_new_session_channel_context(&resolver, id).await;
+        assert!(!is_dm, "a nameless stream channel is still not a DM");
+        assert_eq!(
+            title_channel, None,
+            "the `unknown` placeholder must yield a bare title"
+        );
+        server.abort();
+    }
+
+    /// An unresolvable channel yields the bare title, fails closed as a DM, and
+    /// costs exactly ONE `fetch_channel_info` sequence — two attempts, because
+    /// `fetch_with_retry` retries once. `resolve()` caches only `Some`, so a
+    /// second resolve for the title would double this in front of `session/new`,
+    /// exactly when the relay is already degraded.
+    #[tokio::test]
+    async fn test_new_session_channel_context_attempts_an_unresolved_channel_once() {
+        use std::sync::atomic::Ordering;
+
+        let (resolver, requests, server) = counting_resolver(json!([])).await;
+
+        let (is_dm, title_channel) =
+            resolve_new_session_channel_context(&resolver, Uuid::new_v4()).await;
+        assert!(is_dm, "an undeterminable channel type must fail closed");
+        assert_eq!(title_channel, None, "unresolved channels get a bare title");
+        assert_eq!(
+            requests.load(Ordering::SeqCst),
+            2,
+            "one fetch_channel_info sequence (initial attempt + single retry)"
+        );
+        server.abort();
+    }
 }
diff --git a/crates/buzz-acp/src/usage.rs b/crates/buzz-acp/src/usage.rs
index a4f7abd3b32..8cca9c96f8b 100644
--- a/crates/buzz-acp/src/usage.rs
+++ b/crates/buzz-acp/src/usage.rs
@@ -85,6 +85,12 @@ pub(crate) struct UsageUpdatePayload {
     pub context_limit: u64,
     pub accumulated_input_tokens: u64,
     pub accumulated_output_tokens: u64,
+    /// The cache-served subset of `accumulated_input_tokens`. Optional — goose
+    /// does not send it, and buzz-agent only reports a non-zero value when the
+    /// provider returned a cache split, so `0` legitimately means either "no
+    /// cache hits" or "provider reported none".
+    #[serde(default)]
+    pub accumulated_cached_input_tokens: u64,
     pub accumulated_cost: Option<f64>,
     /// Effective model id for this turn. Optional — goose payloads that
     /// predate this field deserialize cleanly as `None`.
@@ -323,12 +329,44 @@ impl UsageTracker {
 mod tests {
     use super::*;
 
+    /// The camelCase key buzz-agent actually puts on the wire must land on the
+    /// field. A rename mismatch here would deserialize to the serde default of
+    /// 0, and every trial would price as if nothing had ever been cached — the
+    /// exact silent failure this field was added to remove.
+    #[test]
+    fn cached_input_tokens_deserialize_from_the_wire_key() {
+        let p: UsageUpdatePayload = serde_json::from_value(serde_json::json!({
+            "used": 15_247,
+            "contextLimit": 0,
+            "accumulatedInputTokens": 15_091,
+            "accumulatedOutputTokens": 156,
+            "accumulatedCachedInputTokens": 5_033,
+        }))
+        .expect("payload must deserialize");
+        assert_eq!(p.accumulated_cached_input_tokens, 5_033);
+        assert!(p.accumulated_cached_input_tokens <= p.accumulated_input_tokens);
+    }
+
+    /// goose does not send the field; its payloads must still deserialize.
+    #[test]
+    fn a_payload_without_the_cache_field_defaults_to_zero() {
+        let p: UsageUpdatePayload = serde_json::from_value(serde_json::json!({
+            "used": 500,
+            "contextLimit": 200_000,
+            "accumulatedInputTokens": 400,
+            "accumulatedOutputTokens": 100,
+        }))
+        .expect("payload must deserialize without the cache field");
+        assert_eq!(p.accumulated_cached_input_tokens, 0);
+    }
+
     fn payload(input: u64, output: u64, cost: Option<f64>) -> UsageUpdatePayload {
         UsageUpdatePayload {
             used: input + output,
             context_limit: 200_000,
             accumulated_input_tokens: input,
             accumulated_output_tokens: output,
+            accumulated_cached_input_tokens: 0,
             accumulated_cost: cost,
             model: None,
         }
@@ -340,6 +378,7 @@ mod tests {
             context_limit: 0,
             accumulated_input_tokens: input,
             accumulated_output_tokens: output,
+            accumulated_cached_input_tokens: 0,
             accumulated_cost: cost,
             model: None,
         }
@@ -836,6 +875,7 @@ mod tests {
             context_limit: 200_000,
             accumulated_input_tokens: input,
             accumulated_output_tokens: output,
+            accumulated_cached_input_tokens: 0,
             accumulated_cost: cost,
             model: model.map(str::to_string),
         }
diff --git a/crates/buzz-agent/src/agent.rs b/crates/buzz-agent/src/agent.rs
index 730e87b2e87..ed04daca2cb 100644
--- a/crates/buzz-agent/src/agent.rs
+++ b/crates/buzz-agent/src/agent.rs
@@ -60,6 +60,11 @@ pub struct RunCtx<'a> {
     /// Accumulated output tokens across all LLM rounds in this turn, for
     /// NIP-AM metric publishing. Reset to `None` at turn start in `run()`.
     pub turn_output_tokens: &'a mut Option<u64>,
+    /// The cache-served subset of `turn_input_tokens`, accumulated across all
+    /// LLM rounds in this turn. Reset to `None` at turn start in `run()`.
+    /// Consumers price this slice at the provider's cached rate; without it
+    /// every round of a growing conversation is billed at full price.
+    pub turn_cached_input_tokens: &'a mut Option<u64>,
 }
 
 impl RunCtx<'_> {
@@ -78,6 +83,7 @@ impl RunCtx<'_> {
         // Reset per-turn token accumulators for this prompt.
         *self.turn_input_tokens = None;
         *self.turn_output_tokens = None;
+        *self.turn_cached_input_tokens = None;
 
         let mut round = 0u32;
         // Per-prompt `_Stop` objection count. Bounded per prompt (not per
@@ -175,6 +181,17 @@ impl RunCtx<'_> {
                 *self.turn_output_tokens =
                     Some(self.turn_output_tokens.unwrap_or(0).saturating_add(out));
             }
+            // Accumulate the cache-served subset of this turn's input. Tracked
+            // separately from `turn_input_tokens` rather than subtracted from
+            // it: the input total must stay inclusive for the handoff gate,
+            // which cares how much context was sent, not what it cost.
+            if let Some(cached) = response.cached_input_tokens {
+                *self.turn_cached_input_tokens = Some(
+                    self.turn_cached_input_tokens
+                        .unwrap_or(0)
+                        .saturating_add(cached),
+                );
+            }
 
             if !response.reasoning.is_empty() {
                 wire::send(
@@ -679,6 +696,9 @@ pub(crate) fn push_hook_outputs_as_tool_results(
                 provider_id: provider_id.clone(),
                 name: tool_name,
                 arguments: serde_json::json!({}),
+                // Synthesised locally, so there is no provider wire form to
+                // preserve.
+                provider_extra: Default::default(),
             }],
         });
         history.push(HistoryItem::ToolResult(ToolResult {
diff --git a/crates/buzz-agent/src/config.rs b/crates/buzz-agent/src/config.rs
index f3464fb9039..037b67b3cb9 100644
--- a/crates/buzz-agent/src/config.rs
+++ b/crates/buzz-agent/src/config.rs
@@ -184,6 +184,7 @@ pub fn anthropic_thinking_config(
 fn anthropic_model_supports_xhigh(model: &str) -> bool {
     model.starts_with("claude-opus-4-7")
         || model.starts_with("claude-opus-4-8")
+        || model.starts_with("claude-opus-5")
         || model.starts_with("claude-sonnet-5")
         || model.starts_with("claude-fable-5")
         || model.starts_with("claude-mythos-5")
@@ -606,6 +607,7 @@ fn is_adaptive_thinking_model(model: &str) -> bool {
     model.starts_with("claude-opus-4-6")
         || model.starts_with("claude-opus-4-7")
         || model.starts_with("claude-opus-4-8")
+        || model.starts_with("claude-opus-5")
         // Sonnet 5.x (any patch/date suffix after "claude-sonnet-5").
         || model.starts_with("claude-sonnet-5")
         // Sonnet 4.6 exactly (not Sonnet 4.5 or earlier — not in the adaptive table).
@@ -736,6 +738,13 @@ pub struct Config {
     /// Thinking/reasoning effort level. `None` = use provider default (no
     /// thinking config sent). Set via `BUZZ_AGENT_THINKING_EFFORT`.
     pub thinking_effort: Option<ThinkingEffort>,
+    /// Emit Anthropic `cache_control` breakpoints on the stable prefix
+    /// (tools + system prompt) and the rolling conversation tail. Default on;
+    /// disable with `BUZZ_AGENT_PROMPT_CACHING=0`. Only consulted on Anthropic
+    /// Messages routes (first-party Anthropic and the DatabricksV2 Claude
+    /// route) — the Databricks gateway does not auto-cache, so without this the
+    /// surfaced `cache_read_input_tokens` is structurally always 0.
+    pub prompt_caching: bool,
 }
 
 impl Config {
@@ -831,6 +840,7 @@ impl Config {
             hook_servers: parse_hook_servers_env("MCP_HOOK_SERVERS"),
             hints_enabled: parse_env("BUZZ_AGENT_NO_HINTS", 0u8)? == 0,
             thinking_effort: parse_thinking_effort(env("BUZZ_AGENT_THINKING_EFFORT").as_deref())?,
+            prompt_caching: parse_env("BUZZ_AGENT_PROMPT_CACHING", 1u8)? != 0,
         };
         cfg.validate()?;
         Ok(cfg)
@@ -872,6 +882,7 @@ impl Config {
             hook_servers: HookServers::None,
             hints_enabled: false,
             thinking_effort: None,
+            prompt_caching: false,
         }
     }
 
diff --git a/crates/buzz-agent/src/lib.rs b/crates/buzz-agent/src/lib.rs
index e141b9860f4..6745dd0f92d 100644
--- a/crates/buzz-agent/src/lib.rs
+++ b/crates/buzz-agent/src/lib.rs
@@ -100,6 +100,11 @@ struct Session {
     accumulated_input_tokens: u64,
     /// Session-cumulative output tokens across all turns.
     accumulated_output_tokens: u64,
+    /// Session-cumulative cache-served input tokens across all turns — a subset
+    /// of `accumulated_input_tokens`, not an addition to it. Emitted alongside
+    /// it so a consumer can price the cached slice at the provider's discounted
+    /// rate instead of assuming every input token cost full price.
+    accumulated_cached_input_tokens: u64,
 }
 
 fn die(msg: String) -> ! {
@@ -426,6 +431,7 @@ async fn session_new(app: &Arc<App>, id: Value, params: Value, wire_tx: &WireSen
             effective_model: None,
             accumulated_input_tokens: 0,
             accumulated_output_tokens: 0,
+            accumulated_cached_input_tokens: 0,
         },
     );
     drop(sessions);
@@ -672,6 +678,7 @@ async fn run_prompt(app: Arc<App>, id: Value, params: Value, wire_tx: WireSender
         .unwrap_or(&app.cfg.model);
     let mut turn_input_tokens: Option<u64> = None;
     let mut turn_output_tokens: Option<u64> = None;
+    let mut turn_cached_input_tokens: Option<u64> = None;
     let mut ctx = RunCtx {
         cfg: &app.cfg,
         effective_model: effective_model_str,
@@ -690,6 +697,7 @@ async fn run_prompt(app: Arc<App>, id: Value, params: Value, wire_tx: WireSender
         last_request_history_bytes: &mut last_request_history_bytes,
         turn_input_tokens: &mut turn_input_tokens,
         turn_output_tokens: &mut turn_output_tokens,
+        turn_cached_input_tokens: &mut turn_cached_input_tokens,
     };
     let result = ctx.run(p.prompt).await;
     if let Some(s) = app.sessions.lock().await.get_mut(&sid) {
@@ -722,14 +730,21 @@ async fn run_prompt(app: Arc<App>, id: Value, params: Value, wire_tx: WireSender
                 s.accumulated_output_tokens = s
                     .accumulated_output_tokens
                     .saturating_add(turn_output_tokens.unwrap_or(0));
-                Some((s.accumulated_input_tokens, s.accumulated_output_tokens))
+                s.accumulated_cached_input_tokens = s
+                    .accumulated_cached_input_tokens
+                    .saturating_add(turn_cached_input_tokens.unwrap_or(0));
+                Some((
+                    s.accumulated_input_tokens,
+                    s.accumulated_output_tokens,
+                    s.accumulated_cached_input_tokens,
+                ))
             } else {
                 // Session is gone — the accumulated baseline no longer exists, so
                 // there is nothing correct to emit. Skip the usage notification.
                 None
             }
         };
-        if let Some((accumulated_in, accumulated_out)) = accumulated {
+        if let Some((accumulated_in, accumulated_out, accumulated_cached)) = accumulated {
             wire::send(
                 &wire_tx,
                 goose_session_update(
@@ -742,6 +757,11 @@ async fn run_prompt(app: Arc<App>, id: Value, params: Value, wire_tx: WireSender
                         "contextLimit": 0u64,
                         "accumulatedInputTokens": accumulated_in,
                         "accumulatedOutputTokens": accumulated_out,
+                        // A subset of accumulatedInputTokens, not an addition to
+                        // it. Extends goose's usage_update shape; a consumer that
+                        // does not know the field ignores it and prices exactly as
+                        // it did before.
+                        "accumulatedCachedInputTokens": accumulated_cached,
                         "model": effective_model_str,
                     }),
                 ),
diff --git a/crates/buzz-agent/src/llm.rs b/crates/buzz-agent/src/llm.rs
index 23cef24e72a..22d3f8b73e6 100644
--- a/crates/buzz-agent/src/llm.rs
+++ b/crates/buzz-agent/src/llm.rs
@@ -3,7 +3,7 @@ use std::sync::atomic::{AtomicBool, Ordering};
 use std::sync::Arc;
 
 use reqwest::Client;
-use serde_json::{json, Value};
+use serde_json::{json, Map, Value};
 use tokio::sync::Mutex;
 use tokio::time::Instant;
 
@@ -720,6 +720,12 @@ fn anthropic_body(
         }
     }
     flush(&mut messages, &mut pending);
+    // Rolling cache breakpoint: mark the tail of the (append-only) conversation
+    // so the next turn re-reads this whole prefix from cache instead of paying
+    // full input price for it. See `stamp_rolling_cache_breakpoint`.
+    if cfg.prompt_caching {
+        stamp_rolling_cache_breakpoint(&mut messages);
+    }
     let tools_json: Vec<Value> = tools
         .iter()
         .map(|t| {
@@ -727,8 +733,19 @@ fn anthropic_body(
         "name": t.name, "description": t.description, "input_schema": t.input_schema })
         })
         .collect();
+    // Static prefix breakpoint: caching the `system` block caches the whole
+    // prefix up to and including it — and the prefix order is
+    // `tools -> system -> messages`, so this single marker caches tools +
+    // system together. Requires the structured (array) form of `system`; skip
+    // it for an empty prompt since Anthropic rejects empty text blocks.
+    let system_value = if cfg.prompt_caching && !system_prompt.is_empty() {
+        json!([{ "type": "text", "text": system_prompt,
+            "cache_control": { "type": "ephemeral" } }])
+    } else {
+        json!(system_prompt)
+    };
     let mut body = json!({ "model": effective_model, "max_tokens": cfg.max_output_tokens,
-        "system": system_prompt, "messages": messages });
+        "system": system_value, "messages": messages });
     if let Some(e) = effort {
         let (thinking, output_config) =
             crate::config::anthropic_thinking_config(effective_model, e, cfg.max_output_tokens);
@@ -745,6 +762,41 @@ fn anthropic_body(
     body
 }
 
+/// Attach ephemeral `cache_control` markers to the tail of the conversation so
+/// the next turn re-reads the whole prior prefix from cache (~0.1x input price)
+/// rather than re-billing it as fresh input. Anthropic caches the prefix up to
+/// and including each marked block.
+///
+/// We mark the last content block of the last *two* messages, not just the
+/// final one. Each Anthropic breakpoint walks back at most 20 content blocks to
+/// find a prior cache entry, and one agentic turn can append ~17 blocks at the
+/// default `max_parallel_tools` (1 assistant text + N `tool_use` +
+/// N `tool_result`). With only a tail marker, consecutive breakpoints sit a
+/// full turn apart, which slips past the 20-block window as soon as parallelism
+/// rises or a turn carries extra blocks — and the miss is silent. Marking the
+/// last two messages halves the gap (to ~N+1 blocks), keeping a live cache
+/// entry comfortably within reach. Uses 2 of the 4 allowed breakpoints; the
+/// static `system` marker is the third.
+///
+/// A no-op for messages whose content is empty or whose tail block is not a
+/// JSON object.
+fn stamp_rolling_cache_breakpoint(messages: &mut [Value]) {
+    let n = messages.len();
+    // The two most-recently-appended messages (the current turn's tool results
+    // and the assistant turn before them). `checked_sub` + `flatten` skips the
+    // second index when there is only one message.
+    for idx in [n.checked_sub(1), n.checked_sub(2)].into_iter().flatten() {
+        if let Some(block) = messages[idx]
+            .get_mut("content")
+            .and_then(Value::as_array_mut)
+            .and_then(|c| c.last_mut())
+            .and_then(Value::as_object_mut)
+        {
+            block.insert("cache_control".into(), json!({ "type": "ephemeral" }));
+        }
+    }
+}
+
 fn anthropic_tool_result_content(content: &[ToolResultContent]) -> Vec<Value> {
     content
         .iter()
@@ -796,11 +848,24 @@ fn openai_body(
                     let calls: Vec<Value> = tool_calls
                         .iter()
                         .map(|c| {
-                            json!({
-                        "id": c.provider_id, "type": "function",
-                        "function": { "name": c.name,
-                            "arguments": serde_json::to_string(&c.arguments)
-                                .unwrap_or_else(|_| "{}".into()) } })
+                            let mut call = serde_json::Map::new();
+                            call.insert("id".into(), json!(c.provider_id));
+                            call.insert("type".into(), json!("function"));
+                            // Provider-owned fields go back beside `function`,
+                            // which is where the provider put them. Position is
+                            // load-bearing, not cosmetic: Gemini rejects a
+                            // `thoughtSignature` nested inside `function{}` with
+                            // the same 400 it gives for one that is missing.
+                            for (k, v) in &c.provider_extra {
+                                call.insert(k.clone(), v.clone());
+                            }
+                            call.insert(
+                                "function".into(),
+                                json!({ "name": c.name,
+                                    "arguments": serde_json::to_string(&c.arguments)
+                                        .unwrap_or_else(|_| "{}".into()) }),
+                            );
+                            Value::Object(call)
                         })
                         .collect();
                     msg.insert("tool_calls".into(), Value::Array(calls));
@@ -967,13 +1032,53 @@ fn is_responses_required_error(body: &str) -> bool {
         || b.contains("use the responses api")
 }
 
+/// OpenAI-family code names that appear as their own segment in a Databricks v2
+/// endpoint name (the GPT-5 launch aliases). The `gpt` family itself is matched
+/// separately by segment prefix so `gpt`, `gpt5`, and the `gpt` of a split
+/// `gpt-5` all qualify.
+const DATABRICKS_V2_OPENAI_CODE_NAMES: &[&str] = &["sol", "luna", "terra"];
+
+/// Anthropic (Claude) family and release code names that appear as their own
+/// segment in a Databricks v2 endpoint name — the `claude` prefix, the family
+/// names (`opus`, `sonnet`, `haiku`), and the release code names (`mythos`,
+/// `fable`). Getting a Claude model onto the Anthropic Messages route is what
+/// lets it carry a `cache_control` breakpoint; an endpoint that matches none of
+/// these falls through to the MLflow (OpenAI-wire) path, where Anthropic prompt
+/// caching is structurally impossible and the discount is silently lost.
+const DATABRICKS_V2_CLAUDE_NAMES: &[&str] =
+    &["claude", "opus", "sonnet", "haiku", "mythos", "fable"];
+
+/// Split a Databricks v2 endpoint name into its lowercase alphanumeric segments,
+/// breaking on any non-alphanumeric delimiter (`-`, `_`, `.`, `/`, …). E.g.
+/// `Databricks-Claude-Opus-5` -> `["databricks", "claude", "opus", "5"]`.
+fn model_name_segments(model: &str) -> Vec<String> {
+    model
+        .split(|c: char| !c.is_ascii_alphanumeric())
+        .filter(|s| !s.is_empty())
+        .map(str::to_ascii_lowercase)
+        .collect()
+}
+
 fn databricks_v2_route_for_model(model: &str) -> DatabricksV2Route {
-    // Databricks v2 catalog names currently identify OpenAI-shaped GPT-5
-    // models and Anthropic-shaped Claude models by these substrings.
-    let lower = model.to_ascii_lowercase();
-    if lower.contains("gpt-5") || lower.contains("gpt5") {
+    // The v2 catalog exposes no family field, so the wire format is inferred
+    // from the endpoint name. Discovery deliberately keeps arbitrary custom
+    // aliases, so we match whole name *segments* rather than raw substrings: a
+    // substring test would misroute unrelated names — `consolidated-llama`
+    // (`sol`), `terraform-coder` (`terra`), `corpus-reranker`/`octopus-model`
+    // (`opus`) — onto a wire whose request shape their backend can't parse,
+    // turning a caching optimization into a hard request/parse failure. Segment
+    // matching still accepts real prefixed names like `goose-opus-5`.
+    let segments = model_name_segments(model);
+    let has_named_segment =
+        |names: &[&str]| segments.iter().any(|seg| names.contains(&seg.as_str()));
+    // `gpt` family: any segment beginning with `gpt` — covers `gpt`, `gpt5`, and
+    // the `gpt` segment of a split `gpt-5`, without matching mid-word.
+    let is_gpt_family = segments.iter().any(|seg| seg.starts_with("gpt"));
+    // OpenAI is checked before Claude so a name carrying both markers resolves
+    // to the OpenAI wire (preserving the prior `gpt-5`-first precedence).
+    if is_gpt_family || has_named_segment(DATABRICKS_V2_OPENAI_CODE_NAMES) {
         DatabricksV2Route::OpenAiResponses
-    } else if lower.contains("claude") {
+    } else if has_named_segment(DATABRICKS_V2_CLAUDE_NAMES) {
         DatabricksV2Route::AnthropicMessages
     } else {
         DatabricksV2Route::MlflowChatCompletions
@@ -1028,10 +1133,15 @@ fn parse_responses(v: Value) -> Result<LlmResponse, AgentError> {
                 let args: Value = serde_json::from_str(raw).map_err(|e| {
                     AgentError::Llm(format!("function_call.arguments not valid JSON: {e}"))
                 })?;
+                // No passthrough on this route: `responses_body` replays a
+                // function call as `{call_id, name, arguments}` and the Responses
+                // API asks for nothing else, so an empty map keeps the request
+                // byte-identical to before.
                 tool_calls.push(make_tool_call(
                     str_field(item, "call_id"),
                     str_field(item, "name"),
                     args,
+                    Default::default(),
                 )?);
             }
             Some("reasoning") => {
@@ -1079,11 +1189,18 @@ fn parse_responses(v: Value) -> Result<LlmResponse, AgentError> {
     };
     let input_tokens = sum_usage(&v, &["input_tokens"]);
     let output_tokens = sum_usage(&v, &["output_tokens"]);
+    // The Responses API nests the cache split under `input_tokens_details`.
+    let cached_input_tokens = usage_first(
+        &v,
+        &["cache_read_input_tokens"],
+        &[("input_tokens_details", "cached_tokens")],
+    );
     Ok(LlmResponse {
         text,
         tool_calls,
         stop,
         input_tokens,
+        cached_input_tokens,
         output_tokens,
         reasoning,
     })
@@ -1131,19 +1248,70 @@ fn anthropic_input_tokens(v: &Value) -> Option<u64> {
     )
 }
 
-/// Input-token total for OpenAI Chat Completions and Databricks responses.
-/// OpenAI's `prompt_tokens` is already inclusive. Databricks uses the same
-/// `prompt_tokens` wire field but ALSO reports Anthropic-style cache fields
-/// alongside it, so we sum them; the cache fields are simply absent (and
-/// contribute 0) for vanilla OpenAI.
+/// Input-token total for OpenAI Chat Completions and Databricks MLflow-route
+/// responses. `prompt_tokens` is already the inclusive input total on both, so
+/// it is read alone and never summed with the cache fields.
+///
+/// Vanilla OpenAI nests the cache split under `prompt_tokens_details` and
+/// `prompt_tokens` includes it. The Databricks MLflow route reports the split
+/// with the flat Anthropic spelling (`cache_read_input_tokens`) *alongside* an
+/// already-inclusive `prompt_tokens` — so summing double-counts. Verified on
+/// `databricks-glm-5-2` (2026-07-28): `prompt_tokens 13320`,
+/// `cache_read_input_tokens 13312`, `completion_tokens 30`, `total_tokens
+/// 13350`; since `prompt_tokens + completion_tokens == total_tokens`, the 13312
+/// cached tokens are contained in the 13320, not additional to it. Summing gave
+/// 26632 — nearly double — inflating both the context-budget gate and cost.
+///
+/// This differs from Anthropic's native route (see [`anthropic_input_tokens`]),
+/// where `input_tokens` genuinely EXCLUDES the cache fields and must be summed.
+/// The two never collide here: the router sends `claude*` models to the
+/// Anthropic route, so `parse_openai` only ever sees inclusive `prompt_tokens`.
 fn openai_chat_input_tokens(v: &Value) -> Option<u64> {
-    sum_usage(
+    sum_usage(v, &["prompt_tokens"])
+}
+
+/// First present value among `usage.<field>` and `usage.<nested>.<leaf>` pairs.
+///
+/// Cache counts are the one usage figure providers do not agree on the shape of.
+/// Anthropic puts `cache_read_input_tokens` flat on `usage`; OpenAI nests the
+/// same quantity one level down, under `prompt_tokens_details` on
+/// `/chat/completions` and `input_tokens_details` on `/responses`. [`sum_usage`]
+/// only reads flat keys, which is why the OpenAI split was invisible for so
+/// long: `prompt_tokens` is already inclusive, so the *total* was right and
+/// nothing looked broken while the discount silently went unclaimed.
+///
+/// Returns the first candidate that resolves, not a sum — these are alternative
+/// spellings of one number, so adding them would double-count on Databricks,
+/// which reports both shapes.
+fn usage_first(v: &Value, flat: &[&str], nested: &[(&str, &str)]) -> Option<u64> {
+    let usage = v.get("usage")?;
+    for f in flat {
+        if let Some(n) = usage.get(*f).and_then(Value::as_u64) {
+            return Some(n);
+        }
+    }
+    for (outer, leaf) in nested {
+        if let Some(n) = usage
+            .get(*outer)
+            .and_then(|o| o.get(*leaf))
+            .and_then(Value::as_u64)
+        {
+            return Some(n);
+        }
+    }
+    None
+}
+
+/// Cache-read tokens for an OpenAI Chat Completions response.
+///
+/// `prompt_tokens_details.cached_tokens` is where vanilla OpenAI reports it.
+/// The flat Anthropic spelling is checked first for Databricks, which routes
+/// Anthropic models through an OpenAI-shaped envelope.
+fn openai_chat_cached_tokens(v: &Value) -> Option<u64> {
+    usage_first(
         v,
-        &[
-            "prompt_tokens",
-            "cache_read_input_tokens",
-            "cache_creation_input_tokens",
-        ],
+        &["cache_read_input_tokens"],
+        &[("prompt_tokens_details", "cached_tokens")],
     )
 }
 
@@ -1151,6 +1319,76 @@ fn str_field(v: &Value, key: &str) -> String {
     v.get(key).and_then(Value::as_str).unwrap_or("").to_owned()
 }
 
+/// Append `part` to `buf` on its own line, ignoring empties.
+fn push_part(buf: &mut String, part: &str) {
+    if part.is_empty() {
+        return;
+    }
+    if !buf.is_empty() {
+        buf.push('\n');
+    }
+    buf.push_str(part);
+}
+
+/// Split an OpenAI-shaped `message.content` into `(text, reasoning)`.
+///
+/// Standard OpenAI sends a string. Several models on the Databricks MLflow route
+/// — Gemini, Qwen35, gpt-oss — send an array of typed blocks instead, and
+/// `as_str()` yields nothing for an array, so their entire answer was being
+/// discarded: no error, no warning, just a turn that looked like the model had
+/// said nothing. `parse_anthropic` already walks a block array; this gives
+/// `parse_openai` the same tolerance.
+fn openai_content_parts(content: Option<&Value>) -> (String, String) {
+    let mut text = String::new();
+    let mut reasoning = String::new();
+    match content {
+        Some(Value::String(s)) => text.push_str(s),
+        Some(Value::Array(blocks)) => {
+            for b in blocks {
+                match b.get("type").and_then(Value::as_str) {
+                    Some("text") => push_part(&mut text, &str_field(b, "text")),
+                    Some("reasoning") => match b.get("summary").and_then(Value::as_array) {
+                        // Gemini nests the prose one level down under `summary`.
+                        Some(summary) => {
+                            for s in summary {
+                                push_part(&mut reasoning, &str_field(s, "text"));
+                            }
+                        }
+                        None => push_part(&mut reasoning, &str_field(b, "text")),
+                    },
+                    // An untyped block carrying text is still the model talking;
+                    // treating it as text loses nothing and keeps one more
+                    // provider out of the silent-empty-answer failure mode.
+                    _ => push_part(&mut text, &str_field(b, "text")),
+                }
+            }
+        }
+        _ => {}
+    }
+    (text, reasoning)
+}
+
+/// Make `provider_id` unique across one assistant turn's tool calls.
+///
+/// Gemini returns the function name as the id, so two parallel calls to the same
+/// function arrive sharing one id — and that id is what pairs a `role:"tool"`
+/// result back to its call, leaving two results indistinguishable. Rewriting is
+/// safe because both halves of that pairing are re-emitted from this same value;
+/// the provider never sees its original id again.
+fn dedupe_provider_ids(calls: &mut [ToolCall]) {
+    let mut seen: BTreeSet<String> = BTreeSet::new();
+    for c in calls.iter_mut() {
+        if seen.contains(&c.provider_id) {
+            let mut n = 2;
+            while seen.contains(&format!("{}-{n}", c.provider_id)) {
+                n += 1;
+            }
+            c.provider_id = format!("{}-{n}", c.provider_id);
+        }
+        seen.insert(c.provider_id.clone());
+    }
+}
+
 fn parse_anthropic(v: Value) -> Result<LlmResponse, AgentError> {
     let stop = map_stop(v.get("stop_reason").and_then(Value::as_str));
     let mut tool_calls = Vec::new();
@@ -1173,10 +1411,12 @@ fn parse_anthropic(v: Value) -> Result<LlmResponse, AgentError> {
                         reasoning.push_str(t);
                     }
                 }
+                // Anthropic's replay shape is fully modelled, so nothing to keep.
                 Some("tool_use") => tool_calls.push(make_tool_call(
                     str_field(b, "id"),
                     str_field(b, "name"),
                     b.get("input").cloned().unwrap_or(Value::Null),
+                    Default::default(),
                 )?),
                 _ => {}
             }
@@ -1184,11 +1424,15 @@ fn parse_anthropic(v: Value) -> Result<LlmResponse, AgentError> {
     }
     let input_tokens = anthropic_input_tokens(&v);
     let output_tokens = sum_usage(&v, &["output_tokens"]);
+    // Anthropic reports the cache split flat on `usage`. Note this is already
+    // part of `input_tokens` above, which sums it in deliberately.
+    let cached_input_tokens = usage_first(&v, &["cache_read_input_tokens"], &[]);
     Ok(LlmResponse {
         text,
         tool_calls,
         stop,
         input_tokens,
+        cached_input_tokens,
         output_tokens,
         reasoning,
     })
@@ -1204,17 +1448,23 @@ fn parse_openai(v: Value) -> Result<LlmResponse, AgentError> {
     let msg = choice
         .get("message")
         .ok_or_else(|| AgentError::Llm("missing message".into()))?;
-    let text = str_field(msg, "content");
+    let (text, block_reasoning) = openai_content_parts(msg.get("content"));
     // DeepSeek and vLLM-style OpenAI-compat hosts expose reasoning tokens on the
     // message object. Prefer `reasoning_content` (DeepSeek's field name); fall
-    // back to `reasoning` (some other providers). Both are absent for standard
-    // OpenAI responses, which leaves this empty without any special-casing.
+    // back to `reasoning` (some other providers), and last to reasoning blocks
+    // found inside `content`. All three are absent for standard OpenAI
+    // responses, which leaves this empty without any special-casing.
     let reasoning = {
         let rc = str_field(msg, "reasoning_content");
-        if rc.is_empty() {
+        let rc = if rc.is_empty() {
             str_field(msg, "reasoning")
         } else {
             rc
+        };
+        if rc.is_empty() {
+            block_reasoning
+        } else {
+            rc
         }
     };
     let mut tool_calls = Vec::new();
@@ -1226,26 +1476,45 @@ fn parse_openai(v: Value) -> Result<LlmResponse, AgentError> {
             let raw = f.get("arguments").and_then(Value::as_str).unwrap_or("{}");
             let args: Value = serde_json::from_str(raw)
                 .map_err(|e| AgentError::Llm(format!("tool_call.arguments not valid JSON: {e}")))?;
+            // Everything on the wire object we do not model, kept for replay.
+            let extra = tc
+                .as_object()
+                .map(|o| {
+                    o.iter()
+                        .filter(|(k, _)| !matches!(k.as_str(), "id" | "type" | "function"))
+                        .map(|(k, v)| (k.clone(), v.clone()))
+                        .collect()
+                })
+                .unwrap_or_default();
             tool_calls.push(make_tool_call(
                 str_field(tc, "id"),
                 str_field(f, "name"),
                 args,
+                extra,
             )?);
         }
     }
+    dedupe_provider_ids(&mut tool_calls);
     let input_tokens = openai_chat_input_tokens(&v);
     let output_tokens = sum_usage(&v, &["completion_tokens"]);
+    let cached_input_tokens = openai_chat_cached_tokens(&v);
     Ok(LlmResponse {
         text,
         tool_calls,
         stop,
         input_tokens,
+        cached_input_tokens,
         output_tokens,
         reasoning,
     })
 }
 
-fn make_tool_call(id: String, name: String, args: Value) -> Result<ToolCall, AgentError> {
+fn make_tool_call(
+    id: String,
+    name: String,
+    args: Value,
+    provider_extra: Map<String, Value>,
+) -> Result<ToolCall, AgentError> {
     if id.is_empty() || name.is_empty() {
         return Err(AgentError::Llm("tool_call missing id or name".into()));
     }
@@ -1262,6 +1531,7 @@ fn make_tool_call(id: String, name: String, args: Value) -> Result<ToolCall, Age
         provider_id: id,
         name,
         arguments,
+        provider_extra,
     })
 }
 
@@ -1606,6 +1876,7 @@ mod tests {
             prefer_mesh_for_auto: false,
             hints_enabled: true,
             thinking_effort: None,
+            prompt_caching: true,
         }
     }
 
@@ -2208,6 +2479,7 @@ mod tests {
                     provider_id: "toolu_1".into(),
                     name: "dev__view_image".into(),
                     arguments: serde_json::json!({"source":"x.png"}),
+                    provider_extra: Default::default(),
                 }],
             },
             HistoryItem::ToolResult(ToolResult {
@@ -2257,6 +2529,7 @@ mod tests {
                     provider_id: "call_abc".into(),
                     name: "dev__shell".into(),
                     arguments: serde_json::json!({"command": "ls"}),
+                    provider_extra: Default::default(),
                 }],
             },
             HistoryItem::ToolResult(ToolResult {
@@ -2355,6 +2628,7 @@ mod tests {
                     provider_id: "call_x".into(),
                     name: "t".into(),
                     arguments: serde_json::json!({}),
+                    provider_extra: Default::default(),
                 }],
             },
         ];
@@ -2462,20 +2736,105 @@ mod tests {
 
     #[test]
     fn databricks_v2_routes_by_model_family() {
+        use DatabricksV2Route::{AnthropicMessages, MlflowChatCompletions, OpenAiResponses};
         for (model, route, path) in [
+            // OpenAI-shaped: the gpt family plus the GPT-5 code names.
             (
                 "databricks-gpt-5-5",
-                DatabricksV2Route::OpenAiResponses,
+                OpenAiResponses,
                 "/ai-gateway/openai/v1/responses",
             ),
+            ("gpt-4o", OpenAiResponses, "/ai-gateway/openai/v1/responses"),
+            // The intentional dashless `gpt5` spelling still routes to OpenAI.
+            ("gpt5", OpenAiResponses, "/ai-gateway/openai/v1/responses"),
+            (
+                "databricks-gpt-5-6-luna",
+                OpenAiResponses,
+                "/ai-gateway/openai/v1/responses",
+            ),
+            (
+                "databricks-gpt-5-6-sol",
+                OpenAiResponses,
+                "/ai-gateway/openai/v1/responses",
+            ),
+            (
+                "databricks-terra",
+                OpenAiResponses,
+                "/ai-gateway/openai/v1/responses",
+            ),
+            // Anthropic-shaped: the claude prefix, the family names, and the
+            // release code names — each must reach the cache-capable route even
+            // when the endpoint name omits the literal "claude".
             (
                 "databricks-claude-opus-4-7",
-                DatabricksV2Route::AnthropicMessages,
+                AnthropicMessages,
+                "/ai-gateway/anthropic/v1/messages",
+            ),
+            (
+                "goose-opus-5",
+                AnthropicMessages,
+                "/ai-gateway/anthropic/v1/messages",
+            ),
+            (
+                "databricks-sonnet-5",
+                AnthropicMessages,
                 "/ai-gateway/anthropic/v1/messages",
             ),
+            (
+                "databricks-haiku-4-5",
+                AnthropicMessages,
+                "/ai-gateway/anthropic/v1/messages",
+            ),
+            (
+                "databricks-mythos-5",
+                AnthropicMessages,
+                "/ai-gateway/anthropic/v1/messages",
+            ),
+            (
+                "databricks-fable-5",
+                AnthropicMessages,
+                "/ai-gateway/anthropic/v1/messages",
+            ),
+            // Case-insensitive.
+            (
+                "Databricks-Claude-Opus-5",
+                AnthropicMessages,
+                "/ai-gateway/anthropic/v1/messages",
+            ),
+            // Unrecognised names still fall through to the MLflow chat route.
             (
                 "custom-tool-model",
-                DatabricksV2Route::MlflowChatCompletions,
+                MlflowChatCompletions,
+                "/ai-gateway/mlflow/v1/chat/completions",
+            ),
+            (
+                "databricks-gemini-3-pro",
+                MlflowChatCompletions,
+                "/ai-gateway/mlflow/v1/chat/completions",
+            ),
+            // Collision guard: short code names must match only as whole
+            // segments, never as substrings of an unrelated custom alias.
+            // Each of these embeds a marker (`sol`, `terra`, `opus`) mid-word
+            // and must stay on the MLflow fallback, not adopt a wire its
+            // backend can't parse.
+            (
+                "consolidated-llama",
+                MlflowChatCompletions,
+                "/ai-gateway/mlflow/v1/chat/completions",
+            ),
+            (
+                "terraform-coder",
+                MlflowChatCompletions,
+                "/ai-gateway/mlflow/v1/chat/completions",
+            ),
+            (
+                "corpus-reranker",
+                MlflowChatCompletions,
+                "/ai-gateway/mlflow/v1/chat/completions",
+            ),
+            (
+                "octopus-model",
+                MlflowChatCompletions,
                 "/ai-gateway/mlflow/v1/chat/completions",
             ),
         ] {
@@ -2548,11 +2907,13 @@ mod tests {
                         provider_id: "toolu_a".into(),
                         name: "dev__view_image".into(),
                         arguments: serde_json::json!({"source": "a.png"}),
+                        provider_extra: Default::default(),
                     },
                     ToolCall {
                         provider_id: "toolu_b".into(),
                         name: "dev__view_image".into(),
                         arguments: serde_json::json!({"source": "b.png"}),
+                        provider_extra: Default::default(),
                     },
                 ],
             },
@@ -2604,6 +2965,100 @@ mod tests {
         assert_eq!(imgs[1]["image_url"]["url"], "data:image/png;base64,bbb");
     }
 
+    // ---- prompt caching (cache_control) body-shape tests ----
+
+    #[test]
+    fn anthropic_body_stamps_cache_control_when_enabled() {
+        let body = anthropic_body(
+            &cfg(Provider::DatabricksV2),
+            "sys",
+            &[
+                HistoryItem::User("hello".into()),
+                HistoryItem::Assistant {
+                    text: "hi".into(),
+                    tool_calls: vec![],
+                },
+                HistoryItem::User("more".into()),
+            ],
+            &[],
+            "databricks-claude-opus-5",
+            None,
+        );
+        // Static prefix: system promoted to a structured block carrying the marker.
+        assert_eq!(body["system"][0]["type"], "text");
+        assert_eq!(body["system"][0]["text"], "sys");
+        assert_eq!(body["system"][0]["cache_control"]["type"], "ephemeral");
+        // Leapfrog: the last block of the last TWO messages is marked; earlier
+        // ones are not. Three distinct user/assistant/user turns → messages[1]
+        // and messages[2] marked, messages[0] clean.
+        let msgs = body["messages"].as_array().unwrap();
+        assert_eq!(msgs.len(), 3);
+        let tail_block = |m: &Value| m["content"].as_array().unwrap().last().unwrap().clone();
+        assert_eq!(tail_block(&msgs[2])["cache_control"]["type"], "ephemeral");
+        assert_eq!(tail_block(&msgs[1])["cache_control"]["type"], "ephemeral");
+        assert!(
+            tail_block(&msgs[0]).get("cache_control").is_none(),
+            "only the last two messages carry a breakpoint"
+        );
+    }
+
+    #[test]
+    fn anthropic_body_single_message_stamps_only_one_breakpoint() {
+        // With a single message there is no second turn to leapfrog to; the
+        // checked_sub(2) index is skipped rather than panicking.
+        let body = anthropic_body(
+            &cfg(Provider::DatabricksV2),
+            "sys",
+            &[HistoryItem::User("hello".into())],
+            &[],
+            "databricks-claude-opus-5",
+            None,
+        );
+        let msgs = body["messages"].as_array().unwrap();
+        assert_eq!(msgs.len(), 1);
+        assert_eq!(
+            msgs[0]["content"].as_array().unwrap().last().unwrap()["cache_control"]["type"],
+            "ephemeral"
+        );
+    }
+
+    #[test]
+    fn anthropic_body_no_cache_control_when_disabled() {
+        let mut c = cfg(Provider::DatabricksV2);
+        c.prompt_caching = false;
+        let body = anthropic_body(
+            &c,
+            "sys",
+            &[HistoryItem::User("hello".into())],
+            &[],
+            "databricks-claude-opus-5",
+            None,
+        );
+        // system stays a bare string; no marker anywhere.
+        assert_eq!(body["system"], "sys");
+        let last_block = &body["messages"][0]["content"][0];
+        assert!(last_block.get("cache_control").is_none());
+    }
+
+    #[test]
+    fn anthropic_body_empty_system_stays_string_even_when_caching() {
+        // An empty system prompt must not become an empty text block —
+        // Anthropic rejects those. Caching is still applied to the tail.
+        let body = anthropic_body(
+            &cfg(Provider::DatabricksV2),
+            "",
+            &[HistoryItem::User("hello".into())],
+            &[],
+            "databricks-claude-opus-5",
+            None,
+        );
+        assert_eq!(body["system"], "");
+        assert_eq!(
+            body["messages"][0]["content"][0]["cache_control"]["type"],
+            "ephemeral"
+        );
+    }
+
     // ---- ThinkingEffort body-shape tests ----
 
     #[test]
@@ -3483,6 +3938,92 @@ mod tests {
         assert_eq!(parse_anthropic(v).unwrap().input_tokens, None);
     }
 
+    /// A Gemini reply as the Databricks MLflow route actually returns it:
+    /// block-array `content`, and a `thoughtSignature` beside `function`.
+    fn gemini_choice() -> Value {
+        json!({"choices": [{"finish_reason": "tool_calls", "message": {
+            "role": "assistant",
+            "content": [
+                {"type": "reasoning", "summary": [{"type": "summary_text", "text": "weighing it"}]},
+                {"type": "text", "text": "391"}
+            ],
+            "tool_calls": [{
+                "id": "get_weather", "type": "function", "thoughtSignature": "SIG-A",
+                "function": {"name": "get_weather", "arguments": "{\"city\":\"Paris\"}"}
+            }]
+        }}]})
+    }
+
+    #[test]
+    fn parse_openai_reads_text_out_of_a_block_array() {
+        // Before this, `as_str()` on the array yielded "" and the model's answer
+        // was discarded with no error at all.
+        let r = parse_openai(gemini_choice()).unwrap();
+        assert_eq!(r.text, "391");
+        assert_eq!(r.reasoning, "weighing it");
+    }
+
+    #[test]
+    fn parse_openai_still_reads_a_plain_string_content() {
+        let v = json!({"choices": [{"finish_reason": "stop", "message": {
+            "role": "assistant", "content": "plain"}}]});
+        let r = parse_openai(v).unwrap();
+        assert_eq!(r.text, "plain");
+        assert_eq!(r.reasoning, "");
+    }
+
+    #[test]
+    fn parse_openai_keeps_unmodelled_tool_call_fields() {
+        let r = parse_openai(gemini_choice()).unwrap();
+        let extra = &r.tool_calls[0].provider_extra;
+        assert_eq!(extra.get("thoughtSignature"), Some(&json!("SIG-A")));
+        // `id`/`type`/`function` are modelled, so they must not be duplicated
+        // into the passthrough — they would be re-emitted twice.
+        assert!(!extra.contains_key("id"));
+        assert!(!extra.contains_key("type"));
+        assert!(!extra.contains_key("function"));
+    }
+
+    #[test]
+    fn openai_body_replays_the_signature_beside_function_not_inside_it() {
+        // Position is what the gateway checks: nested inside `function{}` it is
+        // rejected with the same 400 as a missing signature.
+        let r = parse_openai(gemini_choice()).unwrap();
+        let history = vec![HistoryItem::Assistant {
+            text: r.text.clone(),
+            tool_calls: r.tool_calls.clone(),
+        }];
+        let body = openai_body(
+            &cfg(Provider::DatabricksV2),
+            "sys",
+            &history,
+            &[],
+            "databricks-gemini-3-6-flash",
+            None,
+        );
+        let call = &body["messages"][1]["tool_calls"][0];
+        assert_eq!(call["thoughtSignature"], json!("SIG-A"));
+        assert!(call["function"].get("thoughtSignature").is_none());
+        assert_eq!(call["function"]["name"], json!("get_weather"));
+    }
+
+    #[test]
+    fn parse_openai_makes_duplicate_tool_call_ids_unique() {
+        // Gemini returns the function name as the id, so parallel calls to one
+        // function collide and their results become indistinguishable.
+        let v = json!({"choices": [{"finish_reason": "tool_calls", "message": {
+        "role": "assistant", "content": "",
+        "tool_calls": [
+            {"id": "get_weather", "type": "function",
+             "function": {"name": "get_weather", "arguments": "{\"city\":\"Paris\"}"}},
+            {"id": "get_weather", "type": "function",
+             "function": {"name": "get_weather", "arguments": "{\"city\":\"Rome\"}"}}
+        ]}}]});
+        let r = parse_openai(v).unwrap();
+        assert_eq!(r.tool_calls[0].provider_id, "get_weather");
+        assert_eq!(r.tool_calls[1].provider_id, "get_weather-2");
+    }
+
     #[test]
     fn parse_openai_uses_prompt_tokens() {
         let v = serde_json::json!({
@@ -3493,20 +4034,34 @@ mod tests {
     }
 
     #[test]
-    fn parse_openai_databricks_sums_cache_fields() {
-        // Databricks uses the OpenAI chat wire format (prompt_tokens) but also
-        // reports Anthropic-style cache fields; the inclusive total sums them.
+    fn parse_openai_databricks_prompt_tokens_already_inclusive() {
+        // Databricks' MLflow route uses the OpenAI chat wire format
+        // (prompt_tokens) but ALSO reports the flat Anthropic-style
+        // cache_read_input_tokens. prompt_tokens is already inclusive of that
+        // slice, so the total is prompt_tokens alone — summing double-counts.
+        // Values are the live databricks-glm-5-2 response (2026-07-28), where
+        // prompt_tokens + completion_tokens == total_tokens proves inclusivity.
         let v = serde_json::json!({
             "choices": [{"finish_reason": "stop", "message": {"content": "hi"}}],
             "usage": {
-                "prompt_tokens": 200,
-                "completion_tokens": 4,
-                "total_tokens": 204,
-                "cache_read_input_tokens": 800,
-                "cache_creation_input_tokens": 0
+                "prompt_tokens": 13320,
+                "completion_tokens": 30,
+                "total_tokens": 13350,
+                "cache_read_input_tokens": 13312,
+                "prompt_tokens_details": {"cached_tokens": 13312}
             }
         });
-        assert_eq!(parse_openai(v).unwrap().input_tokens, Some(1000));
+        let r = parse_openai(v).unwrap();
+        assert_eq!(
+            r.input_tokens,
+            Some(13320),
+            "prompt_tokens is the inclusive total"
+        );
+        assert_eq!(r.cached_input_tokens, Some(13312));
+        assert!(
+            r.cached_input_tokens.unwrap() <= r.input_tokens.unwrap(),
+            "the cached slice is a subset of the input total"
+        );
     }
 
     #[test]
@@ -3517,6 +4072,115 @@ mod tests {
         assert_eq!(parse_openai(v).unwrap().input_tokens, None);
     }
 
+    #[test]
+    fn parse_openai_reads_nested_cached_tokens() {
+        // The shape vanilla OpenAI actually returns, captured from a live
+        // /chat/completions probe on gpt-5.6-luna: `prompt_tokens` is already
+        // inclusive and the cache split is nested one level down. Reading only
+        // flat keys left the discount unclaimed while the total looked correct,
+        // which is why this went unnoticed.
+        let v = serde_json::json!({
+            "choices": [{"finish_reason": "stop", "message": {"content": "OK"}}],
+            "usage": {
+                "prompt_tokens": 5229,
+                "completion_tokens": 4,
+                "total_tokens": 5233,
+                "prompt_tokens_details": {"audio_tokens": 0, "cached_tokens": 5226,
+                                          "cache_write_tokens": 0}
+            }
+        });
+        let r = parse_openai(v).unwrap();
+        assert_eq!(r.input_tokens, Some(5229), "total must stay inclusive");
+        assert_eq!(r.cached_input_tokens, Some(5226));
+    }
+
+    #[test]
+    fn parse_openai_cache_write_round_reports_zero_cached() {
+        // First request of a cold prefix: the provider writes the cache and
+        // serves nothing from it. `Some(0)` not `None` — the split was reported,
+        // it was simply zero, and a consumer must be able to tell the two apart.
+        let v = serde_json::json!({
+            "choices": [{"finish_reason": "stop", "message": {"content": "OK"}}],
+            "usage": {
+                "prompt_tokens": 5229,
+                "completion_tokens": 4,
+                "prompt_tokens_details": {"cached_tokens": 0, "cache_write_tokens": 5226}
+            }
+        });
+        assert_eq!(parse_openai(v).unwrap().cached_input_tokens, Some(0));
+    }
+
+    #[test]
+    fn parse_openai_no_cache_detail_is_none() {
+        let v = serde_json::json!({
+            "choices": [{"finish_reason": "stop", "message": {"content": "hi"}}],
+            "usage": {"prompt_tokens": 123, "completion_tokens": 4}
+        });
+        assert_eq!(parse_openai(v).unwrap().cached_input_tokens, None);
+    }
+
+    #[test]
+    fn parse_openai_prefers_flat_anthropic_spelling_over_nested() {
+        // Databricks reports both shapes for the same quantity. Take one, never
+        // the sum, or the cached slice double-counts. cache_read (800) is a
+        // subset of the inclusive prompt_tokens (1000), as it must be.
+        let v = serde_json::json!({
+            "choices": [{"finish_reason": "stop", "message": {"content": "hi"}}],
+            "usage": {
+                "prompt_tokens": 1000,
+                "completion_tokens": 4,
+                "cache_read_input_tokens": 800,
+                "prompt_tokens_details": {"cached_tokens": 800}
+            }
+        });
+        let r = parse_openai(v).unwrap();
+        assert_eq!(r.input_tokens, Some(1000));
+        assert_eq!(r.cached_input_tokens, Some(800));
+        assert!(r.cached_input_tokens.unwrap() <= r.input_tokens.unwrap());
+    }
+
+    #[test]
+    fn parse_anthropic_reports_cache_read_as_cached() {
+        // Anthropic's `input_tokens` EXCLUDES cached, so the inclusive total is
+        // a sum -- but the cached slice must still be a subset of that total.
+        let v = serde_json::json!({
+            "stop_reason": "end_turn",
+            "content": [{"type": "text", "text": "hi"}],
+            "usage": {
+                "input_tokens": 100,
+                "output_tokens": 7,
+                "cache_read_input_tokens": 900,
+                "cache_creation_input_tokens": 50
+            }
+        });
+        let r = parse_anthropic(v).unwrap();
+        assert_eq!(r.input_tokens, Some(1050));
+        assert_eq!(r.cached_input_tokens, Some(900));
+        assert!(r.cached_input_tokens.unwrap() <= r.input_tokens.unwrap());
+    }
+
+    #[test]
+    fn parse_responses_reads_nested_cached_tokens() {
+        // The Responses API nests the same figure under a different key than
+        // /chat/completions does.
+        let v = serde_json::json!({
+            "status": "completed",
+            "output": [{
+                "type": "message",
+                "role": "assistant",
+                "content": [{"type": "output_text", "text": "hi"}]
+            }],
+            "usage": {
+                "input_tokens": 4000,
+                "output_tokens": 9,
+                "input_tokens_details": {"cached_tokens": 3584}
+            }
+        });
+        let r = parse_responses(v).unwrap();
+        assert_eq!(r.input_tokens, Some(4000));
+        assert_eq!(r.cached_input_tokens, Some(3584));
+    }
+
     #[test]
     fn parse_responses_uses_input_tokens() {
         let v = serde_json::json!({
diff --git a/crates/buzz-agent/src/mcp.rs b/crates/buzz-agent/src/mcp.rs
index fa8815df50a..9ae125a0b76 100644
--- a/crates/buzz-agent/src/mcp.rs
+++ b/crates/buzz-agent/src/mcp.rs
@@ -52,6 +52,31 @@ const PASSTHROUGH_ENV: &[&str] = &[
     "GIT_ASKPASS",
     "GIT_SSH_COMMAND",
     "GIT_CONFIG_GLOBAL",
+    // Proxy — on a host whose only route out is a CONNECT proxy, dropping
+    // these does not degrade the tools, it blinds them: apt, curl, pip and git
+    // all connect directly instead, and the egress firewall resets the socket.
+    // The agent then reports "Connection reset by peer" and concludes the
+    // environment has no network, which is indistinguishable in the transcript
+    // from a task that is genuinely offline.
+    //
+    // Both cases are needed. curl and git read the lowercase spellings, most
+    // Go and Python tooling reads the uppercase ones, and libcurl deliberately
+    // ignores uppercase HTTP_PROXY (CGI ambiguity), so keeping only one form
+    // silently breaks half the toolchain.
+    "HTTP_PROXY",
+    "HTTPS_PROXY",
+    "NO_PROXY",
+    "ALL_PROXY",
+    "http_proxy",
+    "https_proxy",
+    "no_proxy",
+    "all_proxy",
+    // TLS trust — a proxy that terminates TLS presents its own CA, and an
+    // image whose trust store does not carry it fails every https fetch with a
+    // verification error. Same class of failure as the proxy vars: the parent
+    // was configured correctly and the child could not see it.
+    "SSL_CERT_FILE",
+    "SSL_CERT_DIR",
     // Buzz identity — dev-mcp writes NOSTR_PRIVATE_KEY to a keyfile then
     // removes it from its own env (children never see it). BUZZ_PRIVATE_KEY
     // and BUZZ_RELAY_URL are kept for the buzz CLI. BUZZ_AUTH_TAG is a
@@ -61,6 +86,11 @@ const PASSTHROUGH_ENV: &[&str] = &[
     "BUZZ_PRIVATE_KEY",
     "BUZZ_RELAY_URL",
     "BUZZ_AUTH_TAG",
+    // Agent display name — dev-mcp uses it as the git author name. On the
+    // Desktop path this arrives via the wire `mcpServers[].env` declaration
+    // (which wins here anyway); the allowlist entry covers ACP clients that
+    // spawn buzz-agent without declaring it.
+    "BUZZ_ACP_DISPLAY_NAME",
 ];
 
 // Windows has no $TMPDIR/$HOME. TMP/TEMP/USERPROFILE are what
@@ -1010,6 +1040,41 @@ mod content_tests {
     fn passthrough_includes_buzz_owner_attestation() {
         assert!(PASSTHROUGH_ENV.contains(&"BUZZ_AUTH_TAG"));
     }
+
+    #[test]
+    fn passthrough_carries_proxy_configuration_to_tools() {
+        // On a proxy-only host this is the difference between an agent that can
+        // install a package and one that reports the network is down. Both
+        // spellings: libcurl ignores uppercase HTTP_PROXY, and Go/Python
+        // tooling largely ignores the lowercase set.
+        for var in [
+            "HTTP_PROXY",
+            "HTTPS_PROXY",
+            "NO_PROXY",
+            "ALL_PROXY",
+            "http_proxy",
+            "https_proxy",
+            "no_proxy",
+            "all_proxy",
+        ] {
+            assert!(
+                PASSTHROUGH_ENV.contains(&var),
+                "{var} must survive env_clear() or every MCP tool loses the proxy"
+            );
+        }
+    }
+
+    #[test]
+    fn passthrough_carries_tls_trust_to_tools() {
+        // A TLS-terminating proxy presents its own CA; without these the child
+        // rejects every https fetch even though the proxy itself is reachable.
+        for var in ["SSL_CERT_FILE", "SSL_CERT_DIR"] {
+            assert!(
+                PASSTHROUGH_ENV.contains(&var),
+                "{var} must survive env_clear() or https fails inside tools"
+            );
+        }
+    }
     use rmcp::model::Content;
 
     #[cfg(windows)]
diff --git a/crates/buzz-agent/src/types.rs b/crates/buzz-agent/src/types.rs
index d29e975e03b..a3d48a7cf12 100644
--- a/crates/buzz-agent/src/types.rs
+++ b/crates/buzz-agent/src/types.rs
@@ -1,5 +1,5 @@
 use serde::Deserialize;
-use serde_json::Value;
+use serde_json::{Map, Value};
 
 /// Byte-equivalent charged to the handoff/context-pressure gate for a single
 /// image tool result. The gate maps bytes to tokens at 1 byte/token (see
@@ -93,6 +93,13 @@ impl HistoryItem {
                                 + serde_json::to_vec(&c.arguments)
                                     .map(|b| b.len())
                                     .unwrap_or(0)
+                                // `provider_extra` (e.g. a Gemini
+                                // `thoughtSignature`) is re-serialized into
+                                // every replayed call, so it counts toward the
+                                // request body and the context-pressure gate.
+                                + serde_json::to_vec(&c.provider_extra)
+                                    .map(|b| b.len())
+                                    .unwrap_or(0)
                         })
                         .sum::<usize>()
             }
@@ -108,6 +115,17 @@ pub struct ToolCall {
     pub provider_id: String,
     pub name: String,
     pub arguments: Value,
+    /// Fields the provider put on the tool call that we do not model, kept so
+    /// the assistant turn can be replayed the way it arrived.
+    ///
+    /// Gemini on the Databricks MLflow route returns a `thoughtSignature` per
+    /// call and *requires* it echoed back: replaying without it fails the whole
+    /// request with `Function call is missing a thought_signature in functionCall
+    /// parts`. For an agent loop that lands on the very first tool call, so the
+    /// model is unusable without this. Carrying whatever we did not model,
+    /// rather than naming that one field, means the next provider with an opaque
+    /// per-call token needs no change here.
+    pub provider_extra: Map<String, Value>,
 }
 
 #[derive(Debug, Clone)]
@@ -139,6 +157,17 @@ pub struct LlmResponse {
     /// tokens, so reading it alone would undercount). Used to gate handoff on
     /// the real token budget rather than a byte estimate.
     pub input_tokens: Option<u64>,
+    /// The portion of `input_tokens` the provider served from its prompt cache,
+    /// or `None` when the response reported no cache split. Providers bill this
+    /// slice at a large discount (roughly 10x for both OpenAI and Anthropic),
+    /// so a consumer that prices all of `input_tokens` at the full rate
+    /// *overstates* cost — by a lot on an append-only agent loop, where most of
+    /// each request is a prefix the provider already has.
+    ///
+    /// This is a subset of `input_tokens`, never an addition to it: every
+    /// provider we speak to reports an inclusive input total, so adding this
+    /// would double-count.
+    pub cached_input_tokens: Option<u64>,
     /// Output tokens the provider reported for this request, or `None` if the
     /// response carried no usage. Used to accumulate per-turn output counts
     /// for NIP-AM metric publishing.
@@ -342,6 +371,39 @@ mod tests {
         assert!(item.estimated_bytes() >= 3_118_884);
     }
 
+    #[test]
+    fn assistant_size_counts_provider_extra() {
+        // A Gemini `thoughtSignature` rides the wire on every replayed call, so
+        // both size measures must see it — otherwise `truncate_history` and the
+        // handoff gate under-count and let the real request exceed the budget.
+        let mut extra = Map::new();
+        extra.insert("thoughtSignature".into(), Value::String("S".repeat(500)));
+        let with_extra = HistoryItem::Assistant {
+            text: String::new(),
+            tool_calls: vec![ToolCall {
+                provider_id: "id".into(),
+                name: "t".into(),
+                arguments: Value::Null,
+                provider_extra: extra,
+            }],
+        };
+        let without_extra = HistoryItem::Assistant {
+            text: String::new(),
+            tool_calls: vec![ToolCall {
+                provider_id: "id".into(),
+                name: "t".into(),
+                arguments: Value::Null,
+                provider_extra: Map::new(),
+            }],
+        };
+        assert!(with_extra.estimated_bytes() > without_extra.estimated_bytes() + 500);
+        assert_eq!(
+            with_extra.estimated_bytes(),
+            with_extra.context_pressure_bytes(),
+            "provider_extra is text, so both measures must agree"
+        );
+    }
+
     #[test]
     fn text_content_size_is_identical_for_both_measures() {
         // Only images diverge; text must size the same under both paths.
diff --git a/crates/buzz-cli/README.md b/crates/buzz-cli/README.md
index a8c668cf062..40699459fc0 100644
--- a/crates/buzz-cli/README.md
+++ b/crates/buzz-cli/README.md
@@ -57,6 +57,8 @@ buzz users get                          # your own profile
 buzz users get --pubkey <hex>           # single user
 buzz users get --pubkey <hex> --pubkey <hex>  # batch (max 200)
 buzz users set-presence --status online
+buzz users set-status --text "heads down on the CLI" --emoji "🚀"
+buzz users set-status --clear                 # remove your status
 
 # DMs
 buzz dms open --pubkey <hex>
@@ -133,6 +135,7 @@ stored rules in `validation_error` so an owner can remove and repair them.
 | | `set-profile` | Update your profile |
 | | `presence` | Get presence status |
 | | `set-presence` | Set presence status |
+| | `set-status` | Set or clear your NIP-38 profile status |
 | `workflows` | `list` | List workflows |
 | | `get` | Get workflow definition |
 | | `create` | Create a workflow |
diff --git a/crates/buzz-cli/TESTING.md b/crates/buzz-cli/TESTING.md
index 4b7257aba76..77234b7faab 100644
--- a/crates/buzz-cli/TESTING.md
+++ b/crates/buzz-cli/TESTING.md
@@ -87,7 +87,7 @@ export BUZZ_PRIVATE_KEY="nsec1..."   # from the mint output
 | `channels:read` | ✅ | `channels list`, `channels get`, `channels members` |
 | `channels:write` | ✅ | `channels create`, `channels update`, `channels join`, `channels leave`, `channels topic`, `channels purpose` |
 | `users:read` | ✅ | `users get`, `users presence` |
-| `users:write` | ✅ | `users set-profile`, `users set-presence` |
+| `users:write` | ✅ | `users set-profile`, `users set-presence`, `users set-status` |
 | `files:read` | ✅ | — |
 | `files:write` | ✅ | — |
 | `admin:channels` | ❌ | `channels archive`, `channels unarchive`, `channels delete`, `channels add-member`, `channels remove-member` |
@@ -331,6 +331,20 @@ buzz users set-presence --status online | jq .
 buzz users set-presence --status away | jq .
 buzz users set-presence --status offline | jq .
 # Note: set-presence may fail — kind:20001 is ephemeral and rejected by the HTTP bridge
+
+# users set-status — NIP-38 kind:30315 on the d:general coordinate
+buzz users set-status --text "reviewing PRs" --emoji "🔍" | jq .
+buzz users set-status --text "no emoji this time" | jq .
+
+# users set-status — emoji-only status (intentional: text is blank, emoji is kept)
+buzz users set-status --text "" --emoji "🎶" | jq .
+
+# users set-status --clear — removes the status (empty content, d:general only)
+buzz users set-status --clear | jq .
+
+# --clear is mutually exclusive with --text/--emoji
+buzz users set-status --clear --text "nope" 2>&1; echo "exit: $?"
+# Expected: exit 1 — clap conflict error
 ```
 
 ### 6.8 Channel Members (add/remove require admin:channels)
@@ -606,3 +620,4 @@ buzz channels delete --channel "$FORUM_ID" | jq .
 | 59 | `notes get` | ☐ | By name, by naddr, --content-only, cross-author, ambiguous → exit 1 |
 | 60 | `notes ls` | ☐ | Own, --author all, --tag, --limit |
 | 61 | `notes rm` | ☐ | Delete→get 404, double-delete idempotent, missing slug → NotFound |
+| 62 | `users set-status` | ☐ | Text+emoji, text only, emoji-only (`--text ""`), `--clear`, `--clear` + `--text` → exit 1 |
diff --git a/crates/buzz-cli/src/client.rs b/crates/buzz-cli/src/client.rs
index d0dd2677a9e..353e6717448 100644
--- a/crates/buzz-cli/src/client.rs
+++ b/crates/buzz-cli/src/client.rs
@@ -272,12 +272,17 @@ fn media_url_from_input(relay_url: &str, input: &str) -> Result<String, CliError
     if input.starts_with("http://") || input.starts_with("https://") {
         let parsed = url::Url::parse(input)
             .map_err(|e| CliError::Usage(format!("invalid media URL: {e}")))?;
-        if !parsed.path().starts_with("/media/") {
-            return Err(CliError::Usage(
-                "media URL must point at a /media/ path".to_string(),
-            ));
-        }
-        let Some(sha256_ext) = parsed.path().strip_prefix("/media/") else {
+        let relay = url::Url::parse(relay_url)
+            .map_err(|e| CliError::Usage(format!("invalid relay URL: {e}")))?;
+        // A relay served under a base path (BUZZ_BASE_PATH) hosts media at
+        // `<prefix>/media/<hash>`, so the relay URL's own path is stripped before
+        // the `/media/` check rather than assuming the relay owns the root.
+        let relay_prefix = relay.path().trim_end_matches('/');
+        let media_path = parsed
+            .path()
+            .strip_prefix(relay_prefix)
+            .unwrap_or(parsed.path());
+        let Some(sha256_ext) = media_path.strip_prefix("/media/") else {
             return Err(CliError::Usage(
                 "media URL must point at a /media/ path".to_string(),
             ));
@@ -287,8 +292,6 @@ fn media_url_from_input(relay_url: &str, input: &str) -> Result<String, CliError
                 "media path must be sha256, sha256.ext, or sha256.thumb.jpg".to_string(),
             ));
         }
-        let relay = url::Url::parse(relay_url)
-            .map_err(|e| CliError::Usage(format!("invalid relay URL: {e}")))?;
         if parsed.scheme() != relay.scheme()
             || parsed.host_str() != relay.host_str()
             || parsed.port_or_known_default() != relay.port_or_known_default()
@@ -401,6 +404,44 @@ mod media_download_tests {
         );
     }
 
+    /// A relay served under `BUZZ_BASE_PATH` hosts media at
+    /// `<prefix>/media/<hash>`, so both the sha shorthand and a full URL have to
+    /// work against a relay URL that carries a path.
+    #[test]
+    fn media_url_handles_a_relay_served_under_a_base_path() {
+        let hash = "a".repeat(64);
+        assert_eq!(
+            media_url_from_input("https://relay.example/relay", &format!("{hash}.jpg")).unwrap(),
+            format!("https://relay.example/relay/media/{hash}.jpg"),
+            "sha shorthand resolves under the prefix"
+        );
+        assert_eq!(
+            media_url_from_input(
+                "https://relay.example/relay",
+                &format!("https://relay.example/relay/media/{hash}.jpg")
+            )
+            .unwrap(),
+            format!("https://relay.example/relay/media/{hash}.jpg"),
+            "a full prefixed URL is accepted, not rejected as non-media"
+        );
+        assert!(
+            media_url_from_input(
+                "https://relay.example/relay",
+                &format!("https://relay.example/relay/media-evil/{hash}.jpg")
+            )
+            .is_err(),
+            "the /media/ requirement still holds inside the prefix"
+        );
+        assert!(
+            media_url_from_input(
+                "https://relay.example/relay",
+                &format!("https://evil.example/relay/media/{hash}.jpg")
+            )
+            .is_err(),
+            "origin pinning still holds under a prefix"
+        );
+    }
+
     #[test]
     fn media_url_accepts_only_same_relay_media_urls() {
         let hash = "a".repeat(64);
diff --git a/crates/buzz-cli/src/commands/users.rs b/crates/buzz-cli/src/commands/users.rs
index 3f8325b4b9d..f5a0bee8799 100644
--- a/crates/buzz-cli/src/commands/users.rs
+++ b/crates/buzz-cli/src/commands/users.rs
@@ -304,6 +304,22 @@ pub async fn cmd_set_presence(client: &BuzzClient, status: &str) -> Result<(), C
     Ok(())
 }
 
+/// Set user status — sign and submit a NIP-38 kind:30315 user status event.
+///
+/// Uses the `d:general` coordinate that the desktop client reads for the
+/// profile status line. A blank `text` with no `emoji` clears the status.
+pub async fn cmd_set_status(
+    client: &BuzzClient,
+    text: &str,
+    emoji: Option<&str>,
+) -> Result<(), CliError> {
+    let builder = buzz_sdk::build_user_status(text, emoji).map_err(crate::validate::sdk_err)?;
+    let event = client.sign_event(builder)?;
+    let resp = client.submit_event(event).await?;
+    println!("{}", normalize_write_response(&resp));
+    Ok(())
+}
+
 pub async fn dispatch(
     cmd: crate::UsersCmd,
     client: &BuzzClient,
@@ -331,6 +347,16 @@ pub async fn dispatch(
         }
         UsersCmd::Presence { pubkeys } => cmd_get_presence(client, &pubkeys).await,
         UsersCmd::SetPresence { status } => cmd_set_presence(client, &status.to_string()).await,
+        UsersCmd::SetStatus { text, emoji, clear } => {
+            // `--clear` is mutually exclusive with `--text`/`--emoji`: publish the
+            // empty `d:general` event that clients read as "no status".
+            let (text, emoji) = if clear {
+                ("", None)
+            } else {
+                (text.as_deref().unwrap_or_default(), emoji.as_deref())
+            };
+            cmd_set_status(client, text, emoji).await
+        }
     }
 }
 
diff --git a/crates/buzz-cli/src/lib.rs b/crates/buzz-cli/src/lib.rs
index 6ab81a082df..74656258040 100644
--- a/crates/buzz-cli/src/lib.rs
+++ b/crates/buzz-cli/src/lib.rs
@@ -82,11 +82,11 @@ struct Cli {
     relay: String,
 
     /// Nostr private key (hex or nsec). This is the CLI's identity.
-    #[arg(long, env = "BUZZ_PRIVATE_KEY")]
+    #[arg(long, env = "BUZZ_PRIVATE_KEY", hide_env_values = true)]
     private_key: Option<String>,
 
     /// NIP-OA auth tag JSON (owner attestation). Injected into every signed event.
-    #[arg(long, env = "BUZZ_AUTH_TAG")]
+    #[arg(long, env = "BUZZ_AUTH_TAG", hide_env_values = true)]
     auth_tag: Option<String>,
 
     /// Output format: 'json' (default, full fields) or 'compact' (reduced fields).
@@ -838,6 +838,19 @@ pub enum UsersCmd {
         #[arg(long, value_enum)]
         status: PresenceStatus,
     },
+    /// Set your user status (NIP-38 kind:30315 — the "status" line on your profile)
+    #[command(name = "set-status")]
+    SetStatus {
+        /// Status text (required unless --clear)
+        #[arg(long, required_unless_present = "clear")]
+        text: Option<String>,
+        /// Optional emoji shown before the status text
+        #[arg(long)]
+        emoji: Option<String>,
+        /// Remove your status entirely
+        #[arg(long, conflicts_with_all = ["text", "emoji"])]
+        clear: bool,
+    },
 }
 
 #[derive(Subcommand)]
@@ -1803,6 +1816,30 @@ mod tests {
         Cli::command().debug_assert();
     }
 
+    #[test]
+    fn set_status_clear_rejects_text_and_emoji() {
+        for extra in [["--text", "busy"], ["--emoji", "🎶"]] {
+            let args = ["buzz", "users", "set-status", "--clear"]
+                .into_iter()
+                .chain(extra);
+            assert!(
+                Cli::try_parse_from(args).is_err(),
+                "--clear must conflict with {}",
+                extra[0]
+            );
+        }
+    }
+
+    #[test]
+    fn set_status_requires_text_or_clear() {
+        assert!(Cli::try_parse_from(["buzz", "users", "set-status"]).is_err());
+        assert!(
+            Cli::try_parse_from(["buzz", "users", "set-status", "--emoji", "🎶"]).is_err(),
+            "--emoji alone must not imply a status"
+        );
+        assert!(Cli::try_parse_from(["buzz", "users", "set-status", "--clear"]).is_ok());
+    }
+
     #[test]
     fn command_inventory_is_stable() {
         let expected_groups: Vec<&str> = vec![
@@ -1924,7 +1961,13 @@ mod tests {
         );
         assert_eq!(
             names(&cmd, "users"),
-            vec!["get", "presence", "set-presence", "set-profile"]
+            vec![
+                "get",
+                "presence",
+                "set-presence",
+                "set-profile",
+                "set-status"
+            ]
         );
         assert_eq!(
             names(&cmd, "workflows"),
@@ -2011,7 +2054,7 @@ mod tests {
             ("repos", 4),
             ("social", 7),
             ("upload", 1),
-            ("users", 4),
+            ("users", 5),
             ("workflows", 8),
         ];
 
@@ -2032,4 +2075,46 @@ mod tests {
             );
         }
     }
+
+    /// Collect all args (recursing into subcommands) whose env var name looks
+    /// like a credential but does NOT have `hide_env_values` set.
+    fn collect_unhidden_secret_args(cmd: &clap::Command) -> Vec<(String, String)> {
+        const SECRET_PATTERNS: &[&str] = &["KEY", "SECRET", "TOKEN", "PASSWORD", "CRED", "AUTH"];
+
+        let mut violations: Vec<(String, String)> = Vec::new();
+
+        for arg in cmd.get_arguments() {
+            if let Some(env_key) = arg.get_env() {
+                let env_name = env_key.to_string_lossy().to_uppercase();
+                let is_secret = SECRET_PATTERNS.iter().any(|pat| env_name.contains(pat));
+                if is_secret && !arg.is_hide_env_values_set() {
+                    violations.push((cmd.get_name().to_string(), env_name));
+                }
+            }
+        }
+
+        for sub in cmd.get_subcommands() {
+            violations.extend(collect_unhidden_secret_args(sub));
+        }
+
+        violations
+    }
+
+    /// Every arg whose env var name contains KEY/SECRET/TOKEN/PASSWORD/CRED/AUTH
+    /// must set `hide_env_values = true` to prevent credential leakage in --help.
+    #[test]
+    fn secret_env_args_hide_their_values_in_help() {
+        let cmd = Cli::command();
+        let violations = collect_unhidden_secret_args(&cmd);
+        assert!(
+            violations.is_empty(),
+            "Found secret-bearing env args without hide_env_values=true. \
+             Add `hide_env_values = true` to each:\n{}",
+            violations
+                .iter()
+                .map(|(cmd, env)| format!("  command={cmd:?} env={env:?}"))
+                .collect::<Vec<_>>()
+                .join("\n")
+        );
+    }
 }
diff --git a/crates/buzz-core/Cargo.toml b/crates/buzz-core/Cargo.toml
index 489df360dd5..c55225adf60 100644
--- a/crates/buzz-core/Cargo.toml
+++ b/crates/buzz-core/Cargo.toml
@@ -11,6 +11,7 @@ description = "Core types, event verification, and filter matching for Buzz"
 test-utils = []
 
 [dependencies]
+base64     = { workspace = true }
 nostr      = { workspace = true }
 serde      = { workspace = true }
 serde_json = { workspace = true }
diff --git a/crates/buzz-core/src/invite.rs b/crates/buzz-core/src/invite.rs
new file mode 100644
index 00000000000..8f557c95aa2
--- /dev/null
+++ b/crates/buzz-core/src/invite.rs
@@ -0,0 +1,109 @@
+//! Shared pure contracts for relay invite links.
+//!
+//! The relay transport and database persistence layers both depend on
+//! `buzz-core`. Protocol constants and deterministic v2 code operations live
+//! here so neither layer becomes the accidental source of truth.
+
+use base64::engine::general_purpose::URL_SAFE_NO_PAD;
+use base64::Engine as _;
+use sha2::{Digest, Sha256};
+
+/// Minimum invite lifetime accepted by the mint API: 60 seconds.
+pub const MIN_INVITE_TTL_SECS: u64 = 60;
+
+/// Default invite lifetime when the mint request omits `ttl_secs`: 72 hours.
+pub const DEFAULT_INVITE_TTL_SECS: u64 = 72 * 60 * 60;
+
+/// Maximum invite lifetime accepted by the mint API: 30 days.
+pub const MAX_INVITE_TTL_SECS: u64 = 30 * 24 * 60 * 60;
+
+/// Maximum supported `max_uses` value. Matches the database constraint.
+pub const MAX_INVITE_USES: i32 = 10_000;
+
+/// Prefix that distinguishes v2 opaque database-backed codes from v1 tokens.
+pub const V2_PREFIX: &str = "v2.";
+
+/// Number of random bytes encoded in a v2 invite code.
+pub const V2_SECRET_LEN: usize = 32;
+
+/// A malformed v2 opaque invite code.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct InvalidV2InviteCode;
+
+/// Build a canonical v2 code from its random secret.
+pub fn encode_v2_code(secret: &[u8; V2_SECRET_LEN]) -> String {
+    format!("{V2_PREFIX}{}", URL_SAFE_NO_PAD.encode(secret))
+}
+
+/// Validate the canonical v2 opaque-code shape without consulting storage.
+///
+/// A valid code is exactly `v2.` followed by the unpadded base64url encoding
+/// of a 32-byte secret. The decode/re-encode comparison rejects aliases such
+/// as padded or otherwise non-canonical encodings.
+pub fn validate_v2_code(code: &str) -> Result<(), InvalidV2InviteCode> {
+    let encoded = code.strip_prefix(V2_PREFIX).ok_or(InvalidV2InviteCode)?;
+    let secret = URL_SAFE_NO_PAD
+        .decode(encoded)
+        .map_err(|_| InvalidV2InviteCode)?;
+    if secret.len() != V2_SECRET_LEN || URL_SAFE_NO_PAD.encode(&secret) != encoded {
+        return Err(InvalidV2InviteCode);
+    }
+    Ok(())
+}
+
+/// Hash the complete v2 code to the digest persisted by the database.
+pub fn hash_v2_code(code: &str) -> [u8; 32] {
+    Sha256::digest(code.as_bytes()).into()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn v2_code_round_trip_is_canonical() {
+        let secret = [7_u8; V2_SECRET_LEN];
+        let code = encode_v2_code(&secret);
+
+        assert_eq!(validate_v2_code(&code), Ok(()));
+        assert_eq!(
+            code,
+            format!("{V2_PREFIX}{}", URL_SAFE_NO_PAD.encode(secret))
+        );
+    }
+
+    #[test]
+    fn v2_validation_rejects_malformed_and_noncanonical_codes() {
+        let valid = encode_v2_code(&[7_u8; V2_SECRET_LEN]);
+        let short = format!(
+            "{V2_PREFIX}{}",
+            URL_SAFE_NO_PAD.encode([7_u8; V2_SECRET_LEN - 1])
+        );
+
+        for malformed in [
+            "v2.",
+            "v2.not-base64!",
+            short.as_str(),
+            &format!("{valid}="),
+        ] {
+            assert_eq!(
+                validate_v2_code(malformed),
+                Err(InvalidV2InviteCode),
+                "accepted malformed v2 code: {malformed}"
+            );
+        }
+    }
+
+    #[test]
+    fn v2_hash_covers_the_complete_code() {
+        let code = encode_v2_code(&[7_u8; V2_SECRET_LEN]);
+
+        let expected: [u8; 32] = Sha256::digest(code.as_bytes()).into();
+
+        assert_eq!(hash_v2_code(&code), expected);
+        assert_ne!(
+            hash_v2_code(&code),
+            hash_v2_code(code.trim_start_matches(V2_PREFIX))
+        );
+    }
+}
diff --git a/crates/buzz-core/src/lib.rs b/crates/buzz-core/src/lib.rs
index dd57b469378..66b7708f1d1 100644
--- a/crates/buzz-core/src/lib.rs
+++ b/crates/buzz-core/src/lib.rs
@@ -20,6 +20,8 @@ pub mod event;
 pub mod filter;
 /// Git permission types — ref patterns, protection rules, policy evaluation.
 pub mod git_perms;
+/// Shared invite-link contract constants.
+pub mod invite;
 /// Buzz kind number registry — custom event type constants.
 pub mod kind;
 /// Network utilities — SSRF-safe IP classification.
diff --git a/crates/buzz-db/Cargo.toml b/crates/buzz-db/Cargo.toml
index 23ea3c9d8fe..01f1e172b6e 100644
--- a/crates/buzz-db/Cargo.toml
+++ b/crates/buzz-db/Cargo.toml
@@ -20,6 +20,7 @@ sha2        = { workspace = true }
 tracing     = { workspace = true }
 thiserror   = { workspace = true }
 nostr       = { workspace = true }
+rand        = { workspace = true }
 
 [dev-dependencies]
 tokio = { workspace = true }
diff --git a/crates/buzz-db/src/admin_moderation.rs b/crates/buzz-db/src/admin_moderation.rs
index 2a0d2768947..31efaca3623 100644
--- a/crates/buzz-db/src/admin_moderation.rs
+++ b/crates/buzz-db/src/admin_moderation.rs
@@ -54,6 +54,31 @@ pub struct AdminReport {
     pub created_at: DateTime<Utc>,
 }
 
+/// Reported message details available only on the admin report detail read.
+#[derive(Debug, Clone, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct AdminReportedMessage {
+    /// Message author public key.
+    pub author_pubkey: String,
+    /// Complete message content.
+    pub content: String,
+    /// Timestamp signed into the message event.
+    pub created_at: DateTime<Utc>,
+    /// Soft-deletion time, when the message has since been deleted.
+    pub deleted_at: Option<DateTime<Utc>>,
+}
+
+/// Deployment-global moderation report detail.
+#[derive(Debug, Clone, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct AdminReportDetail {
+    /// Report metadata.
+    #[serde(flatten)]
+    pub report: AdminReport,
+    /// Reported message when the report targets a stored event.
+    pub message: Option<AdminReportedMessage>,
+}
+
 /// Deployment-global product feedback with source-community provenance.
 #[derive(Debug, Clone, Serialize)]
 #[serde(rename_all = "camelCase")]
@@ -128,24 +153,54 @@ pub async fn list_reports(
     rows.into_iter().map(row_to_report).collect()
 }
 
-/// Fetch one report globally by its row id.
-pub async fn get_report(pool: &PgPool, report_id: Uuid) -> Result<Option<AdminReport>> {
+/// Fetch one report globally by its row id, including its event target content.
+pub async fn get_report(pool: &PgPool, report_id: Uuid) -> Result<Option<AdminReportDetail>> {
     let row = sqlx::query(
         r#"
         SELECT r.id, r.community_id, c.host AS community_host,
                r.report_event_id, r.reporter_pubkey, r.target_kind,
                r.target_event_id, r.target_pubkey, r.target_blob_sha256,
                r.channel_id, r.report_type, r.note, r.status, r.resolved_by,
-               r.resolved_at, r.action_id, r.created_at
+               r.resolved_at, r.action_id, r.created_at,
+               target.pubkey AS message_author_pubkey,
+               target.content AS message_content,
+               target.created_at AS message_created_at,
+               target.deleted_at AS message_deleted_at
         FROM moderation_reports r
         JOIN communities c ON c.id = r.community_id
+        LEFT JOIN LATERAL (
+            SELECT e.pubkey, e.content, e.created_at, e.deleted_at
+            FROM events e
+            WHERE r.target_kind = 'event'
+              AND e.community_id = r.community_id
+              AND e.id = r.target_event_id
+            ORDER BY e.created_at DESC
+            LIMIT 1
+        ) target ON TRUE
         WHERE r.id = $1
         "#,
     )
     .bind(report_id)
     .fetch_optional(pool)
     .await?;
-    row.map(row_to_report).transpose()
+    row.map(|row| {
+        let message = row
+            .try_get::<Option<Vec<u8>>, _>("message_author_pubkey")?
+            .map(|author_pubkey| -> Result<AdminReportedMessage> {
+                Ok(AdminReportedMessage {
+                    author_pubkey: hex::encode(author_pubkey),
+                    content: row.try_get("message_content")?,
+                    created_at: row.try_get("message_created_at")?,
+                    deleted_at: row.try_get("message_deleted_at")?,
+                })
+            })
+            .transpose()?;
+        Ok(AdminReportDetail {
+            report: row_to_report(row)?,
+            message,
+        })
+    })
+    .transpose()
 }
 
 fn row_to_report(row: sqlx::postgres::PgRow) -> Result<AdminReport> {
@@ -228,3 +283,206 @@ fn row_to_feedback(row: sqlx::postgres::PgRow) -> Result<AdminFeedback> {
         received_at: row.try_get("received_at")?,
     })
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    const TEST_DB_URL: &str = "postgres://buzz:buzz_dev@localhost:5432/buzz";
+
+    async fn setup_pool() -> PgPool {
+        let database_url = std::env::var("BUZZ_TEST_DATABASE_URL")
+            .or_else(|_| std::env::var("DATABASE_URL"))
+            .unwrap_or_else(|_| TEST_DB_URL.to_owned());
+        PgPool::connect(&database_url)
+            .await
+            .expect("connect to test DB")
+    }
+
+    async fn insert_community(pool: &PgPool, label: &str) -> Uuid {
+        let id = Uuid::new_v4();
+        sqlx::query("INSERT INTO communities (id, host) VALUES ($1, $2)")
+            .bind(id)
+            .bind(format!("admin-report-{label}-{}.example", id.simple()))
+            .execute(pool)
+            .await
+            .expect("insert community");
+        id
+    }
+
+    async fn insert_event(
+        pool: &PgPool,
+        community_id: Uuid,
+        event_id: &[u8],
+        author: &[u8],
+        content: &str,
+        deleted_at: Option<DateTime<Utc>>,
+    ) {
+        sqlx::query(
+            r#"
+            INSERT INTO events (
+                community_id, id, pubkey, created_at, kind, tags, content, sig, deleted_at
+            ) VALUES ($1, $2, $3, $4, 9, '[]'::jsonb, $5, $6, $7)
+            "#,
+        )
+        .bind(community_id)
+        .bind(event_id)
+        .bind(author)
+        .bind(Utc::now())
+        .bind(content)
+        .bind(vec![3_u8; 64])
+        .bind(deleted_at)
+        .execute(pool)
+        .await
+        .expect("insert event");
+    }
+
+    async fn insert_event_report(
+        pool: &PgPool,
+        community_id: Uuid,
+        target_event_id: &[u8],
+    ) -> Uuid {
+        let id = Uuid::new_v4();
+        sqlx::query(
+            r#"
+            INSERT INTO moderation_reports (
+                community_id, id, report_event_id, reporter_pubkey,
+                target_kind, target_event_id, report_type
+            ) VALUES ($1, $2, $3, $4, 'event', $5, 'spam')
+            "#,
+        )
+        .bind(community_id)
+        .bind(id)
+        .bind(Uuid::new_v4().as_bytes().repeat(2))
+        .bind(vec![4_u8; 32])
+        .bind(target_event_id)
+        .execute(pool)
+        .await
+        .expect("insert report");
+        id
+    }
+
+    async fn insert_pubkey_report(pool: &PgPool, community_id: Uuid) -> Uuid {
+        let id = Uuid::new_v4();
+        sqlx::query(
+            r#"
+            INSERT INTO moderation_reports (
+                community_id, id, report_event_id, reporter_pubkey,
+                target_kind, target_pubkey, report_type
+            ) VALUES ($1, $2, $3, $4, 'pubkey', $5, 'spam')
+            "#,
+        )
+        .bind(community_id)
+        .bind(id)
+        .bind(Uuid::new_v4().as_bytes().repeat(2))
+        .bind(vec![4_u8; 32])
+        .bind(vec![7_u8; 32])
+        .execute(pool)
+        .await
+        .expect("insert report");
+        id
+    }
+
+    async fn delete_report_fixture(pool: &PgPool, community_id: Uuid) {
+        sqlx::query("DELETE FROM moderation_reports WHERE community_id = $1")
+            .bind(community_id)
+            .execute(pool)
+            .await
+            .expect("delete report fixture");
+        sqlx::query("DELETE FROM communities WHERE id = $1")
+            .bind(community_id)
+            .execute(pool)
+            .await
+            .expect("delete community fixture");
+    }
+
+    #[tokio::test]
+    #[ignore = "requires Postgres"]
+    async fn report_detail_reads_only_the_same_community_target_and_includes_deleted_content() {
+        let pool = setup_pool().await;
+        let report_community = insert_community(&pool, "reported").await;
+        let other_community = insert_community(&pool, "other").await;
+        let event_id = vec![1_u8; 32];
+        let deleted_at = Utc::now();
+        insert_event(
+            &pool,
+            report_community,
+            &event_id,
+            &[5_u8; 32],
+            "reported message",
+            Some(deleted_at),
+        )
+        .await;
+        insert_event(
+            &pool,
+            other_community,
+            &event_id,
+            &[6_u8; 32],
+            "wrong tenant message",
+            None,
+        )
+        .await;
+        let report_id = insert_event_report(&pool, report_community, &event_id).await;
+
+        let detail = get_report(&pool, report_id)
+            .await
+            .expect("query report")
+            .expect("report exists");
+        let message = detail.message.expect("reported message exists");
+        assert_eq!(message.content, "reported message");
+        assert_eq!(message.author_pubkey, hex::encode([5_u8; 32]));
+        assert!(message.deleted_at.is_some());
+
+        sqlx::query("DELETE FROM moderation_reports WHERE community_id = $1")
+            .bind(report_community)
+            .execute(&pool)
+            .await
+            .expect("delete report fixture");
+        sqlx::query("DELETE FROM events WHERE community_id = ANY($1)")
+            .bind(vec![report_community, other_community])
+            .execute(&pool)
+            .await
+            .expect("delete event fixtures");
+        sqlx::query("DELETE FROM communities WHERE id = ANY($1)")
+            .bind(vec![report_community, other_community])
+            .execute(&pool)
+            .await
+            .expect("delete community fixtures");
+    }
+
+    #[tokio::test]
+    #[ignore = "requires Postgres"]
+    async fn report_detail_has_no_message_for_non_event_target() {
+        let pool = setup_pool().await;
+        let community_id = insert_community(&pool, "pubkey-target").await;
+        let report_id = insert_pubkey_report(&pool, community_id).await;
+
+        let detail = get_report(&pool, report_id)
+            .await
+            .expect("query report")
+            .expect("report exists");
+        assert_eq!(detail.report.target_kind, "pubkey");
+        assert!(detail.message.is_none());
+
+        delete_report_fixture(&pool, community_id).await;
+    }
+
+    #[tokio::test]
+    #[ignore = "requires Postgres"]
+    async fn report_detail_has_no_message_when_event_row_is_missing() {
+        let pool = setup_pool().await;
+        let community_id = insert_community(&pool, "missing-event").await;
+        let missing_event_id = vec![8_u8; 32];
+        let report_id = insert_event_report(&pool, community_id, &missing_event_id).await;
+
+        let detail = get_report(&pool, report_id)
+            .await
+            .expect("query report")
+            .expect("report exists");
+        assert_eq!(detail.report.target_kind, "event");
+        assert_eq!(detail.report.target, hex::encode(missing_event_id));
+        assert!(detail.message.is_none());
+
+        delete_report_fixture(&pool, community_id).await;
+    }
+}
diff --git a/crates/buzz-db/src/lib.rs b/crates/buzz-db/src/lib.rs
index 9c63b2e8ab2..2a3ba9a63e2 100644
--- a/crates/buzz-db/src/lib.rs
+++ b/crates/buzz-db/src/lib.rs
@@ -39,6 +39,8 @@ pub mod product_feedback;
 pub mod push;
 /// Reaction persistence.
 pub mod reaction;
+/// Use-limited relay invite persistence (v2 opaque tokens).
+pub mod relay_invite;
 /// Relay-level membership persistence (NIP-43).
 pub mod relay_members;
 /// Replica freshness fence for keyset-cursor read routing.
@@ -563,7 +565,7 @@ impl Db {
     pub async fn admin_get_report(
         &self,
         id: Uuid,
-    ) -> Result<Option<admin_moderation::AdminReport>> {
+    ) -> Result<Option<admin_moderation::AdminReportDetail>> {
         admin_moderation::get_report(&self.pool, id).await
     }
 
@@ -2639,6 +2641,23 @@ impl Db {
         workflow::set_workflow_enabled(&self.pool, community_id, id, enabled).await
     }
 
+    /// Disable all of an owner's workflows in a channel (SEC-006, on
+    /// membership loss). Returns the number of workflows disabled.
+    pub async fn disable_workflows_for_owner_in_channel(
+        &self,
+        community_id: CommunityId,
+        channel_id: Uuid,
+        owner_pubkey: &[u8],
+    ) -> Result<u64> {
+        workflow::disable_workflows_for_owner_in_channel(
+            &self.pool,
+            community_id,
+            channel_id,
+            owner_pubkey,
+        )
+        .await
+    }
+
     /// Delete a workflow and all its runs/approvals.
     pub async fn delete_workflow(&self, community_id: CommunityId, id: Uuid) -> Result<()> {
         workflow::delete_workflow(&self.pool, community_id, id).await
@@ -3028,6 +3047,51 @@ impl Db {
         relay_members::backfill_from_allowlist(&self.pool, community).await
     }
 
+    /// Mints a v2 use-limited relay invite. The plaintext code is returned
+    /// exactly once; only its SHA-256 hash is persisted.
+    ///
+    /// `max_uses` is `None` for unlimited or `Some(1..=10000)`.
+    /// `ttl_secs` must be in the shared invite lifetime range.
+    pub async fn mint_relay_invite(
+        &self,
+        community: CommunityId,
+        created_by: &str,
+        ttl_secs: u64,
+        max_uses: Option<i32>,
+    ) -> Result<relay_invite::MintedInvite> {
+        relay_invite::mint_relay_invite(&self.pool, community, created_by, ttl_secs, max_uses).await
+    }
+
+    /// Delete one bounded batch of invites expired before `cutoff`.
+    pub async fn reap_expired_relay_invites(
+        &self,
+        cutoff: chrono::DateTime<chrono::Utc>,
+    ) -> Result<u64> {
+        relay_invite::reap_expired_relay_invites(&self.pool, cutoff).await
+    }
+
+    /// Atomically claims a v2 relay invite. The full redemption (membership
+    /// insert, policy evidence, use_count increment) runs in one PostgreSQL
+    /// transaction with `FOR UPDATE` on the invite row.
+    ///
+    /// `token_hash` is the SHA-256 of the presented v2 code (32 bytes).
+    pub async fn claim_relay_invite(
+        &self,
+        community: CommunityId,
+        token_hash: &[u8; 32],
+        claimer_pubkey: &str,
+        policy_version: Option<&str>,
+    ) -> Result<relay_invite::ClaimOutcome> {
+        relay_invite::claim_relay_invite(
+            &self.pool,
+            community,
+            token_hash,
+            claimer_pubkey,
+            policy_version,
+        )
+        .await
+    }
+
     /// Sidecar an accepted product-feedback event, idempotent by event id.
     pub async fn insert_product_feedback(
         &self,
diff --git a/crates/buzz-db/src/migration.rs b/crates/buzz-db/src/migration.rs
index 1674b0ec4d4..1d1b7e05d42 100644
--- a/crates/buzz-db/src/migration.rs
+++ b/crates/buzz-db/src/migration.rs
@@ -560,7 +560,7 @@ mod tests {
         let mut migrations: Vec<_> = MIGRATOR.iter().collect();
         migrations.sort_by_key(|migration| migration.version);
 
-        assert_eq!(migrations.len(), 24);
+        assert_eq!(migrations.len(), 25);
         assert_eq!(migrations[0].version, 1);
         assert_eq!(&*migrations[0].description, "initial schema");
         assert!(migrations[0]
@@ -879,6 +879,31 @@ mod tests {
             .to_lowercase()
             .contains("for update"));
         assert!(ttl_shared.contains("NEW.kind <> 9007"));
+
+        // Use-limited invite links: durable relay_invites table stores only
+        // the SHA-256 of an opaque v2 code, scoped by community_id. Never
+        // listed in _operator_global_tables — it is community-scoped.
+        assert_eq!(migrations[24].version, 25);
+        let relay_invites = migrations[24].sql.as_str();
+        assert!(relay_invites.contains("CREATE TABLE relay_invites"));
+        assert!(relay_invites
+            .contains("token_hash   BYTEA       NOT NULL CHECK (length(token_hash) = 32)"));
+        assert!(relay_invites.contains("PRIMARY KEY (community_id, id)"));
+        assert!(relay_invites.contains("UNIQUE (community_id, token_hash)"));
+        assert!(
+            relay_invites.contains("max_uses     INTEGER     CHECK (max_uses BETWEEN 1 AND 10000)")
+        );
+        assert!(relay_invites.contains("CHECK (max_uses IS NULL OR use_count <= max_uses)"));
+        assert!(relay_invites.contains("role = 'member'"));
+        assert!(relay_invites
+            .contains("CREATE INDEX relay_invites_expires_at_idx ON relay_invites (expires_at)"));
+        assert!(!relay_invites.contains("_operator_global_tables"));
+
+        let desired_schema = include_str!("../../../schema/schema.sql");
+        assert!(
+            desired_schema.contains("CREATE TABLE join_policy_acceptances"),
+            "desired-state schema must include join-policy evidence used by invite claims",
+        );
     }
 
     #[test]
@@ -1121,7 +1146,7 @@ mod tests {
         run_migrations(&pool)
             .await
             .expect("retry succeeds after operator repair");
-        assert_eq!(applied_versions(&pool).await.last().copied(), Some(24));
+        assert_eq!(applied_versions(&pool).await.last().copied(), Some(25));
     }
 
     #[tokio::test]
diff --git a/crates/buzz-db/src/relay_invite.rs b/crates/buzz-db/src/relay_invite.rs
new file mode 100644
index 00000000000..82b71b07bb0
--- /dev/null
+++ b/crates/buzz-db/src/relay_invite.rs
@@ -0,0 +1,671 @@
+//! Use-limited relay invite persistence (v2 opaque tokens).
+//!
+//! Unlike the stateless v1 HMAC invite tokens in `buzz-relay::invite_token`,
+//! v2 invites are backed by durable rows in `relay_invites`. The table stores
+//! only `SHA-256(code)` — never the reusable bearer secret — so a leaked
+//! database does not immediately yield valid invite codes.
+//!
+//! Every lookup binds both `(community_id, token_hash)` to prevent cross-tenant
+//! authorization seams: a code minted on tenant A presented to tenant B returns
+//! `Invalid`, not a membership.
+//!
+//! ## Atomic redemption
+//!
+//! `claim_relay_invite` executes the full redemption in one PostgreSQL
+//! transaction: `SELECT FOR UPDATE` on the invite row, membership insert,
+//! join-policy evidence insert, and `use_count` increment all commit together.
+//! `FOR UPDATE` serializes concurrent claims for one invite across relay
+//! processes — exactly one claimant can win the final slot.
+
+use buzz_core::invite::{
+    encode_v2_code, hash_v2_code, MAX_INVITE_TTL_SECS, MAX_INVITE_USES, MIN_INVITE_TTL_SECS,
+    V2_SECRET_LEN,
+};
+use chrono::{DateTime, Utc};
+use sqlx::{PgPool, Row as _};
+
+use crate::error::Result;
+use crate::CommunityId;
+
+/// Outcome of a v2 invite claim. Expected invalid/expired/exhausted states are
+/// typed variants so the relay layer can map them to distinct HTTP responses
+/// without inspecting database errors.
+#[derive(Debug, PartialEq)]
+pub enum ClaimOutcome {
+    /// A new relay member was inserted. `use_count` is the post-increment count;
+    /// `uses_remaining` is `None` for unlimited invites.
+    Joined {
+        /// Post-claim use count.
+        use_count: i32,
+        /// Remaining slots, or `None` when the invite is unlimited.
+        uses_remaining: Option<i32>,
+    },
+    /// The claimer was already a member. `use_count` was NOT incremented.
+    AlreadyMember {
+        /// Current use count (unchanged by this claim).
+        use_count: i32,
+        /// Remaining slots, or `None` when the invite is unlimited.
+        uses_remaining: Option<i32>,
+    },
+    /// The invite's `expires_at` has passed.
+    Expired,
+    /// The invite's use budget is fully consumed.
+    Exhausted,
+    /// No invite row matches `(community_id, token_hash)`.
+    Invalid,
+}
+
+/// A freshly minted v2 invite, including the plaintext code and metadata.
+#[derive(Debug)]
+pub struct MintedInvite {
+    /// The full v2 code string (`v2.<base64url secret>`). Returned to the caller
+    /// exactly once; the database stores only the SHA-256 hash.
+    pub code: String,
+    /// When the invite expires (UTC).
+    pub expires_at: DateTime<Utc>,
+    /// `None` means unlimited; `Some(n)` means at most `n` uses.
+    pub max_uses: Option<i32>,
+    /// Remaining uses at mint time (equals `max_uses` when bounded, `None`
+    /// when unlimited).
+    pub uses_remaining: Option<i32>,
+    /// The invite's database-generated UUID.
+    pub invite_id: uuid::Uuid,
+}
+
+fn validate_mint_inputs(ttl_secs: u64, max_uses: Option<i32>) -> Result<()> {
+    if !(MIN_INVITE_TTL_SECS..=MAX_INVITE_TTL_SECS).contains(&ttl_secs) {
+        return Err(crate::error::DbError::InvalidData(format!(
+            "ttl_secs must be between {MIN_INVITE_TTL_SECS} and {MAX_INVITE_TTL_SECS}"
+        )));
+    }
+
+    if let Some(max_uses) = max_uses {
+        if !(1..=MAX_INVITE_USES).contains(&max_uses) {
+            return Err(crate::error::DbError::InvalidData(format!(
+                "max_uses must be between 1 and {MAX_INVITE_USES}"
+            )));
+        }
+    }
+
+    Ok(())
+}
+
+/// Mint a v2 invite: generate a 32-byte random secret, hash it, persist the
+/// row, and return the plaintext code plus metadata.
+///
+/// `ttl_secs` must be in the shared invite lifetime range.
+/// `max_uses` must be `None` (unlimited) or `Some(1..=10000)`.
+pub async fn mint_relay_invite(
+    pool: &PgPool,
+    community: CommunityId,
+    created_by: &str,
+    ttl_secs: u64,
+    max_uses: Option<i32>,
+) -> Result<MintedInvite> {
+    validate_mint_inputs(ttl_secs, max_uses)?;
+
+    // Generate 32 random bytes and encode as base64url — this is the secret.
+    let secret: [u8; V2_SECRET_LEN] = rand::random();
+    let code = encode_v2_code(&secret);
+    let token_hash = hash_v2_code(&code);
+    let now = Utc::now();
+    let expires_at = now + chrono::Duration::seconds(ttl_secs as i64);
+
+    let row = sqlx::query(
+        "INSERT INTO relay_invites (community_id, token_hash, max_uses, expires_at, created_by) \
+         VALUES ($1, $2, $3, $4, $5) \
+         RETURNING id",
+    )
+    .bind(community.as_uuid())
+    .bind(token_hash.as_slice())
+    .bind(max_uses)
+    .bind(expires_at)
+    .bind(created_by)
+    .fetch_one(pool)
+    .await?;
+
+    let invite_id: uuid::Uuid = row.try_get("id")?;
+
+    Ok(MintedInvite {
+        code,
+        expires_at,
+        max_uses,
+        uses_remaining: max_uses,
+        invite_id,
+    })
+}
+
+fn log_claim_outcome(
+    community: CommunityId,
+    invite_id: Option<uuid::Uuid>,
+    outcome: &'static str,
+    max_uses: Option<i32>,
+    use_count: Option<i32>,
+) {
+    tracing::info!(
+        community = %community,
+        invite_id = ?invite_id,
+        outcome,
+        max_uses = ?max_uses,
+        use_count = ?use_count,
+        "relay invite claim completed"
+    );
+}
+
+/// Maximum rows deleted by one retention sweep so cleanup cannot monopolize
+/// the invite table on a busy deployment.
+const RETENTION_SWEEP_BATCH_SIZE: i64 = 1_000;
+
+/// Delete one bounded batch of invite rows expired before `cutoff`.
+///
+/// The relay calls this from its leader-only periodic tick. Ordering by the
+/// expiry index makes old rows drain first without turning cleanup into an
+/// unbounded transaction.
+pub async fn reap_expired_relay_invites(pool: &PgPool, cutoff: DateTime<Utc>) -> Result<u64> {
+    let result = sqlx::query(
+        "DELETE FROM relay_invites \
+         WHERE (community_id, id) IN (\
+             SELECT community_id, id FROM relay_invites \
+             WHERE expires_at < $1 \
+             ORDER BY expires_at \
+             LIMIT $2\
+         )",
+    )
+    .bind(cutoff)
+    .bind(RETENTION_SWEEP_BATCH_SIZE)
+    .execute(pool)
+    .await?;
+
+    Ok(result.rows_affected())
+}
+
+/// Atomically claim a v2 relay invite.
+///
+/// Executes the full redemption in one PostgreSQL transaction:
+/// 1. Hash the presented code.
+/// 2. `SELECT ... FOR UPDATE` on the invite row scoped by `(community, token_hash)`.
+/// 3. If no row → `Invalid`.
+/// 4. If `expires_at <= now()` → `Expired`.
+/// 5. Check existing membership.
+/// 6. If already a member → insert policy evidence (if configured), commit,
+///    return `AlreadyMember` (no increment).
+/// 7. If `max_uses` is set and `use_count >= max_uses` → `Exhausted`.
+/// 8. Insert relay member with role `member`, `added_by = 'invite'`.
+/// 9. Insert join-policy acceptance evidence (if configured).
+/// 10. Increment `use_count`.
+/// 11. Commit.
+///
+/// `FOR UPDATE` serializes concurrent claims so exactly one claimant wins the
+/// final slot. Membership insertion, policy evidence, and consumption share
+/// one commit — a failure in any rolls back all.
+pub async fn claim_relay_invite(
+    pool: &PgPool,
+    community: CommunityId,
+    token_hash: &[u8; 32],
+    claimer_pubkey: &str,
+    policy_version: Option<&str>,
+) -> Result<ClaimOutcome> {
+    let mut tx = pool.begin().await?;
+
+    // 2. SELECT FOR UPDATE — lock the invite row for the duration of this txn.
+    let row = sqlx::query(
+        "SELECT id, max_uses, use_count, expires_at \
+         FROM relay_invites \
+         WHERE community_id = $1 AND token_hash = $2 \
+         FOR UPDATE",
+    )
+    .bind(community.as_uuid())
+    .bind(token_hash)
+    .fetch_optional(&mut *tx)
+    .await?;
+
+    // 3. No matching invite.
+    let Some(invite) = row else {
+        tx.rollback().await?;
+        log_claim_outcome(community, None, "invalid", None, None);
+        return Ok(ClaimOutcome::Invalid);
+    };
+
+    let invite_id: uuid::Uuid = invite.try_get("id")?;
+    let max_uses: Option<i32> = invite.try_get("max_uses")?;
+    let use_count: i32 = invite.try_get("use_count")?;
+    let expires_at: DateTime<Utc> = invite.try_get("expires_at")?;
+
+    // Expiry is checked before membership deliberately. An expired bearer must
+    // not authorize fresh policy-acceptance evidence, even for an existing
+    // member; exhausted-but-live invites remain valid for idempotent retries.
+    if expires_at <= Utc::now() {
+        tx.rollback().await?;
+        log_claim_outcome(
+            community,
+            Some(invite_id),
+            "expired",
+            max_uses,
+            Some(use_count),
+        );
+        return Ok(ClaimOutcome::Expired);
+    }
+
+    let uses_remaining = || max_uses.map(|mu| mu - use_count);
+
+    // 5. Check existing membership.
+    let existing =
+        sqlx::query("SELECT 1 FROM relay_members WHERE community_id = $1 AND pubkey = $2")
+            .bind(community.as_uuid())
+            .bind(claimer_pubkey)
+            .fetch_optional(&mut *tx)
+            .await?;
+
+    if existing.is_some() {
+        // 6. Already a member — insert policy evidence but do NOT increment.
+        if let Some(version) = policy_version {
+            sqlx::query(
+                "INSERT INTO join_policy_acceptances (community_id, pubkey, policy_version) \
+                 VALUES ($1, $2, $3) ON CONFLICT DO NOTHING",
+            )
+            .bind(community.as_uuid())
+            .bind(claimer_pubkey)
+            .bind(version)
+            .execute(&mut *tx)
+            .await?;
+        }
+        tx.commit().await?;
+        log_claim_outcome(
+            community,
+            Some(invite_id),
+            "already_member",
+            max_uses,
+            Some(use_count),
+        );
+        return Ok(ClaimOutcome::AlreadyMember {
+            use_count,
+            uses_remaining: uses_remaining(),
+        });
+    }
+
+    // 7. Capacity check.
+    if let Some(mu) = max_uses {
+        if use_count >= mu {
+            tx.rollback().await?;
+            log_claim_outcome(
+                community,
+                Some(invite_id),
+                "exhausted",
+                max_uses,
+                Some(use_count),
+            );
+            return Ok(ClaimOutcome::Exhausted);
+        }
+    }
+
+    // 8. Insert relay member. The conflict branch covers a claimant admitted
+    // concurrently through a different invite: only the transaction that
+    // actually inserted membership may consume this invite.
+    let inserted = sqlx::query(
+        "INSERT INTO relay_members (community_id, pubkey, role, added_by) \
+         VALUES ($1, $2, 'member', 'invite') \
+         ON CONFLICT (community_id, pubkey) DO NOTHING",
+    )
+    .bind(community.as_uuid())
+    .bind(claimer_pubkey)
+    .execute(&mut *tx)
+    .await?
+    .rows_affected()
+        > 0;
+
+    // 9. Insert join-policy acceptance evidence. This is required for both a
+    // new member and a claimant whose concurrent membership insert won first.
+    if let Some(version) = policy_version {
+        sqlx::query(
+            "INSERT INTO join_policy_acceptances (community_id, pubkey, policy_version) \
+             VALUES ($1, $2, $3) ON CONFLICT DO NOTHING",
+        )
+        .bind(community.as_uuid())
+        .bind(claimer_pubkey)
+        .bind(version)
+        .execute(&mut *tx)
+        .await?;
+    }
+
+    if !inserted {
+        tx.commit().await?;
+        log_claim_outcome(
+            community,
+            Some(invite_id),
+            "already_member",
+            max_uses,
+            Some(use_count),
+        );
+        return Ok(ClaimOutcome::AlreadyMember {
+            use_count,
+            uses_remaining: uses_remaining(),
+        });
+    }
+
+    // 10. Increment use_count (for every new member, even unlimited).
+    let new_use_count = use_count + 1;
+    sqlx::query("UPDATE relay_invites SET use_count = $1 WHERE community_id = $2 AND id = $3")
+        .bind(new_use_count)
+        .bind(community.as_uuid())
+        .bind(invite_id)
+        .execute(&mut *tx)
+        .await?;
+
+    // 11. Commit.
+    tx.commit().await?;
+
+    let new_uses_remaining = max_uses.map(|mu| mu - new_use_count);
+
+    log_claim_outcome(
+        community,
+        Some(invite_id),
+        "joined",
+        max_uses,
+        Some(new_use_count),
+    );
+
+    Ok(ClaimOutcome::Joined {
+        use_count: new_use_count,
+        uses_remaining: new_uses_remaining,
+    })
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::relay_members::is_relay_member;
+    use sqlx::PgPool;
+    use uuid::Uuid;
+
+    const TEST_DB_URL: &str = "postgres://buzz:buzz_dev@localhost:5432/buzz"; // sadscan:disable np.postgres.1
+
+    async fn setup_pool() -> PgPool {
+        let database_url = std::env::var("BUZZ_TEST_DATABASE_URL")
+            .or_else(|_| std::env::var("DATABASE_URL"))
+            .unwrap_or_else(|_| TEST_DB_URL.to_owned());
+        PgPool::connect(&database_url)
+            .await
+            .expect("connect to test DB")
+    }
+
+    async fn make_test_community(pool: &PgPool) -> CommunityId {
+        let id = Uuid::new_v4();
+        sqlx::query("INSERT INTO communities (id, host) VALUES ($1, $2)")
+            .bind(id)
+            .bind(format!("relay-invite-test-{}.example", id.simple()))
+            .execute(pool)
+            .await
+            .expect("insert test community");
+        CommunityId::from_uuid(id)
+    }
+
+    async fn delete_test_community(pool: &PgPool, community: CommunityId) {
+        let mut tx = pool.begin().await.expect("begin test cleanup");
+        sqlx::query("DELETE FROM relay_invites WHERE community_id = $1")
+            .bind(community.as_uuid())
+            .execute(&mut *tx)
+            .await
+            .expect("delete test invites");
+        sqlx::query("DELETE FROM relay_members WHERE community_id = $1")
+            .bind(community.as_uuid())
+            .execute(&mut *tx)
+            .await
+            .expect("delete test members");
+        sqlx::query("DELETE FROM communities WHERE id = $1")
+            .bind(community.as_uuid())
+            .execute(&mut *tx)
+            .await
+            .expect("delete test community");
+        tx.commit().await.expect("commit test cleanup");
+    }
+
+    fn test_pubkey() -> String {
+        format!("{:064x}", Uuid::new_v4().as_u128())
+    }
+
+    async fn use_count(pool: &PgPool, community: CommunityId, invite_id: Uuid) -> i32 {
+        sqlx::query_scalar(
+            "SELECT use_count FROM relay_invites WHERE community_id = $1 AND id = $2",
+        )
+        .bind(community.as_uuid())
+        .bind(invite_id)
+        .fetch_one(pool)
+        .await
+        .expect("read invite use_count")
+    }
+
+    #[test]
+    fn mint_validation_rejects_invalid_bounds_before_database_access() {
+        for (ttl, max_uses) in [
+            (MIN_INVITE_TTL_SECS - 1, None),
+            (MAX_INVITE_TTL_SECS + 1, None),
+            (3600, Some(0)),
+            (3600, Some(-1)),
+            (3600, Some(MAX_INVITE_USES + 1)),
+        ] {
+            let error = validate_mint_inputs(ttl, max_uses).expect_err("invalid mint contract");
+            assert!(matches!(error, crate::DbError::InvalidData(_)), "{error:?}");
+        }
+    }
+
+    #[tokio::test]
+    #[ignore = "requires Postgres"]
+    async fn bounded_claim_exhausts_and_existing_member_retry_does_not_consume() {
+        let pool = setup_pool().await;
+        let community = make_test_community(&pool).await;
+        let first = test_pubkey();
+        let second = test_pubkey();
+        let invite = mint_relay_invite(&pool, community, "owner", 3600, Some(1))
+            .await
+            .expect("mint bounded invite");
+        let hash = hash_v2_code(&invite.code);
+
+        assert_eq!(
+            claim_relay_invite(&pool, community, &hash, &first, None)
+                .await
+                .expect("first claim"),
+            ClaimOutcome::Joined {
+                use_count: 1,
+                uses_remaining: Some(0),
+            }
+        );
+        assert_eq!(
+            claim_relay_invite(&pool, community, &hash, &first, None)
+                .await
+                .expect("idempotent retry"),
+            ClaimOutcome::AlreadyMember {
+                use_count: 1,
+                uses_remaining: Some(0),
+            }
+        );
+        assert_eq!(
+            claim_relay_invite(&pool, community, &hash, &second, None)
+                .await
+                .expect("exhausted claim"),
+            ClaimOutcome::Exhausted
+        );
+        assert_eq!(use_count(&pool, community, invite.invite_id).await, 1);
+        assert!(is_relay_member(&pool, community, &first)
+            .await
+            .expect("first membership"));
+        assert!(!is_relay_member(&pool, community, &second)
+            .await
+            .expect("second membership"));
+        delete_test_community(&pool, community).await;
+    }
+
+    #[tokio::test]
+    #[ignore = "requires Postgres"]
+    async fn concurrent_claims_serialize_the_final_slot() {
+        let pool = setup_pool().await;
+        let community = make_test_community(&pool).await;
+        let first = test_pubkey();
+        let second = test_pubkey();
+        let invite = mint_relay_invite(&pool, community, "owner", 3600, Some(1))
+            .await
+            .expect("mint bounded invite");
+        let hash = hash_v2_code(&invite.code);
+
+        let (first_outcome, second_outcome) = tokio::join!(
+            claim_relay_invite(&pool, community, &hash, &first, None),
+            claim_relay_invite(&pool, community, &hash, &second, None),
+        );
+        let outcomes = [
+            first_outcome.expect("first concurrent claim"),
+            second_outcome.expect("second concurrent claim"),
+        ];
+        assert_eq!(
+            outcomes
+                .iter()
+                .filter(|outcome| matches!(outcome, ClaimOutcome::Joined { .. }))
+                .count(),
+            1
+        );
+        assert_eq!(
+            outcomes
+                .iter()
+                .filter(|outcome| matches!(outcome, ClaimOutcome::Exhausted))
+                .count(),
+            1
+        );
+        assert_eq!(use_count(&pool, community, invite.invite_id).await, 1);
+        let admitted = is_relay_member(&pool, community, &first)
+            .await
+            .expect("first membership") as u8
+            + is_relay_member(&pool, community, &second)
+                .await
+                .expect("second membership") as u8;
+        assert_eq!(admitted, 1);
+        delete_test_community(&pool, community).await;
+    }
+
+    #[tokio::test]
+    #[ignore = "requires Postgres"]
+    async fn expiry_and_tenant_scope_return_typed_failures() {
+        let pool = setup_pool().await;
+        let community_a = make_test_community(&pool).await;
+        let community_b = make_test_community(&pool).await;
+        let invite = mint_relay_invite(&pool, community_a, "owner", 3600, Some(2))
+            .await
+            .expect("mint invite");
+        let hash = hash_v2_code(&invite.code);
+
+        assert_eq!(
+            claim_relay_invite(&pool, community_b, &hash, &test_pubkey(), None)
+                .await
+                .expect("cross-tenant claim"),
+            ClaimOutcome::Invalid
+        );
+
+        sqlx::query(
+            "UPDATE relay_invites SET expires_at = now() - interval '1 second' \
+             WHERE community_id = $1 AND id = $2",
+        )
+        .bind(community_a.as_uuid())
+        .bind(invite.invite_id)
+        .execute(&pool)
+        .await
+        .expect("expire invite");
+        assert_eq!(
+            claim_relay_invite(&pool, community_a, &hash, &test_pubkey(), None)
+                .await
+                .expect("expired claim"),
+            ClaimOutcome::Expired
+        );
+        assert_eq!(use_count(&pool, community_a, invite.invite_id).await, 0);
+        delete_test_community(&pool, community_a).await;
+        delete_test_community(&pool, community_b).await;
+    }
+
+    #[tokio::test]
+    #[ignore = "requires Postgres"]
+    async fn retention_sweep_deletes_only_invites_older_than_cutoff() {
+        let pool = setup_pool().await;
+        let community = make_test_community(&pool).await;
+        let old = mint_relay_invite(&pool, community, "owner", 3600, Some(1))
+            .await
+            .expect("mint old invite");
+        let recent = mint_relay_invite(&pool, community, "owner", 3600, Some(1))
+            .await
+            .expect("mint recent invite");
+        let cutoff = Utc::now() - chrono::Duration::days(30);
+
+        sqlx::query("UPDATE relay_invites SET expires_at = $1 WHERE community_id = $2 AND id = $3")
+            .bind(cutoff - chrono::Duration::seconds(1))
+            .bind(community.as_uuid())
+            .bind(old.invite_id)
+            .execute(&pool)
+            .await
+            .expect("age old invite");
+
+        assert_eq!(
+            reap_expired_relay_invites(&pool, cutoff)
+                .await
+                .expect("reap expired invites"),
+            1
+        );
+        let remaining: Vec<Uuid> =
+            sqlx::query_scalar("SELECT id FROM relay_invites WHERE community_id = $1 ORDER BY id")
+                .bind(community.as_uuid())
+                .fetch_all(&pool)
+                .await
+                .expect("read remaining invites");
+        assert_eq!(remaining, vec![recent.invite_id]);
+
+        delete_test_community(&pool, community).await;
+    }
+
+    #[tokio::test]
+    #[ignore = "requires Postgres"]
+    async fn unlimited_invites_count_each_new_member() {
+        let pool = setup_pool().await;
+        let community = make_test_community(&pool).await;
+        let invite = mint_relay_invite(&pool, community, "owner", 3600, None)
+            .await
+            .expect("mint unlimited invite");
+        let hash = hash_v2_code(&invite.code);
+
+        for (expected_count, pubkey) in [(1, test_pubkey()), (2, test_pubkey())] {
+            assert_eq!(
+                claim_relay_invite(&pool, community, &hash, &pubkey, None)
+                    .await
+                    .expect("unlimited claim"),
+                ClaimOutcome::Joined {
+                    use_count: expected_count,
+                    uses_remaining: None,
+                }
+            );
+        }
+        assert_eq!(use_count(&pool, community, invite.invite_id).await, 2);
+        delete_test_community(&pool, community).await;
+    }
+
+    #[tokio::test]
+    #[ignore = "requires Postgres"]
+    async fn policy_evidence_failure_rolls_back_membership_and_consumption() {
+        let pool = setup_pool().await;
+        let community = make_test_community(&pool).await;
+        let pubkey = test_pubkey();
+        let invite = mint_relay_invite(&pool, community, "owner", 3600, Some(1))
+            .await
+            .expect("mint bounded invite");
+        let hash = hash_v2_code(&invite.code);
+
+        let error = claim_relay_invite(&pool, community, &hash, &pubkey, Some("too-short"))
+            .await
+            .expect_err("policy CHECK must reject an invalid version");
+        assert!(matches!(error, crate::DbError::Sqlx(_)), "{error:?}");
+        assert!(!is_relay_member(&pool, community, &pubkey)
+            .await
+            .expect("membership after rollback"));
+        assert_eq!(use_count(&pool, community, invite.invite_id).await, 0);
+
+        assert!(matches!(
+            claim_relay_invite(&pool, community, &hash, &pubkey, None)
+                .await
+                .expect("claim after rollback"),
+            ClaimOutcome::Joined { use_count: 1, .. }
+        ));
+        delete_test_community(&pool, community).await;
+    }
+}
diff --git a/crates/buzz-db/src/workflow.rs b/crates/buzz-db/src/workflow.rs
index 9c02f162c90..7a2396c1fd7 100644
--- a/crates/buzz-db/src/workflow.rs
+++ b/crates/buzz-db/src/workflow.rs
@@ -707,6 +707,36 @@ pub async fn set_workflow_enabled(
     Ok(())
 }
 
+/// Disable all of `owner_pubkey`'s workflows in a channel (SEC-006).
+///
+/// Called when the owner loses channel membership (kind 9001 removal or kind
+/// 9022 leave) so their workflows stop firing durably — across pods and
+/// restarts — rather than only until the per-fire authority gate happens to
+/// run. Idempotent; returns the number of workflows disabled so the caller
+/// can decide whether a trigger-cache invalidation is needed.
+pub async fn disable_workflows_for_owner_in_channel(
+    pool: &PgPool,
+    community_id: CommunityId,
+    channel_id: Uuid,
+    owner_pubkey: &[u8],
+) -> Result<u64> {
+    let affected = sqlx::query(
+        r#"
+        UPDATE workflows
+        SET enabled = FALSE
+        WHERE community_id = $1 AND channel_id = $2 AND owner_pubkey = $3 AND enabled = TRUE
+        "#,
+    )
+    .bind(community_id.as_uuid())
+    .bind(channel_id)
+    .bind(owner_pubkey)
+    .execute(pool)
+    .await?
+    .rows_affected();
+
+    Ok(affected)
+}
+
 /// Delete a workflow and all its runs/approvals (CASCADE).
 ///
 /// NOTE: see the cache-invalidation note on [`update_workflow`]. The relay's
@@ -2272,4 +2302,100 @@ mod tests {
             "B's approval must remain pending after A is granted"
         );
     }
+
+    // -- SEC-006: disable-on-membership-loss primitive -------------------------
+
+    /// `disable_workflows_for_owner_in_channel` must disable exactly the
+    /// departing owner's enabled workflows in that channel — not other owners'
+    /// workflows, not the same owner's workflows in other channels — and be
+    /// idempotent. Disabled workflows must drop out of the trigger-path list.
+    #[tokio::test]
+    #[ignore = "requires Postgres"]
+    async fn disable_for_owner_scopes_to_owner_and_channel() {
+        let pool = setup_pool().await;
+        let community = make_community(&pool).await;
+
+        let departing = vec![0xd1; 32];
+        let staying = vec![0xd2; 32];
+        ensure_user(&pool, community, &departing)
+            .await
+            .expect("ensure departing");
+        ensure_user(&pool, community, &staying)
+            .await
+            .expect("ensure staying");
+
+        let channel_a = make_channel(&pool, community, &departing).await;
+        let channel_b = make_channel(&pool, community, &departing).await;
+
+        let def = r#"{"trigger":{"on":"message_posted"},"steps":[]}"#;
+        let wf_departing_a = create_workflow(
+            &pool,
+            community,
+            Some(channel_a),
+            &departing,
+            "departing-a",
+            def,
+            &[0u8; 32],
+        )
+        .await
+        .expect("wf departing a");
+        let wf_departing_b = create_workflow(
+            &pool,
+            community,
+            Some(channel_b),
+            &departing,
+            "departing-b",
+            def,
+            &[0u8; 32],
+        )
+        .await
+        .expect("wf departing b");
+        let wf_staying_a = create_workflow(
+            &pool,
+            community,
+            Some(channel_a),
+            &staying,
+            "staying-a",
+            def,
+            &[0u8; 32],
+        )
+        .await
+        .expect("wf staying a");
+
+        let disabled =
+            disable_workflows_for_owner_in_channel(&pool, community, channel_a, &departing)
+                .await
+                .expect("disable");
+        assert_eq!(
+            disabled, 1,
+            "exactly the departing owner's channel-A workflow"
+        );
+
+        // Idempotent: second call finds nothing enabled.
+        let again = disable_workflows_for_owner_in_channel(&pool, community, channel_a, &departing)
+            .await
+            .expect("disable again");
+        assert_eq!(again, 0, "second disable must be a no-op");
+
+        let enabled_a = list_enabled_channel_workflows(&pool, community, channel_a)
+            .await
+            .expect("list channel a");
+        let enabled_a_ids: Vec<Uuid> = enabled_a.iter().map(|w| w.id).collect();
+        assert!(
+            !enabled_a_ids.contains(&wf_departing_a),
+            "departing owner's workflow must no longer be trigger-eligible"
+        );
+        assert!(
+            enabled_a_ids.contains(&wf_staying_a),
+            "other owners' workflows in the channel must be untouched"
+        );
+
+        let enabled_b = list_enabled_channel_workflows(&pool, community, channel_b)
+            .await
+            .expect("list channel b");
+        assert!(
+            enabled_b.iter().any(|w| w.id == wf_departing_b),
+            "same owner's workflow in a different channel must be untouched"
+        );
+    }
 }
diff --git a/crates/buzz-dev-mcp/src/shim.rs b/crates/buzz-dev-mcp/src/shim.rs
index 36a07a18ca4..cccf0e6eca1 100644
--- a/crates/buzz-dev-mcp/src/shim.rs
+++ b/crates/buzz-dev-mcp/src/shim.rs
@@ -171,15 +171,126 @@ fn derive_git_email(pubkey_hex: &str) -> String {
     format!("{pubkey_hex}@{host}")
 }
 
+/// Stable identity contract for git attribution: the bare agent display name,
+/// never channel-qualified, safe to embed in commit history.
+///
+/// Deliberately distinct from `BUZZ_ACP_SESSION_TITLE`, which is per-session UI
+/// chrome and may be composed (`Agent · #channel`) by consumers. Commits
+/// outlive sessions, so git attribution must not follow a mutable title.
+///
+/// Nothing writes this yet — when unset, [`build_git_env`] falls back to the
+/// npub, which is byte-for-byte today's behavior.
+const DISPLAY_NAME_ENV_VAR: &str = "BUZZ_ACP_DISPLAY_NAME";
+
+/// Max characters in a git author name. Nostr display names are unbounded.
+const MAX_GIT_USER_NAME_CHARS: usize = 80;
+
+/// Characters git's `ident.c` treats as "crud": stripped from both ends of a
+/// name, and — when a name is *nothing but* these — rejected outright with
+/// `fatal: name consists only of disallowed characters`.
+///
+/// Verified empirically against git 2.54.0 by committing with each ASCII byte
+/// 32..=126 as the entire `user.name`: exactly space, `"`, `'`, `,`, `:`, `;`,
+/// `<`, `>`, and `\` abort. Control characters abort too (the predicate is
+/// `c <= 32`). Note `.` is *not* crud in this version despite older lore.
+fn is_git_crud(c: char) -> bool {
+    c <= ' ' || matches!(c, '"' | '\'' | ',' | ':' | ';' | '<' | '>' | '\\')
+}
+
+/// Characters in Unicode general category `Cf` (format): zero-width space and
+/// joiners, bidi embedding/override marks, invisible math operators, interlinear
+/// annotations, and tag characters.
+///
+/// `char::is_control` covers only `Cc`, so every one of these survives it — and
+/// none is whitespace or [`is_git_crud`]. A display name of nothing but U+200B
+/// ZERO WIDTH SPACE would therefore satisfy the "at least one non-crud
+/// character" gate and hand git a visually blank author instead of falling back
+/// to the npub. An embedded U+202E RIGHT-TO-LEFT OVERRIDE is worse: it makes a
+/// commit's persisted author line render as something other than what it says,
+/// the same confusion the angle-bracket filter exists to prevent.
+///
+/// The whole category is rejected rather than the two known-bad marks, because
+/// the boundary that matters is "invisible or reorders text", not "the codepoint
+/// someone thought of". Ranges transcribed from the UCD's
+/// `DerivedGeneralCategory.txt` (17.0.0) and independently cross-checked against
+/// Python's `unicodedata` (16.0.0); both yield exactly these 21 ranges. Inlined
+/// rather than taking a Unicode-tables dependency for one predicate.
+fn is_unicode_format(c: char) -> bool {
+    matches!(c,
+        '\u{00AD}'
+        | '\u{0600}'..='\u{0605}'
+        | '\u{061C}'
+        | '\u{06DD}'
+        | '\u{070F}'
+        | '\u{0890}'..='\u{0891}'
+        | '\u{08E2}'
+        | '\u{180E}'
+        | '\u{200B}'..='\u{200F}'
+        | '\u{202A}'..='\u{202E}'
+        | '\u{2060}'..='\u{2064}'
+        | '\u{2066}'..='\u{206F}'
+        | '\u{FEFF}'
+        | '\u{FFF9}'..='\u{FFFB}'
+        | '\u{110BD}'
+        | '\u{110CD}'
+        | '\u{13430}'..='\u{1343F}'
+        | '\u{1BCA0}'..='\u{1BCA3}'
+        | '\u{1D173}'..='\u{1D17A}'
+        | '\u{E0001}'
+        | '\u{E0020}'..='\u{E007F}'
+    )
+}
+
+/// Normalize a Buzz display name into a git author name, or `None` to fall
+/// back to the npub.
+///
+/// Strips control and Unicode format characters plus angle brackets, collapses
+/// whitespace runs, trims, and caps at [`MAX_GIT_USER_NAME_CHARS`] by `chars()`
+/// so a multi-byte name cannot be split mid-UTF-8. Angle brackets go because git
+/// silently drops them rather than erroring — `Duncan <evil@x.com>` would
+/// render as `Duncan evil@x.com <hex@relay>`, which forges nothing but reads as
+/// though it might.
+///
+/// Returns `None` unless at least one non-crud character survives. A bare
+/// emptiness check is not sufficient: git rejects a name built only of crud,
+/// so a display name of `;;` or `""` would abort **every commit** the agent
+/// makes. Falling back to the npub keeps the agent able to commit.
+fn sanitize_git_user_name(raw: &str) -> Option<String> {
+    let collapsed = raw
+        .split_whitespace()
+        .map(|word| {
+            word.chars()
+                .filter(|c| !c.is_control() && !is_unicode_format(*c) && *c != '<' && *c != '>')
+                .collect::<String>()
+        })
+        .filter(|word| !word.is_empty())
+        .collect::<Vec<_>>()
+        .join(" ");
+    let name: String = collapsed
+        .chars()
+        .take(MAX_GIT_USER_NAME_CHARS)
+        .collect::<String>()
+        .trim_end()
+        .to_string();
+    name.chars().any(|c| !is_git_crud(c)).then_some(name)
+}
+
 /// Build GIT_CONFIG_COUNT/KEY/VALUE env vars for ephemeral nostr git config.
 /// Composes with any existing GIT_CONFIG_COUNT in the environment. When launched
 /// via buzz-agent (which clears env), the base is always 0 — composition only
 /// matters when dev-mcp is run directly with pre-existing GIT_CONFIG vars.
 fn build_git_env(info: &KeyInfo) -> Vec<(String, String)> {
     let email = derive_git_email(&info.pubkey_hex);
+    // Display name for humans reading `git log`; the pubkey stays in the email,
+    // which is what NIP-98 auth, NIP-GS signing, and contributor matching key on.
+    let user_name = std::env::var(DISPLAY_NAME_ENV_VAR)
+        .ok()
+        .as_deref()
+        .and_then(sanitize_git_user_name)
+        .unwrap_or_else(|| info.npub.clone());
     let entries: Vec<(&str, String)> = vec![
-        // Identity — npub as display name, NIP-05-style email
-        ("user.name", info.npub.clone()),
+        // Identity — Buzz display name (npub fallback), NIP-05-style email
+        ("user.name", user_name),
         ("user.email", email),
         // Nostr credential helper is additive — it silently declines non-Buzz
         // remotes (exits 0, no credential), so git falls through to system
@@ -246,3 +357,339 @@ pub fn artifact_dir(session_root: &Path) -> PathBuf {
     let _ = std::fs::create_dir_all(&p);
     p
 }
+
+#[cfg(test)]
+mod git_user_name_tests {
+    use super::{
+        build_git_env, is_git_crud, is_unicode_format, sanitize_git_user_name, KeyInfo,
+        MAX_GIT_USER_NAME_CHARS,
+    };
+    use std::sync::Mutex;
+
+    /// Env-var-touching tests must run serially — env vars are process-global.
+    static ENV_LOCK: Mutex<()> = Mutex::new(());
+
+    const PUBKEY_HEX: &str = "dcfd242e557282d7a1e2cf2e6877522682f1e5c6156dc92ca7d90eaedd3b0f95";
+    const NPUB: &str = "npub1mn7jgtj4w2pd0g0zeuhxsa6jy6p0rewxz4kujt98my82ahfmp72sxjexk7";
+
+    fn key_info() -> KeyInfo {
+        KeyInfo {
+            keyfile_path: "/tmp/.nostr-key".into(),
+            pubkey_hex: PUBKEY_HEX.into(),
+            npub: NPUB.into(),
+        }
+    }
+
+    /// Read a git config value back out of the flat GIT_CONFIG_KEY_n/VALUE_n pairs.
+    fn git_config(env: &[(String, String)], key: &str) -> Option<String> {
+        let idx = env
+            .iter()
+            .find(|(k, v)| k.starts_with("GIT_CONFIG_KEY_") && v == key)?
+            .0
+            .strip_prefix("GIT_CONFIG_KEY_")?
+            .to_owned();
+        env.iter()
+            .find(|(k, _)| *k == format!("GIT_CONFIG_VALUE_{idx}"))
+            .map(|(_, v)| v.clone())
+    }
+
+    #[test]
+    fn test_ordinary_name_passes_through_unchanged() {
+        assert_eq!(sanitize_git_user_name("Duncan"), Some("Duncan".into()));
+    }
+
+    #[test]
+    fn test_angle_brackets_are_stripped_so_no_second_email_is_rendered() {
+        // git drops the brackets itself and renders `Duncan evil@x.com
+        // <hex@relay>` — no forgery, but a confusing author line.
+        assert_eq!(
+            sanitize_git_user_name("Duncan <evil@x.com>"),
+            Some("Duncan evil@x.com".into())
+        );
+    }
+
+    #[test]
+    fn test_whitespace_control_characters_become_a_single_separator() {
+        // Newline, tab and carriage return are whitespace: they collapse to one
+        // space like any other run, so a multi-line name stays readable.
+        assert_eq!(
+            sanitize_git_user_name("Dun\ncan\tThe\r\nIdaho"),
+            Some("Dun can The Idaho".into())
+        );
+    }
+
+    #[test]
+    fn test_non_whitespace_control_characters_are_dropped_outright() {
+        // NUL is the important one: an interior NUL makes `Command::env` fail
+        // the entire spawn upstream, so it must never survive to git config.
+        let got = sanitize_git_user_name("Idaho\0Blade\u{7}").expect("non-empty");
+        assert_eq!(got, "IdahoBlade");
+        assert!(!got.chars().any(char::is_control));
+    }
+
+    #[test]
+    fn test_internal_whitespace_runs_collapse_to_one_space() {
+        assert_eq!(
+            sanitize_git_user_name("  Duncan   Idaho  "),
+            Some("Duncan Idaho".into())
+        );
+    }
+
+    #[test]
+    fn test_whitespace_only_name_falls_back_to_npub() {
+        assert_eq!(sanitize_git_user_name("   \t\n  "), None);
+    }
+
+    #[test]
+    fn test_empty_name_falls_back_to_npub() {
+        assert_eq!(sanitize_git_user_name(""), None);
+    }
+
+    #[test]
+    fn test_crud_only_name_falls_back_rather_than_aborting_every_commit() {
+        // git rejects a name built only of crud with `fatal: name consists
+        // only of disallowed characters`, which would break EVERY commit the
+        // agent makes. Verified against git 2.54.0.
+        for raw in ["<>", ";;", "\"\"", "''", ",", ":", "\\", ",;:"] {
+            assert_eq!(
+                sanitize_git_user_name(raw),
+                None,
+                "crud-only name {raw:?} must fall back to the npub"
+            );
+        }
+    }
+
+    #[test]
+    fn test_crud_mixed_with_real_characters_is_kept() {
+        // Legitimate names contain crud; only an all-crud result is fatal.
+        assert_eq!(sanitize_git_user_name("O'Brien"), Some("O'Brien".into()));
+        assert_eq!(
+            sanitize_git_user_name("Smith, Jr."),
+            Some("Smith, Jr.".into())
+        );
+    }
+
+    #[test]
+    fn test_over_length_name_is_truncated_to_the_cap() {
+        let long = "a".repeat(200);
+        let got = sanitize_git_user_name(&long).expect("non-empty");
+        assert_eq!(got.chars().count(), MAX_GIT_USER_NAME_CHARS);
+    }
+
+    #[test]
+    fn test_truncation_never_splits_a_multibyte_character() {
+        let long = "🐝".repeat(200);
+        let got = sanitize_git_user_name(&long).expect("non-empty");
+        assert_eq!(got.chars().count(), MAX_GIT_USER_NAME_CHARS);
+        assert!(got.chars().all(|c| c == '🐝'), "no replacement chars");
+    }
+
+    #[test]
+    fn test_truncation_does_not_leave_a_trailing_space() {
+        // Cutting mid-word would otherwise strand the separator at the end.
+        let raw = format!("{} tail", "a".repeat(MAX_GIT_USER_NAME_CHARS - 1));
+        let got = sanitize_git_user_name(&raw).expect("non-empty");
+        assert!(!got.ends_with(' '), "got {got:?}");
+    }
+
+    #[test]
+    fn test_non_ascii_names_survive() {
+        assert_eq!(
+            sanitize_git_user_name("Élodie 🐝"),
+            Some("Élodie 🐝".into())
+        );
+    }
+
+    #[test]
+    fn test_format_only_name_falls_back_to_npub() {
+        // U+200B is neither control, nor whitespace, nor crud, so before Cf
+        // filtering this passed the non-crud gate and handed git a visually
+        // blank author instead of falling back.
+        assert_eq!(sanitize_git_user_name("\u{200B}\u{200B}"), None);
+        // Same class, different marks: joiner, word joiner, BOM, bidi override.
+        for raw in ["\u{200D}", "\u{2060}", "\u{FEFF}", "\u{202E}", "\u{00AD}"] {
+            assert_eq!(
+                sanitize_git_user_name(raw),
+                None,
+                "format-only name {raw:?} must fall back to the npub"
+            );
+        }
+    }
+
+    #[test]
+    fn test_bidi_override_is_stripped_and_the_name_is_kept() {
+        // A trailing RLO would reorder everything after it in `git log`, so the
+        // mark goes and the readable name stays.
+        assert_eq!(
+            sanitize_git_user_name("Duncan\u{202E}"),
+            Some("Duncan".into())
+        );
+        assert_eq!(
+            sanitize_git_user_name("Dun\u{202E}can Idaho"),
+            Some("Duncan Idaho".into())
+        );
+    }
+
+    #[test]
+    fn test_zero_width_space_inside_a_word_is_removed_without_splitting_it() {
+        // U+200B is not whitespace, so it must not become a separator: the word
+        // rejoins rather than turning into "Dun can".
+        assert_eq!(
+            sanitize_git_user_name("Dun\u{200B}can"),
+            Some("Duncan".into())
+        );
+    }
+
+    #[test]
+    fn test_format_characters_do_not_consume_the_length_budget() {
+        // Filtering happens before truncation, so invisible padding cannot
+        // shorten the visible name.
+        let raw = format!("{}{}", "\u{200B}".repeat(200), "a".repeat(90));
+        let got = sanitize_git_user_name(&raw).expect("non-empty");
+        assert_eq!(got.chars().count(), MAX_GIT_USER_NAME_CHARS);
+        assert!(got.chars().all(|c| c == 'a'), "got {got:?}");
+    }
+
+    #[test]
+    fn test_unicode_format_covers_every_cf_range_and_nothing_adjacent() {
+        // Both endpoints of each of the 21 `Cf` ranges in UCD 17.0.0. Endpoints
+        // are what a transcription error moves, so they are what gets asserted.
+        for c in [
+            '\u{00AD}',
+            '\u{0600}',
+            '\u{0605}',
+            '\u{061C}',
+            '\u{06DD}',
+            '\u{070F}',
+            '\u{0890}',
+            '\u{0891}',
+            '\u{08E2}',
+            '\u{180E}',
+            '\u{200B}',
+            '\u{200F}',
+            '\u{202A}',
+            '\u{202E}',
+            '\u{2060}',
+            '\u{2064}',
+            '\u{2066}',
+            '\u{206F}',
+            '\u{FEFF}',
+            '\u{FFF9}',
+            '\u{FFFB}',
+            '\u{110BD}',
+            '\u{110CD}',
+            '\u{13430}',
+            '\u{1343F}',
+            '\u{1BCA0}',
+            '\u{1BCA3}',
+            '\u{1D173}',
+            '\u{1D17A}',
+            '\u{E0001}',
+            '\u{E0020}',
+            '\u{E007F}',
+        ] {
+            assert!(is_unicode_format(c), "U+{:04X} is Cf", c as u32);
+        }
+        // Codepoints immediately outside those ranges, plus ordinary characters.
+        // U+2065 is the notable one: it sits *inside* the 2060..206F block but
+        // is unassigned, not `Cf`.
+        for c in [
+            '\u{00AC}',
+            '\u{00AE}',
+            '\u{05FF}',
+            '\u{0606}',
+            '\u{061B}',
+            '\u{061D}',
+            '\u{200A}',
+            '\u{2010}',
+            '\u{2029}',
+            '\u{202F}',
+            '\u{2065}',
+            '\u{205F}',
+            '\u{2070}',
+            '\u{FEFE}',
+            '\u{FFF8}',
+            '\u{FFFC}',
+            '\u{110BC}',
+            '\u{1342F}',
+            '\u{E0000}',
+            '\u{E0080}',
+            'a',
+            ' ',
+            '🐝',
+            'É',
+        ] {
+            assert!(!is_unicode_format(c), "U+{:04X} is not Cf", c as u32);
+        }
+    }
+
+    #[test]
+    fn test_build_git_env_uses_display_name_and_leaves_email_on_the_pubkey() {
+        let _guard = ENV_LOCK.lock().unwrap();
+        std::env::set_var("BUZZ_ACP_DISPLAY_NAME", "Duncan");
+        std::env::remove_var("BUZZ_RELAY_URL");
+        std::env::remove_var("GIT_CONFIG_COUNT");
+        let env = build_git_env(&key_info());
+        std::env::remove_var("BUZZ_ACP_DISPLAY_NAME");
+
+        assert_eq!(git_config(&env, "user.name").as_deref(), Some("Duncan"));
+        // The pubkey — the thing NIP-98 auth, NIP-GS signing, and contributor
+        // matching key on — must stay in the email untouched.
+        assert_eq!(
+            git_config(&env, "user.email").as_deref(),
+            Some(format!("{PUBKEY_HEX}@buzz").as_str())
+        );
+        assert_eq!(
+            git_config(&env, "user.signingkey").as_deref(),
+            Some(PUBKEY_HEX)
+        );
+    }
+
+    #[test]
+    fn test_build_git_env_falls_back_to_npub_when_display_name_unset() {
+        let _guard = ENV_LOCK.lock().unwrap();
+        std::env::remove_var("BUZZ_ACP_DISPLAY_NAME");
+        std::env::remove_var("BUZZ_RELAY_URL");
+        std::env::remove_var("GIT_CONFIG_COUNT");
+        let env = build_git_env(&key_info());
+
+        // Today's behavior, and what every agent gets until a writer for
+        // BUZZ_ACP_DISPLAY_NAME lands on the Desktop side.
+        assert_eq!(git_config(&env, "user.name").as_deref(), Some(NPUB));
+        assert_eq!(
+            git_config(&env, "user.email").as_deref(),
+            Some(format!("{PUBKEY_HEX}@buzz").as_str())
+        );
+    }
+
+    #[test]
+    fn test_build_git_env_falls_back_to_npub_when_display_name_is_unusable() {
+        let _guard = ENV_LOCK.lock().unwrap();
+        std::env::remove_var("BUZZ_RELAY_URL");
+        std::env::remove_var("GIT_CONFIG_COUNT");
+
+        // Crud-only and format-only names both reach git as the npub — one
+        // would abort every commit, the other would render as blank.
+        for raw in ["<>", "\u{200B}"] {
+            std::env::set_var("BUZZ_ACP_DISPLAY_NAME", raw);
+            let env = build_git_env(&key_info());
+            assert_eq!(
+                git_config(&env, "user.name").as_deref(),
+                Some(NPUB),
+                "unusable display name {raw:?} must reach git as the npub"
+            );
+        }
+        std::env::remove_var("BUZZ_ACP_DISPLAY_NAME");
+    }
+
+    #[test]
+    fn test_git_crud_set_matches_observed_git_behavior() {
+        // Empirically derived from git 2.54.0: these bytes, alone, abort a commit.
+        for c in [' ', '"', '\'', ',', ':', ';', '<', '>', '\\', '\t', '\n'] {
+            assert!(is_git_crud(c), "{c:?} should be crud");
+        }
+        for c in ['.', '-', '_', '@', '(', 'a', '🐝'] {
+            assert!(!is_git_crud(c), "{c:?} should not be crud");
+        }
+    }
+}
diff --git a/crates/buzz-relay/Cargo.toml b/crates/buzz-relay/Cargo.toml
index 10a83f03242..01f78a2d496 100644
--- a/crates/buzz-relay/Cargo.toml
+++ b/crates/buzz-relay/Cargo.toml
@@ -92,3 +92,4 @@ reqwest = { workspace = true }
 tokio-tungstenite = { workspace = true }
 futures = "0.3"
 flate2 = "1.1.9"
+opentelemetry_sdk = { workspace = true, features = ["testing"] }
diff --git a/crates/buzz-relay/src/api/admin/mod.rs b/crates/buzz-relay/src/api/admin/mod.rs
index f0f4c5e633e..21f30065f0a 100644
--- a/crates/buzz-relay/src/api/admin/mod.rs
+++ b/crates/buzz-relay/src/api/admin/mod.rs
@@ -126,7 +126,7 @@ async fn report_detail(
     State(state): State<Arc<crate::state::AppState>>,
     headers: HeaderMap,
     Path(id): Path<Uuid>,
-) -> Result<Json<buzz_db::admin_moderation::AdminReport>, ApiError> {
+) -> Result<Json<buzz_db::admin_moderation::AdminReportDetail>, ApiError> {
     authorize(&state, &headers)?;
     state
         .db
@@ -374,6 +374,36 @@ mod tests {
 
     const HASH: &str = "abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789";
 
+    #[tokio::test]
+    async fn report_detail_requires_admin_host_before_database_access() {
+        let response = router(test_state().await)
+            .oneshot(
+                Request::builder()
+                    .uri(format!("/reports/{}", Uuid::nil()))
+                    .header(header::HOST, "community.example")
+                    .body(Body::empty())
+                    .expect("request"),
+            )
+            .await
+            .expect("response");
+        assert_eq!(response.status(), axum::http::StatusCode::FORBIDDEN);
+    }
+
+    #[tokio::test]
+    async fn report_detail_rejects_unknown_report() {
+        let response = router(test_state().await)
+            .oneshot(
+                Request::builder()
+                    .uri(format!("/reports/{}", Uuid::nil()))
+                    .header(header::HOST, "admin.example")
+                    .body(Body::empty())
+                    .expect("request"),
+            )
+            .await
+            .expect("response");
+        assert_eq!(response.status(), axum::http::StatusCode::NOT_FOUND);
+    }
+
     #[tokio::test]
     async fn feedback_attachment_requires_admin_host_before_database_access() {
         let response = router(test_state().await)
diff --git a/crates/buzz-relay/src/api/bridge.rs b/crates/buzz-relay/src/api/bridge.rs
index c8ec0cdbc94..0a28380e06b 100644
--- a/crates/buzz-relay/src/api/bridge.rs
+++ b/crates/buzz-relay/src/api/bridge.rs
@@ -192,8 +192,14 @@ async fn check_nip98_replay_with_guard(
 /// pass and the relay would proceed against the wrong tenant's auth context),
 /// and (b) reject every legitimate request whose community host isn't the
 /// single configured one. Substituting `tenant.host()` closes both directions.
+/// `base_path` is the deployment's `BUZZ_BASE_PATH` prefix (empty when the relay
+/// serves at the root). Callers pass the route's own unprefixed path — the same
+/// literal the route is declared with — and the prefix is applied here, at the
+/// single choke point, so a prefixed deployment reconstructs the URL the client
+/// actually signed instead of 401ing on a path mismatch.
 pub(crate) fn nip98_expected_url(
     config_relay_url: &str,
+    base_path: &str,
     tenant: &TenantContext,
     path: &str,
 ) -> String {
@@ -202,7 +208,7 @@ pub(crate) fn nip98_expected_url(
     } else {
         "http"
     };
-    format!("{scheme}://{}{path}", tenant.host())
+    format!("{scheme}://{}{base_path}{path}", tenant.host())
 }
 
 /// Construct the NIP-42 expected `relay` URL for a connection bound to `tenant`.
@@ -220,15 +226,22 @@ pub(crate) fn nip98_expected_url(
 /// the client's connect URL embedded in the signed AUTH event; the helper
 /// preserves the deployment's TLS posture from `config_relay_url`'s prefix so
 /// `wss://` deployments stay `wss://` and `ws://` dev/test stays `ws://`.
-/// Path is empty — clients put the bare WS origin (`ws://host[:port]`) in the
-/// `relay` tag, matching how `EventBuilder::auth` accepts a [`nostr::RelayUrl`].
-pub(crate) fn nip42_expected_relay_url(config_relay_url: &str, tenant: &TenantContext) -> String {
+/// Path is the deployment's `BUZZ_BASE_PATH` prefix and nothing more: clients put
+/// their connect URL in the `relay` tag, which is the bare WS origin
+/// (`ws://host[:port]`) at the root and `ws://host[:port]/<prefix>` when the relay
+/// is served under one. Matching how `EventBuilder::auth` accepts a
+/// [`nostr::RelayUrl`].
+pub(crate) fn nip42_expected_relay_url(
+    config_relay_url: &str,
+    base_path: &str,
+    tenant: &TenantContext,
+) -> String {
     let scheme = if config_relay_url.trim_start().starts_with("wss://") {
         "wss"
     } else {
         "ws"
     };
-    format!("{scheme}://{}", tenant.host())
+    format!("{scheme}://{}{base_path}", tenant.host())
 }
 
 /// Extract a channel UUID from a single filter's `#h` tag.
@@ -632,7 +645,12 @@ pub async fn submit_event(
             )
         })?;
 
-    let url = nip98_expected_url(&state.config.relay_url, &tenant, "/events");
+    let url = nip98_expected_url(
+        &state.config.relay_url,
+        &state.config.base_path,
+        &tenant,
+        "/events",
+    );
     let (pubkey, event_id_bytes) = verify_bridge_auth(
         &headers,
         "POST",
@@ -900,7 +918,12 @@ pub async fn query_events(
             )
         })?;
 
-    let url = nip98_expected_url(&state.config.relay_url, &tenant, "/query");
+    let url = nip98_expected_url(
+        &state.config.relay_url,
+        &state.config.base_path,
+        &tenant,
+        "/query",
+    );
     let (pubkey, event_id_bytes) = verify_bridge_auth(
         &headers,
         "POST",
@@ -1335,7 +1358,12 @@ pub async fn count_events(
             )
         })?;
 
-    let url = nip98_expected_url(&state.config.relay_url, &tenant, "/count");
+    let url = nip98_expected_url(
+        &state.config.relay_url,
+        &state.config.base_path,
+        &tenant,
+        "/count",
+    );
     let (pubkey, event_id_bytes) = verify_bridge_auth(
         &headers,
         "POST",
@@ -1872,6 +1900,26 @@ pub async fn workflow_webhook(
     }
     let trigger_ctx_json = serde_json::to_value(&trigger_ctx).ok();
 
+    // SEC-006: the webhook secret authenticates the *caller*, but the run
+    // executes with the workflow **owner's** standing authority — so the
+    // secret alone is insufficient. Immediately before run creation, reject
+    // disabled/inactive workflows and recheck the owner's current channel
+    // membership (and role, for exfiltration-capable definitions). Fail
+    // closed with the same generic 404 as the lookups above so a
+    // revoked-owner workflow is indistinguishable from a nonexistent one.
+    if !workflow.enabled || workflow.status != buzz_db::workflow::WorkflowStatus::Active {
+        return Err(not_found("workflow not found"));
+    }
+    let Some(wf_channel_id) = workflow.channel_id else {
+        // No channel scope means no channel authority to verify — fail closed.
+        return Err(not_found("workflow not found"));
+    };
+    state
+        .workflow_engine
+        .check_owner_authority(community_id, wf_channel_id, &workflow.owner_pubkey, &def)
+        .await
+        .map_err(|_| not_found("workflow not found"))?;
+
     let run_id = state
         .db
         .create_workflow_run(community_id, id, None, trigger_ctx_json.as_ref())
@@ -2046,7 +2094,12 @@ async fn authorize_moderation_read(
         Some(q) if !q.is_empty() => format!("{path}?{q}"),
         _ => path.to_string(),
     };
-    let url = nip98_expected_url(&state.config.relay_url, &tenant, &path_with_query);
+    let url = nip98_expected_url(
+        &state.config.relay_url,
+        &state.config.base_path,
+        &tenant,
+        &path_with_query,
+    );
     let (pubkey, event_id_bytes) =
         verify_bridge_auth(headers, "GET", &url, None, state.config.require_auth_token)?;
     check_nip98_replay(state, &tenant, event_id_bytes).await?;
@@ -2442,7 +2495,7 @@ mod tests {
 
         let config_relay_url = "wss://host-a.example"; // doesn't matter — only used for scheme.
         let tenant_b = fresh_tenant("host-b.example");
-        let expected_url = nip98_expected_url(config_relay_url, &tenant_b, "/events");
+        let expected_url = nip98_expected_url(config_relay_url, "", &tenant_b, "/events");
 
         let (status, body) = verify_bridge_auth(&headers, "POST", &expected_url, Some(b""), true)
             .expect_err(
@@ -2508,7 +2561,7 @@ mod tests {
         // tenant host — proving the helper uses `tenant.host()`, not the config.
         let config_relay_url = "wss://other-config-host.example";
         let tenant_a = fresh_tenant("host-a.example");
-        let expected_url = nip98_expected_url(config_relay_url, &tenant_a, "/events");
+        let expected_url = nip98_expected_url(config_relay_url, "", &tenant_a, "/events");
 
         let (pubkey, _event_id_bytes) =
             verify_bridge_auth(&headers, "POST", &expected_url, Some(b""), true)
@@ -2533,7 +2586,7 @@ mod tests {
             Some(q) if !q.is_empty() => format!("{path}?{q}"),
             _ => path.to_string(),
         };
-        nip98_expected_url(config_relay_url, tenant, &path_with_query)
+        nip98_expected_url(config_relay_url, "", tenant, &path_with_query)
     }
 
     /// L7 read-auth blocker (Wren, #1591 sweep): the CLI signs the *full*
@@ -2655,15 +2708,15 @@ mod tests {
         let tenant_a = fresh_tenant("host-a.example");
         let tenant_b = fresh_tenant("host-b.example");
 
-        let url_a = nip98_expected_url("wss://config-host.example", &tenant_a, "/events");
-        let url_b = nip98_expected_url("wss://config-host.example", &tenant_b, "/events");
+        let url_a = nip98_expected_url("wss://config-host.example", "", &tenant_a, "/events");
+        let url_b = nip98_expected_url("wss://config-host.example", "", &tenant_b, "/events");
         assert_eq!(url_a, "https://host-a.example/events");
         assert_eq!(url_b, "https://host-b.example/events");
 
         // Same tenant, two different config hosts → output is identical.
         // (If config-host ever leaked into the URL, this assertion would bite.)
         let url_a_alt_config =
-            nip98_expected_url("wss://different-config.example", &tenant_a, "/events");
+            nip98_expected_url("wss://different-config.example", "", &tenant_a, "/events");
         assert_eq!(
             url_a, url_a_alt_config,
             "config-relay-url's host MUST NOT influence the NIP-98 expected URL — \
@@ -2678,17 +2731,69 @@ mod tests {
     fn nip98_expected_url_derives_scheme_from_config() {
         let tenant = fresh_tenant("host-a.example");
         assert_eq!(
-            nip98_expected_url("wss://config.example", &tenant, "/events"),
+            nip98_expected_url("wss://config.example", "", &tenant, "/events"),
             "https://host-a.example/events",
             "wss:// production config → https:// URL"
         );
         assert_eq!(
-            nip98_expected_url("ws://config.example", &tenant, "/events"),
+            nip98_expected_url("ws://config.example", "", &tenant, "/events"),
             "http://host-a.example/events",
             "ws:// dev config → http:// URL"
         );
     }
 
+    /// A relay served under `BUZZ_BASE_PATH` must reconstruct the *prefixed* URL,
+    /// because that is what the client signed into its NIP-98 `u` tag. Getting
+    /// this wrong 401s every authenticated HTTP call on a prefixed deployment
+    /// while looking like a signature failure.
+    #[test]
+    fn nip98_expected_url_includes_the_base_path_prefix() {
+        let tenant = fresh_tenant("host-a.example");
+        assert_eq!(
+            nip98_expected_url("wss://config.example", "/relay", &tenant, "/events"),
+            "https://host-a.example/relay/events"
+        );
+        assert_eq!(
+            nip98_expected_url("wss://config.example", "/buzz/relay", &tenant, "/query"),
+            "https://host-a.example/buzz/relay/query"
+        );
+        assert_eq!(
+            nip98_expected_url(
+                "wss://config.example",
+                "/relay",
+                &tenant,
+                "/moderation/audit?limit=20"
+            ),
+            "https://host-a.example/relay/moderation/audit?limit=20",
+            "the prefix precedes the path and the query stays last"
+        );
+        assert_eq!(
+            nip98_expected_url("wss://config.example", "", &tenant, "/events"),
+            "https://host-a.example/events",
+            "an empty prefix is byte-identical to pre-base-path behavior"
+        );
+    }
+
+    /// NIP-42 sibling: the `relay` tag carries the client's connect URL, which
+    /// includes the prefix when the relay is served under one.
+    #[test]
+    fn nip42_expected_relay_url_includes_the_base_path_prefix() {
+        let tenant = fresh_tenant("host-a.example");
+        assert_eq!(
+            nip42_expected_relay_url("wss://config.example", "/relay", &tenant),
+            "wss://host-a.example/relay"
+        );
+        assert_eq!(
+            nip42_expected_relay_url("ws://config.example", "/relay", &tenant),
+            "ws://host-a.example/relay"
+        );
+        assert_eq!(
+            nip42_expected_relay_url("wss://config.example", "", &tenant),
+            "wss://host-a.example",
+            "an empty prefix is byte-identical to pre-base-path behavior"
+        );
+    }
+
     // ----- NIP-42 host-binding tests (sibling of NIP-98 row 44 obligation) -----
 
     /// Sign a NIP-42 AUTH event with `relay` tag = `relay_url`, then verify
@@ -2732,7 +2837,7 @@ mod tests {
         let config_relay_url = "ws://host-a.example:3100";
         let signed_relay_url = "ws://host-a.example:3100";
         let tenant_b = fresh_tenant("host-b.example:3100");
-        let expected = nip42_expected_relay_url(config_relay_url, &tenant_b);
+        let expected = nip42_expected_relay_url(config_relay_url, "", &tenant_b);
 
         let err = verify_nip42_with_urls(challenge, signed_relay_url, &expected).expect_err(
             "cross-host NIP-42 AUTH event MUST be rejected — row 44 sibling: \
@@ -2758,7 +2863,7 @@ mod tests {
         // host — proving the helper uses `tenant.host()`, not the config.
         let config_relay_url = "ws://other-config-host.example";
         let tenant_a = fresh_tenant("host-a.example:3100");
-        let expected = nip42_expected_relay_url(config_relay_url, &tenant_a);
+        let expected = nip42_expected_relay_url(config_relay_url, "", &tenant_a);
 
         verify_nip42_with_urls(challenge, signed_relay_url, &expected)
             .expect("matching-host NIP-42 AUTH event must verify");
@@ -2772,15 +2877,16 @@ mod tests {
         let tenant_a = fresh_tenant("host-a.example:3100");
         let tenant_b = fresh_tenant("host-b.example:3100");
 
-        let url_a = nip42_expected_relay_url("ws://config-host.example", &tenant_a);
-        let url_b = nip42_expected_relay_url("ws://config-host.example", &tenant_b);
+        let url_a = nip42_expected_relay_url("ws://config-host.example", "", &tenant_a);
+        let url_b = nip42_expected_relay_url("ws://config-host.example", "", &tenant_b);
         assert_eq!(url_a, "ws://host-a.example:3100");
         assert_eq!(url_b, "ws://host-b.example:3100");
 
         // Same tenant, two different config hosts → output is identical.
         // (If config-host ever leaked into the URL, this assertion would bite —
         // catches the exact "reverted to config host" regression.)
-        let url_a_alt_config = nip42_expected_relay_url("ws://different-config.example", &tenant_a);
+        let url_a_alt_config =
+            nip42_expected_relay_url("ws://different-config.example", "", &tenant_a);
         assert_eq!(
             url_a, url_a_alt_config,
             "config-relay-url's host MUST NOT influence the NIP-42 expected URL — \
@@ -2796,12 +2902,12 @@ mod tests {
     fn nip42_expected_relay_url_derives_scheme_from_config() {
         let tenant = fresh_tenant("host-a.example:3100");
         assert_eq!(
-            nip42_expected_relay_url("wss://config.example", &tenant),
+            nip42_expected_relay_url("wss://config.example", "", &tenant),
             "wss://host-a.example:3100",
             "wss:// production config → wss:// URL"
         );
         assert_eq!(
-            nip42_expected_relay_url("ws://config.example", &tenant),
+            nip42_expected_relay_url("ws://config.example", "", &tenant),
             "ws://host-a.example:3100",
             "ws:// dev config → ws:// URL"
         );
diff --git a/crates/buzz-relay/src/api/git/transport.rs b/crates/buzz-relay/src/api/git/transport.rs
index 80e74e1ca0e..df5bdd4c3e1 100644
--- a/crates/buzz-relay/src/api/git/transport.rs
+++ b/crates/buzz-relay/src/api/git/transport.rs
@@ -63,8 +63,10 @@ const UPLOAD_PACK_MAX_DECODED_BYTES: u64 = 64 * 1024 * 1024;
 /// Validates the `Authorization: Nostr <base64>` header before the request body
 /// is read. Same pattern as `AuthenticatedUpload` in media.rs.
 ///
-/// Authorization model: any authenticated pubkey can clone; push authorization
-/// is handled by the pre-receive hook (calls back to the internal policy endpoint
+/// Authorization model: reads (ref advertisement, upload-pack) require the
+/// caller's *current* active membership in the repo's bound channel — see
+/// [`authorize_git_read`] (SEC-005). Push authorization is additionally
+/// handled by the pre-receive hook (calls back to the internal policy endpoint
 /// which checks channel role + protection rules from kind:30617).
 pub struct GitAuth {
     /// The authenticated user's public key, extracted from the NIP-98 event.
@@ -354,6 +356,114 @@ fn hydrate_error_to_response(owner: &str, repo: &str, err: HydrateError) -> Resp
         .into_response()
 }
 
+/// SEC-005: authorize a repository *read* (ref advertisement, upload-pack).
+///
+/// The authorization invariant is the authenticated git caller's **current
+/// active membership in the repo's bound channel**. NIP-98 alone only proves
+/// key possession — without this gate any authenticated pubkey (including a
+/// member removed from the channel) can clone channel-bound repositories.
+///
+/// Resolution follows the current authoritative announcement, the same
+/// mapping the push policy endpoint uses:
+/// 1. current live kind:30617 by `(community, owner pubkey from the URL,
+///    d = canonical repo name)` — soft-deleted/replaced announcements do not
+///    resolve;
+/// 2. its `buzz-channel` tag → channel UUID;
+/// 3. [`buzz_db::Db::get_member_role`] for the caller — a read is allowed
+///    only on `Ok(Some(role))` with a role the relay recognizes.
+///
+/// Fail-closed: missing/deleted announcement, invalid owner, missing or
+/// malformed `buzz-channel` binding, non-member, unknown role, and every DB
+/// error all deny. There is deliberately **no repo-owner bypass**: an owner
+/// removed from the bound channel loses read access, which is the exact
+/// exploit shape this gate closes. Every denial is the same generic 404 as a
+/// nonexistent repo so membership cannot be probed through the git endpoints.
+async fn authorize_git_read(
+    db: &buzz_db::Db,
+    community: buzz_core::CommunityId,
+    caller: &nostr::PublicKey,
+    owner_hex: &str,
+    repo_name: &str,
+) -> Result<(), Response> {
+    fn denied() -> Response {
+        (StatusCode::NOT_FOUND, "repository not found").into_response()
+    }
+
+    let Ok(owner_bytes) = hex::decode(owner_hex) else {
+        return Err(denied());
+    };
+    if owner_bytes.len() != 32 {
+        return Err(denied());
+    }
+
+    let query = buzz_db::EventQuery {
+        kinds: Some(vec![30617]),
+        pubkey: Some(owner_bytes),
+        d_tag: Some(repo_name.to_string()),
+        global_only: true,
+        limit: Some(1),
+        ..buzz_db::EventQuery::for_community(community)
+    };
+    let repo_event = match db.query_events(&query).await {
+        Ok(mut events) => match events.pop() {
+            Some(event) => event,
+            None => return Err(denied()),
+        },
+        Err(e) => {
+            error!(repo = %repo_name, error = %e, "git read gate: 30617 lookup failed (deny)");
+            return Err(denied());
+        }
+    };
+
+    let Some(channel_id) = repo_bound_channel_id(&repo_event.event) else {
+        warn!(repo = %repo_name, "git read gate: missing/malformed buzz-channel binding (deny)");
+        return Err(denied());
+    };
+
+    match db
+        .get_member_role(community, channel_id, &caller.to_bytes())
+        .await
+    {
+        Ok(role) if read_role_allows(role.as_deref()) => Ok(()),
+        Ok(_) => Err(denied()),
+        Err(e) => {
+            error!(repo = %repo_name, error = %e, "git read gate: role lookup failed (deny)");
+            Err(denied())
+        }
+    }
+}
+
+/// Extract the `buzz-channel` UUID from a kind:30617 announcement.
+///
+/// First-tag semantics, matching the push policy endpoint: only the *first*
+/// `buzz-channel` tag is considered, and it must carry a valid UUID. A
+/// malformed first binding denies even if a later duplicate tag is valid —
+/// an ambiguous announcement must fail closed, not silently resolve to
+/// whichever duplicate happens to parse.
+fn repo_bound_channel_id(event: &nostr::Event) -> Option<uuid::Uuid> {
+    let first = event
+        .tags
+        .iter()
+        .find(|t| t.as_slice().first().map(String::as_str) == Some("buzz-channel"))?;
+    first
+        .as_slice()
+        .get(1)
+        .and_then(|v| uuid::Uuid::parse_str(v).ok())
+}
+
+/// Pure decision for [`authorize_git_read`]: a read requires a current
+/// active membership row whose role the relay recognizes.
+///
+/// `None` = not an active member (removed, left, never joined) ⇒ deny.
+/// An unrecognized role string ⇒ deny (fail-closed, same as the push
+/// policy endpoint).
+fn read_role_allows(role: Option<&str>) -> bool {
+    match role {
+        Some(r) => r.parse::<buzz_core::channel::MemberRole>().is_ok(),
+        None => false,
+    }
+}
+
 #[derive(Deserialize)]
 /// Query parameters for the `info/refs` endpoint.
 pub struct InfoRefsQuery {
@@ -547,7 +657,19 @@ pub async fn info_refs(
         "git-upload-pack" | "git-receive-pack" => &query.service,
         _ => return Err((StatusCode::BAD_REQUEST, "invalid service").into_response()),
     };
-    let _repo_name = validate_repo_id(&params.owner, &params.repo)?;
+    let repo_name = validate_repo_id(&params.owner, &params.repo)?;
+
+    // SEC-005: channel-membership gate before any manifest load, hydration,
+    // or subprocess work. Both services — the receive-pack advertisement
+    // leaks the ref list just like the upload-pack one.
+    authorize_git_read(
+        &state.db,
+        auth.tenant.community(),
+        &auth.pubkey,
+        &params.owner,
+        repo_name,
+    )
+    .await?;
 
     // Track C fast path: only for clone advertisement. The receive-pack
     // advertisement carries a different capability set (report-status,
@@ -790,7 +912,21 @@ pub async fn upload_pack(
     AxumPath(params): AxumPath<GitRepoParams>,
     body: Body,
 ) -> Result<Response, Response> {
-    let _ = validate_repo_id(&params.owner, &params.repo)?;
+    let repo_name = validate_repo_id(&params.owner, &params.repo)?;
+
+    // SEC-005: the reused NIP-98 token means the GET advertisement's
+    // authorization cannot stand in for POST-time membership — gate this
+    // door independently, before body decode work is driven or hydration
+    // starts.
+    authorize_git_read(
+        &state.db,
+        auth.tenant.community(),
+        &auth.pubkey,
+        &params.owner,
+        repo_name,
+    )
+    .await?;
+
     let body = decode_git_request_body(&headers, body, UPLOAD_PACK_MAX_DECODED_BYTES);
     let permit = acquire_git_permit(&state, "upload_pack")?;
 
@@ -2286,3 +2422,335 @@ mod track_c_tests {
         assert!(caps.contains("object-format=sha256"));
     }
 }
+
+#[cfg(test)]
+mod sec005_read_gate_tests {
+    use super::*;
+    use nostr::{EventBuilder, Keys, Kind, Tag};
+
+    // ── Pure decision helpers ────────────────────────────────────────────
+
+    #[test]
+    fn read_role_allows_every_recognized_role() {
+        for role in ["owner", "admin", "member", "guest", "bot"] {
+            assert!(read_role_allows(Some(role)), "role {role:?} must allow");
+        }
+    }
+
+    #[test]
+    fn read_role_denies_non_members_and_unknown_roles() {
+        assert!(!read_role_allows(None), "no membership row must deny");
+        assert!(
+            !read_role_allows(Some("superuser")),
+            "unrecognized role must deny (fail-closed)"
+        );
+        assert!(!read_role_allows(Some("")), "empty role must deny");
+    }
+
+    fn announcement(keys: &Keys, tags: Vec<Tag>) -> nostr::Event {
+        EventBuilder::new(Kind::Custom(30617), "")
+            .tags(tags)
+            .sign_with_keys(keys)
+            .expect("sign 30617")
+    }
+
+    #[test]
+    fn repo_bound_channel_id_extracts_valid_uuid() {
+        let keys = Keys::generate();
+        let ch = uuid::Uuid::new_v4();
+        let event = announcement(
+            &keys,
+            vec![
+                Tag::parse(["d", "r"]).unwrap(),
+                Tag::parse(["buzz-channel", &ch.to_string()]).unwrap(),
+            ],
+        );
+        assert_eq!(repo_bound_channel_id(&event), Some(ch));
+    }
+
+    #[test]
+    fn repo_bound_channel_id_rejects_absent_and_malformed_bindings() {
+        let keys = Keys::generate();
+        let absent = announcement(&keys, vec![Tag::parse(["d", "r"]).unwrap()]);
+        assert_eq!(repo_bound_channel_id(&absent), None);
+
+        let malformed = announcement(
+            &keys,
+            vec![
+                Tag::parse(["d", "r"]).unwrap(),
+                Tag::parse(["buzz-channel", "not-a-uuid"]).unwrap(),
+            ],
+        );
+        assert_eq!(repo_bound_channel_id(&malformed), None);
+
+        let empty = announcement(
+            &keys,
+            vec![
+                Tag::parse(["d", "r"]).unwrap(),
+                Tag::parse(["buzz-channel"]).unwrap(),
+            ],
+        );
+        assert_eq!(repo_bound_channel_id(&empty), None);
+    }
+
+    #[test]
+    fn repo_bound_channel_id_fails_closed_on_ambiguous_duplicate_bindings() {
+        // First-tag semantics: a malformed first binding must deny even when
+        // a later duplicate tag is valid. An ambiguous announcement must not
+        // silently resolve to whichever duplicate happens to parse.
+        let keys = Keys::generate();
+        let ch = uuid::Uuid::new_v4();
+        let malformed_first = announcement(
+            &keys,
+            vec![
+                Tag::parse(["d", "r"]).unwrap(),
+                Tag::parse(["buzz-channel", "not-a-uuid"]).unwrap(),
+                Tag::parse(["buzz-channel", &ch.to_string()]).unwrap(),
+            ],
+        );
+        assert_eq!(repo_bound_channel_id(&malformed_first), None);
+
+        // And the mirror image: a valid first binding wins, matching the
+        // push policy endpoint's first-tag resolution.
+        let other = uuid::Uuid::new_v4();
+        let valid_first = announcement(
+            &keys,
+            vec![
+                Tag::parse(["d", "r"]).unwrap(),
+                Tag::parse(["buzz-channel", &ch.to_string()]).unwrap(),
+                Tag::parse(["buzz-channel", &other.to_string()]).unwrap(),
+            ],
+        );
+        assert_eq!(repo_bound_channel_id(&valid_first), Some(ch));
+    }
+
+    // ── authorize_git_read matrix (requires Postgres) ────────────────────
+
+    const TEST_DB_URL: &str = "postgres://buzz:buzz_dev@localhost:5432/buzz"; // sadscan:disable np.postgres.1
+
+    async fn setup_db() -> buzz_db::Db {
+        let url = std::env::var("BUZZ_TEST_DATABASE_URL")
+            .or_else(|_| std::env::var("DATABASE_URL"))
+            .unwrap_or_else(|_| TEST_DB_URL.to_string());
+        let pool = sqlx::PgPool::connect(&url).await.expect("connect test DB");
+        buzz_db::Db::from_pool(pool)
+    }
+
+    /// How the fixture's kind:30617 binds (or fails to bind) a channel.
+    enum Binding {
+        /// `buzz-channel` tag carrying the fixture channel's UUID.
+        Channel,
+        /// No `buzz-channel` tag at all.
+        Missing,
+        /// `buzz-channel` tag whose value is not a UUID.
+        Malformed,
+    }
+
+    struct RepoFixture {
+        db: buzz_db::Db,
+        community: buzz_core::CommunityId,
+        channel: uuid::Uuid,
+        owner_keys: Keys,
+        owner_hex: String,
+        member_keys: Keys,
+        repo: String,
+    }
+
+    /// Community + channel + one plain member + a kind:30617 announcement.
+    /// The repo owner is a *different* key that is not a channel member —
+    /// deliberately, to pin "no repo-owner bypass".
+    async fn setup_repo(binding: Binding) -> RepoFixture {
+        let db = setup_db().await;
+        let host = format!("sec005-{}.example", uuid::Uuid::new_v4().simple());
+        let community = db
+            .ensure_configured_community(&host)
+            .await
+            .expect("community")
+            .id;
+
+        let owner_keys = Keys::generate();
+        let member_keys = Keys::generate();
+        let creator = Keys::generate(); // channel creator, distinct from repo owner
+        let creator_pk = creator.public_key().to_bytes().to_vec();
+        let member_pk = member_keys.public_key().to_bytes().to_vec();
+        db.ensure_user(community, &creator_pk).await.expect("user");
+        db.ensure_user(community, &member_pk).await.expect("user");
+
+        let channel = uuid::Uuid::new_v4();
+        db.create_channel_with_id(
+            community,
+            channel,
+            &format!("ch-{}", channel.simple()),
+            buzz_db::channel::ChannelType::Stream,
+            buzz_db::channel::ChannelVisibility::Open,
+            None,
+            &creator_pk,
+            None,
+        )
+        .await
+        .expect("channel");
+        db.add_member(
+            community,
+            channel,
+            &member_pk,
+            buzz_core::channel::MemberRole::Member,
+            Some(&creator_pk),
+        )
+        .await
+        .expect("member");
+
+        let repo = format!("repo-{}", uuid::Uuid::new_v4().simple());
+        let mut tags = vec![Tag::parse(["d", &repo]).unwrap()];
+        match binding {
+            Binding::Channel => {
+                tags.push(Tag::parse(["buzz-channel", &channel.to_string()]).unwrap());
+            }
+            Binding::Missing => {}
+            Binding::Malformed => {
+                tags.push(Tag::parse(["buzz-channel", "not-a-uuid"]).unwrap());
+            }
+        }
+        let event = announcement(&owner_keys, tags);
+        db.insert_event(community, &event, None)
+            .await
+            .expect("30617");
+
+        let owner_hex = owner_keys.public_key().to_hex();
+        RepoFixture {
+            db,
+            community,
+            channel,
+            owner_keys,
+            owner_hex,
+            member_keys,
+            repo,
+        }
+    }
+
+    #[tokio::test]
+    #[ignore = "requires Postgres"]
+    async fn read_gate_allows_current_member_denies_removed_and_owner_bypass() {
+        let f = setup_repo(Binding::Channel).await;
+
+        // Current member: allowed.
+        let member = f.member_keys.public_key();
+        assert!(
+            authorize_git_read(&f.db, f.community, &member, &f.owner_hex, &f.repo)
+                .await
+                .is_ok(),
+            "current member must be allowed to read"
+        );
+
+        // Never-a-member caller: denied.
+        let stranger = Keys::generate().public_key();
+        assert!(
+            authorize_git_read(&f.db, f.community, &stranger, &f.owner_hex, &f.repo)
+                .await
+                .is_err(),
+            "non-member must be denied"
+        );
+
+        // Member removed → denied. THE finding-005 exploit shape.
+        let member_pk = member.to_bytes().to_vec();
+        f.db.remove_member(f.community, f.channel, &member_pk, &member_pk)
+            .await
+            .expect("self-remove");
+        assert!(
+            authorize_git_read(&f.db, f.community, &member, &f.owner_hex, &f.repo)
+                .await
+                .is_err(),
+            "removed member must be denied"
+        );
+
+        // No repo-owner bypass: the announcement author is not a channel
+        // member and must be denied too.
+        let owner = f.owner_keys.public_key();
+        assert!(
+            authorize_git_read(&f.db, f.community, &owner, &f.owner_hex, &f.repo)
+                .await
+                .is_err(),
+            "repo owner outside the channel must be denied (no owner bypass)"
+        );
+    }
+
+    #[tokio::test]
+    #[ignore = "requires Postgres"]
+    async fn read_gate_denies_missing_or_malformed_binding_and_absent_repo() {
+        // Missing buzz-channel tag → deny even for a channel member.
+        let f = setup_repo(Binding::Missing).await;
+        let member = f.member_keys.public_key();
+        assert!(
+            authorize_git_read(&f.db, f.community, &member, &f.owner_hex, &f.repo)
+                .await
+                .is_err(),
+            "announcement without buzz-channel binding must deny"
+        );
+
+        // Malformed buzz-channel tag → deny.
+        let g = setup_repo(Binding::Malformed).await;
+        let member_g = g.member_keys.public_key();
+        assert!(
+            authorize_git_read(&g.db, g.community, &member_g, &g.owner_hex, &g.repo)
+                .await
+                .is_err(),
+            "announcement with malformed buzz-channel binding must deny"
+        );
+
+        // Nonexistent announcement → deny.
+        assert!(
+            authorize_git_read(&f.db, f.community, &member, &f.owner_hex, "no-such-repo")
+                .await
+                .is_err(),
+            "nonexistent repo must deny"
+        );
+
+        // Owner-mismatch: URL owner differs from announcement author → deny.
+        let impostor_hex = Keys::generate().public_key().to_hex();
+        assert!(
+            authorize_git_read(&f.db, f.community, &member, &impostor_hex, &f.repo)
+                .await
+                .is_err(),
+            "URL owner that never announced this repo must deny"
+        );
+
+        // Invalid owner hex in URL → deny (never panics).
+        assert!(
+            authorize_git_read(&f.db, f.community, &member, "zz-not-hex", &f.repo)
+                .await
+                .is_err(),
+            "malformed owner hex must deny"
+        );
+    }
+
+    #[tokio::test]
+    #[ignore = "requires Postgres"]
+    async fn read_gate_follows_current_announcement_not_stale_registry() {
+        // Max's registry/pointer concern: a soft-deleted 30617 can leave the
+        // `git_repo_names` reservation and the manifest pointer alive. Reads
+        // must follow the current authoritative announcement — once it's
+        // deleted, the gate denies even a current channel member.
+        let f = setup_repo(Binding::Channel).await;
+
+        let member = f.member_keys.public_key();
+        assert!(
+            authorize_git_read(&f.db, f.community, &member, &f.owner_hex, &f.repo)
+                .await
+                .is_ok(),
+            "precondition: member allowed while announcement is live"
+        );
+
+        let owner_pk = f.owner_keys.public_key().to_bytes().to_vec();
+        let deleted =
+            f.db.soft_delete_by_coordinate(f.community, 30617, &owner_pk, &f.repo)
+                .await
+                .expect("soft delete 30617");
+        assert!(deleted, "precondition: a live announcement row was deleted");
+
+        assert!(
+            authorize_git_read(&f.db, f.community, &member, &f.owner_hex, &f.repo)
+                .await
+                .is_err(),
+            "deleted announcement must deny reads even for channel members"
+        );
+    }
+}
diff --git a/crates/buzz-relay/src/api/invites.rs b/crates/buzz-relay/src/api/invites.rs
index 6719e85f791..0315c843391 100644
--- a/crates/buzz-relay/src/api/invites.rs
+++ b/crates/buzz-relay/src/api/invites.rs
@@ -25,7 +25,12 @@ use serde::Deserialize;
 use serde_json::Value;
 
 use crate::handlers::side_effects::{publish_nip43_member_added, publish_nip43_membership_list};
-use crate::invite_token::{self, DEFAULT_INVITE_TTL_SECS};
+use buzz_core::invite::{
+    hash_v2_code, validate_v2_code, DEFAULT_INVITE_TTL_SECS, MAX_INVITE_TTL_SECS, MAX_INVITE_USES,
+    MIN_INVITE_TTL_SECS, V2_PREFIX,
+};
+
+use crate::invite_token;
 use crate::state::AppState;
 
 use super::{api_error, bridge, internal_error};
@@ -43,10 +48,42 @@ pub(crate) const CLAIM_RATE_CACHE_CAPACITY: u64 = 10_000;
 /// Body for `POST /api/invites`.
 #[derive(Debug, Default, Deserialize)]
 pub struct MintInviteRequest {
-    /// Requested lifetime in seconds. Clamped to
+    /// Requested lifetime in seconds. Must be between
+    /// [`MIN_INVITE_TTL_SECS`] and
     /// [`invite_token::MAX_INVITE_TTL_SECS`]; defaults to 72 h.
     #[serde(default)]
     pub ttl_secs: Option<u64>,
+    /// Maximum number of uses before the invite is exhausted. `None` (omitted
+    /// or `null`) means unlimited — preserves current behavior. When present,
+    /// must be an integer from 1 through [`MAX_INVITE_USES`].
+    #[serde(default)]
+    pub max_uses: Option<i32>,
+}
+
+fn validate_mint_request(
+    request: &MintInviteRequest,
+) -> Result<(u64, Option<i32>), (StatusCode, Json<Value>)> {
+    let ttl = request.ttl_secs.unwrap_or(DEFAULT_INVITE_TTL_SECS);
+    if !(MIN_INVITE_TTL_SECS..=MAX_INVITE_TTL_SECS).contains(&ttl) {
+        return Err(api_error(
+            StatusCode::BAD_REQUEST,
+            &format!(
+                "ttl_secs must be between {} and {MAX_INVITE_TTL_SECS}",
+                MIN_INVITE_TTL_SECS
+            ),
+        ));
+    }
+
+    if let Some(max_uses) = request.max_uses {
+        if !(1..=MAX_INVITE_USES).contains(&max_uses) {
+            return Err(api_error(
+                StatusCode::BAD_REQUEST,
+                &format!("max_uses must be between 1 and {MAX_INVITE_USES}"),
+            ));
+        }
+    }
+
+    Ok((ttl, request.max_uses))
 }
 
 /// Body for `POST /api/invites/claim`.
@@ -209,7 +246,12 @@ async fn authenticate(
             )
         })?;
 
-    let url = bridge::nip98_expected_url(&state.config.relay_url, &tenant, path);
+    let url = bridge::nip98_expected_url(
+        &state.config.relay_url,
+        &state.config.base_path,
+        &tenant,
+        path,
+    );
     let (pubkey, event_id_bytes) = bridge::verify_bridge_auth_with_options(
         headers,
         "POST",
@@ -260,9 +302,17 @@ pub async fn mint_invite(
         })?
     };
 
-    let key = invite_token::derive_invite_key(&state.relay_keypair);
-    let ttl = request.ttl_secs.unwrap_or(DEFAULT_INVITE_TTL_SECS);
-    let (code, expires_at) = invite_token::mint_invite(&key, tenant.community(), ttl);
+    let (ttl, max_uses) = validate_mint_request(&request)?;
+
+    // Mint a v2 opaque, database-backed invite.
+    let invite = state
+        .db
+        .mint_relay_invite(tenant.community(), &sender_hex, ttl, max_uses)
+        .await
+        .map_err(|error| match error {
+            buzz_db::DbError::InvalidData(message) => api_error(StatusCode::BAD_REQUEST, &message),
+            error => internal_error(&format!("invite mint: {error}")),
+        })?;
 
     // Same TLS-posture logic as nip98_expected_url: wss deployments get an
     // https landing page URL, ws dev/test deployments get http.
@@ -275,19 +325,30 @@ pub async fn mint_invite(
     tracing::info!(
         community = %tenant.community(),
         minted_by = %sender_hex,
-        expires_at,
+        invite_id = %invite.invite_id,
+        expires_at = %invite.expires_at,
+        max_uses = ?invite.max_uses,
         "relay invite minted"
     );
 
+    // expires_at as unix seconds for the response contract.
+    let expires_at_unix = invite.expires_at.timestamp() as u64;
+
     Ok(Json(serde_json::json!({
-        "code": code,
-        "expires_at": expires_at,
-        "url": format!("{scheme}://{}/invite/{}", tenant.host(), code),
+        "code": invite.code,
+        "expires_at": expires_at_unix,
+        "max_uses": invite.max_uses,
+        "uses_remaining": invite.uses_remaining,
+        "url": format!("{scheme}://{}/invite/{}", tenant.host(), invite.code),
     })))
 }
 
 /// Claim an invite code — `POST /api/invites/claim`, NIP-98 signed by the
 /// *joining* pubkey. Exempt from the relay-membership gate by design.
+///
+/// Routing is by exact prefix: `v2.` codes go to the database-backed
+/// redemption path; every other code goes to the v1 HMAC verifier. A `v2.`
+/// code is never fallen back to v1 verification.
 pub async fn claim_invite(
     State(state): State<Arc<AppState>>,
     headers: HeaderMap,
@@ -305,7 +366,88 @@ pub async fn claim_invite(
     let request: ClaimInviteRequest = serde_json::from_slice(&body)
         .map_err(|e| api_error(StatusCode::BAD_REQUEST, &format!("invalid claim JSON: {e}")))?;
 
+    let claimer_hex = pubkey.to_hex();
     let key = invite_token::derive_invite_key(&state.relay_keypair);
+
+    // --- v2 database-backed path ---
+    //
+    // Route by exact prefix: v2. codes use the durable invite table. No
+    // fallback to v1 HMAC verification for malformed v2 input.
+    if request.code.starts_with(V2_PREFIX) {
+        validate_v2_code(&request.code)
+            .map_err(|_| api_error(StatusCode::FORBIDDEN, "invite_invalid"))?;
+
+        // Join-policy receipt verification, same mechanism as v1: the receipt
+        // is bound to the code string by SHA-256, so it works for v2 codes.
+        if let Some(policy) = &state.config.join_policy {
+            let receipt = request
+                .policy_receipt
+                .as_deref()
+                .ok_or_else(|| api_error(StatusCode::FORBIDDEN, "join_policy_required"))?;
+            invite_token::verify_policy_acceptance(&key, receipt, &request.code, &policy.version)
+                .map_err(|_| api_error(StatusCode::FORBIDDEN, "join_policy_required"))?;
+        }
+
+        let token_hash = hash_v2_code(&request.code);
+        let outcome = state
+            .db
+            .claim_relay_invite(
+                tenant.community(),
+                &token_hash,
+                &claimer_hex,
+                state
+                    .config
+                    .join_policy
+                    .as_ref()
+                    .map(|policy| policy.version.as_str()),
+            )
+            .await
+            .map_err(|e| internal_error(&format!("v2 invite claim: {e}")))?;
+
+        return match outcome {
+            buzz_db::relay_invite::ClaimOutcome::Joined { .. } => {
+                tracing::info!(
+                    community = %tenant.community(),
+                    member = %claimer_hex,
+                    "relay member added via v2 invite"
+                );
+                // NIP-43 side effects only on Joined, never on other outcomes.
+                if let Err(e) = publish_nip43_member_added(&tenant, &state, &claimer_hex).await {
+                    tracing::warn!(
+                        "failed to publish NIP-43 member-added delta after v2 claim: {e}"
+                    );
+                }
+                if let Err(e) = publish_nip43_membership_list(&tenant, &state).await {
+                    tracing::warn!("failed to publish NIP-43 membership list after v2 claim: {e}");
+                }
+                Ok(Json(serde_json::json!({
+                    "status": "joined",
+                    "community_id": tenant.community().to_string(),
+                    "host": tenant.host(),
+                    "role": "member",
+                })))
+            }
+            buzz_db::relay_invite::ClaimOutcome::AlreadyMember { .. } => {
+                Ok(Json(serde_json::json!({
+                    "status": "already_member",
+                    "community_id": tenant.community().to_string(),
+                    "host": tenant.host(),
+                    "role": "member",
+                })))
+            }
+            buzz_db::relay_invite::ClaimOutcome::Expired => {
+                Err(api_error(StatusCode::FORBIDDEN, "invite_expired"))
+            }
+            buzz_db::relay_invite::ClaimOutcome::Exhausted => {
+                Err(api_error(StatusCode::FORBIDDEN, "invite_exhausted"))
+            }
+            buzz_db::relay_invite::ClaimOutcome::Invalid => {
+                Err(api_error(StatusCode::FORBIDDEN, "invite_invalid"))
+            }
+        };
+    }
+
+    // --- v1 HMAC path (stateless tokens, drain window) ---
     let payload = invite_token::verify_invite(&key, tenant.community(), &request.code).map_err(
         |e| match e {
             // Expired is post-MAC: revealing it helps the UX without helping a forger.
@@ -317,7 +459,6 @@ pub async fn claim_invite(
         },
     )?;
 
-    let claimer_hex = pubkey.to_hex();
     if let Some(policy) = &state.config.join_policy {
         let receipt = request
             .policy_receipt
@@ -395,7 +536,7 @@ mod tests {
     use std::sync::Arc;
     use std::time::Duration;
 
-    use super::{claim_key_rate_limited, CLAIM_RATE_LIMIT};
+    use super::{claim_key_rate_limited, CLAIM_RATE_LIMIT, MAX_INVITE_USES, MIN_INVITE_TTL_SECS};
     use axum::{
         body::{to_bytes, Body},
         http::{header, Request, StatusCode},
@@ -409,7 +550,7 @@ mod tests {
     use tower::ServiceExt;
     use uuid::Uuid;
 
-    use crate::invite_token::{derive_invite_key, InvitePayload};
+    use crate::invite_token::{derive_invite_key, InvitePayload, MAX_INVITE_TTL_SECS};
 
     use crate::router::build_router;
     use crate::state::AppState;
@@ -592,6 +733,355 @@ mod tests {
         serde_json::from_slice(&bytes).expect("response JSON")
     }
 
+    async fn mint_code(state: Arc<AppState>, host: &str, owner: &Keys, request: Value) -> String {
+        let response = post_json(state, host, "/api/invites", owner, request.to_string()).await;
+        assert_eq!(response.status(), StatusCode::OK);
+        read_json(response)
+            .await
+            .get("code")
+            .and_then(Value::as_str)
+            .expect("minted code")
+            .to_string()
+    }
+
+    async fn event_count(state: &AppState, community: buzz_core::CommunityId, kind: i32) -> i64 {
+        state
+            .db
+            .count_events(&buzz_db::EventQuery {
+                kinds: Some(vec![kind]),
+                global_only: true,
+                ..buzz_db::EventQuery::for_community(community)
+            })
+            .await
+            .expect("count side-effect events")
+    }
+
+    #[test]
+    fn mint_request_deserialization_is_strict() {
+        for valid in [
+            serde_json::json!({}),
+            serde_json::json!({ "max_uses": null }),
+            serde_json::json!({ "max_uses": 1 }),
+            serde_json::json!({ "max_uses": MAX_INVITE_USES }),
+        ] {
+            serde_json::from_value::<super::MintInviteRequest>(valid).expect("valid request");
+        }
+
+        for invalid in [
+            serde_json::json!({ "max_uses": 1.5 }),
+            serde_json::json!({ "max_uses": "10" }),
+            serde_json::json!({ "ttl_secs": -1 }),
+            serde_json::json!({ "ttl_secs": 1.5 }),
+            serde_json::json!({ "ttl_secs": "3600" }),
+        ] {
+            assert!(
+                serde_json::from_value::<super::MintInviteRequest>(invalid.clone()).is_err(),
+                "accepted wrong JSON type: {invalid}"
+            );
+        }
+    }
+
+    #[test]
+    fn mint_request_validation_enforces_bounds_without_a_database() {
+        use super::validate_mint_request;
+
+        for (request, expected) in [
+            (
+                super::MintInviteRequest::default(),
+                (crate::invite_token::DEFAULT_INVITE_TTL_SECS, None),
+            ),
+            (
+                super::MintInviteRequest {
+                    ttl_secs: Some(MIN_INVITE_TTL_SECS),
+                    max_uses: Some(1),
+                },
+                (MIN_INVITE_TTL_SECS, Some(1)),
+            ),
+            (
+                super::MintInviteRequest {
+                    ttl_secs: Some(MAX_INVITE_TTL_SECS),
+                    max_uses: Some(MAX_INVITE_USES),
+                },
+                (MAX_INVITE_TTL_SECS, Some(MAX_INVITE_USES)),
+            ),
+        ] {
+            assert_eq!(
+                validate_mint_request(&request).expect("valid request"),
+                expected
+            );
+        }
+
+        for request in [
+            super::MintInviteRequest {
+                ttl_secs: None,
+                max_uses: Some(0),
+            },
+            super::MintInviteRequest {
+                ttl_secs: None,
+                max_uses: Some(-1),
+            },
+            super::MintInviteRequest {
+                ttl_secs: None,
+                max_uses: Some(MAX_INVITE_USES + 1),
+            },
+            super::MintInviteRequest {
+                ttl_secs: Some(MIN_INVITE_TTL_SECS - 1),
+                max_uses: None,
+            },
+            super::MintInviteRequest {
+                ttl_secs: Some(MAX_INVITE_TTL_SECS + 1),
+                max_uses: None,
+            },
+        ] {
+            assert_eq!(
+                validate_mint_request(&request)
+                    .expect_err("invalid request")
+                    .0,
+                StatusCode::BAD_REQUEST
+            );
+        }
+    }
+
+    #[tokio::test]
+    #[ignore = "requires Postgres"]
+    async fn mint_validates_max_uses_and_ttl_bounds() {
+        let host = format!("invites-validation-{}.example", Uuid::new_v4().simple());
+        let owner = Keys::generate();
+        let state = invite_test_state(&host)
+            .await
+            .expect("requires reachable Postgres and relay test state");
+        let community = state
+            .db
+            .lookup_community_by_host(&host)
+            .await
+            .expect("lookup")
+            .expect("community exists");
+        state
+            .db
+            .add_relay_member(community.id, &owner.public_key().to_hex(), "owner", None)
+            .await
+            .expect("seed owner");
+
+        for body in [
+            serde_json::json!({ "max_uses": 0 }),
+            serde_json::json!({ "max_uses": -1 }),
+            serde_json::json!({ "max_uses": MAX_INVITE_USES + 1 }),
+            serde_json::json!({ "ttl_secs": MIN_INVITE_TTL_SECS - 1 }),
+            serde_json::json!({ "ttl_secs": MAX_INVITE_TTL_SECS + 1 }),
+        ] {
+            let response = post_json(
+                state.clone(),
+                &host,
+                "/api/invites",
+                &owner,
+                body.to_string(),
+            )
+            .await;
+            assert_eq!(response.status(), StatusCode::BAD_REQUEST, "{body}");
+        }
+
+        for body in [
+            serde_json::json!({}),
+            serde_json::json!({ "max_uses": null }),
+            serde_json::json!({ "max_uses": 1 }),
+            serde_json::json!({ "max_uses": MAX_INVITE_USES }),
+            serde_json::json!({ "ttl_secs": MIN_INVITE_TTL_SECS }),
+            serde_json::json!({ "ttl_secs": MAX_INVITE_TTL_SECS }),
+        ] {
+            let response = post_json(
+                state.clone(),
+                &host,
+                "/api/invites",
+                &owner,
+                body.to_string(),
+            )
+            .await;
+            assert_eq!(response.status(), StatusCode::OK, "{body}");
+        }
+    }
+
+    #[tokio::test]
+    #[ignore = "requires Postgres"]
+    async fn malformed_and_unknown_v2_codes_are_forbidden_without_v1_fallback() {
+        let host = format!("invites-v2-invalid-{}.example", Uuid::new_v4().simple());
+        let joiner = Keys::generate();
+        let state = invite_test_state(&host)
+            .await
+            .expect("requires reachable Postgres and relay test state");
+        let unknown = format!("v2.{}", URL_SAFE_NO_PAD.encode([9_u8; 32]));
+
+        for code in [
+            "v2.".to_string(),
+            "v2.not-base64!".to_string(),
+            format!("v2.{}", URL_SAFE_NO_PAD.encode([9_u8; 31])),
+            unknown,
+        ] {
+            let response = post_json(
+                state.clone(),
+                &host,
+                "/api/invites/claim",
+                &joiner,
+                serde_json::json!({ "code": code }).to_string(),
+            )
+            .await;
+            assert_eq!(response.status(), StatusCode::FORBIDDEN, "{code}");
+            assert_eq!(
+                read_json(response)
+                    .await
+                    .get("error")
+                    .and_then(Value::as_str),
+                Some("invite_invalid")
+            );
+        }
+    }
+
+    #[tokio::test]
+    #[ignore = "requires Postgres"]
+    async fn bounded_v2_claims_publish_side_effects_only_for_joined() {
+        let host = format!(
+            "invites-v2-side-effects-{}.example",
+            Uuid::new_v4().simple()
+        );
+        let owner = Keys::generate();
+        let first = Keys::generate();
+        let second = Keys::generate();
+        let state = invite_test_state(&host)
+            .await
+            .expect("requires reachable Postgres and relay test state");
+        let community = state
+            .db
+            .lookup_community_by_host(&host)
+            .await
+            .expect("lookup")
+            .expect("community exists");
+        state
+            .db
+            .add_relay_member(community.id, &owner.public_key().to_hex(), "owner", None)
+            .await
+            .expect("seed owner");
+        let before_delta_count = event_count(
+            &state,
+            community.id,
+            buzz_core::kind::KIND_NIP43_MEMBER_ADDED as i32,
+        )
+        .await;
+        let before_list_count = event_count(
+            &state,
+            community.id,
+            buzz_core::kind::KIND_NIP43_MEMBERSHIP_LIST as i32,
+        )
+        .await;
+        let code = mint_code(
+            state.clone(),
+            &host,
+            &owner,
+            serde_json::json!({ "max_uses": 1 }),
+        )
+        .await;
+        let claim_body = serde_json::json!({ "code": code }).to_string();
+
+        let response = post_json(
+            state.clone(),
+            &host,
+            "/api/invites/claim",
+            &first,
+            claim_body.clone(),
+        )
+        .await;
+        assert_eq!(response.status(), StatusCode::OK);
+        assert_eq!(
+            read_json(response)
+                .await
+                .get("status")
+                .and_then(Value::as_str),
+            Some("joined")
+        );
+        let delta_count = event_count(
+            &state,
+            community.id,
+            buzz_core::kind::KIND_NIP43_MEMBER_ADDED as i32,
+        )
+        .await;
+        let list_count = event_count(
+            &state,
+            community.id,
+            buzz_core::kind::KIND_NIP43_MEMBERSHIP_LIST as i32,
+        )
+        .await;
+        assert_eq!(delta_count, before_delta_count + 1);
+        assert_eq!(list_count, before_list_count + 1);
+
+        let response = post_json(
+            state.clone(),
+            &host,
+            "/api/invites/claim",
+            &first,
+            claim_body.clone(),
+        )
+        .await;
+        assert_eq!(response.status(), StatusCode::OK);
+        assert_eq!(
+            read_json(response)
+                .await
+                .get("status")
+                .and_then(Value::as_str),
+            Some("already_member")
+        );
+        assert_eq!(
+            event_count(
+                &state,
+                community.id,
+                buzz_core::kind::KIND_NIP43_MEMBER_ADDED as i32,
+            )
+            .await,
+            delta_count
+        );
+        assert_eq!(
+            event_count(
+                &state,
+                community.id,
+                buzz_core::kind::KIND_NIP43_MEMBERSHIP_LIST as i32,
+            )
+            .await,
+            list_count
+        );
+
+        let response = post_json(
+            state.clone(),
+            &host,
+            "/api/invites/claim",
+            &second,
+            claim_body,
+        )
+        .await;
+        assert_eq!(response.status(), StatusCode::FORBIDDEN);
+        assert_eq!(
+            read_json(response)
+                .await
+                .get("error")
+                .and_then(Value::as_str),
+            Some("invite_exhausted")
+        );
+        assert_eq!(
+            event_count(
+                &state,
+                community.id,
+                buzz_core::kind::KIND_NIP43_MEMBER_ADDED as i32,
+            )
+            .await,
+            delta_count
+        );
+        assert_eq!(
+            event_count(
+                &state,
+                community.id,
+                buzz_core::kind::KIND_NIP43_MEMBERSHIP_LIST as i32,
+            )
+            .await,
+            list_count
+        );
+    }
+
     #[tokio::test]
     #[ignore = "requires Postgres"]
     async fn owner_mints_and_new_pubkey_claims() {
diff --git a/crates/buzz-relay/src/api/media.rs b/crates/buzz-relay/src/api/media.rs
index fa0401bc262..a7478c7d916 100644
--- a/crates/buzz-relay/src/api/media.rs
+++ b/crates/buzz-relay/src/api/media.rs
@@ -402,6 +402,7 @@ pub async fn upload_blob(
     rewrite_descriptor_urls_for_tenant(
         &mut descriptor,
         &state.config.relay_url,
+        &state.config.base_path,
         auth.tenant.host(),
     );
 
@@ -444,7 +445,17 @@ pub async fn upload_blob(
     Ok(Json(descriptor))
 }
 
-pub(crate) fn media_base_url_for_tenant(config_relay_url: &str, tenant_host: &str) -> String {
+/// Build the tenant-scoped media base URL that upload descriptors advertise.
+///
+/// `base_path` is the deployment's `BUZZ_BASE_PATH` prefix (empty when the relay
+/// serves at the root). The prefix must be present: this URL is what clients and
+/// agents fetch, and it is embedded in published events, so a missing prefix
+/// bakes an unreachable URL into message history rather than failing loudly.
+pub(crate) fn media_base_url_for_tenant(
+    config_relay_url: &str,
+    base_path: &str,
+    tenant_host: &str,
+) -> String {
     let scheme = if config_relay_url.trim_start().starts_with("wss://")
         || config_relay_url.trim_start().starts_with("https://")
     {
@@ -452,15 +463,16 @@ pub(crate) fn media_base_url_for_tenant(config_relay_url: &str, tenant_host: &st
     } else {
         "http"
     };
-    format!("{scheme}://{tenant_host}/media")
+    format!("{scheme}://{tenant_host}{base_path}/media")
 }
 
 fn rewrite_descriptor_urls_for_tenant(
     descriptor: &mut BlobDescriptor,
     config_relay_url: &str,
+    base_path: &str,
     tenant_host: &str,
 ) {
-    let base = media_base_url_for_tenant(config_relay_url, tenant_host);
+    let base = media_base_url_for_tenant(config_relay_url, base_path, tenant_host);
     let ext = descriptor
         .url
         .rsplit_once('.')
@@ -1271,15 +1283,69 @@ mod tests {
     #[test]
     fn media_base_url_for_tenant_uses_tenant_host_and_http_scheme() {
         assert_eq!(
-            media_base_url_for_tenant("wss://config.example", "tenant-b.example"),
+            media_base_url_for_tenant("wss://config.example", "", "tenant-b.example"),
             "https://tenant-b.example/media"
         );
         assert_eq!(
-            media_base_url_for_tenant("ws://config.example", "localhost:3100"),
+            media_base_url_for_tenant("ws://config.example", "", "localhost:3100"),
             "http://localhost:3100/media"
         );
     }
 
+    /// A relay served under BUZZ_BASE_PATH must advertise media under the prefix.
+    /// This URL is embedded in published events and fetched by clients and agents,
+    /// so dropping the prefix bakes an unreachable URL into message history — and
+    /// behind a path-routing gateway it resolves to the gateway, not the relay.
+    #[test]
+    fn media_base_url_for_tenant_includes_the_base_path_prefix() {
+        assert_eq!(
+            media_base_url_for_tenant("wss://config.example", "/relay", "tenant-b.example"),
+            "https://tenant-b.example/relay/media"
+        );
+        assert_eq!(
+            media_base_url_for_tenant("wss://config.example", "/buzz/relay", "tenant-b.example"),
+            "https://tenant-b.example/buzz/relay/media"
+        );
+        assert_eq!(
+            media_base_url_for_tenant("ws://config.example", "/relay", "localhost:3100"),
+            "http://localhost:3100/relay/media"
+        );
+    }
+
+    #[test]
+    fn rewrite_descriptor_urls_for_tenant_applies_the_base_path_prefix() {
+        let hash = "b".repeat(64);
+        let mut descriptor = BlobDescriptor {
+            url: format!("https://primary.example/media/{hash}.png"),
+            sha256: hash.clone(),
+            size: 7,
+            mime_type: "image/png".to_string(),
+            uploaded: 1700000000,
+            dim: None,
+            blurhash: None,
+            thumb: Some(format!("https://primary.example/media/{hash}.thumb.jpg")),
+            duration: None,
+        };
+
+        rewrite_descriptor_urls_for_tenant(
+            &mut descriptor,
+            "wss://primary.example",
+            "/relay",
+            "tenant-b.example",
+        );
+
+        assert_eq!(
+            descriptor.url,
+            format!("https://tenant-b.example/relay/media/{hash}.png")
+        );
+        assert_eq!(
+            descriptor.thumb,
+            Some(format!(
+                "https://tenant-b.example/relay/media/{hash}.thumb.jpg"
+            ))
+        );
+    }
+
     #[test]
     fn rewrite_descriptor_urls_for_tenant_replaces_global_media_host() {
         let hash = "a".repeat(64);
@@ -1298,6 +1364,7 @@ mod tests {
         rewrite_descriptor_urls_for_tenant(
             &mut descriptor,
             "wss://primary.example",
+            "",
             "tenant-b.example",
         );
 
diff --git a/crates/buzz-relay/src/api/operator.rs b/crates/buzz-relay/src/api/operator.rs
index 5b69a43874c..8073068ce50 100644
--- a/crates/buzz-relay/src/api/operator.rs
+++ b/crates/buzz-relay/src/api/operator.rs
@@ -74,7 +74,11 @@ async fn authorize_operator_request(
         Some(q) if !q.is_empty() => format!("{path}?{q}"),
         _ => path.to_string(),
     };
-    let url = format!("{origin}{path_with_query}");
+    // `RELAY_OPERATOR_API_ORIGIN` is validated to carry no path, so the
+    // deployment's `BUZZ_BASE_PATH` prefix is applied here — the operator's
+    // signed `u` tag is the URL they actually called, prefix included.
+    let base_path = state.config.base_path.as_str();
+    let url = format!("{origin}{base_path}{path_with_query}");
     let (pubkey, event_id_bytes) = bridge::verify_bridge_auth_with_options(
         headers,
         method,
diff --git a/crates/buzz-relay/src/audio/handler.rs b/crates/buzz-relay/src/audio/handler.rs
index 16cd56209c7..9598e16bc4f 100644
--- a/crates/buzz-relay/src/audio/handler.rs
+++ b/crates/buzz-relay/src/audio/handler.rs
@@ -216,7 +216,11 @@ async fn handle_active_audio_connection(
     // Extract NIP-OA auth tag before verify_auth_event consumes the event.
     let auth_tag_json = crate::handlers::auth::extract_auth_tag_json(&auth_msg.event);
 
-    let relay_url = crate::api::bridge::nip42_expected_relay_url(&state.config.relay_url, &tenant);
+    let relay_url = crate::api::bridge::nip42_expected_relay_url(
+        &state.config.relay_url,
+        &state.config.base_path,
+        &tenant,
+    );
     let auth_ctx = match state
         .auth
         .verify_auth_event(auth_msg.event, &challenge, &relay_url)
diff --git a/crates/buzz-relay/src/config.rs b/crates/buzz-relay/src/config.rs
index 47030dcf3f0..13dc7301972 100644
--- a/crates/buzz-relay/src/config.rs
+++ b/crates/buzz-relay/src/config.rs
@@ -64,8 +64,37 @@ pub struct Config {
     /// pod is only 4 — small enough that rate-limit checks, presence, and
     /// pub/sub publishes queue behind each other under load.
     pub redis_pool_size: usize,
+    /// Maximum connections in the Postgres writer/reader pools. Defaults to 50.
+    ///
+    /// The `buzz-db` default of 20 was sized for a handful of pods against
+    /// `max_connections=100`. Against Aurora (~5,000 connections) that cap
+    /// is the binding constraint: a burst of concurrent handlers exhausts
+    /// the per-pod pool and requests fail on acquire timeout while the
+    /// database sits idle.
+    pub db_pool_size: u32,
     /// Public WebSocket URL of this relay, advertised in NIP-11.
     pub relay_url: String,
+    /// URL path prefix the relay is served under (`BUZZ_BASE_PATH`).
+    ///
+    /// Empty by default: every route mounts at the root and behavior is
+    /// identical to deployments that never set this. When non-empty, the whole
+    /// HTTP + WebSocket surface nests under the prefix, so the relay can sit
+    /// behind a gateway that routes by path instead of by hostname — the
+    /// WebSocket lands on `wss://host/<prefix>` and the bridge endpoints on
+    /// `https://host/<prefix>/events` and friends.
+    ///
+    /// Normalized at load time to exactly one leading slash and no trailing
+    /// slash (`relay`, `/relay`, and `/relay/` all become `/relay`). The
+    /// prefix participates in NIP-98 `u` tags and the NIP-42 `relay` tag, so
+    /// it must match what clients connect to byte-for-byte. `RELAY_URL` and
+    /// `BUZZ_MEDIA_BASE_URL` must carry the same prefix.
+    ///
+    /// Known limitation: the browser web bundle (`BUZZ_WEB_DIR`) references its
+    /// assets at absolute `/assets/...` URLs baked in at build time, so serving
+    /// that SPA under a prefix additionally requires rebuilding it with a
+    /// matching Vite `base`. The relay's protocol surface — WebSocket, bridge,
+    /// media, git — is unaffected.
+    pub base_path: String,
     /// Public WebSocket URL of the dedicated device-pairing relay, when configured.
     pub pairing_relay_url: Option<String>,
     /// Maximum number of concurrent WebSocket connections.
@@ -267,6 +296,47 @@ fn parse_bind_addr(raw: &str) -> Result<SocketAddr, ConfigError> {
         .map_err(|e| ConfigError::InvalidBindAddr(e.to_string()))
 }
 
+/// Normalize a `BUZZ_BASE_PATH` value to the canonical form the router and the
+/// auth-URL builders expect: either empty (mount at the root) or exactly one
+/// leading slash with no trailing slash.
+///
+/// The prefix is concatenated into signed-URL expectations (NIP-98 `u`, NIP-42
+/// `relay`), so anything that could make the server's reconstruction differ from
+/// the client's connect URL is rejected at startup rather than surfacing later
+/// as an unexplainable 401. That means no query, fragment, whitespace, dot
+/// segments, or empty interior segments.
+pub(crate) fn normalize_base_path(raw: &str) -> Result<String, ConfigError> {
+    let trimmed = raw.trim();
+    let stripped = trimmed.trim_matches('/');
+    if stripped.is_empty() {
+        // Unset, blank, and a bare "/" all mean "serve at the root".
+        return Ok(String::new());
+    }
+
+    let invalid = |reason: &str| {
+        Err(ConfigError::InvalidValue(format!(
+            "BUZZ_BASE_PATH {reason} (got {raw:?})"
+        )))
+    };
+
+    if stripped.contains('?') || stripped.contains('#') {
+        return invalid("must not contain a query string or fragment");
+    }
+    if stripped.chars().any(char::is_whitespace) {
+        return invalid("must not contain whitespace");
+    }
+    for segment in stripped.split('/') {
+        if segment.is_empty() {
+            return invalid("must not contain empty path segments");
+        }
+        if segment == "." || segment == ".." {
+            return invalid("must not contain dot segments");
+        }
+    }
+
+    Ok(format!("/{stripped}"))
+}
+
 fn positive_u64_from_env(name: &str, default: u64) -> Result<u64, ConfigError> {
     match std::env::var(name) {
         Ok(raw) => raw
@@ -424,9 +494,20 @@ impl Config {
             .filter(|&v| v > 0)
             .unwrap_or(16);
 
+        let db_pool_size = std::env::var("BUZZ_DB_POOL_SIZE")
+            .ok()
+            .and_then(|v| v.parse::<u32>().ok())
+            .filter(|&v| v > 0)
+            .unwrap_or(50);
+
         let relay_url =
             std::env::var("RELAY_URL").unwrap_or_else(|_| "ws://localhost:3000".to_string());
 
+        let base_path = match std::env::var("BUZZ_BASE_PATH") {
+            Ok(raw) => normalize_base_path(&raw)?,
+            Err(_) => String::new(),
+        };
+
         let pairing_relay_url = std::env::var("BUZZ_PAIRING_RELAY_URL")
             .ok()
             .map(|value| value.trim().to_string())
@@ -875,7 +956,9 @@ impl Config {
             read_database_url,
             redis_url,
             redis_pool_size,
+            db_pool_size,
             relay_url,
+            base_path,
             pairing_relay_url,
             max_connections,
             max_concurrent_handlers,
@@ -934,14 +1017,93 @@ mod tests {
     // value set by `invalid_bind_addr_returns_error`, causing a flaky failure.
     static ENV_MUTEX: std::sync::Mutex<()> = std::sync::Mutex::new(());
 
+    #[test]
+    fn base_path_normalizes_equivalent_spellings() {
+        for raw in ["relay", "/relay", "relay/", "/relay/", "  /relay/  "] {
+            assert_eq!(
+                normalize_base_path(raw).expect("valid prefix"),
+                "/relay",
+                "{raw:?} should normalize to /relay"
+            );
+        }
+        assert_eq!(
+            normalize_base_path("/buzz/relay").expect("valid prefix"),
+            "/buzz/relay",
+            "multi-segment prefixes are preserved"
+        );
+    }
+
+    #[test]
+    fn base_path_treats_blank_and_root_as_unprefixed() {
+        for raw in ["", "   ", "/", "//"] {
+            assert_eq!(
+                normalize_base_path(raw).expect("valid prefix"),
+                "",
+                "{raw:?} should mean serve at the root"
+            );
+        }
+    }
+
+    #[test]
+    fn base_path_rejects_values_that_would_break_signed_urls() {
+        // Each of these would make the server's URL reconstruction differ from
+        // the client's connect URL, surfacing as an unexplainable 401.
+        for raw in [
+            "/relay?x=1",
+            "/relay#frag",
+            "/re lay",
+            "/relay//inner",
+            "/relay/../etc",
+            "/./relay",
+        ] {
+            let err = normalize_base_path(raw).expect_err("should be rejected");
+            assert!(
+                matches!(err, ConfigError::InvalidValue(_)),
+                "{raw:?} should be an InvalidValue error, got {err:?}"
+            );
+        }
+    }
+
+    #[test]
+    fn base_path_defaults_to_empty_when_unset() {
+        let _guard = ENV_MUTEX.lock().unwrap();
+        let previous = std::env::var_os("BUZZ_BASE_PATH");
+        std::env::remove_var("BUZZ_BASE_PATH");
+        let config = Config::from_env().expect("default config");
+        assert_eq!(
+            config.base_path, "",
+            "an unset BUZZ_BASE_PATH must leave routes at the root"
+        );
+
+        std::env::set_var("BUZZ_BASE_PATH", "relay/");
+        let prefixed = Config::from_env().expect("prefixed config");
+        assert_eq!(prefixed.base_path, "/relay");
+
+        std::env::set_var("BUZZ_BASE_PATH", "/relay?x=1");
+        assert!(
+            Config::from_env().is_err(),
+            "an invalid prefix must fail startup, not degrade silently"
+        );
+
+        match previous {
+            Some(value) => std::env::set_var("BUZZ_BASE_PATH", value),
+            None => std::env::remove_var("BUZZ_BASE_PATH"),
+        }
+    }
+
     #[test]
     fn defaults_are_valid() {
         let _guard = ENV_MUTEX.lock().unwrap();
         let config = Config::from_env().expect("default config");
+        assert_eq!(
+            config.base_path, "",
+            "base_path should default to empty (root-mounted)"
+        );
         assert!(config.bind_addr.port() > 0);
         assert!(!config.database_url.is_empty());
         assert!(!config.redis_url.is_empty());
         assert_eq!(config.redis_pool_size, 16);
+        assert_eq!(config.db_pool_size, 50);
         assert!(config.max_connections > 0);
         assert!(config.send_buffer_size > 0);
         assert_eq!(config.max_frame_bytes, DEFAULT_MAX_FRAME_BYTES);
@@ -1009,6 +1171,31 @@ mod tests {
         assert_eq!(junk, 16, "unparsable value must fall back to the default");
     }
 
+    #[test]
+    fn db_pool_size_env_override_and_invalid_fallback() {
+        let _guard = ENV_MUTEX.lock().unwrap();
+        let previous = std::env::var_os("BUZZ_DB_POOL_SIZE");
+
+        std::env::set_var("BUZZ_DB_POOL_SIZE", "80");
+        let overridden = Config::from_env().expect("config").db_pool_size;
+
+        std::env::set_var("BUZZ_DB_POOL_SIZE", "0");
+        let zero = Config::from_env().expect("config").db_pool_size;
+
+        std::env::set_var("BUZZ_DB_POOL_SIZE", "not-a-number");
+        let junk = Config::from_env().expect("config").db_pool_size;
+
+        if let Some(value) = previous {
+            std::env::set_var("BUZZ_DB_POOL_SIZE", value);
+        } else {
+            std::env::remove_var("BUZZ_DB_POOL_SIZE");
+        }
+
+        assert_eq!(overridden, 80);
+        assert_eq!(zero, 50, "zero must fall back to the default");
+        assert_eq!(junk, 50, "unparsable value must fall back to the default");
+    }
+
     #[test]
     fn read_database_url_unset_or_blank_is_none() {
         let _guard = ENV_MUTEX.lock().unwrap();
diff --git a/crates/buzz-relay/src/handlers/auth.rs b/crates/buzz-relay/src/handlers/auth.rs
index 127f1fc40e0..ccc0990e9ba 100644
--- a/crates/buzz-relay/src/handlers/auth.rs
+++ b/crates/buzz-relay/src/handlers/auth.rs
@@ -77,8 +77,11 @@ pub async fn handle_auth(event: nostr::Event, conn: Arc<ConnectionState>, state:
     // tampered, NIP-42 verification will fail before we ever inspect it.
     let auth_tag_json = extract_auth_tag_json(&event);
 
-    let relay_url =
-        crate::api::bridge::nip42_expected_relay_url(&state.config.relay_url, &conn.tenant);
+    let relay_url = crate::api::bridge::nip42_expected_relay_url(
+        &state.config.relay_url,
+        &state.config.base_path,
+        &conn.tenant,
+    );
     let auth_svc = Arc::clone(&state.auth);
 
     metrics::counter!("buzz_auth_attempts_total", "method" => "nip42").increment(1);
diff --git a/crates/buzz-relay/src/handlers/command_executor.rs b/crates/buzz-relay/src/handlers/command_executor.rs
index bd3eff4de9b..2d82736807a 100644
--- a/crates/buzz-relay/src/handlers/command_executor.rs
+++ b/crates/buzz-relay/src/handlers/command_executor.rs
@@ -685,6 +685,24 @@ async fn handle_workflow_def(
         .map_err(|e| IngestError::Rejected(format!("invalid: workflow YAML parse error: {e}")))?;
     let workflow_name = extract_tag(event, "name").unwrap_or_else(|| def.name.clone());
 
+    // SEC-006: definitions with exfiltration-capable actions (call_webhook)
+    // require elevated channel authority to save — plain membership is not
+    // enough, because the workflow will forward channel content outward with
+    // the owner's standing authority. Fail-closed on lookup errors.
+    if def.requires_elevated_authority() {
+        let role = state
+            .db
+            .get_member_role(tenant.community(), channel_id, &self_bytes)
+            .await
+            .map_err(|e| IngestError::Internal(format!("error: role check: {e}")))?;
+        if !matches!(role.as_deref(), Some("owner") | Some("admin")) {
+            return Err(IngestError::Rejected(
+                "forbidden: workflows with call_webhook actions require the owner or admin role"
+                    .into(),
+            ));
+        }
+    }
+
     let mut definition_json: serde_json::Value = serde_json::from_str(&definition_json_str)
         .map_err(|e| IngestError::Internal(format!("error: json parse of definition: {e}")))?;
 
@@ -843,6 +861,31 @@ async fn handle_workflow_trigger(
         ));
     }
 
+    // SEC-006: manual triggers must honor the workflow's lifecycle state and
+    // recheck the owner's *current* channel authority before creating a run.
+    // Without this, a disabled workflow — including one disabled because its
+    // owner was removed from the channel — could still be fired by the owner.
+    if !workflow.enabled || workflow.status != buzz_db::workflow::WorkflowStatus::Active {
+        return Err(IngestError::Rejected(
+            "forbidden: workflow is disabled or inactive".into(),
+        ));
+    }
+    let def: buzz_workflow::WorkflowDef = serde_json::from_value(workflow.definition.clone())
+        .map_err(|e| IngestError::Internal(format!("error: corrupt workflow definition: {e}")))?;
+    let Some(wf_channel_id) = workflow.channel_id else {
+        // No channel scope means no channel authority to verify — fail closed.
+        return Err(IngestError::Rejected(
+            "forbidden: workflow has no channel scope".into(),
+        ));
+    };
+    state
+        .workflow_engine
+        .check_owner_authority(community_id, wf_channel_id, &workflow.owner_pubkey, &def)
+        .await
+        .map_err(|_| {
+            IngestError::Rejected("forbidden: not authorized to trigger this workflow".into())
+        })?;
+
     // Persist the command event under the workflow channel even though the
     // trigger event itself only carries the workflow UUID. Storing channel
     // triggers as global events leaks workflow IDs to unrelated relay members.
diff --git a/crates/buzz-relay/src/handlers/ingest.rs b/crates/buzz-relay/src/handlers/ingest.rs
index 497adc6c737..1457cb64b20 100644
--- a/crates/buzz-relay/src/handlers/ingest.rs
+++ b/crates/buzz-relay/src/handlers/ingest.rs
@@ -183,6 +183,19 @@ pub enum IngestError {
     Internal(String),
 }
 
+fn map_relay_admin_error(error: super::relay_admin::RelayAdminError) -> IngestError {
+    use super::relay_admin::RelayAdminError;
+    match error {
+        // Same wire prefix and HTTP status (403) as every other durable
+        // restriction refusal — see the write-path gate below and `auth.rs`.
+        RelayAdminError::Banned => {
+            IngestError::AuthFailed("blocked: you are banned from this community".to_string())
+        }
+        RelayAdminError::Rejected(reason) => IngestError::Rejected(format!("invalid: {reason}")),
+        RelayAdminError::Internal(reason) => IngestError::Internal(format!("error: {reason}")),
+    }
+}
+
 fn map_push_accept_error(error: super::push_lease::AcceptError) -> IngestError {
     match error {
         super::push_lease::AcceptError::Validation(reason) => {
@@ -1624,7 +1637,10 @@ async fn ingest_event_inner(
     // is the durable backstop the fan-out's best-effort delivery relies on.
     // Moderation commands enforce bans inside their handler and remain exempt
     // here only so timeouts do not disarm the tool used to lift them. Relay-admin
-    // commands retain their separate authorization policy.
+    // commands (9030–9033) are exempt for the same reason — a timed-out admin
+    // must still be able to administer the roster — and likewise enforce the
+    // durable ban inside `relay_admin::handle_relay_admin_event`. Any kind added
+    // to this exemption owes the same handler-local ban check.
     //
     // Scope: this gate checks the *authoring* pubkey only, with no NIP-OA
     // owner→agent cascade. That cascade lives at the auth seam for bans, where
@@ -1831,10 +1847,13 @@ async fn ingest_event_inner(
     }
 
     // Handled directly — these mutate relay_members and do NOT get stored.
+    // The handler enforces the durable community ban itself: the write-path
+    // gate above exempts relay-admin kinds so timed-out admins keep their
+    // administrative capability, which leaves bans to the handler.
     if is_relay_admin_kind(event.kind.as_u16() as u32) {
         crate::handlers::relay_admin::handle_relay_admin_event(tenant, state, &event)
             .await
-            .map_err(|e| IngestError::Rejected(format!("invalid: {e}")))?;
+            .map_err(map_relay_admin_error)?;
         return Ok(IngestResult {
             event_id: event_id_hex,
             accepted: true,
@@ -2234,8 +2253,11 @@ async fn ingest_event_inner(
         .map(|t| t.as_slice().iter().map(|s| s.to_string()).collect())
         .collect();
     if !imeta_tags.is_empty() {
-        let tenant_media_base =
-            crate::api::media::media_base_url_for_tenant(&state.config.relay_url, tenant.host());
+        let tenant_media_base = crate::api::media::media_base_url_for_tenant(
+            &state.config.relay_url,
+            &state.config.base_path,
+            tenant.host(),
+        );
         crate::api::validate_imeta_tags(&imeta_tags, &tenant_media_base)
             .map_err(|e| IngestError::Rejected(format!("invalid: {e}")))?;
         crate::api::verify_imeta_blobs(tenant, &imeta_tags, &state.media_storage)
@@ -2542,6 +2564,62 @@ mod tests {
     };
     use nostr::{EventBuilder, Kind};
 
+    /// A banned relay admin must be refused with the same wire prefix and
+    /// transport status as every other durable-restriction refusal:
+    /// `blocked:` and (via `bridge.rs`'s `AuthFailed` arm) HTTP 403 — never
+    /// `invalid:`/400, which reads as "your request was malformed" and lets a
+    /// client retry-loop against an authorization decision.
+    #[test]
+    fn relay_admin_ban_maps_to_blocked_auth_failure() {
+        let mapped = map_relay_admin_error(super::super::relay_admin::RelayAdminError::Banned);
+        match mapped {
+            IngestError::AuthFailed(msg) => {
+                assert_eq!(msg, "blocked: you are banned from this community");
+            }
+            other => panic!("banned admin must map to AuthFailed (HTTP 403), got {other:?}"),
+        }
+    }
+
+    /// Validation/authorization failures keep the pre-existing `invalid:`
+    /// prefix and 400 status — this is the arm the whole 9030-series relied on
+    /// before the ban category existed, so it must not regress.
+    #[test]
+    fn relay_admin_rejection_keeps_invalid_prefix() {
+        let mapped = map_relay_admin_error(super::super::relay_admin::RelayAdminError::Rejected(
+            "actor not authorized: must be admin or owner".to_string(),
+        ));
+        match mapped {
+            IngestError::Rejected(msg) => {
+                assert_eq!(
+                    msg, "invalid: actor not authorized: must be admin or owner",
+                    "existing relay-admin rejections must keep their exact wire text"
+                );
+            }
+            other => panic!("validation failure must map to Rejected, got {other:?}"),
+        }
+    }
+
+    /// A restriction-lookup outage is a server fault, not a client one. It
+    /// must fail closed as `error:`/500 so a Postgres blip can neither admit a
+    /// banned admin nor be reported to an innocent one as a bad request.
+    #[test]
+    fn relay_admin_internal_maps_to_error_not_client_fault() {
+        let mapped = map_relay_admin_error(super::super::relay_admin::RelayAdminError::Internal(
+            "internal error checking restriction state: pool timed out".to_string(),
+        ));
+        match mapped {
+            IngestError::Internal(msg) => {
+                assert!(
+                    msg.starts_with("error: "),
+                    "internal failures need the `error:` NIP-01 prefix, got {msg:?}"
+                );
+            }
+            other => {
+                panic!("restriction DB failure must map to Internal (HTTP 500), got {other:?}")
+            }
+        }
+    }
+
     #[derive(Debug, Default)]
     struct VecTracer {
         steps: Mutex<Vec<TraceStep>>,
diff --git a/crates/buzz-relay/src/handlers/product_feedback.rs b/crates/buzz-relay/src/handlers/product_feedback.rs
index 92d045e1947..c11b1f57c2e 100644
--- a/crates/buzz-relay/src/handlers/product_feedback.rs
+++ b/crates/buzz-relay/src/handlers/product_feedback.rs
@@ -27,8 +27,11 @@ pub async fn handle(
         .map(|tag| tag.as_slice().iter().map(ToString::to_string).collect())
         .collect::<Vec<Vec<String>>>();
     if !imeta_tags.is_empty() {
-        let media_base =
-            crate::api::media::media_base_url_for_tenant(&state.config.relay_url, tenant.host());
+        let media_base = crate::api::media::media_base_url_for_tenant(
+            &state.config.relay_url,
+            &state.config.base_path,
+            tenant.host(),
+        );
         crate::api::validate_imeta_tags(&imeta_tags, &media_base)?;
         crate::api::verify_imeta_blobs(tenant, &imeta_tags, &state.media_storage).await?;
     }
diff --git a/crates/buzz-relay/src/handlers/relay_admin.rs b/crates/buzz-relay/src/handlers/relay_admin.rs
index 840d9dcfe58..3f58a9c2aa8 100644
--- a/crates/buzz-relay/src/handlers/relay_admin.rs
+++ b/crates/buzz-relay/src/handlers/relay_admin.rs
@@ -94,8 +94,92 @@ fn validate_workspace_icon(icon: &str) -> Result<(), String> {
     Ok(())
 }
 
+/// A relay-admin command failure, carrying the *category* of the failure so
+/// the ingest seam can map it to the right NIP-01 prefix and HTTP status.
+///
+/// The category is part of the security contract, not cosmetics: a ban must
+/// surface as `blocked:` / HTTP 403 (like every other durable-restriction
+/// refusal), and a restriction-lookup outage must surface as a 500 rather than
+/// a client-side 400 that reads as "your request was malformed". Mirrors
+/// [`super::push_lease::AcceptError`] and its `map_push_accept_error` seam.
+#[derive(Debug, PartialEq, Eq)]
+pub(super) enum RelayAdminError {
+    /// Sender is under a durable community ban — `blocked:` / HTTP 403.
+    Banned,
+    /// Legacy command rejection — `invalid:` / HTTP 400. This is whatever
+    /// [`execute_relay_admin_command`] returned as a `String`, which is mostly
+    /// validation and authorization but also still includes that function's own
+    /// DB failures. Categorizing those is deliberately out of scope for the ban
+    /// fix, so this arm claims no stronger invariant than "the command body said
+    /// no".
+    Rejected(String),
+    /// Admission could not be decided because the restriction lookup failed —
+    /// `error:` / HTTP 500.
+    Internal(String),
+}
+
+/// Decide whether a durable restriction state admits a relay-admin command.
+///
+/// Ban only, deliberately: a timeout is a write-block on *content*, and
+/// `ingest_event` exempts relay-admin kinds from its durable write-path gate
+/// precisely so restricted-but-not-banned admins retain their administrative
+/// capability. Mirrors `moderation_commands::ensure_actor_not_banned`.
+///
+/// Split out as a pure function so the admission rule itself is unit-testable
+/// without a live relay: the end-to-end HTTP test proves the transport, this
+/// proves the decision.
+fn admits_relay_admin_command(
+    restriction: &buzz_db::moderation::RestrictionState,
+) -> Result<(), RelayAdminError> {
+    if restriction.banned {
+        return Err(RelayAdminError::Banned);
+    }
+    Ok(())
+}
+
 /// Validate and execute a relay admin command (kinds 9030–9033).
 ///
+/// Admission: rejects a sender under a durable community ban before any
+/// command runs. The command itself is executed by
+/// [`execute_relay_admin_command`].
+///
+/// Returns `Ok(())` on success, or a categorized [`RelayAdminError`].
+pub(super) async fn handle_relay_admin_event(
+    tenant: &TenantContext,
+    state: &Arc<AppState>,
+    event: &Event,
+) -> Result<(), RelayAdminError> {
+    // A ban is an admission boundary, not only a WebSocket-auth check. HTTP
+    // NIP-98 requests and already-authenticated sockets reach this handler
+    // without passing through a fresh NIP-42 challenge, and `ingest_event`
+    // exempts relay-admin kinds from its durable write-path gate so a *timed
+    // out* admin can still administer the roster. That exemption is ban-blind,
+    // so the ban must be enforced here or not at all: a banned admin otherwise
+    // keeps mutating `relay_members` — the very table `moderation_authz`
+    // derives moderator capability from — until someone manually deletes the
+    // row. Mirrors `moderation_commands.rs`, which defends the same boundary
+    // for 9040–9044, and holds that file's stated invariant that a direct
+    // command handler rejects a banned actor on every transport.
+    //
+    // This gate wraps execution rather than opening it so no future early
+    // return inside the command body can precede it.
+    let restriction = state
+        .db
+        .moderation_restriction_state(tenant.community(), &event.pubkey.to_bytes())
+        .await
+        // Fail closed: a DB blip must never admit a banned admin.
+        .map_err(|e| {
+            RelayAdminError::Internal(format!("internal error checking restriction state: {e}"))
+        })?;
+    admits_relay_admin_command(&restriction)?;
+
+    execute_relay_admin_command(tenant, state, event)
+        .await
+        .map_err(RelayAdminError::Rejected)
+}
+
+/// Execute an already-admitted relay admin command.
+///
 /// The handler:
 /// 1. Extracts the target pubkey from the `["p", ...]` tag.
 /// 2. Extracts the role from the `["role", ...]` tag (kinds 9030 and 9032).
@@ -103,9 +187,11 @@ fn validate_workspace_icon(icon: &str) -> Result<(), String> {
 /// 4. Enforces the permission matrix.
 /// 5. Applies the change via the DB.
 ///
-/// Returns `Ok(())` on success.  Returns `Err(msg)` — where `msg` is a
-/// human-readable rejection reason — on any validation failure.
-pub async fn handle_relay_admin_event(
+/// Returns `Ok(())` on success.  Returns `Err(msg)` — where `msg` is the
+/// legacy rejection reason — on any failure. This body does not distinguish
+/// validation failures from execution DB failures; both surface as `Err(msg)`
+/// and are categorised by the caller as [`RelayAdminError::Rejected`].
+async fn execute_relay_admin_command(
     tenant: &TenantContext,
     state: &Arc<AppState>,
     event: &Event,
@@ -349,6 +435,46 @@ mod tests {
     use super::*;
     use nostr::{EventBuilder, Keys, Kind, Tag};
 
+    /// The vulnerability this file's ban gate closes: `ingest_event` exempts
+    /// relay-admin kinds 9030–9033 from its durable write-path restriction
+    /// gate, so a **banned** admin could add/remove relay members and change
+    /// the workspace icon over signed NIP-98 `POST /events`. Deleting the
+    /// admission check must fail here, in the default (non-ignored) suite.
+    #[test]
+    fn banned_actor_is_not_admitted_to_a_relay_admin_command() {
+        let banned = buzz_db::moderation::RestrictionState {
+            banned: true,
+            muted_until: None,
+        };
+        assert_eq!(
+            admits_relay_admin_command(&banned),
+            Err(RelayAdminError::Banned),
+            "a durably banned admin must never reach a relay-admin command"
+        );
+    }
+
+    /// The counter-invariant, and the reason the ingest exemption exists at
+    /// all: a timeout restricts *content* writes, not administrative
+    /// capability. Widening this gate to timeouts would silently change policy.
+    #[test]
+    fn timed_out_actor_is_still_admitted() {
+        let timed_out = buzz_db::moderation::RestrictionState {
+            banned: false,
+            muted_until: Some(chrono::Utc::now() + chrono::Duration::minutes(5)),
+        };
+        assert!(
+            admits_relay_admin_command(&timed_out).is_ok(),
+            "a timed-out admin must still administer the roster"
+        );
+    }
+
+    #[test]
+    fn unrestricted_actor_is_admitted() {
+        assert!(
+            admits_relay_admin_command(&buzz_db::moderation::RestrictionState::default()).is_ok()
+        );
+    }
+
     /// Build a minimal signed Event with the given kind and tags.
     /// The pubkey will be randomly generated — sufficient for tag extraction tests.
     fn make_test_event(kind: u16, tags: Vec<Vec<&'static str>>) -> Event {
diff --git a/crates/buzz-relay/src/handlers/side_effects.rs b/crates/buzz-relay/src/handlers/side_effects.rs
index 6ff1315acc7..65d04ef0bac 100644
--- a/crates/buzz-relay/src/handlers/side_effects.rs
+++ b/crates/buzz-relay/src/handlers/side_effects.rs
@@ -51,6 +51,52 @@ async fn evict_live_channel_subscriptions(
     }
 }
 
+/// Durably disable a departing member's workflows in the channel (SEC-006).
+///
+/// A workflow runs with its owner's standing authority; once the owner is no
+/// longer a member (removed via kind 9001 or left via kind 9022) their
+/// workflows must stop firing on every path — event triggers, the scheduler,
+/// manual triggers, and the webhook endpoint all honor `enabled = FALSE`.
+/// The per-fire authority gate in `buzz-workflow` is the fail-closed backstop;
+/// this makes the revocation durable and immediately visible.
+///
+/// Failures are logged, not propagated: membership removal has already been
+/// committed, and the per-fire gate still denies a removed owner even if this
+/// disable write is lost.
+async fn disable_departed_member_workflows(
+    tenant: &TenantContext,
+    state: &Arc<AppState>,
+    channel_id: Uuid,
+    target_pubkey: &[u8],
+) {
+    match state
+        .db
+        .disable_workflows_for_owner_in_channel(tenant.community(), channel_id, target_pubkey)
+        .await
+    {
+        Ok(0) => {}
+        Ok(n) => {
+            tracing::info!(
+                channel = %channel_id,
+                owner = %hex::encode(target_pubkey),
+                disabled = n,
+                "Disabled departed member's workflows"
+            );
+            state
+                .workflow_engine
+                .invalidate_channel_workflows(tenant.community(), channel_id);
+        }
+        Err(e) => {
+            warn!(
+                channel = %channel_id,
+                owner = %hex::encode(target_pubkey),
+                error = %e,
+                "Failed to disable departed member's workflows — per-fire authority gate still denies"
+            );
+        }
+    }
+}
+
 /// Close every live channel-scoped subscription on `conn_id`, removing them from
 /// the connection's local map and sending `CLOSED restricted` for each.
 async fn evict_conn_channel_subscriptions(
@@ -1341,6 +1387,7 @@ async fn handle_remove_user(
         .await?;
     state.invalidate_membership(tenant, channel_id, &target_pubkey);
     evict_live_channel_subscriptions(tenant, state, channel_id, &target_pubkey).await;
+    disable_departed_member_workflows(tenant, state, channel_id, &target_pubkey).await;
 
     let actor_hex = hex::encode(&actor_bytes);
     let target_hex = hex::encode(&target_pubkey);
@@ -1987,6 +2034,7 @@ async fn handle_leave_request(
         .await?;
     state.invalidate_membership(tenant, channel_id, &actor_bytes);
     evict_live_channel_subscriptions(tenant, state, channel_id, &actor_bytes).await;
+    disable_departed_member_workflows(tenant, state, channel_id, &actor_bytes).await;
 
     let actor_hex = hex::encode(&actor_bytes);
     emit_system_message(
diff --git a/crates/buzz-relay/src/invite_token.rs b/crates/buzz-relay/src/invite_token.rs
index 436040c32a6..e271f40f0b5 100644
--- a/crates/buzz-relay/src/invite_token.rs
+++ b/crates/buzz-relay/src/invite_token.rs
@@ -49,10 +49,10 @@ use buzz_core::tenant::CommunityId;
 type HmacSha256 = Hmac<Sha256>;
 
 /// Default invite lifetime: 72 hours.
-pub const DEFAULT_INVITE_TTL_SECS: u64 = 72 * 60 * 60;
+pub use buzz_core::invite::DEFAULT_INVITE_TTL_SECS;
 
 /// Maximum invite lifetime a mint request may ask for: 30 days.
-pub const MAX_INVITE_TTL_SECS: u64 = 30 * 24 * 60 * 60;
+pub use buzz_core::invite::MAX_INVITE_TTL_SECS;
 
 /// Maximum accepted code length (defense against absurd inputs before any
 /// parsing work happens). A real code is ~200 bytes.
@@ -121,10 +121,11 @@ fn sign_payload(key: &[u8; 32], payload_bytes: &[u8]) -> Vec<u8> {
     mac.finalize().into_bytes().to_vec()
 }
 
-/// Mint an invite code for `community`, expiring `ttl_secs` from now.
+/// Mint a legacy v1 invite code for compatibility tests.
 ///
-/// The role is fixed to `"member"` — elevated roles are granted post-join via
-/// the existing kind:9032 change-role command, never via a bearer link.
+/// Production minting uses database-backed v2 codes. Remove this helper with
+/// v1 claim verification after the compatibility drain window.
+#[cfg(test)]
 pub fn mint_invite(key: &[u8; 32], community: CommunityId, ttl_secs: u64) -> (String, u64) {
     let ttl = ttl_secs.clamp(60, MAX_INVITE_TTL_SECS);
     let expires_at = now_unix() + ttl;
diff --git a/crates/buzz-relay/src/main.rs b/crates/buzz-relay/src/main.rs
index 22101219ebf..3ed820d3c50 100644
--- a/crates/buzz-relay/src/main.rs
+++ b/crates/buzz-relay/src/main.rs
@@ -4,6 +4,10 @@ use std::sync::Arc;
 
 use tracing::{error, info, warn};
 use tracing_subscriber::{fmt, prelude::*, EnvFilter};
+
+fn log_env_filter(rust_log: Option<&str>) -> EnvFilter {
+    EnvFilter::new(rust_log.unwrap_or("buzz_relay=info"))
+}
 use uuid::Uuid;
 
 use buzz_audit::AuditService;
@@ -107,9 +111,17 @@ async fn main() -> anyhow::Result<()> {
     };
 
     tracing_subscriber::registry()
-        .with(fmt::layer().json().flatten_event(true))
-        .with(EnvFilter::from_default_env().add_directive("buzz_relay=info".parse()?))
-        .with(otel_layer)
+        .with(
+            fmt::layer()
+                .json()
+                .flatten_event(true)
+                .with_filter(log_env_filter(std::env::var("RUST_LOG").ok().as_deref())),
+        )
+        .with(otel_layer.map(|layer| {
+            layer.with_filter(telemetry::otel_env_filter(
+                std::env::var("BUZZ_OTEL_FILTER").ok().as_deref(),
+            ))
+        }))
         .init();
 
     // Log any exporter-build failure now that the subscriber is installed.
@@ -146,6 +158,7 @@ async fn main() -> anyhow::Result<()> {
     let db_config = DbConfig {
         database_url: config.database_url.clone(),
         read_database_url: config.read_database_url.clone(),
+        max_connections: config.db_pool_size,
         ..DbConfig::default()
     };
     let db = Db::new(&db_config).await.map_err(|e| {
@@ -1060,6 +1073,52 @@ async fn main() -> anyhow::Result<()> {
     Ok(())
 }
 
+#[cfg(test)]
+mod env_filter_tests {
+    use super::log_env_filter;
+    use buzz_relay::telemetry::otel_env_filter;
+    use tracing_subscriber::prelude::*;
+
+    #[test]
+    fn unset_enables_datastore_only_for_otel_filter() {
+        let logs = tracing_subscriber::registry().with(log_env_filter(None));
+        tracing::subscriber::with_default(logs, || {
+            assert!(!tracing::enabled!(target: "buzz_datastore", tracing::Level::INFO));
+            assert!(tracing::enabled!(target: "buzz_relay", tracing::Level::INFO));
+        });
+
+        let otel = tracing_subscriber::registry().with(otel_env_filter(None));
+        tracing::subscriber::with_default(otel, || {
+            assert!(tracing::enabled!(target: "buzz_datastore", tracing::Level::INFO));
+        });
+    }
+
+    #[test]
+    fn explicit_datastore_off_is_preserved_alone() {
+        assert_eq!(
+            otel_env_filter(Some("buzz_datastore=off")).to_string(),
+            "buzz_datastore=off"
+        );
+    }
+
+    #[test]
+    fn explicit_datastore_debug_is_preserved_alone() {
+        assert_eq!(
+            otel_env_filter(Some("buzz_datastore=debug")).to_string(),
+            "buzz_datastore=debug"
+        );
+    }
+
+    #[test]
+    fn log_and_otel_filters_are_configured_independently() {
+        assert_eq!(log_env_filter(Some("warn")).to_string(), "warn");
+        assert_eq!(
+            otel_env_filter(Some("buzz_relay=debug")).to_string(),
+            "buzz_relay=debug"
+        );
+    }
+}
+
 async fn run_community_revalidator(
     state: Arc<AppState>,
     period: std::time::Duration,
@@ -1426,6 +1485,20 @@ async fn run_usage_metrics_tick(
             *leader = None;
             return Err(error);
         }
+        let invite_retention_cutoff = chrono::Utc::now() - chrono::Duration::days(30);
+        match state
+            .db
+            .reap_expired_relay_invites(invite_retention_cutoff)
+            .await
+        {
+            Ok(deleted) if deleted > 0 => {
+                info!(deleted, "reaped expired relay invites");
+            }
+            Ok(_) => {}
+            Err(error) => {
+                warn!(error = %error, "failed to reap expired relay invites");
+            }
+        }
         run_storage_sweep_tick(state, emission_scope, &host_map).await;
     }
 
diff --git a/crates/buzz-relay/src/nip11.rs b/crates/buzz-relay/src/nip11.rs
index a8e397dd21f..75e93012ae8 100644
--- a/crates/buzz-relay/src/nip11.rs
+++ b/crates/buzz-relay/src/nip11.rs
@@ -180,9 +180,14 @@ pub async fn relay_info_handler(
     axum::response::Json(nip11_document(&state, raw_host).await)
 }
 
+/// `base_path` is the deployment's `BUZZ_BASE_PATH` prefix (empty when the relay
+/// serves at the root). Push clients dial the advertised `origin` directly, so a
+/// prefixed deployment must advertise the prefix or every push registration
+/// lands on a path the gateway does not route.
 fn push_descriptor(
     push_configured: bool,
     relay_url: &str,
+    base_path: &str,
     executor_key_id: &str,
     relay_keypair: &nostr::Keys,
     tenant_host: Option<&str>,
@@ -195,7 +200,7 @@ fn push_descriptor(
         "ws"
     };
     Some(serde_json::json!({
-        "origin": format!("{scheme}://{host}"),
+        "origin": format!("{scheme}://{host}{base_path}"),
         "keys": [{
             "id": executor_key_id,
             "pubkey": relay_keypair.public_key().to_hex(),
@@ -253,6 +258,7 @@ pub(crate) async fn nip11_document(state: &crate::state::AppState, raw_host: &st
     if let Some(push) = push_descriptor(
         state.config.push_gateway_delivery_url.is_some(),
         &state.config.relay_url,
+        &state.config.base_path,
         &state.config.push_executor_key_id,
         &state.relay_keypair,
         tenant_host.as_deref(),
@@ -341,12 +347,19 @@ mod tests {
     #[test]
     fn push_descriptor_is_gated_by_gateway_configuration_and_tenant_binding() {
         let keys = nostr::Keys::generate();
-        assert!(
-            push_descriptor(false, "ws://relay", "key", &keys, Some("tenant.example")).is_none()
-        );
-        assert!(push_descriptor(true, "ws://relay", "key", &keys, None).is_none());
-        let descriptor = push_descriptor(true, "ws://relay", "key", &keys, Some("tenant.example"))
-            .expect("configured push descriptor");
+        assert!(push_descriptor(
+            false,
+            "ws://relay",
+            "",
+            "key",
+            &keys,
+            Some("tenant.example")
+        )
+        .is_none());
+        assert!(push_descriptor(true, "ws://relay", "", "key", &keys, None).is_none());
+        let descriptor =
+            push_descriptor(true, "ws://relay", "", "key", &keys, Some("tenant.example"))
+                .expect("configured push descriptor");
         assert_eq!(descriptor["origin"], "ws://tenant.example");
         assert_eq!(
             descriptor["push_kinds"],
@@ -354,6 +367,23 @@ mod tests {
         );
     }
 
+    /// Push clients dial the advertised `origin` verbatim, so a relay served
+    /// under `BUZZ_BASE_PATH` has to advertise the prefix.
+    #[test]
+    fn push_descriptor_origin_carries_the_base_path_prefix() {
+        let keys = nostr::Keys::generate();
+        let descriptor = push_descriptor(
+            true,
+            "wss://relay",
+            "/relay",
+            "key",
+            &keys,
+            Some("tenant.example"),
+        )
+        .expect("configured push descriptor");
+        assert_eq!(descriptor["origin"], "wss://tenant.example/relay");
+    }
+
     #[test]
     fn supported_nips_includes_nip23_and_nip33() {
         // Tests the production SUPPORTED_NIPS constant directly — no Config::from_env()
diff --git a/crates/buzz-relay/src/router.rs b/crates/buzz-relay/src/router.rs
index 2af036079ff..2004a4c6ac3 100644
--- a/crates/buzz-relay/src/router.rs
+++ b/crates/buzz-relay/src/router.rs
@@ -4,8 +4,9 @@ use std::sync::atomic::Ordering;
 use std::sync::Arc;
 
 use axum::{
+    body::Body,
     extract::{ConnectInfo, FromRequest, State, WebSocketUpgrade},
-    http::{HeaderMap, StatusCode},
+    http::{HeaderMap, Request, StatusCode},
     middleware,
     response::{IntoResponse, Json},
     routing::{get, post, put},
@@ -16,7 +17,7 @@ use tower::ServiceExt;
 use tower_http::cors::{AllowOrigin, CorsLayer};
 use tower_http::limit::RequestBodyLimitLayer;
 use tower_http::services::ServeDir;
-use tower_http::trace::TraceLayer;
+use tower_http::trace::{HttpMakeClassifier, TraceLayer};
 
 use crate::api;
 use crate::audio;
@@ -185,12 +186,60 @@ pub fn build_router(state: Arc<AppState>) -> Router {
         merged = merged.fallback_service(spa_fallback);
     }
 
-    merged
+    // Optional path prefix (`BUZZ_BASE_PATH`). Empty is the default and leaves
+    // the router exactly as built above. When set, the whole surface nests
+    // under the prefix so the relay can live behind a gateway that routes by
+    // path rather than by hostname.
+    //
+    // `nest` strips the prefix before the inner router sees the request, so
+    // every route match, the SPA fallback's `req.uri().path()` checks, and the
+    // media/git sub-routers keep working against their unprefixed paths.
+    //
+    // Health probes stay mounted at the root as well: Kubernetes probes reach
+    // the pod directly rather than through the gateway that needs the prefix,
+    // and `deploy/compose` curls `/_liveness` on the published port.
+    let root_health = Router::new()
+        .route("/health", get(health_handler))
+        .route("/_liveness", get(liveness_handler))
+        .route("/_readiness", get(readiness_handler))
+        .with_state(state.clone());
+    let routed = nest_under_base_path(&state.config.base_path, merged, root_health);
+
+    routed
         .layer(middleware::from_fn(track_metrics))
-        .layer(TraceLayer::new_for_http())
+        .layer(http_trace_layer())
         .layer(build_cors_layer(&state.config.cors_origins))
 }
 
+/// Mount `router` under `base_path`, keeping `root_extras` reachable at the root.
+///
+/// An empty `base_path` returns `router` untouched — the default, and byte-identical
+/// to the pre-`BUZZ_BASE_PATH` router. Otherwise everything nests under the prefix
+/// so the relay can sit behind a gateway that routes by path rather than hostname.
+/// `nest` strips the prefix before the inner router sees the request, so route
+/// matches and the SPA fallback's own `req.uri().path()` checks keep working
+/// against their unprefixed paths.
+fn nest_under_base_path(base_path: &str, router: Router, root_extras: Router) -> Router {
+    if base_path.is_empty() {
+        router
+    } else {
+        Router::new().nest(base_path, router).merge(root_extras)
+    }
+}
+
+fn http_trace_layer() -> TraceLayer<HttpMakeClassifier, fn(&Request<Body>) -> tracing::Span> {
+    TraceLayer::new_for_http().make_span_with(make_http_span as fn(&Request<Body>) -> tracing::Span)
+}
+
+fn make_http_span(request: &Request<Body>) -> tracing::Span {
+    tracing::info_span!(
+        target: "buzz_relay",
+        "http.request",
+        otel.kind = "server",
+        http.request.method = %request.method(),
+    )
+}
+
 fn is_admin_spa_path(path: &str) -> bool {
     path == "/"
         || path == "/reports"
@@ -435,9 +484,14 @@ fn build_cors_layer(cors_origins: &[String]) -> CorsLayer {
 mod tests {
     use axum::{routing::get, Router};
     use futures_util::SinkExt;
+    use opentelemetry::trace::TracerProvider as _;
+    use opentelemetry_sdk::trace::{InMemorySpanExporter, SdkTracerProvider};
     use tokio::net::TcpListener;
     use tokio::sync::mpsc;
     use tokio_tungstenite::{connect_async, tungstenite::Message};
+    use tower::ServiceBuilder;
+    use tracing::Instrument as _;
+    use tracing_subscriber::prelude::*;
 
     use super::*;
 
@@ -471,6 +525,133 @@ mod tests {
         assert!(!should_serve_spa("/arbitrary", true));
     }
 
+    /// Build the two-router pair `build_router` hands to [`nest_under_base_path`],
+    /// standing in for the real relay surface and the root-mounted health probes.
+    fn base_path_fixture(base_path: &str) -> Router {
+        // The real surface already carries the health probes (they live in
+        // `api_router`), so `root_extras` is a deliberate duplicate that only
+        // matters once the surface moves under a prefix.
+        let surface = Router::new()
+            .route("/", get(|| async { "ws-or-nip11" }))
+            .route("/events", get(|| async { "events" }))
+            .route("/_liveness", get(|| async { "ok" }));
+        let root_extras = Router::new().route("/_liveness", get(|| async { "ok" }));
+        nest_under_base_path(base_path, surface, root_extras)
+    }
+
+    async fn status_of(router: Router, path: &str) -> StatusCode {
+        let request = Request::builder()
+            .uri(path)
+            .body(Body::empty())
+            .expect("request");
+        router
+            .oneshot(request)
+            .await
+            .expect("router response")
+            .status()
+    }
+
+    #[tokio::test(flavor = "current_thread")]
+    async fn empty_base_path_leaves_every_route_at_the_root() {
+        let router = base_path_fixture("");
+        assert_eq!(status_of(router.clone(), "/").await, StatusCode::OK);
+        assert_eq!(status_of(router.clone(), "/events").await, StatusCode::OK);
+        assert_eq!(status_of(router, "/_liveness").await, StatusCode::OK);
+    }
+
+    #[tokio::test(flavor = "current_thread")]
+    async fn base_path_moves_the_surface_under_the_prefix() {
+        let router = base_path_fixture("/relay");
+        // The WebSocket/NIP-11 route answers on the bare prefix, which is what a
+        // client connecting to wss://host/relay asks for.
+        assert_eq!(status_of(router.clone(), "/relay").await, StatusCode::OK);
+        assert_eq!(
+            status_of(router.clone(), "/relay/events").await,
+            StatusCode::OK
+        );
+        // Root probes stay reachable: Kubernetes hits the pod directly, bypassing
+        // the gateway that requires the prefix.
+        assert_eq!(
+            status_of(router.clone(), "/_liveness").await,
+            StatusCode::OK
+        );
+        // Unprefixed application paths no longer resolve — the gateway owns the
+        // root, and a stale client hitting it should fail loudly, not silently
+        // reach a half-configured relay.
+        assert_eq!(
+            status_of(router.clone(), "/events").await,
+            StatusCode::NOT_FOUND
+        );
+        assert_eq!(status_of(router, "/other").await, StatusCode::NOT_FOUND);
+    }
+
+    #[tokio::test(flavor = "current_thread")]
+    async fn multi_segment_base_path_routes() {
+        let router = base_path_fixture("/buzz/relay");
+        assert_eq!(
+            status_of(router.clone(), "/buzz/relay").await,
+            StatusCode::OK
+        );
+        assert_eq!(
+            status_of(router, "/buzz/relay/events").await,
+            StatusCode::OK
+        );
+    }
+
+    #[tokio::test(flavor = "current_thread")]
+    async fn http_and_datastore_spans_are_exported_in_the_same_trace() {
+        let exporter = InMemorySpanExporter::default();
+        let provider = SdkTracerProvider::builder()
+            .with_simple_exporter(exporter.clone())
+            .build();
+        let subscriber = tracing_subscriber::registry().with(
+            tracing_opentelemetry::layer()
+                .with_tracer(provider.tracer("test"))
+                .with_filter(crate::telemetry::otel_env_filter(None)),
+        );
+        let _subscriber_guard = tracing::subscriber::set_default(subscriber);
+        let service = ServiceBuilder::new()
+            .layer(http_trace_layer())
+            .service(tower::service_fn(
+                |_: axum::http::Request<axum::body::Body>| async {
+                    async {}
+                        .instrument(tracing::info_span!(
+                            target: "buzz_datastore",
+                            "SELECT",
+                            otel.kind = "client",
+                            db.system.name = "postgresql",
+                        ))
+                        .await;
+                    Ok::<_, std::convert::Infallible>(axum::response::Response::new(
+                        axum::body::Body::empty(),
+                    ))
+                },
+            ));
+
+        service
+            .oneshot(
+                axum::http::Request::get("/")
+                    .body(axum::body::Body::empty())
+                    .unwrap(),
+            )
+            .await
+            .unwrap();
+
+        provider.force_flush().unwrap();
+        let spans = exporter.get_finished_spans().unwrap();
+        let http = spans
+            .iter()
+            .find(|span| span.name == "http.request")
+            .unwrap();
+        let datastore = spans.iter().find(|span| span.name == "SELECT").unwrap();
+
+        assert_eq!(
+            datastore.span_context.trace_id(),
+            http.span_context.trace_id()
+        );
+        assert_eq!(datastore.parent_span_id, http.span_context.span_id());
+    }
+
     async fn handler_receives_message_with_limit(limit: usize, size: usize) -> bool {
         let (received_tx, mut received_rx) = mpsc::unbounded_channel();
         let app = Router::new().route(
diff --git a/crates/buzz-relay/src/subscription.rs b/crates/buzz-relay/src/subscription.rs
index 68f0fea3c40..7a62188d3a6 100644
--- a/crates/buzz-relay/src/subscription.rs
+++ b/crates/buzz-relay/src/subscription.rs
@@ -164,17 +164,30 @@ impl SubscriptionRegistry {
         conn_id: ConnId,
         sub_id: &str,
     ) -> Option<RemovedSubscription> {
-        if let Some(mut conn_subs) = self.subs.get_mut(&conn_id) {
-            if let Some((filters, community_id, channel_id)) = conn_subs.remove(sub_id) {
-                self.remove_from_index(conn_id, sub_id, &filters, community_id, channel_id);
-                metrics::gauge!("buzz_subscriptions_active").decrement(1.0);
-                return Some(RemovedSubscription {
-                    community_id,
-                    channel_id,
-                });
-            }
-        }
-        None
+        self.remove_subscription_inner(conn_id, sub_id, || {})
+    }
+
+    fn remove_subscription_inner<F>(
+        &self,
+        conn_id: ConnId,
+        sub_id: &str,
+        after_remove: F,
+    ) -> Option<RemovedSubscription>
+    where
+        F: FnOnce(),
+    {
+        let mut conn_subs = self.subs.get_mut(&conn_id)?;
+        let (filters, community_id, channel_id) = conn_subs.remove(sub_id)?;
+
+        after_remove();
+        self.remove_from_index(conn_id, sub_id, &filters, community_id, channel_id);
+        drop(conn_subs);
+
+        metrics::gauge!("buzz_subscriptions_active").decrement(1.0);
+        Some(RemovedSubscription {
+            community_id,
+            channel_id,
+        })
     }
 
     /// Remove all subscriptions for a connection and clean up index entries.
@@ -275,15 +288,37 @@ impl SubscriptionRegistry {
                 channel_id,
                 kind: event.event.kind,
             };
-            if let Some(candidates) = self.channel_kind_index.get(&(community_id, key)) {
-                for (conn_id, sub_id) in candidates.iter() {
-                    self.push_match(*conn_id, sub_id, event, &mut results, &mut seen);
+            if let Some(candidates) = self
+                .channel_kind_index
+                .get(&(community_id, key))
+                .map(|entry| entry.value().clone())
+            {
+                for (conn_id, sub_id) in candidates {
+                    self.push_match(
+                        conn_id,
+                        &sub_id,
+                        community_id,
+                        event,
+                        &mut results,
+                        &mut seen,
+                    );
                 }
             }
             // Also check wildcard (channel-only, kindless) index.
-            if let Some(wildcards) = self.channel_wildcard_index.get(&(community_id, channel_id)) {
-                for (conn_id, sub_id) in wildcards.iter() {
-                    self.push_match(*conn_id, sub_id, event, &mut results, &mut seen);
+            if let Some(wildcards) = self
+                .channel_wildcard_index
+                .get(&(community_id, channel_id))
+                .map(|entry| entry.value().clone())
+            {
+                for (conn_id, sub_id) in wildcards {
+                    self.push_match(
+                        conn_id,
+                        &sub_id,
+                        community_id,
+                        event,
+                        &mut results,
+                        &mut seen,
+                    );
                 }
             }
         } else {
@@ -296,24 +331,54 @@ impl SubscriptionRegistry {
                     kind: event.event.kind,
                     p,
                 };
-                if let Some(candidates) = self.global_p_kind_index.get(&key) {
-                    for (conn_id, sub_id) in candidates.iter() {
-                        self.push_match(*conn_id, sub_id, event, &mut results, &mut seen);
+                if let Some(candidates) = self
+                    .global_p_kind_index
+                    .get(&key)
+                    .map(|entry| entry.value().clone())
+                {
+                    for (conn_id, sub_id) in candidates {
+                        self.push_match(
+                            conn_id,
+                            &sub_id,
+                            community_id,
+                            event,
+                            &mut results,
+                            &mut seen,
+                        );
                     }
                 }
             }
             if let Some(candidates) = self
                 .global_kind_index
                 .get(&(community_id, event.event.kind))
+                .map(|entry| entry.value().clone())
             {
-                for (conn_id, sub_id) in candidates.iter() {
-                    self.push_match(*conn_id, sub_id, event, &mut results, &mut seen);
+                for (conn_id, sub_id) in candidates {
+                    self.push_match(
+                        conn_id,
+                        &sub_id,
+                        community_id,
+                        event,
+                        &mut results,
+                        &mut seen,
+                    );
                 }
             }
             // Also check global wildcard (kindless global subs).
-            if let Some(wildcards) = self.global_wildcard_index.get(&community_id) {
-                for (conn_id, sub_id) in wildcards.iter() {
-                    self.push_match(*conn_id, sub_id, event, &mut results, &mut seen);
+            if let Some(wildcards) = self
+                .global_wildcard_index
+                .get(&community_id)
+                .map(|entry| entry.value().clone())
+            {
+                for (conn_id, sub_id) in wildcards {
+                    self.push_match(
+                        conn_id,
+                        &sub_id,
+                        community_id,
+                        event,
+                        &mut results,
+                        &mut seen,
+                    );
                 }
             }
         }
@@ -370,13 +435,20 @@ impl SubscriptionRegistry {
         &self,
         conn_id: ConnId,
         sub_id: &str,
+        community_id: CommunityId,
         event: &StoredEvent,
         results: &mut Vec<(ConnId, SubId)>,
         seen: &mut HashSet<(ConnId, SubId)>,
     ) {
         if let Some(conn_subs) = self.subs.get(&conn_id) {
-            if let Some((filters, _, _)) = conn_subs.get(sub_id) {
-                if filters_match(filters, event) {
+            if let Some((filters, sub_community_id, sub_channel_id)) = conn_subs.get(sub_id) {
+                // Candidate snapshots can become stale while a same-ID replacement
+                // moves the subscription. Re-check its authoritative scope before
+                // matching so an old index entry cannot deliver across scopes.
+                if *sub_community_id == community_id
+                    && *sub_channel_id == event.channel_id
+                    && filters_match(filters, event)
+                {
                     let entry = (conn_id, sub_id.to_string());
                     if seen.insert(entry.clone()) {
                         results.push(entry);
@@ -576,6 +648,8 @@ mod tests {
     use buzz_core::StoredEvent;
     use chrono::Utc;
     use nostr::{EventBuilder, Keys, Kind, Tag};
+    use std::sync::Arc;
+    use std::time::{Duration, Instant};
 
     fn make_stored_event(kind: Kind, channel_id: Option<Uuid>) -> StoredEvent {
         let keys = Keys::generate();
@@ -629,6 +703,141 @@ mod tests {
         assert!(matches.is_empty());
     }
 
+    #[test]
+    fn test_subscription_removal_cannot_delete_replacement_index() {
+        let registry = Arc::new(SubscriptionRegistry::new());
+        let conn_id = Uuid::new_v4();
+        let channel_id = Uuid::new_v4();
+        let sub_id = "same-id".to_string();
+        let filters = vec![Filter::new().kind(Kind::TextNote)];
+        registry.register(conn_id, sub_id.clone(), filters.clone(), Some(channel_id));
+
+        let (removed_tx, removed_rx) = std::sync::mpsc::sync_channel(0);
+        let (resume_tx, resume_rx) = std::sync::mpsc::sync_channel(0);
+        let remove_registry = Arc::clone(&registry);
+        let remove_sub_id = sub_id.clone();
+        let remove = std::thread::spawn(move || {
+            remove_registry.remove_subscription_inner(conn_id, &remove_sub_id, || {
+                removed_tx.send(()).expect("signal authoritative removal");
+                resume_rx.recv().expect("resume index cleanup");
+            })
+        });
+
+        removed_rx.recv().expect("old subscription removed");
+
+        let (registered_tx, registered_rx) = std::sync::mpsc::sync_channel(0);
+        let register_registry = Arc::clone(&registry);
+        let register_sub_id = sub_id.clone();
+        let register = std::thread::spawn(move || {
+            register_registry.register(conn_id, register_sub_id, filters, Some(channel_id));
+            registered_tx
+                .send(())
+                .expect("signal replacement registration");
+        });
+
+        let replacement_finished_early = registered_rx
+            .recv_timeout(Duration::from_millis(100))
+            .is_ok();
+        resume_tx.send(()).expect("resume old cleanup");
+        remove.join().expect("removal thread completes");
+        if !replacement_finished_early {
+            registered_rx
+                .recv_timeout(Duration::from_secs(1))
+                .expect("replacement registration completes");
+        }
+        register.join().expect("registration thread completes");
+        assert!(
+            !replacement_finished_early,
+            "replacement must wait until old index cleanup is complete"
+        );
+
+        let event = make_stored_event(Kind::TextNote, Some(channel_id));
+        assert_eq!(
+            registry.fan_out(&event),
+            vec![(conn_id, sub_id)],
+            "replacement must remain reachable through its index"
+        );
+    }
+
+    #[test]
+    fn test_stale_candidate_snapshot_does_not_cross_subscription_scope() {
+        let registry = SubscriptionRegistry::new();
+        let conn_id = Uuid::new_v4();
+        let channel_a = Uuid::new_v4();
+        let channel_b = Uuid::new_v4();
+        let sub_id = "same-id".to_string();
+        let filters = vec![Filter::new().kind(Kind::TextNote)];
+        registry.register(conn_id, sub_id.clone(), filters.clone(), Some(channel_a));
+
+        // Reproduce fan-out's unlocked candidate snapshot, then move the same
+        // subscription ID before the authoritative subscription lookup.
+        let key = IndexKey {
+            channel_id: channel_a,
+            kind: Kind::TextNote,
+        };
+        let candidates = registry
+            .channel_kind_index
+            .get(&(test_community(), key))
+            .expect("channel A candidate exists")
+            .value()
+            .clone();
+        registry.register(conn_id, sub_id, filters, Some(channel_b));
+
+        let event = make_stored_event(Kind::TextNote, Some(channel_a));
+        let mut results = Vec::new();
+        let mut seen = HashSet::new();
+        for (candidate_conn_id, candidate_sub_id) in candidates {
+            registry.push_match(
+                candidate_conn_id,
+                &candidate_sub_id,
+                test_community(),
+                &event,
+                &mut results,
+                &mut seen,
+            );
+        }
+
+        assert!(
+            results.is_empty(),
+            "replacement on channel B received channel A event through stale snapshot"
+        );
+    }
+
+    #[test]
+    fn test_fan_out_concurrent_with_subscription_replacement_completes() {
+        let registry = Arc::new(SubscriptionRegistry::new());
+        let conn_id = Uuid::new_v4();
+        let channel_id = Uuid::new_v4();
+        let sub_id = "sub1".to_string();
+        let filters = vec![Filter::new().kind(Kind::TextNote)];
+        registry.register(conn_id, sub_id.clone(), filters.clone(), Some(channel_id));
+        let event = Arc::new(make_stored_event(Kind::TextNote, Some(channel_id)));
+        let deadline = Instant::now() + Duration::from_secs(2);
+
+        let fan_out_registry = Arc::clone(&registry);
+        let fan_out_event = Arc::clone(&event);
+        let fan_out = std::thread::spawn(move || {
+            while Instant::now() < deadline {
+                let _ = fan_out_registry.fan_out(&fan_out_event);
+            }
+        });
+
+        let replace_registry = Arc::clone(&registry);
+        let replace = std::thread::spawn(move || {
+            while Instant::now() < deadline {
+                replace_registry.register(
+                    conn_id,
+                    sub_id.clone(),
+                    filters.clone(),
+                    Some(channel_id),
+                );
+            }
+        });
+
+        fan_out.join().expect("fan-out thread completes");
+        replace.join().expect("replacement thread completes");
+    }
+
     #[test]
     fn test_subscription_registry_remove_connection() {
         let registry = SubscriptionRegistry::new();
diff --git a/crates/buzz-relay/src/telemetry.rs b/crates/buzz-relay/src/telemetry.rs
index 8dd305cd422..11c6d035128 100644
--- a/crates/buzz-relay/src/telemetry.rs
+++ b/crates/buzz-relay/src/telemetry.rs
@@ -25,6 +25,16 @@
 
 use opentelemetry_otlp::ExporterBuildError;
 use opentelemetry_sdk::{resource::EnvResourceDetector, trace::SdkTracerProvider, Resource};
+use tracing_subscriber::EnvFilter;
+
+/// Build the filter for spans exported through OpenTelemetry.
+///
+/// This is intentionally independent from `RUST_LOG`: changing stdout log
+/// verbosity must not remove parent spans from exported traces. Set
+/// `BUZZ_OTEL_FILTER` to override the default targets.
+pub fn otel_env_filter(configured: Option<&str>) -> EnvFilter {
+    EnvFilter::new(configured.unwrap_or("buzz_relay=info,buzz_datastore=info"))
+}
 
 /// Build the OTEL [`Resource`] used by the trace provider.
 ///
diff --git a/crates/buzz-sdk/src/builders.rs b/crates/buzz-sdk/src/builders.rs
index f9e54de9c52..8cc9c8650a9 100644
--- a/crates/buzz-sdk/src/builders.rs
+++ b/crates/buzz-sdk/src/builders.rs
@@ -11,8 +11,8 @@ use buzz_core::{
         KIND_GIT_STATUS_CLOSED, KIND_GIT_STATUS_DRAFT, KIND_GIT_STATUS_MERGED,
         KIND_GIT_STATUS_OPEN, KIND_IA_ARCHIVE_REQUEST, KIND_IA_UNARCHIVE_REQUEST,
         KIND_MODERATION_BAN, KIND_MODERATION_RESOLVE_REPORT, KIND_MODERATION_TIMEOUT,
-        KIND_MODERATION_UNBAN, KIND_MODERATION_UNTIMEOUT, KIND_PRESENCE_UPDATE, KIND_WORKFLOW_DEF,
-        KIND_WORKFLOW_TRIGGER,
+        KIND_MODERATION_UNBAN, KIND_MODERATION_UNTIMEOUT, KIND_PRESENCE_UPDATE, KIND_USER_STATUS,
+        KIND_WORKFLOW_DEF, KIND_WORKFLOW_TRIGGER,
     },
     observer::{
         content_looks_like_nip44, OBSERVER_AGENT_TAG, OBSERVER_FRAME_CONTROL, OBSERVER_FRAME_TAG,
@@ -1580,6 +1580,22 @@ pub fn build_presence_update(status: &str) -> Result<EventBuilder, SdkError> {
     Ok(EventBuilder::new(Kind::Custom(KIND_PRESENCE_UPDATE as u16), status).tags(tags))
 }
 
+/// Build a NIP-38 user status event (kind 30315) on the `d:general` coordinate.
+///
+/// `text` becomes the event content and `emoji`, when non-blank, an
+/// `["emoji", ...]` tag; both are trimmed. Blank text with no emoji clears the
+/// status — kind 30315 is parameterized-replaceable, so an event carrying
+/// neither is what clients read as "no status".
+pub fn build_user_status(text: &str, emoji: Option<&str>) -> Result<EventBuilder, SdkError> {
+    let text = text.trim();
+    check_content(text, 64 * 1024)?;
+    let mut tags = vec![tag(&["d", "general"])?];
+    if let Some(emoji) = emoji.map(str::trim).filter(|e| !e.is_empty()) {
+        tags.push(tag(&["emoji", emoji])?);
+    }
+    Ok(EventBuilder::new(Kind::Custom(KIND_USER_STATUS as u16), text).tags(tags))
+}
+
 // ---------------------------------------------------------------------------
 // Community moderation commands (kinds 9040–9044).
 //
@@ -3391,6 +3407,53 @@ mod tests {
         assert!(matches!(err, SdkError::InvalidInput(_)));
     }
 
+    // ── build_user_status ─────────────────────────────────────────────────────
+
+    #[test]
+    fn user_status_carries_text_and_emoji_on_d_general() {
+        let ev = sign(build_user_status("shipping the CLI", Some("🚀")).unwrap());
+        assert_eq!(ev.kind.as_u16(), 30315);
+        assert_eq!(ev.content, "shipping the CLI");
+        assert_eq!(tag_values(&ev, "d"), vec!["general"]);
+        assert_eq!(tag_values(&ev, "emoji"), vec!["🚀"]);
+    }
+
+    #[test]
+    fn user_status_trims_text_and_emoji() {
+        let ev = sign(build_user_status("  heads down  ", Some("  🎧 ")).unwrap());
+        assert_eq!(ev.content, "heads down");
+        assert_eq!(tag_values(&ev, "emoji"), vec!["🎧"]);
+    }
+
+    #[test]
+    fn user_status_omits_blank_emoji_tag() {
+        let ev = sign(build_user_status("on call", Some("   ")).unwrap());
+        assert_eq!(ev.content, "on call");
+        assert!(tag_values(&ev, "emoji").is_empty());
+    }
+
+    #[test]
+    fn user_status_keeps_emoji_when_text_is_blank() {
+        let ev = sign(build_user_status("", Some("🎶")).unwrap());
+        assert_eq!(ev.content, "");
+        assert_eq!(tag_values(&ev, "emoji"), vec!["🎶"]);
+    }
+
+    #[test]
+    fn user_status_clear_shape_is_empty_content_and_d_tag_only() {
+        let ev = sign(build_user_status("", None).unwrap());
+        assert_eq!(ev.kind.as_u16(), 30315);
+        assert_eq!(ev.content, "");
+        assert_eq!(tag_values(&ev, "d"), vec!["general"]);
+        assert_eq!(ev.tags.len(), 1);
+    }
+
+    #[test]
+    fn user_status_rejects_oversize_text() {
+        let err = build_user_status(&"x".repeat(64 * 1024 + 1), None).unwrap_err();
+        assert!(matches!(err, SdkError::ContentTooLarge { .. }));
+    }
+
     // ── build_git_pull_request / build_git_pr_update ──────────────────────────
 
     fn pr_repo() -> GitRepoCoord {
diff --git a/crates/buzz-test-client/tests/regression_relay_admin_ban_gate.rs b/crates/buzz-test-client/tests/regression_relay_admin_ban_gate.rs
new file mode 100644
index 00000000000..c37be8ca404
--- /dev/null
+++ b/crates/buzz-test-client/tests/regression_relay_admin_ban_gate.rs
@@ -0,0 +1,377 @@
+//! Regression test for the NIP-43 relay-admin durable-ban bypass
+//! (BUZZ-SEC-007 class, reported 2026-07-27).
+//!
+//! `ingest_event` exempts relay-admin kinds 9030-9033 from its durable
+//! write-path restriction gate so a *timed out* admin keeps its administrative
+//! capability. That exemption was ban-blind, so a **banned** admin could still
+//! add/remove relay members and change the workspace icon via signed NIP-98
+//! `POST /events`. The ban is now enforced inside
+//! `relay_admin::handle_relay_admin_event`; this test pins both halves of that
+//! contract — bans refused, timeouts still admitted.
+//!
+//! Requires a running relay and its Postgres. Ignored by default:
+//!   REPRO_RELAY_HTTP=http://localhost:3999 REPRO_HOST=localhost:3999 \
+//!   DATABASE_URL=postgres://buzz:buzz_dev@localhost:5432/buzz_relay_admin_regression \
+//!   cargo test -p buzz-test-client --test regression_relay_admin_ban_gate \
+//!     -- --ignored --nocapture
+
+use base64::engine::general_purpose::STANDARD as BASE64;
+use base64::Engine;
+use nostr::{EventBuilder, Keys, Kind, Tag};
+use sha2::{Digest, Sha256};
+use uuid::Uuid;
+
+fn http_base() -> String {
+    std::env::var("REPRO_RELAY_HTTP").unwrap_or_else(|_| "http://localhost:3999".into())
+}
+fn host() -> String {
+    std::env::var("REPRO_HOST").unwrap_or_else(|_| "localhost:3999".into())
+}
+fn db_url() -> String {
+    std::env::var("DATABASE_URL").expect("DATABASE_URL required")
+}
+
+fn sha256_hex(b: &[u8]) -> String {
+    hex::encode(Sha256::digest(b))
+}
+
+fn nip98(keys: &Keys, url: &str, body: &str) -> String {
+    let ev = EventBuilder::new(Kind::Custom(27_235), "")
+        .tags(vec![
+            Tag::parse(["u", url]).unwrap(),
+            Tag::parse(["method", "POST"]).unwrap(),
+            Tag::parse(["payload", &sha256_hex(body.as_bytes())]).unwrap(),
+            Tag::parse(["nonce", &Uuid::new_v4().to_string()]).unwrap(),
+        ])
+        .sign_with_keys(keys)
+        .unwrap();
+    format!(
+        "Nostr {}",
+        BASE64.encode(serde_json::to_string(&ev).unwrap())
+    )
+}
+
+async fn post_event(keys: &Keys, event: &nostr::Event) -> (u16, String) {
+    let body = serde_json::to_string(event).unwrap();
+    let signed_url = format!("http://{}/events", host());
+    let r = reqwest::Client::new()
+        .post(format!("{}/events", http_base()))
+        .header("Host", host())
+        .header("Content-Type", "application/json")
+        .header("Authorization", nip98(keys, &signed_url, &body))
+        .body(body)
+        .send()
+        .await
+        .expect("POST /events");
+    let status = r.status().as_u16();
+    (status, r.text().await.unwrap_or_default())
+}
+
+fn signed(keys: &Keys, kind: u16, tags: Vec<Tag>) -> nostr::Event {
+    EventBuilder::new(Kind::Custom(kind), "")
+        .tags(tags)
+        .sign_with_keys(keys)
+        .unwrap()
+}
+
+async fn pool() -> sqlx::Pool<sqlx::Postgres> {
+    sqlx::postgres::PgPoolOptions::new()
+        .max_connections(2)
+        .connect(&db_url())
+        .await
+        .expect("connect Postgres")
+}
+
+async fn community_id(p: &sqlx::Pool<sqlx::Postgres>) -> Uuid {
+    let id = Uuid::new_v4();
+    sqlx::query(
+        "INSERT INTO communities (id, host) VALUES ($1, $2) ON CONFLICT (lower(host)) DO NOTHING",
+    )
+    .bind(id)
+    .bind(host())
+    .execute(p)
+    .await
+    .unwrap();
+    sqlx::query_scalar("SELECT id FROM communities WHERE lower(host) = lower($1)")
+        .bind(host())
+        .fetch_one(p)
+        .await
+        .unwrap()
+}
+
+async fn seed(p: &sqlx::Pool<sqlx::Postgres>, cid: Uuid, keys: &Keys, role: &str) {
+    sqlx::query("INSERT INTO users (community_id, pubkey) VALUES ($1, $2) ON CONFLICT DO NOTHING")
+        .bind(cid)
+        .bind(keys.public_key().to_bytes().to_vec())
+        .execute(p)
+        .await
+        .ok();
+    sqlx::query(
+        "INSERT INTO relay_members (community_id, pubkey, role, added_by) VALUES ($1,$2,$3,NULL) \
+         ON CONFLICT (community_id, pubkey) DO UPDATE SET role = $3, updated_at = now()",
+    )
+    .bind(cid)
+    .bind(keys.public_key().to_hex())
+    .bind(role)
+    .execute(p)
+    .await
+    .unwrap();
+}
+
+/// Post-fix regression bar.
+///
+/// Asserts the full contract rather than just "the exploit stopped":
+/// - banned admin: 403 + exact `blocked:` prefix on 9030/9031/9033, and a
+///   banned *owner* likewise on 9032 (owner-only kind), covering all four
+///   exempt kinds,
+/// - no roster, role, or icon mutation from any of those attempts,
+/// - a *timed-out* admin still reaches relay-admin authorization (the ingest
+///   exemption's whole purpose — the fix must not silently widen to timeouts),
+/// - an unrestricted admin's behaviour is unchanged, mutation included.
+#[tokio::test]
+#[ignore]
+async fn banned_admin_is_refused_but_timed_out_admin_still_administers() {
+    let p = pool().await;
+    let cid = community_id(&p).await;
+
+    let owner = Keys::generate();
+    let banned_owner = Keys::generate();
+    let banned_admin = Keys::generate();
+    let timed_out_admin = Keys::generate();
+    let good_admin = Keys::generate();
+    let victim = Keys::generate();
+    let victim2 = Keys::generate();
+    let victim3 = Keys::generate();
+    let role_target = Keys::generate();
+    // Retained (not generated inline) so the 9030 attempt can be checked for
+    // absence afterward — a planted member is the mutation that attempt buys.
+    let planted = Keys::generate();
+    for (k, r) in [
+        (&owner, "owner"),
+        (&banned_owner, "owner"),
+        (&banned_admin, "admin"),
+        (&timed_out_admin, "admin"),
+        (&good_admin, "admin"),
+        (&victim, "member"),
+        (&victim2, "member"),
+        (&victim3, "member"),
+        (&role_target, "member"),
+    ] {
+        seed(&p, cid, k, r).await;
+    }
+
+    // Owner bans one admin and times out another, through the real 9040/9042
+    // command path.
+    let (s, _) = post_event(
+        &owner,
+        &signed(
+            &owner,
+            9040,
+            vec![Tag::parse(["p", &banned_admin.public_key().to_hex()]).unwrap()],
+        ),
+    )
+    .await;
+    assert_eq!(s, 200, "ban must land");
+    let expiry = (chrono_now() + 3600).to_string();
+    let (s, b) = post_event(
+        &owner,
+        &signed(
+            &owner,
+            9042,
+            vec![
+                Tag::parse(["p", &timed_out_admin.public_key().to_hex()]).unwrap(),
+                Tag::parse(["expiration", &expiry]).unwrap(),
+            ],
+        ),
+    )
+    .await;
+    assert_eq!(s, 200, "timeout must land: {b}");
+
+    // 9032 is owner-only, so its banned case needs a banned *owner*. Whether
+    // one owner may 9040 another is a moderation-policy question independent of
+    // this fix, so the ban row is seeded directly to keep the test pinned to
+    // the admission gate.
+    sqlx::query(
+        "INSERT INTO community_bans (community_id, pubkey, banned, actor_pubkey) \
+         VALUES ($1,$2,true,$3) \
+         ON CONFLICT (community_id, pubkey) DO UPDATE SET banned = true",
+    )
+    .bind(cid)
+    .bind(banned_owner.public_key().to_bytes().to_vec())
+    .bind(owner.public_key().to_bytes().to_vec())
+    .execute(&p)
+    .await
+    .unwrap();
+
+    // ── Banned actors: every relay-admin kind must be 403 + `blocked:`. ──
+    for (actor, kind, tags, label) in [
+        (
+            &banned_admin,
+            9031u16,
+            vec![Tag::parse(["p", &victim.public_key().to_hex()]).unwrap()],
+            "9031 remove",
+        ),
+        (
+            &banned_admin,
+            9030u16,
+            vec![
+                Tag::parse(["p", &planted.public_key().to_hex()]).unwrap(),
+                Tag::parse(["role", "member"]).unwrap(),
+            ],
+            "9030 add",
+        ),
+        (
+            &banned_admin,
+            9033u16,
+            vec![Tag::parse(["icon", "https://evil.example/pwned.png"]).unwrap()],
+            "9033 icon",
+        ),
+        (
+            &banned_owner,
+            9032u16,
+            vec![
+                Tag::parse(["p", &role_target.public_key().to_hex()]).unwrap(),
+                Tag::parse(["role", "admin"]).unwrap(),
+            ],
+            "9032 change role",
+        ),
+    ] {
+        let (st, body) = post_event(actor, &signed(actor, kind, tags)).await;
+        println!("[banned] {label} -> {st} {body}");
+        assert_eq!(
+            st, 403,
+            "{label}: banned actor must get 403, got {st} {body}"
+        );
+        let msg: serde_json::Value = serde_json::from_str(&body).unwrap_or_default();
+        let text = msg.get("error").and_then(|v| v.as_str()).unwrap_or(&body);
+        assert_eq!(
+            text, "blocked: you are banned from this community",
+            "{label}: must carry the exact `blocked:` wire contract"
+        );
+    }
+
+    // No mutation from any banned attempt.
+    let role_of = |k: &Keys| {
+        let hex = k.public_key().to_hex();
+        let p = p.clone();
+        async move {
+            sqlx::query_scalar::<_, String>(
+                "SELECT role FROM relay_members WHERE community_id=$1 AND pubkey=$2",
+            )
+            .bind(cid)
+            .bind(hex)
+            .fetch_optional(&p)
+            .await
+            .unwrap()
+        }
+    };
+    assert_eq!(
+        role_of(&victim).await.as_deref(),
+        Some("member"),
+        "9031: banned admin must not remove a member"
+    );
+    assert_eq!(
+        role_of(&planted).await,
+        None,
+        "9030: banned admin must not plant a new member"
+    );
+    assert_eq!(
+        role_of(&role_target).await.as_deref(),
+        Some("member"),
+        "9032: banned owner must not change a member's role"
+    );
+    let icon: Option<String> = sqlx::query_scalar("SELECT icon FROM communities WHERE id=$1")
+        .bind(cid)
+        .fetch_one(&p)
+        .await
+        .unwrap();
+    assert!(
+        icon.is_none(),
+        "9033: banned admin must not change the workspace icon, got {icon:?}"
+    );
+
+    // ── Timed-out admin: still administers (ingest exemption preserved). ──
+    let (ts, tb) = post_event(
+        &timed_out_admin,
+        &signed(
+            &timed_out_admin,
+            9031,
+            vec![Tag::parse(["p", &victim2.public_key().to_hex()]).unwrap()],
+        ),
+    )
+    .await;
+    println!("[timed-out] 9031 remove -> {ts} {tb}");
+    assert_eq!(
+        ts, 200,
+        "timed-out admin must still administer the roster: {tb}"
+    );
+    assert_eq!(
+        role_of(&victim2).await,
+        None,
+        "timed-out admin's removal must take effect"
+    );
+
+    // Control: the same timed-out admin is still write-blocked for content.
+    let (cs, cb) = post_event(
+        &timed_out_admin,
+        &EventBuilder::new(Kind::Custom(9), "x")
+            .tags(vec![Tag::parse(["h", &Uuid::new_v4().to_string()]).unwrap()])
+            .sign_with_keys(&timed_out_admin)
+            .unwrap(),
+    )
+    .await;
+    println!("[timed-out] control kind:9 -> {cs} {cb}");
+    assert_ne!(
+        cs, 200,
+        "timed-out admin must still be write-blocked for content"
+    );
+
+    // ── Unrestricted admin: behaviour unchanged, mutation included. ──
+    let (gs, gb) = post_event(
+        &good_admin,
+        &signed(
+            &good_admin,
+            9031,
+            vec![Tag::parse(["p", &victim3.public_key().to_hex()]).unwrap()],
+        ),
+    )
+    .await;
+    println!("[clean] 9031 remove -> {gs} {gb}");
+    assert_eq!(gs, 200, "unrestricted admin must be unaffected: {gb}");
+    assert_eq!(
+        role_of(&victim3).await,
+        None,
+        "unrestricted admin's removal must actually take effect"
+    );
+
+    // ── Unchanged rejection contract: non-admin still gets `invalid:`/400. ──
+    let nobody = Keys::generate();
+    seed(&p, cid, &nobody, "member").await;
+    let (ns, nb) = post_event(
+        &nobody,
+        &signed(
+            &nobody,
+            9031,
+            vec![Tag::parse(["p", &victim.public_key().to_hex()]).unwrap()],
+        ),
+    )
+    .await;
+    println!("[non-admin] 9031 -> {ns} {nb}");
+    assert_eq!(
+        ns, 400,
+        "a plain member's 9031 must stay a 400 validation reject"
+    );
+    assert!(
+        nb.contains("invalid: actor not authorized"),
+        "non-admin rejection must keep its `invalid:` prefix, got {nb}"
+    );
+
+    println!("\nALL INVARIANTS HELD");
+}
+
+fn chrono_now() -> i64 {
+    std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)
+        .map(|d| d.as_secs() as i64)
+        .unwrap_or(0)
+}
diff --git a/crates/buzz-workflow/src/error.rs b/crates/buzz-workflow/src/error.rs
index 34e3d5311fc..292f8dd027c 100644
--- a/crates/buzz-workflow/src/error.rs
+++ b/crates/buzz-workflow/src/error.rs
@@ -54,6 +54,12 @@ pub enum WorkflowError {
     #[error("database error: {0}")]
     Database(String),
 
+    /// The workflow's owner is not currently authorized to run it (removed
+    /// from the channel, insufficient role for the definition's actions, or
+    /// the authority lookup failed — all deny, fail-closed).
+    #[error("unauthorized: {0}")]
+    Unauthorized(String),
+
     /// The action is defined but not yet implemented.
     #[error("action not implemented: {0}")]
     NotImplemented(String),
diff --git a/crates/buzz-workflow/src/lib.rs b/crates/buzz-workflow/src/lib.rs
index 93581225ee8..7aaa3d17026 100644
--- a/crates/buzz-workflow/src/lib.rs
+++ b/crates/buzz-workflow/src/lib.rs
@@ -132,6 +132,44 @@ impl WorkflowEngine {
         self.workflow_cache.invalidate(&(community_id, channel_id));
     }
 
+    /// Fail-closed pre-run authority gate (SEC-006).
+    ///
+    /// A workflow executes with its **owner's** standing authority long after
+    /// the definition was saved, so every run-creation door must recheck the
+    /// owner's *current* channel authority immediately before creating a run:
+    ///
+    /// - the owner must still be an active member of the workflow's channel;
+    /// - if the definition contains an exfiltration-capable action
+    ///   (`call_webhook`), the owner must currently hold the `owner` or
+    ///   `admin` role.
+    ///
+    /// Any lookup error denies (fail-closed): a removed owner must never keep
+    /// exfiltration authority because a membership read happened to fail.
+    pub async fn check_owner_authority(
+        &self,
+        community_id: CommunityId,
+        channel_id: Uuid,
+        owner_pubkey: &[u8],
+        def: &WorkflowDef,
+    ) -> Result<(), WorkflowError> {
+        let role = self
+            .db
+            .get_member_role(community_id, channel_id, owner_pubkey)
+            .await
+            .map_err(|e| {
+                WorkflowError::Unauthorized(format!(
+                    "owner authority lookup failed (fail-closed): {e}"
+                ))
+            })?;
+        if owner_authority_allows(role.as_deref(), def.requires_elevated_authority()) {
+            Ok(())
+        } else {
+            Err(WorkflowError::Unauthorized(
+                "workflow owner lacks current channel authority".into(),
+            ))
+        }
+    }
+
     /// Set the action sink. Called once after `AppState` construction.
     ///
     /// # Panics
@@ -340,6 +378,23 @@ impl WorkflowEngine {
                 continue;
             }
 
+            // SEC-006: recheck the owner's *current* channel authority
+            // immediately before run creation. The cached workflow list can be
+            // up to 10s stale, and disable-on-removal can race a concurrent
+            // event — this per-fire gate is the authoritative, fail-closed
+            // check that a removed (or under-privileged, for exfiltration
+            // definitions) owner cannot cause a run.
+            if let Err(e) = self
+                .check_owner_authority(community_id, channel_id, &workflow.owner_pubkey, &def)
+                .await
+            {
+                tracing::warn!(
+                    workflow_id = %workflow.id,
+                    "Skipping workflow — owner authority check failed: {e}"
+                );
+                continue;
+            }
+
             let trigger_event_id_bytes = event.event.id.as_bytes().to_vec();
             let run_id = match self
                 .db
@@ -537,6 +592,22 @@ impl WorkflowEngine {
                     _ => continue, // Non-schedule triggers handled by on_event()
                 };
 
+                // SEC-006: recheck the owner's current channel authority
+                // BEFORE the durable claim. Placing the gate after the claim
+                // would let a revoked owner's workflow consume the
+                // at-most-once fire slot (claims are never re-fired), turning
+                // revocation into a denial-of-fire for a later re-enable.
+                if let Err(e) = self
+                    .check_owner_authority(community_id, channel_id, &workflow.owner_pubkey, &def)
+                    .await
+                {
+                    tracing::warn!(
+                        workflow_id = %workflow.id,
+                        "Cron tick: skipping workflow — owner authority check failed: {e}"
+                    );
+                    continue;
+                }
+
                 // Durable at-most-once claim — the cross-pod fire boundary.
                 // The loser receives `None` and skips BEFORE any run creation or
                 // side effect. `community_id` is the workflow row's own
@@ -951,6 +1022,25 @@ pub fn build_trigger_context(event: &buzz_core::StoredEvent) -> executor::Trigge
     }
 }
 
+/// Pure authority decision for [`WorkflowEngine::check_owner_authority`].
+///
+/// `role` is the owner's *current* active role in the workflow's channel
+/// (`None` = not an active member — removed, left, or never joined).
+/// `needs_elevated` is true when the definition contains an
+/// exfiltration-capable action (see `WorkflowDef::requires_elevated_authority`).
+///
+/// Rules:
+/// - not a member ⇒ deny, always;
+/// - member ⇒ allowed for ordinary definitions;
+/// - elevated definitions ⇒ only `owner` / `admin` roles.
+fn owner_authority_allows(role: Option<&str>, needs_elevated: bool) -> bool {
+    match role {
+        None => false,
+        Some(r) if needs_elevated => matches!(r, "owner" | "admin"),
+        Some(_) => true,
+    }
+}
+
 /// Returns `true` if the trigger type matches the given event kind.
 fn trigger_matches_event(trigger: &TriggerDef, kind_u32: u32) -> bool {
     use buzz_core::kind::{KIND_REACTION, KIND_STREAM_MESSAGE, KIND_STREAM_MESSAGE_DIFF};
@@ -1561,4 +1651,244 @@ steps:
         // Should pick the LAST e tag (direct target), not the first (thread root)
         assert_eq!(ctx.message_id, direct_target_id.to_hex());
     }
+
+    // -- SEC-006: owner authority decision --------------------------------
+
+    #[test]
+    fn owner_authority_denies_non_members_always() {
+        assert!(!owner_authority_allows(None, false));
+        assert!(!owner_authority_allows(None, true));
+    }
+
+    #[test]
+    fn owner_authority_allows_any_member_for_ordinary_definitions() {
+        assert!(owner_authority_allows(Some("member"), false));
+        assert!(owner_authority_allows(Some("admin"), false));
+        assert!(owner_authority_allows(Some("owner"), false));
+    }
+
+    #[test]
+    fn owner_authority_requires_elevated_role_for_exfiltration_definitions() {
+        assert!(!owner_authority_allows(Some("member"), true));
+        assert!(owner_authority_allows(Some("admin"), true));
+        assert!(owner_authority_allows(Some("owner"), true));
+    }
+
+    #[test]
+    fn requires_elevated_authority_detects_call_webhook() {
+        let (plain, _) = WorkflowEngine::parse_yaml(concat!(
+            "name: plain\n",
+            "trigger:\n  on: message_posted\n",
+            "steps:\n  - id: s1\n    action: send_message\n    text: hi\n",
+        ))
+        .expect("parse plain");
+        assert!(!plain.requires_elevated_authority());
+
+        let (hook, _) = WorkflowEngine::parse_yaml(concat!(
+            "name: hook\n",
+            "trigger:\n  on: message_posted\n",
+            "steps:\n  - id: s1\n    action: send_message\n    text: hi\n",
+            "  - id: s2\n    action: call_webhook\n    url: https://example.com/x\n",
+        ))
+        .expect("parse hook");
+        assert!(hook.requires_elevated_authority());
+    }
+
+    // -- SEC-006: event-path regression (requires Postgres) ----------------
+
+    async fn setup_db() -> buzz_db::Db {
+        let database_url = std::env::var("BUZZ_TEST_DATABASE_URL")
+            .or_else(|_| std::env::var("DATABASE_URL"))
+            .unwrap_or_else(|_| "postgres://buzz:buzz_dev@localhost:5432/buzz".to_owned());
+        buzz_db::Db::new(&buzz_db::DbConfig {
+            database_url,
+            ..Default::default()
+        })
+        .await
+        .expect("connect test DB")
+    }
+
+    /// Create a community, a channel owned by `creator`, and add `member` as a
+    /// plain member. Returns `(community, channel)`.
+    async fn setup_channel(db: &buzz_db::Db, creator: &[u8], member: &[u8]) -> (CommunityId, Uuid) {
+        let host = format!("sec006-{}.example", Uuid::new_v4().simple());
+        let community = match db
+            .create_community_with_owner(&host, &hex::encode(creator))
+            .await
+            .expect("create community")
+        {
+            buzz_db::CreateCommunityWithOwnerResult::Created(rec) => rec.id,
+            other => panic!("unexpected community create result: {other:?}"),
+        };
+        db.ensure_user(community, creator)
+            .await
+            .expect("creator user");
+        db.ensure_user(community, member)
+            .await
+            .expect("member user");
+        let channel_id = Uuid::new_v4();
+        db.create_channel_with_id(
+            community,
+            channel_id,
+            &format!("ch-{}", channel_id.simple()),
+            buzz_db::channel::ChannelType::Stream,
+            buzz_db::channel::ChannelVisibility::Open,
+            None,
+            creator,
+            None,
+        )
+        .await
+        .expect("create channel");
+        db.add_member(
+            community,
+            channel_id,
+            member,
+            buzz_db::channel::MemberRole::Member,
+            Some(creator),
+        )
+        .await
+        .expect("add member");
+        (community, channel_id)
+    }
+
+    fn message_event(channel_id: Uuid) -> buzz_core::StoredEvent {
+        let keys = nostr::Keys::generate();
+        let event = nostr::EventBuilder::new(nostr::Kind::Custom(9), "hello")
+            .sign_with_keys(&keys)
+            .expect("sign");
+        buzz_core::StoredEvent::new(event, Some(channel_id))
+    }
+
+    /// The event path must stop creating runs the moment the workflow's owner
+    /// loses channel membership — even while the workflow row is still
+    /// `enabled` (the disable-on-removal side effect is a separate, relay-side
+    /// write; this gate must hold on its own).
+    #[tokio::test]
+    #[ignore = "requires Postgres"]
+    async fn on_event_denies_run_after_owner_removed() {
+        let db = setup_db().await;
+        let creator = nostr::Keys::generate().public_key().to_bytes().to_vec();
+        let member = nostr::Keys::generate().public_key().to_bytes().to_vec();
+        let (community, channel_id) = setup_channel(&db, &creator, &member).await;
+
+        let def_json = serde_json::json!({
+            "name": "sec006-event",
+            "trigger": {"on": "message_posted"},
+            "steps": [{"id": "s1", "action": "send_message", "text": "hi"}],
+            "enabled": true,
+        })
+        .to_string();
+        let workflow_id = db
+            .create_workflow(
+                community,
+                Some(channel_id),
+                &member,
+                "sec006-event",
+                &def_json,
+                &[0u8; 32],
+            )
+            .await
+            .expect("create workflow");
+
+        let engine = Arc::new(WorkflowEngine::new(db.clone(), WorkflowConfig::default()));
+
+        // Owner is an active member: the event fires the workflow.
+        engine
+            .on_event(community, &message_event(channel_id))
+            .await
+            .expect("on_event while member");
+        let runs = db
+            .list_workflow_runs(community, workflow_id, 10)
+            .await
+            .expect("list runs");
+        assert_eq!(runs.len(), 1, "member owner's workflow must fire");
+
+        // Remove the owner (actor = channel creator, an owner-role member).
+        db.remove_member(community, channel_id, &member, &creator)
+            .await
+            .expect("remove member");
+
+        // Workflow row is still enabled — only the authority gate stands.
+        engine
+            .on_event(community, &message_event(channel_id))
+            .await
+            .expect("on_event after removal");
+        let runs = db
+            .list_workflow_runs(community, workflow_id, 10)
+            .await
+            .expect("list runs after removal");
+        assert_eq!(
+            runs.len(),
+            1,
+            "no new run may be created after the owner lost membership"
+        );
+    }
+
+    /// Exfiltration-capable definitions (call_webhook) require the owner to
+    /// currently hold an elevated role — a plain member's workflow must not
+    /// fire even though the owner is still an active channel member.
+    #[tokio::test]
+    #[ignore = "requires Postgres"]
+    async fn on_event_denies_webhook_definition_for_plain_member_owner() {
+        let db = setup_db().await;
+        let creator = nostr::Keys::generate().public_key().to_bytes().to_vec();
+        let member = nostr::Keys::generate().public_key().to_bytes().to_vec();
+        let (community, channel_id) = setup_channel(&db, &creator, &member).await;
+
+        let def_json = serde_json::json!({
+            "name": "sec006-hook",
+            "trigger": {"on": "message_posted"},
+            "steps": [{"id": "s1", "action": "call_webhook", "url": "https://example.com/x"}],
+            "enabled": true,
+        })
+        .to_string();
+
+        // Same definition, two owners: plain member vs channel owner.
+        let wf_member = db
+            .create_workflow(
+                community,
+                Some(channel_id),
+                &member,
+                "hook-member",
+                &def_json,
+                &[0u8; 32],
+            )
+            .await
+            .expect("create member workflow");
+        let wf_owner = db
+            .create_workflow(
+                community,
+                Some(channel_id),
+                &creator,
+                "hook-owner",
+                &def_json,
+                &[1u8; 32],
+            )
+            .await
+            .expect("create owner workflow");
+
+        let engine = Arc::new(WorkflowEngine::new(db.clone(), WorkflowConfig::default()));
+        engine
+            .on_event(community, &message_event(channel_id))
+            .await
+            .expect("on_event");
+
+        let member_runs = db
+            .list_workflow_runs(community, wf_member, 10)
+            .await
+            .expect("member runs");
+        assert!(
+            member_runs.is_empty(),
+            "plain member's call_webhook workflow must not fire"
+        );
+        let owner_runs = db
+            .list_workflow_runs(community, wf_owner, 10)
+            .await
+            .expect("owner runs");
+        assert_eq!(
+            owner_runs.len(),
+            1,
+            "channel owner's call_webhook workflow fires"
+        );
+    }
 }
diff --git a/crates/buzz-workflow/src/schema.rs b/crates/buzz-workflow/src/schema.rs
index 34e8bb19603..9bc79aa48b3 100644
--- a/crates/buzz-workflow/src/schema.rs
+++ b/crates/buzz-workflow/src/schema.rs
@@ -147,6 +147,19 @@ pub enum ActionDef {
 }
 
 impl WorkflowDef {
+    /// True when any step performs an action that can exfiltrate channel data
+    /// to an arbitrary external destination (`call_webhook`).
+    ///
+    /// Definitions with such steps require elevated (owner/admin) channel
+    /// authority both to save and to run — plain membership is not enough,
+    /// because a workflow forwards channel content with the *owner's* standing
+    /// authority long after the save (SEC-006).
+    pub fn requires_elevated_authority(&self) -> bool {
+        self.steps
+            .iter()
+            .any(|s| matches!(s.action, ActionDef::CallWebhook { .. }))
+    }
+
     /// Validate the workflow definition. Returns `Err` with a descriptive message
     /// if any invariant is violated.
     pub fn validate(&self) -> Result<(), WorkflowError> {
diff --git a/deploy/charts/buzz/Chart.yaml b/deploy/charts/buzz/Chart.yaml
index 956e0857498..9309074895b 100644
--- a/deploy/charts/buzz/Chart.yaml
+++ b/deploy/charts/buzz/Chart.yaml
@@ -7,7 +7,7 @@ description: |
   PostgreSQL and Redis. Configurable for single-node evaluation
   (subcharts on) and HA production (external services, existingSecret).
 type: application
-version: 0.1.6
+version: 0.1.7
 appVersion: "0.1.0"
 home: https://github.com/block/buzz
 sources:
@@ -24,7 +24,7 @@ maintainers:
 annotations:
   artifacthub.io/changes: |
     - kind: added
-      description: Optional READ_DATABASE_URL env (secretKeyRef) enabling relay read-replica routing; absent key preserves prior behavior.
+      description: Generic init-container, volume, volume-mount, command, and args extension points for the relay Pod.
   artifacthub.io/license: Apache-2.0
 
 # Optional eval-only subcharts. Production deploys disable both and point
diff --git a/deploy/charts/buzz/README.md b/deploy/charts/buzz/README.md
index 4cf4b22b245..a7c4bcf63b2 100644
--- a/deploy/charts/buzz/README.md
+++ b/deploy/charts/buzz/README.md
@@ -12,7 +12,7 @@ This chart has two operating profiles selected by values:
 ## Quickstart (eval only)
 
 ```sh
-helm install buzz oci://ghcr.io/block/buzz/charts/buzz --version 0.1.0 \
+helm install buzz oci://ghcr.io/block/buzz/charts/buzz --version 0.1.7 \
   --create-namespace --namespace buzz \
   --set quickstart=true \
   --set postgresql.enabled=true \
@@ -52,6 +52,57 @@ See:
 
 The chart fails at `helm install` / `helm template` time with a clear message if any of these are missing or malformed (see `templates/_validate.tpl`).
 
+## Relay Pod extensions
+
+The chart exposes narrow extension points for init containers, volumes, relay
+volume mounts, and image command/argument overrides. `extraManifests` creates
+independent Kubernetes resources but cannot modify the chart-managed relay
+Deployment. These extension values insert fields into that Deployment, avoiding
+duplication of its environment, probes, security context, secrets, and
+chart-owned volumes.
+
+For example, an init container can copy a wrapper binary into a shared volume
+and make that wrapper the relay entrypoint:
+
+```yaml
+extraInitContainers:
+  - name: install-wrapper
+    image: example.com/wrapper-init:v1
+    args: [/opt/wrapper/wrapper]
+    securityContext:
+      runAsNonRoot: true
+      runAsUser: 65532
+      runAsGroup: 65532
+      allowPrivilegeEscalation: false
+      capabilities:
+        drop: [ALL]
+    resources:
+      requests:
+        cpu: 10m
+        memory: 16Mi
+    volumeMounts:
+      - name: wrapper
+        mountPath: /opt/wrapper
+
+extraVolumes:
+  - name: wrapper
+    emptyDir: {}
+
+relay:
+  command: [/opt/wrapper/wrapper]
+  args: [/usr/local/bin/buzz-relay]
+  extraVolumeMounts:
+    - name: wrapper
+      mountPath: /opt/wrapper
+```
+
+These values are raw Kubernetes fragments rendered with `toYaml`, not `tpl`.
+The chart does not validate cross-field relationships: extension names must not
+collide with chart-owned containers or volumes, mounts must reference existing
+volumes, and each init container must define an appropriate security context
+and resources. Empty `relay.command` and `relay.args` arrays preserve the image
+defaults; non-empty values override its entrypoint and arguments respectively.
+
 ## Device pairing relay
 
 The chart can run Buzz's stateless pairing WebSocket relay as an independent
diff --git a/deploy/charts/buzz/templates/NOTES.txt b/deploy/charts/buzz/templates/NOTES.txt
index d65c1f837b1..b409f4d9424 100644
--- a/deploy/charts/buzz/templates/NOTES.txt
+++ b/deploy/charts/buzz/templates/NOTES.txt
@@ -64,7 +64,8 @@
 {{- end }}
 {{- if not .Values.relay.requireMediaGetAuth }}
   ⚠ relay.requireMediaGetAuth=false — media GET/HEAD reads are not auth-gated.
-    Keep this false only during staged client rollout.
+    Anyone who learns a media URL/hash can fetch private attachments. Only
+    use for local development or fully public communities.
 {{- end }}
 {{- if not .Values.migrate.autoMigrate }}
   ⚠ migrate.autoMigrate=false — relay startup will NOT run sqlx migrations.
diff --git a/deploy/charts/buzz/templates/deployment.yaml b/deploy/charts/buzz/templates/deployment.yaml
index f8d67de31de..bf2df4c2c86 100644
--- a/deploy/charts/buzz/templates/deployment.yaml
+++ b/deploy/charts/buzz/templates/deployment.yaml
@@ -55,13 +55,14 @@ spec:
       topologySpreadConstraints:
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- if or .Values.minio.enabled .Values.extraInitContainers }}
+      initContainers:
       {{- if .Values.minio.enabled }}
       # Quickstart only: the bundled MinIO bucket is created by a concurrent
       # init Job (templates/quickstart-minio-init.yaml). The relay's A3 S3
       # conformance probe is startup-fatal, so without this gate the relay Pods
       # CrashLoopBackOff (with growing backoff) until the bucket appears. Block
       # relay start until the bucket exists — deterministic, no crash-loops.
-      initContainers:
         - name: wait-for-bucket
           image: {{ .Values.minio.mcImage | quote }}
           securityContext:
@@ -90,12 +91,24 @@ spec:
               done
               echo "bucket {{ .Values.s3.bucket }} present"
       {{- end }}
+      {{- with .Values.extraInitContainers }}
+      {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- end }}
       containers:
         - name: relay
           image: {{ include "buzz.image" . }}
           imagePullPolicy: {{ .Values.image.pullPolicy }}
           securityContext:
             {{- toYaml .Values.relay.containerSecurityContext | nindent 12 }}
+          {{- with .Values.relay.command }}
+          command:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- with .Values.relay.args }}
+          args:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
           ports:
             - { name: app,     containerPort: 3000, protocol: TCP }
             - { name: health,  containerPort: {{ .Values.service.healthPort }}, protocol: TCP }
@@ -225,6 +238,9 @@ spec:
           volumeMounts:
             - { name: git-repos, mountPath: {{ .Values.persistence.git.mountPath | quote }} }
             - { name: git-pack-cache, mountPath: {{ .Values.git.packCachePath | quote }} }
+            {{- with .Values.relay.extraVolumeMounts }}
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
 
       volumes:
         - name: git-repos
@@ -238,3 +254,6 @@ spec:
         - name: git-pack-cache
           emptyDir:
             sizeLimit: {{ .Values.git.packCacheVolumeSize | quote }}
+        {{- with .Values.extraVolumes }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
diff --git a/deploy/charts/buzz/tests/render_test.yaml b/deploy/charts/buzz/tests/render_test.yaml
index 6313fd59580..3e044f5d7c1 100644
--- a/deploy/charts/buzz/tests/render_test.yaml
+++ b/deploy/charts/buzz/tests/render_test.yaml
@@ -36,6 +36,34 @@ tests:
             name: BUZZ_HUDDLE_AUDIO_AVAILABLE
             value: "true"
         template: templates/deployment.yaml
+      # Security default: media GET/HEAD reads must be auth-gated out of the
+      # box. A private attachment must never be publicly readable by URL/hash
+      # in an unmodified render. If this assertion fails, someone flipped the
+      # default — treat that as a security regression, not a config tweak.
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: BUZZ_REQUIRE_MEDIA_GET_AUTH
+            value: "true"
+        template: templates/deployment.yaml
+
+  - it: lets an explicit value opt out of media read auth for dev/public deployments
+    set:
+      relayUrl: wss://buzz.example.com
+      ownerPubkey: "0000000000000000000000000000000000000000000000000000000000000000"
+      externalPostgresql.url: postgres://u:p@h:5432/d
+      externalRedis.url: redis://h:6379
+      s3.endpoint: http://minio:9000
+      s3.accessKey: a
+      s3.secretKey: s
+      relay.requireMediaGetAuth: false
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: BUZZ_REQUIRE_MEDIA_GET_AUTH
+            value: "false"
+        template: templates/deployment.yaml
 
   - it: lets an explicit value disable huddle audio in a single-replica render
     set:
@@ -137,3 +165,118 @@ tests:
       - hasDocuments:
           count: 0
         template: templates/pvc-git.yaml
+
+  - it: preserves image defaults when Pod extensions are empty
+    set:
+      relayUrl: wss://buzz.example.com
+      ownerPubkey: "0000000000000000000000000000000000000000000000000000000000000000"
+      externalPostgresql.url: postgres://u:p@h:5432/d
+      externalRedis.url: redis://h:6379
+      s3.endpoint: http://minio:9000
+      s3.accessKey: a
+      s3.secretKey: s
+    asserts:
+      - notExists:
+          path: spec.template.spec.initContainers
+        template: templates/deployment.yaml
+      - notExists:
+          path: spec.template.spec.containers[0].command
+        template: templates/deployment.yaml
+      - notExists:
+          path: spec.template.spec.containers[0].args
+        template: templates/deployment.yaml
+
+  - it: appends generic Pod extensions and overrides the relay command
+    set:
+      relayUrl: wss://buzz.example.com
+      ownerPubkey: "0000000000000000000000000000000000000000000000000000000000000000"
+      externalPostgresql.url: postgres://u:p@h:5432/d
+      externalRedis.url: redis://h:6379
+      s3.endpoint: http://minio:9000
+      s3.accessKey: a
+      s3.secretKey: s
+      relay.command:
+        - /opt/wrapper/wrapper
+      relay.args:
+        - /usr/local/bin/buzz-relay
+      relay.extraVolumeMounts:
+        - name: wrapper
+          mountPath: /opt/wrapper
+      extraInitContainers:
+        - name: install-wrapper
+          image: example.com/wrapper-init:v1
+          args:
+            - /opt/wrapper/wrapper
+          env:
+            - name: LITERAL_TEMPLATE
+              value: '{{ .Release.Name }}'
+          securityContext:
+            runAsNonRoot: true
+          resources:
+            requests:
+              cpu: 10m
+              memory: 16Mi
+          volumeMounts:
+            - name: wrapper
+              mountPath: /opt/wrapper
+      extraVolumes:
+        - name: wrapper
+          emptyDir: {}
+    asserts:
+      - equal:
+          path: spec.template.spec.initContainers[0].name
+          value: install-wrapper
+        template: templates/deployment.yaml
+      - equal:
+          path: spec.template.spec.initContainers[0].securityContext.runAsNonRoot
+          value: true
+        template: templates/deployment.yaml
+      # Extension fragments are deliberately rendered with toYaml, not tpl.
+      - equal:
+          path: spec.template.spec.initContainers[0].env[0].value
+          value: '{{ .Release.Name }}'
+        template: templates/deployment.yaml
+      - equal:
+          path: spec.template.spec.containers[0].command
+          value:
+            - /opt/wrapper/wrapper
+        template: templates/deployment.yaml
+      - equal:
+          path: spec.template.spec.containers[0].args
+          value:
+            - /usr/local/bin/buzz-relay
+        template: templates/deployment.yaml
+      - contains:
+          path: spec.template.spec.containers[0].volumeMounts
+          content:
+            name: wrapper
+            mountPath: /opt/wrapper
+        template: templates/deployment.yaml
+      - contains:
+          path: spec.template.spec.volumes
+          content:
+            name: wrapper
+            emptyDir: {}
+        template: templates/deployment.yaml
+
+  - it: appends generic init containers after the bundled MinIO readiness gate
+    release:
+      name: rel
+    set:
+      relayUrl: wss://buzz.example.com
+      ownerPubkey: "0000000000000000000000000000000000000000000000000000000000000000"
+      postgresql.enabled: true
+      redis.enabled: true
+      minio.enabled: true
+      extraInitContainers:
+        - name: install-wrapper
+          image: example.com/wrapper-init:v1
+    asserts:
+      - equal:
+          path: spec.template.spec.initContainers[0].name
+          value: wait-for-bucket
+        template: templates/deployment.yaml
+      - equal:
+          path: spec.template.spec.initContainers[1].name
+          value: install-wrapper
+        template: templates/deployment.yaml
diff --git a/deploy/charts/buzz/values.schema.json b/deploy/charts/buzz/values.schema.json
index 203fd9b69b7..53bb29bb608 100644
--- a/deploy/charts/buzz/values.schema.json
+++ b/deploy/charts/buzz/values.schema.json
@@ -72,9 +72,34 @@
           "type": "array",
           "items": { "type": "string" }
         },
-        "ephemeralTtlOverride": { "type": "integer", "minimum": 0 }
+        "ephemeralTtlOverride": { "type": "integer", "minimum": 0 },
+        "command": {
+          "type": "array",
+          "items": { "type": "string" },
+          "description": "Optional relay container entrypoint override. Empty preserves the image default."
+        },
+        "args": {
+          "type": "array",
+          "items": { "type": "string" },
+          "description": "Optional relay container arguments override. Empty preserves the image default."
+        },
+        "extraVolumeMounts": {
+          "type": "array",
+          "items": { "type": "object" },
+          "description": "Raw Kubernetes volumeMount fragments appended to the relay container."
+        }
       }
     },
+    "extraInitContainers": {
+      "type": "array",
+      "items": { "type": "object" },
+      "description": "Raw Kubernetes init-container fragments appended to the relay Pod."
+    },
+    "extraVolumes": {
+      "type": "array",
+      "items": { "type": "object" },
+      "description": "Raw Kubernetes volume fragments appended to the relay Pod."
+    },
     "service": {
       "type": "object",
       "additionalProperties": true,
diff --git a/deploy/charts/buzz/values.yaml b/deploy/charts/buzz/values.yaml
index 180afc67462..8ac5086e275 100644
--- a/deploy/charts/buzz/values.yaml
+++ b/deploy/charts/buzz/values.yaml
@@ -107,10 +107,12 @@ relay:
   sendBuffer: 1000
   requireAuthToken: true
   requireRelayMembership: true
-  # Staged rollout gate for authenticated media reads. When true, relay
-  # GET/HEAD /media/* requires Blossom kind 24242 t=get plus relay membership.
-  # Keep false until deployed desktop/mobile/CLI clients attach read auth.
-  requireMediaGetAuth: false
+  # Authenticated media reads: relay GET/HEAD /media/* requires Blossom
+  # kind 24242 t=get plus relay membership. Enabled by default so private
+  # attachments are never publicly readable by URL/hash. Only set false for
+  # local development or fully public communities — desktop, mobile, and CLI
+  # clients all attach read auth.
+  requireMediaGetAuth: true
   allowNipOaAuth: true
   pubkeyAllowlist: false
   corsOrigins: []
@@ -183,9 +185,24 @@ relay:
     readOnlyRootFilesystem: false  # git writes need a writable repo path
   terminationGracePeriodSeconds: 60
 
+  # Optional image entrypoint/arguments overrides. Empty arrays preserve the
+  # relay image's defaults. Consumers own compatibility with the selected image.
+  command: []
+  args: []
+  # Appended to the chart-owned relay mounts. Names must match extraVolumes (or
+  # another volume supplied by the platform) and must not collide with built-ins.
+  extraVolumeMounts: []
+
   extraEnv: []
   extraEnvFrom: []
 
+# ── Pod extensions ──────────────────────────────────────────────────────────
+# Raw Kubernetes fragments appended to the relay Pod. They are rendered with
+# toYaml, not tpl. Init containers must define their own securityContext and
+# resources; names must not collide with chart-owned containers or volumes.
+extraInitContainers: []
+extraVolumes: []
+
 # ── Device pairing relay ─────────────────────────────────────────────────────
 # Optional, stateless NIP-AB relay. When enabled, the main relay advertises
 # pairingRelay.url in NIP-11 and Buzz clients use it instead of the legacy
diff --git a/deploy/compose/.env.example b/deploy/compose/.env.example
index cebe879da0d..db1f2eb2521 100644
--- a/deploy/compose/.env.example
+++ b/deploy/compose/.env.example
@@ -11,6 +11,10 @@ RELAY_URL=wss://buzz.example.com
 BUZZ_MEDIA_BASE_URL=https://buzz.example.com/media
 BUZZ_MEDIA_SERVER_DOMAIN=buzz.example.com
 BUZZ_CORS_ORIGINS=https://buzz.example.com
+# Optional URL path prefix, for gateways that route by path rather than by
+# hostname (the relay is normally served at the root, so leave this unset).
+# When set, RELAY_URL and BUZZ_MEDIA_BASE_URL must carry the same prefix.
+# BUZZ_BASE_PATH=/relay
 
 # Production defaults. Closed relay mode requires RELAY_OWNER_PUBKEY and a stable relay key.
 BUZZ_REQUIRE_AUTH_TOKEN=true
@@ -30,7 +34,6 @@ POSTGRES_DB=buzz
 POSTGRES_USER=buzz
 POSTGRES_PASSWORD=CHANGE_ME_RANDOM_PASSWORD
 REDIS_PASSWORD=CHANGE_ME_RANDOM_PASSWORD
-TYPESENSE_API_KEY=CHANGE_ME_RANDOM_API_KEY
 BUZZ_S3_ACCESS_KEY=CHANGE_ME_RANDOM_ACCESS_KEY
 BUZZ_S3_SECRET_KEY=CHANGE_ME_RANDOM_SECRET_KEY
 BUZZ_S3_BUCKET=buzz-media
@@ -45,7 +48,6 @@ CADDY_HTTPS_PORT=443
 # Dev override ports. Only used with compose.dev.yml.
 POSTGRES_PORT=5432
 REDIS_PORT=6379
-TYPESENSE_PORT=8108
 MINIO_API_PORT=9000
 MINIO_CONSOLE_PORT=9001
 ADMINER_PORT=8082
diff --git a/desktop/package.json b/desktop/package.json
index 8c5795e359a..7943b949b94 100644
--- a/desktop/package.json
+++ b/desktop/package.json
@@ -1,7 +1,7 @@
 {
   "name": "buzz",
   "private": true,
-  "version": "0.4.26",
+  "version": "0.5.1",
   "type": "module",
   "scripts": {
     "dev": "vite",
@@ -14,7 +14,7 @@
     "lint": "biome lint .",
     "check": "biome check . && pnpm check:file-sizes && pnpm check:px-text && pnpm check:pubkey-truncation",
     "format": "biome format --write .",
-    "test": "node --import ./test-loader.mjs --experimental-strip-types --test 'src/**/*.test.mjs'",
+    "test": "node --import ./test-loader.mjs --experimental-strip-types --test \"src/**/*.test.mjs\"",
     "preview": "vite preview",
     "tauri": "tauri",
     "test:e2e": "pnpm build:e2e && playwright test",
diff --git a/desktop/playwright.config.ts b/desktop/playwright.config.ts
index 7e316dd5432..459fa757432 100644
--- a/desktop/playwright.config.ts
+++ b/desktop/playwright.config.ts
@@ -59,6 +59,7 @@ export default defineConfig({
         "**/video-attachment.spec.ts",
         "**/spoiler.spec.ts",
         "**/composer-link-shortcut.spec.ts",
+        "**/composer-selection-formatting.spec.ts",
         "**/composer-tooltip-dismiss.spec.ts",
         "**/mentions.spec.ts",
         "**/team-mentions.spec.ts",
@@ -102,6 +103,8 @@ export default defineConfig({
         "**/project-pr-review.spec.ts",
         "**/persona-model-combobox-screenshots.spec.ts",
         "**/drafts-screenshots.spec.ts",
+        "**/drafts-all-fix-screenshots.spec.ts",
+        "**/inbox-refactor-screenshots.spec.ts",
         "**/buzz-theme-screenshots.spec.ts",
         "**/channel-sort.spec.ts",
         "**/identity-lost.spec.ts",
@@ -122,6 +125,8 @@ export default defineConfig({
         "**/mesh-compute.spec.ts",
         "**/observer-archive-policy.spec.ts",
         "**/harness-management.spec.ts",
+        "**/harness-catalog-screenshots.spec.ts",
+        "**/inline-custom-harness.spec.ts",
       ],
       use: {
         ...devices["Desktop Chrome"],
diff --git a/desktop/public/harness-logos/CREDITS.md b/desktop/public/harness-logos/CREDITS.md
index 654a6b74284..de4e003c3f2 100644
--- a/desktop/public/harness-logos/CREDITS.md
+++ b/desktop/public/harness-logos/CREDITS.md
@@ -15,8 +15,25 @@ license permits redistribution.
 | `kimi.png` | [MoonshotAI/kimi-cli](https://github.com/MoonshotAI/kimi-cli) | `4a550effdfcb29a25a5d325bf935296cc50cd417` | Apache-2.0; NOTICE: Kimi Code CLI © 2025 Moonshot AI | `web/public/logo.png` | None |
 | `grok.svg` | [SpaceXAI brand guidelines](https://x.ai/legal/brand-guidelines) | Retrieved 2026-07-25 | xAI Brand Guidelines: marks may be used to accurately refer to xAI or its services; logos must be used exactly as provided | `SpaceXAI_Grok_Assets.zip` → `Grok_Logomark_Dark.svg` | None |
 
+## Inline SVG marks (`RUNTIME_MARKS`)
+
+Monochrome marks inlined as `currentColor` paths in
+`desktop/src/features/onboarding/ui/HarnessMarks.tsx` (no files under
+`public/`), so they adapt to dark/light themes without bitmap filters.
+
+| Mark | Upstream | Version/Commit | License | Source path | Modifications |
+|---|---|---|---|---|---|
+| Goose | [block/goose](https://github.com/block/goose) | `305849b71709b95b86ed9f11bd3bc939899c0aab` | Apache-2.0 © Block, Inc. | `documentation/static/img/goose.svg` | `fill="#101010"` → `currentColor`; dropped the redundant clipPath wrapper |
+| Cursor | [simple-icons](https://github.com/simple-icons/simple-icons) | `16.27.1` (slug `cursor`) | CC0-1.0 (path data); nominative use of the Cursor mark to identify Cursor's harness | `icons/cursor.svg` | `fill` → `currentColor` |
+
+Codex deliberately has **no** bundled mark: the OpenAI blossom was removed
+from simple-icons in v16 at the vendor's request, so we do not ship it —
+Codex renders `RuntimeIcon`'s neutral terminal-glyph fallback instead.
+
 `amp.png` and `opencode.svg` predate this file; their provenance was not
-recorded when they were added. Cursor intentionally uses the generic terminal
-fallback: Cursor's official brand page offers downloadable assets, but neither
-that page nor its Terms of Service grants third parties permission to
-redistribute them. The previous unproven `cursor.png` was removed.
+recorded when they were added. Cursor previously used the generic terminal
+fallback because Cursor's own brand page does not grant redistribution; the
+CC0-licensed simple-icons path (above) resolves that, mirroring the grok
+nominative-use precedent. The previous unproven `cursor.png` was removed, as
+were the unproven `chatgpt.png` and `goose.png` builtin-runtime bitmaps
+(replaced by the inline marks above).
diff --git a/desktop/public/runtime-icons/codex.png b/desktop/public/runtime-icons/codex.png
deleted file mode 100644
index fbdd19c060e..00000000000
Binary files a/desktop/public/runtime-icons/codex.png and /dev/null differ
diff --git a/desktop/public/runtime-icons/goose.svg b/desktop/public/runtime-icons/goose.svg
deleted file mode 100644
index c5ed5e00a8f..00000000000
--- a/desktop/public/runtime-icons/goose.svg
+++ /dev/null
@@ -1,6 +0,0 @@
-<svg width="2048" height="2048" viewBox="0 0 2048 2048" xmlns="http://www.w3.org/2000/svg">
-  <rect x="200" y="200" width="1648" height="1648" rx="400" ry="400" fill="#fff"/>
-  <g transform="translate(128 94) scale(3)">
-    <path fill="#000" d="M455.145 485.687c18.641-4.048 38.414-15.065 38.414-15.065l-34.607-28.507c-17.108-14.081-31.67-30.999-43.054-50.007-15.731-26.263-37.467-48.425-63.413-64.663l-12.672-7.379c-4.342-3.018-7.369-7.722-7.8-13.029-.276-3.422.544-6.481 2.457-9.173 6.598-9.3 40.702-49.767 46.952-54.938 8.049-6.653 17.018-12.187 25.339-18.523 1.183-.902 2.37-1.799 3.539-2.714.041-.041.1-.073.136-.109 2.67-2.108 5.19-4.347 7.193-7.002 7.233-8.376 8.991-15.781 9.422-19.058-.979-3.154-3.898-10.206-12.033-18.341 5.099.313 11.272 4.346 16.869 9.091 3.757-6.005 7.691-12.35 11.62-18.708 2.624-4.247-1.269-7.424-1.378-7.523l-.022-.005v-.018c-.1-.109-3.277-4.002-7.514-1.378-9.06 5.606-18.115 11.217-26.168 16.315 0 0-9.545-.199-20.848 9.563-2.66 2.008-4.899 4.527-7.002 7.192-.041.041-.077.095-.109.136-.92 1.165-1.817 2.352-2.714 3.54-6.341 8.325-11.87 17.29-18.523 25.339-5.167 6.254-45.638 40.353-54.938 46.952-2.692 1.913-5.747 2.737-9.173 2.456-5.302-.426-10.011-3.458-13.03-7.799l-7.378-12.672c-16.238-25.955-38.4-47.682-64.663-63.413-19.008-11.384-35.922-25.951-50.007-43.055l-28.516-34.607s-11.022 19.769-15.065 38.414c5.624 6.839 20.295 23.812 37.372 36.774-18.36-8.634-31.933-15.31-42.638-20.893-1.65 12.209-1.006 30.673.693 44.972 11.589 5.071 31.321 12.884 51.408 17.036-16.067 3.757-33.692 4.441-47.302 4.174 2.398 8.851 5.733 17.879 10.22 26.961 1.908 4.201 3.997 8.303 6.254 12.318 7.202 1.981 35.478 6.1 50.524 2.719-14.969 5.344-40.1 14.322-40.1 14.322 19.302 24.015 40.635 43.553 40.635 43.553 32.449-17.448 39.846-19.832 64.183-35.749-39.411 32.069-49.64 45.162-60.703 58.618l-7.709 10.818c-4.006 5.62-7.482 11.589-10.387 17.847-9.721 20.916-23.481 65.484-23.481 65.484-2.456 7.768 3.236 13.461 10.777 10.778 0 0 44.56-13.76 65.484-23.481 6.255-2.91 12.233-6.386 17.848-10.388l10.818-7.709c3.63-2.986 7.238-5.914 11.199-9.367 0 0 27.233 32.263 55.227 53.487 0 0 8.979-25.13 14.322-40.1-3.386 15.051.734 43.327 2.719 50.524 4.006 2.257 8.117 4.346 12.318 6.254 9.087 4.491 18.11 7.822 26.962 10.22-.263-13.614.417-31.235 4.174-47.301 4.151 20.086 11.96 39.823 17.036 51.407 14.298 1.7 32.762 2.343 44.972.693-5.584-10.704-12.26-24.287-20.893-42.637 12.961 17.077 29.934 31.747 36.773 37.371l-.014-.013z"/>
-  </g>
-</svg>
diff --git a/desktop/scripts/check-file-sizes.mjs b/desktop/scripts/check-file-sizes.mjs
index 55bf334f284..326587b87f8 100644
--- a/desktop/scripts/check-file-sizes.mjs
+++ b/desktop/scripts/check-file-sizes.mjs
@@ -46,636 +46,8 @@ const rules = [
   },
 ];
 
-// TEMP — these files exceed the 1000-line limit and are queued to be split.
-// Do not add to this list; split the file instead. Remove each entry as its
-// file is broken up. Tracked as a follow-up.
-const overrides = new Map([
-  // Native Builderlab auth/community commands add a small registration surface
-  // to the existing Tauri composition root. The implementation lives in
-  // builderlab.rs; this narrowly ratchets the command wiring while lib.rs is
-  // queued for a broader composition-root split. Bumped for the
-  // archive/unarchive/transfer community-management commands (web parity).
-  ["src-tauri/src/lib.rs", 1013],
-  // persona-events rebase: build_deploy_payload threads `state` for the
-  // read-time relay-URL workspace fallback while keeping the create-time env
-  // pin (the credential-leak guard). Load-bearing feature growth from the
-  // rebase, queued to split with the rest of this list.
-  // persona-refresh-on-spawn: re-snapshot + retain_managed_agent_pending call
-  // in start_local_agent_with_preflight adds ~23 lines. Queued to split.
-  // rebase onto main (2026-06-25): main's agents.rs grew by ~17 lines since
-  // config-bridge: get_agent_config_surface/write_agent_config_field/put_agent_session_config
-  // commands add ~40 lines. Queued to split.
-  // branch cut; override bumped to cover the merged total. Queued to split.
-  // persona-blank-fallback: persona_snapshot_with_agent_config_fallback call
-  // sites add ~4 lines (extra fallback params + inline comments). build_deploy_payload
-  // fix (blank-persona provider/model fallback) adds ~6 lines. Bug fix.
-  // archive/mod_tests.rs carries the full test module for archive/mod.rs:
-  // unit tests + 4 real-relay integration tests (ignored, live-relay only).
-  // Production logic in mod.rs is now ~527 lines (under 1000). mod_tests.rs
-  // is test-only content; the override covers the test growth accumulated
-  // across the local-archive + agent-metric-archive PR series. store_tests.rs
-  // (~731 lines) is under 1000 so needs no override.
-  ["src-tauri/src/archive/mod_tests.rs", 1208],
-  // unified-agent-model 1A.1: profile reconcile split to agents_profile.rs,
-  // ratcheting 1443 -> 1295. Queued to split further in the A2 fold.
-  // global-agent-config: resolve_deploy_model_provider + visibility exports
-  // add ~40 lines on top of the 1A.1 ratchet. Queued to split.
-  // +29 (1340 -> 1369, main): agent-config-resolver — start_local_agent_with_preflight
-  // uses resolve_effective_relay_mesh_model_id at both preflight call sites;
-  // preview_prospective_persona_snapshot helper extracted; orphan guard threaded
-  // through restore path; start_local_agent_pairs_with_preflight resolver
-  // preflight. Load-bearing feature changes; queued to split.
-  // +47 (#2773): review fix — load_global_agent_config hoisted out of
-  // build_managed_agent_summary into callers, dangling-harness summaries render
-  // the deleted id, and spawn errors surface as sentences (tests included).
-  // +1: merge of the two deltas above (actual post-merge count).
-  ["src-tauri/src/commands/agents.rs", 1418],
-  // agent-lifecycle-fixes: cascade-delete in delete_persona restructured into
-  // 3-phase (stage/stop/commit) + commit_cascade_agents injectable helper for
-  // retry-safety. Load-bearing reviewer-required change; queued to split.
-  // Consolidation removed the legacy persona-card import/export codecs.
-  ["src-tauri/src/commands/personas/mod.rs", 984],
-  // #1418 read-path fix: get_thread_replies' blocker fix (shared TIMELINE_KINDS
-  // const + build_thread_replies_filter helper, mirroring the channel sibling so
-  // the two p-gate filters can't drift) plus two guard unit tests. The file was
-  // already at 995; this load-bearing correctness fix crossed 1000. Not generic
-  // debt growth. Approved override; queued to split with the rest of this list.
-  ["src-tauri/src/commands/messages.rs", 1082],
-  // Residual repos_dir integration in ensure_nest_at: REPOS is provisioned
-  // outside NEST_DIRS (it may be a symlink), so it needs its own create +
-  // chmod-only-when-real-dir handling plus integration test coverage. The
-  // self-contained repos_dir functions and their unit tests live in repos.rs;
-  // this is the seam that must stay in nest.rs. Approved override; still queued
-  // to split with the rest of this list.
-  // dev-nest namespace: OnceLock<Option<PathBuf>> + init_nest_dir + constants
-  // added to plumb the dev/prod discriminator. Load-bearing for the D2 nest fix.
-  // dev-build CLI symlink: cli_link_name helper + is_dev param on
-  // ensure_cli_symlink + prod/dev test variants add ~68 lines. Load-bearing;
-  // queued to split with the rest of this list.
-  // +4 lines: adopt shared create_symlink wrapper (behavior-preserving refactor
-  // for multi-line rustfmt expansion of the skills symlink call site).
-  // unified-agent-model 1A.1: inline test module moved to nest/tests.rs,
-  // ratcheting 1575 -> 679 (under the 1000 default; entry kept as a ratchet).
-  // observer-archive dev-default: path_is_dev_nest + nest_is_dev getters
-  // (+25 lines) so observer_archive_default_enabled() keys off the dev nest.
-  // Load-bearing; spends banked ratchet headroom, still well under 1000.
-  ["src-tauri/src/managed_agents/nest.rs", 704],
-  // keyring-dev-isolation: agent key migration added copy_agent_keys_between_stores
-  // and load_readonly support; file grew past 1000 default. Queued to split.
-  // +7 for try_delete_agent_key result-returning seam (snapshot-import rollback).
-  // +48 (1335 -> 1383): agents-everywhere pair re-key — pair-scoped runtime
-  // receipts (write_agent_runtime_receipt atomic JSON + remove/read_all
-  // helpers) replace the pubkey-keyed PID file, plus the hashed pair-scoped
-  // runtime log path. Load-bearing crash-recovery surface; queued to split.
-  ["src-tauri/src/managed_agents/storage.rs", 1383],
-  // config-bridge setup-payload env-boundary fix adds readiness wiring in
-  // spawn_agent_child; load-bearing security fix, queued to split.
-  ["src-tauri/src/managed_agents/config_bridge/reader.rs", 1016],
-  // config-bridge-aware requirements: goose_requirements + injection tests
-  // (4 new tests in goose_file_config_tests module) + test-determinism fixes
-  // for the 3 existing goose tests that previously read real disk config.
-  // New file in this PR; queued to split.
-  // +2 readiness integration tests for flat-DATABRICKS_HOST canonicalization fix.
-  // +1 cargo fmt whitespace reformat (readiness.rs closures inline after rebase).
-  // +2 unit tests for cli_login_requirements resolve_command integration (DMG PATH fix).
-  // Doctor-CTA: reworked cli_login_requirements to carry AcpAvailabilityStatus,
-  // skip login probe for not-installed/adapter-missing/cli-missing states, and
-  // added 4 unit tests covering each arm. Load-bearing discoverability fix.
-  // Updated existing codex_not_ready test to use make_cli_runtime stub.
-  // +4 lines: #1640 persona-env-vars-refresh rebase added availability-classification
-  // growth in the live-persona env merge path. Feature plumbing, not generic debt.
-  // Windows-CI portability: replaced POSIX true/false probes with current_exe()
-  // stand-in + present_binary_str()/static_commands() helpers (+29 lines).
-  // Tests now pass on windows-latest CI shard without POSIX shell utilities.
-  // databricks-v1-to-v2-migration: databricks-v2 hyphen-alias added to all
-  // host/credential match arms + 30+ readiness tests for provider aliases,
-  // missing-host, and DATABRICKS_MODEL fallback. Load-bearing correctness fix.
-  // #1613 augmented-PATH readiness probes grew the file +3 past the prior cap.
-  // +16: resolve_effective_agent_env + global-config readiness wiring (#1448).
-  // +1 rebase merge: GlobalAgentConfig import added alongside AcpAvailabilityStatus.
-  // +2 rebase onto #1667: behavioral quad fields in AgentDefinition/ManagedAgentRecord.
-  // +3 rebase onto main (#1568 + #1613): identity-import-keyring + augmented-PATH probes.
-  // +18: CliConfigInvalid requirement surface for config-parse probe classification —
-  // new Requirement variant + updated cli_login_requirements + 3 new probe-layer tests.
-  // Load-bearing UX fix (bad config → clear diagnostic, not "run codex login").
-  // codex-acp-package-swap: AdapterOutdated version-probe in cli_login_requirements
-  // (+22 lines). Load-bearing — blocks login gate for deprecated 0.16.x adapter.
-  // code-reviewer fix-round: codex readiness gate tests — 2 new tests for
-  // outdated-adapter and garbage-version-output paths through the codex id gate
-  // (+140 lines: make_codex_runtime helper, PATH_MUTEX serializer, 2 test fns).
-  // Load-bearing test coverage; queued to split with the file generally.
-  // +1: pub(crate) mod cli_probe declaration for doctor auth probe access.
-  // +3: auth_probe_args: None + login_hint: None added to make_cli_runtime and
-  // make_codex_runtime stubs (new KnownAcpRuntime fields).
-  // Git Bash readiness is intentionally colocated with buzz-agent's other
-  // setup-mode requirements. The Windows-only requirement and serialization
-  // test add eight lines; split remains queued with the existing file debt.
-  // Windows Doctor install fix: cli_install_commands_windows field added to test stubs.
-  // team-instructions-first-class: ManagedAgentRecord fixture gains the new
-  // team_id field (+1 line).
-  ["src-tauri/src/managed_agents/readiness.rs", 1863],
-  // Windows PATH-correctness fix: 3 #[cfg(windows)] test functions covering
-  // .cmd shim rejection, .bat shim rejection, and .exe acceptance for
-  // configure_runtime_cli (fix #2397). Test-only growth; queued to split.
-  // +7 (main): this PR's resolver tests land on top of main's #2397 Windows
-  // shim tests, plus main's restart_eligible orphan-gate tests.
-  // +34: BYOH custom-harness sweep condition unit tests — 3 tests validating
-  // the OR-gate fix for custom-binary orphan cleanup.
-  // +26: BYOH pass-2 I3 — 2 collector-decision tests for receipt path
-  // ownership (valid_agent_runtime_receipt uses buzz_sweep_owns_process).
-  ["src-tauri/src/managed_agents/runtime/tests.rs", 1320],
-  // runtime.rs re-entered the list after the #1968 merge: main's
-  // definition-authoritative resolver comments grew it to 982, and this PR's
-  // typed harness-descriptor resolution in spawn_agent_child (+38) lands on
-  // top. Queued to shrink with the next runtime split pass (#2974 follow-up).
-  ["src-tauri/src/managed_agents/runtime.rs", 1020],
-  // applyWorkspace reposDir parameter plus the validateReposDir binding,
-  // threaded through Tauri invokes for configurable repos_dir, plus the
-  // harness-persona-sync `harnessOverride` create-input bit — load-bearing
-  // parameter plumbing, not generic debt growth. Approved override; still
-  // queued to split. Read-path lanes 1+2 add server-side fetch bindings
-  // (getThreadReplies + getChannelMessagesBefore) and paged people-search
-  // reachability — load-bearing reachability plumbing, not generic debt.
-  // #1418 read-path fix: +3 doc-only lines correcting the getThreadReplies
-  // contract (replies-only, root excluded — the query keys on root_event_id,
-  // which root rows lack). Documentation accuracy, not code growth.
-  // linux-updater isAutoUpdateSupported() binding + onboarding has_profile_event field.
-  // config-bridge-aware requirements: getRuntimeFileConfig command adds ~15 lines.
-  // +26 lines from PRs landing on main between prior rebase and this rebase.
-  // baked-env-required-badge: getBakedBuildEnvKeys wrapper adds ~16 lines. Queued to split.
-  // restart-badge: started the queued split — start/stopManagedAgent moved to
-  // tauriManagedAgents.ts; limit ratcheted down 1388 → 1380 to bank the headroom.
-  // identity-import-keyring: identity wrappers (RawIdentity, getIdentity, getNsec,
-  // importIdentity, persistCurrentIdentity) moved to tauriIdentity.ts;
-  // limit ratcheted down 1380 → 1360 to bank the headroom (absorbs main-side
-  // growth landed between the split and the rebase).
-  // mention-alias fix: profile wrappers (RawProfile/RawUserProfileSummary types,
-  // getProfile/updateProfile/getUserProfile/getUsersBatch/searchUsers) moved to
-  // tauriProfiles.ts; limit ratcheted down 1360 → 1241 to bank the headroom.
-  // baked-env fold-in: getBakedBuildEnv + BakedEnvEntry type adds ~28 lines.
-  // doctor-npm-eacces-preflight: hint field on RawInstallStepResult + mapper
-  // passthrough (+2 lines).
-  // doctor-install-reliability: node_required + auth_status + login_hint fields
-  // added to RawAcpRuntimeCatalogEntry + fromRawAcpRuntimeCatalogEntry mapper (+8).
-  // codex-install-auto-restart: restarted_count + failed_restart_count added to
-  // RawInstallRuntimeResult + fromRawInstallRuntimeResult mapper (+2).
-  // Git Bash Doctor discovery adds the raw Tauri response and its camelCase
-  // mapper. This is the existing API boundary; split remains queued.
-  // team-instructions-first-class: createManagedAgent Tauri bridge threads the
-  // new teamId input through to the backend (+1 line).
-  // +2 for model_source field in RawManagedAgent + fromRawManagedAgent mapping.
-  ["src/shared/api/tauri.ts", 1307],
-  // doctor-npm-eacces-preflight: hint field added to InstallStepResult (+1 line).
-  // codex-acp-package-swap: "adapter_outdated" variant added to AcpAvailabilityStatus (+1 line).
-  // doctor-install-reliability: AuthStatus tagged union + nodeRequired/authStatus/
-  // loginHint fields on AcpRuntimeCatalogEntry (+14 lines). Load-bearing new feature.
-  // agent-lifecycle-fixes: GlobalAgentConfigSaveResult type grows with
-  // failed_restart_count (+2 lines). Queued to split with the rest of this list.
-  // mcp-readonly-view rebase: PR2 MCP config surface FE-type fields force +1 over the grandfathered ceiling.
-  // Git Bash prerequisite payload adds four fields to the shared Tauri API
-  // contract. This is the canonical type location; split remains queued.
-  // signout-wipe: resetFailed field added to Identity type (+6 lines).
-  // team-instructions-first-class: CreateManagedAgentInput.teamId (+2, incl.
-  // doc comment) and AgentTeam/CreateTeamInput/UpdateTeamInput.instructions
-  // (+3) — the new team-id spawn link and the runtime-layered instructions
-  // field.
-  // byoh-env-roundtrip: AcpRuntimeCatalogEntry.definitionEnv field + JSDoc
-  // (+12 lines) so the edit form can read back existing env vars on save.
-  // Load-bearing correctness fix. Queued to split.
-  // +2: AcpRuntimeCatalogEntry.requiresExternalCli field added by main
-  // (#2680) to indicate runtimes that need a separate CLI install.
-  // +6: ManagedAgent.runtime record-level pin + JSDoc so the harness delete
-  // confirmation can count referencing agents (review fix for #2773).
-  ["src/shared/api/types.ts", 1058],
-  // harness-persona-sync feature growth, queued to split in the resolver-unify
-  // refactor followup. discovery.rs is dominated by the new test module
-  // (the effective_agent_command / divergent / create-time override matrix);
-  // alias-preservation coverage extends that matrix so create-time persona
-  // agents keep an installed runtime alias when the primary command is absent.
-  // Load-bearing, not generic debt.
-  // config-bridge: schema-driven field extraction adds ~26 lines. Queued to split.
-  // config-parity: max_tokens_env_var + context_limit_env_var fields added to
-  // KnownAcpRuntime (2 fields × 4 runtimes + discovery tests = ~13 lines).
-  // Load-bearing — required for buzz-agent normalized config parity.
-  // same-runtime-pin: update_time_agent_command_override + its override /
-  // same-runtime / alias / sentinel / non-override / persona-less test matrix
-  // (~135 lines, mostly tests) so a deliberate Custom pin survives the update
-  // path instead of being dropped back to inherit. Load-bearing, not debt.
-  // unified-agent-model 1A.1: inline test module moved to discovery/tests.rs,
-  // ratcheting 1259 -> 802 (under the 1000 default; entry kept as a ratchet).
-  // agent-config-propagation: the agent_command_override decision family
-  // (divergent / create-time / update-time / apply) moved to
-  // discovery/overrides.rs; ratcheting 802 -> 685 to bank the headroom.
-  // codex-acp-package-swap: probe_codex_acp_major_version (+24 lines) +
-  // AdapterOutdated version-gate in discover_acp_runtimes (+22 lines). Both
-  // load-bearing — required to detect the deprecated 0.16.x adapter and
-  // prevent silent relay breakage after the spawn-contract change.
-  // codex-acp-package-swap follow-up: tempfile-based bounded stdout read
-  // (+18 lines), codex_adapter_availability/is_outdated helpers (+16 lines),
-  // cross-platform probe contract. All load-bearing — required for correct
-  // probe behaviour on Windows and descendant-process edge cases.
-  // doctor-install-reliability: refreshable login_shell_path cache,
-  // find_nvm_default_bin + parse_semver_tag helpers, auth probe cache +
-  // probe_auth_status/cached_auth_status, runtime_needs_npm, probe_args_for,
-  // PartialEntry struct, and updated discover_acp_runtimes with parallel auth
-  // probes. Load-bearing fresh-install reliability fixes. (+289 lines)
-  // doctor-install-reliability review fixes: LoginShellPath enum + double-checked
-  // locking, is_safe_nvm_tag security validation, classify_probe_output helper,
-  // auth_probe_args on KnownAcpRuntime (removes probe_args_for indirection),
-  // process-level timeout replacing inner-thread pattern. (+75 lines)
-  // codex-install-auto-restart review-fixes: availability_drift pure predicate
-  // + updated adapter_availability_cached() signature (Option return, cold=None)
-  // prevents false restart badge on newly restarted agents. Correctness fix;
-  // load-bearing — required by Thufir's IMPORTANT findings. (+15 lines)
-  // Windows Doctor install fix: cli_install_commands_windows field, impl block
-  // for cli_install_commands_for_os(), command_basenames() + .cmd/.bat resolution,
-  // Windows well-known dirs in common_binary_paths(), login_shell_candidates(),
-  // path_candidates_from_env_raw(). Load-bearing Windows platform support.
-  // +13: fetch_login_shell_path_inner Windows guard (POSIX PATH → None).
-  // resolve_git_bash made pub(crate) for Windows test access.
-  // +1: login_shell_candidates doc comment expanded for resolve_bash_path.
-  // Buzz-managed Node path helpers and resolution tests moved to
-  // managed_node_paths.rs and discovery/tests/managed_path_resolution.rs;
-  // ratcheting 1366 -> 1392 after adding the managed-path probes to discovery.
-  // +17: BYOH custom harness catalog merge phase-3 — append custom definitions
-  // from custom_harnesses_dir with PATH-probe availability; source tagging.
-  // +148: BYOH F2/F3 — PRESET_HARNESSES static data (6 presets), Phase 2.5 in
-  // discover_acp_runtimes_from (PATH-probe each preset, build catalog entries,
-  // populate loaded-harness registry), record/effective command resolution now
-  // checks loaded registry for preset/custom ids. Queued to split presets out.
-  // +3: BYOH F5 — seen_ids rejects preset/builtin collisions from custom files.
-  // +79: BYOH pass-2 C1 — 4 registry lifecycle tests (warm→spawn, delete→
-  // dangling, immediate save+start, edit with rename); try_record_agent_command
-  // typed error for dangling ids wired into spawn; readiness/spawn_hash now
-  // include definition env floor.
-  // +7: BYOH pass-2 I2 env round-trip — definition_env field populated in
-  // custom catalog entries + 2 discriminating tests (custom env preserved,
-  // builtin env empty). Load-bearing edit round-trip fix.
-  // +16: BYOH scope addition — Hermes Agent + OpenClaw preset entries (two
-  // data-only PresetHarness structs; no new logic or test functions).
-  // +29: rebase over main (#2680) — discover_acp_runtime_phase1 extracted
-  // helper + discover_acp_runtime_availability; both load-bearing for
-  // post-install verification. Semantic composition with BYOH changes.
-  // +17: merge of main (#2767) — codex_adapter_is_outdated_with_path split out
-  // so Codex adapter planning takes an explicit PATH. Auto-merged cleanly; only
-  // the ceiling needed composing with the BYOH growth above.
-  // +13: review fix for #2773 — discovery publishes the registry by re-reading
-  // the harness dir under persist_mutex (publish_harness_registry_from_dir call
-  // + doc comment), closing the stale-snapshot clobber race.
-  // +35: review round 2 (#2773) — cfg(test) pre_publish_test_hook seam so the
-  // stale-publish regression is pinned through the REAL discover_acp_runtimes_from
-  // path (Wren's finding: the seam-only tests stayed green under a stale-publish
-  // mutant). Test-only code, zero release-build footprint.
-  // +55: #2773 follow-up — PresetHarness.underlying_cli (Amp's amp-acp wraps
-  // the amp CLI) + preset_catalog_entry helper: adapter presence alone keeps
-  // deciding Available (adapter-present/CLI-absent stays selectable, Wren's
-  // regression catch); underlying_cli is consulted only when the adapter is
-  // absent, so AdapterMissing replaces the misleading NotInstalled. Includes
-  // the deliberate-divergence doc comments; net after the inline preset
-  // entries.push block collapsed into the helper.
-  ["src-tauri/src/managed_agents/discovery.rs", 1835],
-  // BYOH — save_custom_harness_to_dir (backup-swap atomic write) + save_and_warm /
-  // delete_and_warm (persist-mutex serialization for concurrent-safe registry
-  // refresh, B-6). Also: id/collision/load/registry tests (from the file base) +
-  // B-4 real persistence tests (create, same-id edit, rename, backup cleanup) +
-  // B-3 env validation boundary tests (malformed key, reserved shape, NUL,
-  // size limit, ownership marker). Load-bearing correctness/security coverage;
-  // queued to extract helper module once the feature stabilizes.
-  // +153: review fix for #2773 — collision/dup filtering moved into
-  // load_custom_harnesses so warm + discovery inherit identical shadowing
-  // rules, publish_harness_registry_from_dir (mutex-scoped publish seam), and
-  // comma-in-args validation at validate_harness_definition, with tests.
-  // +34: review round 2 (#2773) — Dawn's mutation finding: the loader-boundary
-  // collision/dedup enforcement was untested (deleting it left the suite green).
-  // load_applies_id_collision_check now drives the real loader against a real
-  // shadowing file, plus a dedup twin; both verified to kill the mutants.
-  ["src-tauri/src/managed_agents/custom_harnesses.rs", 1232],
-  // rebase over codex-acp-package-swap: its version-probe tests union with the
-  // doctor-install-reliability nvm/login-shell/semver tests — each side alone
-  // stayed under the 1000 default; the union exceeds it.
-  // Windows Doctor install fix: command_basenames, cli_install_commands_for_os,
-  // and login_shell_candidates tests. Load-bearing platform-awareness coverage.
-  // +132: pass 2 — five cfg(windows) behavioral tests: command_basenames .cmd/.bat
-  // candidates, cli_install_commands_for_os PowerShell selection, login_shell_path
-  // None regression, .cmd shim resolution, no-git-bash error hint.
-  // +32: deterministic .cmd resolver + no-registry + install_shell_from tests.
-  // Managed-path resolution test split to discovery/tests/managed_path_resolution.rs.
-  // +227: BYOH pass-2 C1 — 4 registry lifecycle tests (warm→spawn, delete→dangling,
-  // immediate save+start, edit with rename) added to discovery/tests.rs.
-  // +64: BYOH pass-2 I2 env round-trip — 2 discriminating tests proving custom
-  // catalog entries carry definition_env and builtins do not.
-  // +90: review fix for #2773 — deterministic interleaving regressions for the
-  // discovery publish race (save-during-discovery survives publish;
-  // delete-during-discovery stays gone).
-  // +103: review round 2 (#2773) — production-path interleaving regressions:
-  // discovery_publish_path_survives_mid_flight_save / _drops_mid_flight_delete
-  // drive the real discover_acp_runtimes_from with a save/delete landed via the
-  // pre_publish_test_hook; verified to red under a stale-publish mutant.
-  // +18: flake fix — lock_path_mutex + registry_test_lock guards (with lock-
-  // order comments) on the four tests that drive discovery's global caches.
-  // +84: #2773 follow-up — preset_catalog_entry coverage (Amp-shaped adapter
-  // preset: AdapterMissing when CLI present, NotInstalled both-missing,
-  // Available both-present AND adapter-present/CLI-absent — the selectability
-  // regression guard), bound to an injectable resolver so the tests stay
-  // PATH-independent.
-  ["src-tauri/src/managed_agents/discovery/tests.rs", 1871],
-  // identity-import-keyring: the identity resolution state machine's behavioral
-  // matrix (46 tests over FakeIdentityStore — probe × marker × file cells,
-  // adoption / read-back-corruption / marker-failure arms, recovery-mode
-  // gating). Load-bearing regression coverage for silent identity rotation,
-  // not generic debt growth. Approved override; split if the matrix grows.
-  ["src-tauri/src/app_state_tests.rs", 1420],
-  // migration_tests.rs carries the harness-sync migration coverage plus the
-  // patch_json_records owner-only writeback regression test (SECURITY.md:90
-  // crash-safe 0o600 fallback). Load-bearing security + feature coverage, not
-  // generic debt growth. Approved override; still queued to split. Event-sync
-  // (persona/team event reconcile) tests were split out to event_sync_tests.rs
-  // and the limit ratcheted 1410 → 1110.
-  // unified-agent-model 1A.1: materialize tests live with their module in
-  // migration/materialize.rs; ratchet held at 1110.
-  ["src-tauri/src/migration_tests.rs", 1110],
-  ["src-tauri/src/nostr_convert.rs", 1126],
-  // degraded-network resilience: relay.rs grew past 1000 with the addition of
-  // relay_error_message hint-capping (oversized-hint test via loopback TCP) and
-  // the relay_admission freshness-verification test. The loopback mock was
-  // hardened (std::net + request-read-before-write) adding ~10 lines.
-  // Queued to split test helpers to relay/tests.rs.
-  // +30 (1047 -> 1077): agents-everywhere pair re-key — query_relay_at_with_keys
-  // (NIP-98 signed /query with explicit agent keys + optional x-auth-tag) for
-  // bounded-auth agent relay-membership discovery. Load-bearing; queued to
-  // split alongside the test-helper split.
-  ["src-tauri/src/relay.rs", 1077],
-  // degraded-network resilience: visibleChannelId field + getter/setter, NOTICE
-  // handler for relay back-pressure, and rate-limit gate imports add ~74 lines
-  // of load-bearing degraded-network recovery code. Queued to split.
-  ["src/shared/api/relayClientSession.ts", 1096],
-  // Boot-time event sync (persona/team/agent event reconcile) was split out
-  // to event_sync.rs, ratcheting this limit 1575 → 1310. Remaining content is
-  // the pre-identity data migrations; still queued to split further.
-  // unified-agent-model 1A.1: materialize_agent_runtimes split to
-  // migration/materialize.rs, ratcheting 1310 -> 1297.
-  // databricks-v1-to-v2-migration: reconcile_databricks_v1_to_v2 migration
-  // + inner fn with baked-env gate + 26 tests. Load-bearing correctness fix.
-  // am review fix: also clear stale V1 model field on provider rewrite +
-  // new model-clear test. Load-bearing chimera fix.
-  // keyring-dev-isolation: run_boot_migrations wires agent-key migration.
-  ["src-tauri/src/migration.rs", 1436],
-  // onMarkRead + isUnread prop threading (mirrors the onMarkUnread prop
-  // already here) for the single-toggle mark-read/unread menu item — a small
-  // overage from load-bearing per-message plumbing, not generic debt growth.
-  // Approved override; still queued to split with the rest of this list.
-  ["src/features/messages/ui/MessageThreadPanel.tsx", 1006],
-  // AgentConfigPanel footer fold into ProfileFieldGroup for the config-bridge
-  // panel — a small overage from load-bearing UI plumbing, not generic debt
-  // growth. Approved override; still queued to split with the rest of this list.
-  // +135 for AgentInfoFocusedView/DiagnosticsFocusedView/ChannelsFocusedView
-  // props restored after 826d735fe removal (UserProfilePanel.tsx still needs them).
-  ["src/features/profile/ui/UserProfilePanelSections.tsx", 1140],
-  // +14 for openEditAgent event subscription (config-nudge card "Open Edit Agent" action).
-  // +11 for editAgentFocus state + initialFocus prop threading (deep-link granularity).
-  ["src/features/profile/ui/UserProfilePanel.tsx", 1025],
-  // PersistBackend enum + marker-on-keyring-success plumbing and its three
-  // fail-closed regression tests (silent identity rotation on keyring outage).
-  // A small overage from load-bearing security plumbing on a file already at
-  // 893 lines, not generic debt growth. Approved override; still queued to split.
-  // cross-process keychain race fix (D3): interprocess lock + BlobLockGuard +
-  // uid-keyed lockfile path + behavioral tests add ~303 lines. Load-bearing
-  // security fix for the lost-update race that stranded agent keys.
-  // identity-import-keyring: KeyringLockedScreen, RecoveryScreen,
-  // load_readonly + load_all_readonly + store_all for safe cross-service reads.
-  // sign-out wipe: delete_all() method removes the entire keychain blob under
-  // the interprocess advisory lock; +8 lines. Load-bearing; queued to split.
-  // signout-wipe phase 2: delete_all_with_legacy_cleanup replaces delete_all;
-  // reads blob keys + deletes per-key legacy entries to prevent resurrection.
-  // + regression test for per-key resurrection via real OS keychain.
-  // Net growth ~36+32 lines over prior cap. Load-bearing correctness fix.
-  // signout-wipe pass-2 (F2): delete_all_with_legacy_cleanup DPK deletes now
-  // observable (propagate real errors); verify_fully_wiped checks all three
-  // keychain shapes (main blob, DPK blob, per-key "identity"). +73 lines.
-  ["src-tauri/src/secret_store.rs", 1307],
-  // keyring-dev-isolation: keyring_service() fn (7 lines) replaces the const
-  // to return "buzz-desktop-dev" in debug builds. Load-bearing isolation fix.
-  // +10 (1042 -> 1052): media_fetch_client with redirect::Policy::none() so a
-  // relay 3xx cannot forward the minted auth header cross-origin (SSRF fix).
-  // +16 (1052 -> 1068): extracted that client into `build_media_fetch_client()`
-  // -> Result so the fail-closed invariant is testable (no silent redirect-
-  // following fallback; startup panics loudly instead). The function belongs
-  // here beside `build_app_state` and its sibling client; its doc comment
-  // carries the load-bearing SSRF rationale. Extraction would only relocate,
-  // not reduce, the security-critical code.
-  // +5 (1068 -> 1073): merge with main, which independently added the
-  // managed_agent_profile_reconcile_enabled flag (field + doc + init) under
-  // its own 1042-line override. Union of two separately approved additions.
-  // +8 (1073 -> 1081): agents-everywhere pair re-key — managed_agent_processes
-  // and session_config_cache re-keyed by ManagedAgentRuntimeKey, the runtime
-  // transition lock doc broadened to cover all protected-PID transitions, and
-  // clear_agent_session_caches (per-pubkey retain) added alongside the
-  // per-key clear. Load-bearing identity-contract change; queued to split.
-  // +4 (1081 -> 1085): mesh recovery keeps one app-scoped state object beside
-  // the embedded runtime and coordinator. Probe/re-arm logic lives in
-  // mesh_llm/recovery.rs rather than growing AppState or command modules.
-  ["src-tauri/src/app_state.rs", 1085],
-  // multi-slot splitting + no-op suppression (#1309): the ReadStateManager
-  // class grew from ~700 lines to ~1019 with the addition of
-  // splitContextsIntoBudgetedSlots (pure fn + 5 tests), publishSplitSlots,
-  // publishOneSlot, deleteExtraSlots, and the no-op suppression integration
-  // test. Load-bearing feature growth, queued to split publishSplitSlots path
-  // into readStateManagerSplit.ts.
-  ["src/features/channels/readState/readStateManager.ts", 1030],
-  // review feedback on #1492 restored the two-line load-bearing comment
-  // documenting why `lastMessageAt` must not be an `activeReadAt` fallback
-  // (reply-inclusive; would clear unread state early). The file was already
-  // at the 1000 ceiling; comment-only overage, not code growth. Queued to
-  // split with the rest of this list.
-  // member-agent-flags: messageProfiles merge + ref stabilisation split out to
-  // useMessageProfiles.ts, ratcheting 1002 -> 972 (under the 1000 default;
-  // entry kept as a ratchet). +7 rebase onto main (#1698 timeline-window
-  // growth), 972 -> 979.
-  ["src/features/channels/ui/ChannelScreen.tsx", 979],
-  // forced-unread persistence: markChannelUnread now writes through to
-  // forcedUnreadStore (localStorage) so the sidebar badge survives reload and
-  // the rail observer can read it. Three clear points added (markChannelRead,
-  // markAllChannelsRead, drainSyncedAdvances). Load-bearing fix, not generic
-  // debt growth. Queued to split with the rest of this list.
-  ["src/features/channels/useUnreadChannels.ts", 1022],
-  // Shared UI was added to this guard after splitting globals/markdown so
-  // large shared renderers cannot grow further while follow-up splits land.
-  // +33 for config-nudge detect-and-render + author-auth gate (normalizePubkey guard).
-  ["src/shared/ui/markdown.tsx", 2152],
-  // +15 (2199 -> 2214): the video right-click Download/Copy menu's props,
-  // hook wiring, and render slot. The stateful menu logic (~52 lines) was
-  // extracted to useVideoContextMenu.tsx; what remains here is the component's
-  // public interface (downloadUrl/filename props) and cannot move out.
-  ["src/shared/ui/VideoPlayer.tsx", 2214],
-  ["src/shared/ui/sidebar.tsx", 1042],
-  // permission-outcome (fix #1381 regression): pendingPermissions state map,
-  // describePermissionOutcome helper, jsonRpcId key helper (handles both
-  // string and finite-number JSON-RPC ids per spec), and the acp_write
-  // response correlation branch are all tightly coupled to the existing
-  // request handler. Load-bearing logic growth, not generic debt. Queued to
-  // split into a dedicated permission module in the next transcript refactor.
-  // +123: observer parity — 4 new named session/update classifier cases
-  // (current_mode_update, usage_update, available_commands_update,
-  // config_option_update) + replaceLifecycleItem helper for usage coalescing +
-  // system-prompt ordering fix (turnId: null for per-channel items).
-  // +35: session/new reposition-on-refire fix — removeItem helper +
-  // upsertMetadata restart branch (remove+sealOpenMessages+push instead of
-  // replaceItem in-place) so system-prompt anchor moves to stream tail.
-  // Load-bearing feature growth; queued to split in next transcript refactor.
-  ["src/features/agents/ui/agentSessionTranscript.ts", 1202],
-  // catalog module; agent_models.rs retains the thin wrapper (~50 lines).
-  // File still exceeds 1000 due to OpenAI/Anthropic discovery + subprocess
-  // fallback. Queued to split into dedicated discovery modules.
-  // Kept activity-feed design fixture: realistic prompt context and tool-heavy
-  // chatter for render-class test/reference coverage. Queued to split with the
-  // rest of this list if it grows further.
-  // +2: baked build env folded under merged_env in both get_agent_models and
-  // discover_agent_models so in-process discovery sees baked provider config on
-  // a GUI-launched DMG (the discovery_env_with_baked_floor fold).
-  // +3: provider tri-state applied in update_managed_agent handler
-  // (if let Some(provider_update) = input.provider { record.provider = provider_update; }).
-  // +8: harness_override thread-through in update_managed_agent so a deliberate
-  // Custom pin routes to update_time_agent_command_override (comment + call).
-  // +22 (1079 -> 1101, main): Finding 2 — model discovery now resolves through
-  // resolve_effective_model_provider instead of raw record bytes, plus
-  // apply_model_provider_prompt_update's linked-instance write-guard
-  // extraction and its regression tests.
-  // +4 (1101 -> 1105): rebase onto agents-everywhere — agents.rs function
-  // signatures updated for ManagedAgentRuntimeKey-keyed runtimes map.
-  // +1 (#2773): model_discovery_error helper routes dangling-harness
-  // resolution errors through user_facing_harness_error (sentence, not raw
-  // DANGLING_HARNESS_ID sentinel) for the get_agent_models surface. The PR's
-  // descriptor path also deletes saved_agent_model_discovery_config, whose
-  // callers now use resolve_effective_model_provider + the descriptor env
-  // directly (net wash after the merge of the deltas above).
-  // +38 (1114 -> 1152): agent_model_discovery_config extracted as a pure,
-  // test-bindable seam (struct + helper + docs) so the linked-agent
-  // regression test kills the stale-record mutation at get_agent_models'
-  // consumption point (review finding, Wren + Dawn).
-  ["src-tauri/src/commands/agent_models.rs", 1152],
-  // global-agent-config: get_agent_config_surface / write_agent_config_field /
-  // put_agent_session_config commands + GlobalAgentConfig serde types. New file
-  // in this PR; queued to split with the command module refactor.
-  // +17: baked-env-global-unify: BUZZ_AGENT_THINKING_EFFORT added to
-  // is_safe_to_reveal allowlist + baked_env_thinking_effort_is_unmasked test.
-  // +1: doctor-install-reliability: login_hint: None added to goose_runtime test stub.
-  // +1: doctor-install-reliability review fixes: auth_probe_args: None added to stub.
-  // +11 (1021 -> 1032): agents-everywhere pair re-key — session-cache reads in
-  // get_agent_config_surface derive the ManagedAgentRuntimeKey (relay-URL
-  // fallback resolution) and put_agent_session_config gains a relay_url param.
-  // Load-bearing identity plumbing; queued to split.
-  // +18 (1032 -> 1050): review fix — put_agent_session_config reads the pair
-  // relay from the harness-attached payload relayUrl (with effective-relay
-  // fallback for older harnesses) instead of a required arg the frontend
-  // wrapper never passed, which silently broke the session-config cache.
-  // +60 (1050 -> 1110): agent-config-resolver — resolve_config_surface now
-  // clears a linked instance's own system_prompt/model/provider before
-  // computing had_* so stale materialized snapshot bytes can never be tagged
-  // BuzzExplicit and shadow the definition/global fallthrough; the dead
-  // persona-model re-tag branch replaced; two new regression tests added.
-  ["src-tauri/src/commands/agent_config.rs", 1110],
-  // codex-install-auto-restart review-fixes: should_restart_after_install
-  // takes pid_alive:bool (pure predicate, no OS-dependent call); 3 racy
-  // cache tests replaced with 6 pure availability_drift predicate tests;
-  // dead-pid non-happy-path added. All load-bearing correctness fixes.
-  // (+17 lines net vs previous 1330 limit; rustfmt expanded some call sites)
-  // Git Bash Doctor discovery exposes a narrow async Tauri command at the
-  // existing discovery boundary. The ten-line addition preserves the platform
-  // neutral frontend contract; split remains queued.
-  // Windows Doctor install fix: resolve_install_shell() + install_shell_command()
-  // returns Result (Windows Git Bash resolution, CREATE_NO_WINDOW, taskkill timeout
-  // kill), cli_install_commands_for_os() callsite, unit tests for shell selection
-  // and per-OS install command accessor. Load-bearing Windows platform support.
-  // +53: pass 2 — three cfg(windows) install shell tests (resolve succeeds with
-  // Git, error hint content, install_shell_command succeeds).
-  // +8: install_shell_from pure seam extracted for deterministic testing.
-  // +287: is_powershell_command + install_powershell_command + build_install_command
-  // route PowerShell CLI installs natively on Windows (bypasses Git Bash PATH
-  // poisoning that resolved GNU tar instead of bsdtar → Codex install failure).
-  // Includes unit tests for detection, routing, and -Command body preservation.
-  // +16: test_powershell_command_goose_catalog_dequoted proves the \$→$ escape
-  // fix for the Goose Windows installer (PR #2680 interaction with #2750).
-  // +10: pass an explicit PATH through Codex adapter install planning so unit
-  // tests avoid the process-global login-shell PATH cache.
-  // +59 (main): run install commands under `pipefail` so a failing `curl` in a
-  // `curl … | bash` install fails the `cli` step instead of being masked by
-  // `bash`'s exit 0, plus tests for the arg shape and the real pipeline status.
-  // +81 (main): install_shell_args re-exports the composed PATH inside the command
-  // body so login startup files can't clear or reorder it, plus an isolated
-  // hostile-profile regression the pure composition tests structurally miss.
-  // +42 (main): gate that re-export off Windows, where join_paths is `;`-separated
-  // and bash would collapse it into one entry, plus a platform-shape test.
-  // +126 (#2773): BYOH — save_custom_harness (validate, atomic write, return
-  // entry) + delete_custom_harness (id-guard, builtin reject, remove file)
-  // commands; discover_acp_providers updated to pass AppHandle +
-  // custom_harnesses dir.
-  // +30: BYOH F5 — atomic-write-file dep, original_id rename/delete support.
-  // +13: BYOH pass-2 C1 — warm_harness_registry_from_dir call in save and
-  // delete commands now verifies transactional registry refresh.
-  // +2: BYOH pass-2 I2 env round-trip — definition_env carried through save
-  // return value so the frontend immediately has the updated env.
-  // +1: rebase over main (#2680) — requires_external_cli: false added to
-  // save_custom_harness catalog entry construction (new required field).
-  ["src-tauri/src/commands/agent_discovery.rs", 2167],
-  // draft-persistence predicate: submit-time `loadDraft` check + inline comment
-  // + deps-array entry in submitMessage closes the never-persisted-boundary
-  // defect (Thufir Pass-3 finding). Load-bearing correctness fix; queued to
-  // split MessageComposer into submit/edit/media sub-modules.
-  // +18: pendingImetaForPersistRef (local snapshot ref) + synchronous restore
-  // path writes in the draft-key effect body, fixing the image-drop bug on
-  // top-level nav switch (StrictMode simulate-unmount race on remount).
-  // +12 autoSubmitDraftKey/onAutoSubmitComplete props + onAutoSubmitCompleteRef
-  // + mount-only useEffect for the Drafts-panel "Send message" confirm-dialog
-  // flow. Load-bearing feature growth; queued to split with the rest of this
-  // list.
-  // +3: onLinkShortcutRef wiring (ref decl + editor option + assignment) for
-  // the ⌘K link-editor shortcut, mirroring the existing onEditLinkRef
-  // pattern. Queued to split with the rest of this list.
-  // +35: persistent audience scope/hook wiring and chip component handoff. The
-  // chip markup lives separately; remaining lines connect existing composer
-  // send state to the audience store. Queued with the existing split.
-  // +23: edit-to-add-mention notify (8ace8eed) — onEditSave/edit-branch
-  // mentionPubkeys threading + two snapshot refs (extractMentionPubkeys,
-  // ownerPubkey) feeding the newly-added-mentions diff. Diff logic itself
-  // lives in threading.ts (diffAddedMentionPubkeys); this is the minimal
-  // composer-side wiring. Queued to split with the rest of this list.
-  ["src/features/messages/ui/MessageComposer.tsx", 1114],
-  // global-agent-config: model-tuning section (BuzzAgentModelTuningFields via
-  // EditAgentAdvancedFields) + providerValid gate + effectiveProvider derivation
-  // + globalProvider threading into getPersonaProviderOptions. All load-bearing
-  // feature logic; queued to split with the rest of this list.
-  ["src/features/agents/ui/EditAgentDialog.tsx", 1088],
-  // global-agent-config rebase over #1639: AgentInstanceEditDialog (renamed from
-  // EditAgentDialog by #1639) gained initialFocus?/EditAgentFocusTarget prop
-  // threading from the deep-link focus feature, and isEditAgentProviderSaveValid
-  // extracted as a testable helper with originalRuntimeSupportsProvider to close
-  // the runtime-switch hole in Will's (b) providerValid gate narrowing.
-  // E2E-fix round: added globalProvider fallback to useRequiredCredentialState
-  // call site and buzz-agent auto-expand effect for model-tuning knob visibility.
-  // F1-fix: added globalEnvVars to useRequiredCredentialState so globally-satisfied
-  // credential keys are excluded from requiredEnvKeyMissing (display/gate parity).
-  // Feature logic, not generic debt. Approved override; still queued to split.
-  // +23 rebase onto #1667: behavioral quad fields (respond_to/parallelism/toolsets)
-  // plumbed through AgentInstanceEditDialog from PersonaAdvancedFields.
-  // +2 provider-aware effort: model/provider props threaded to BuzzAgentModelTuningFields.
-  // +15 provider/model dropdown fixes: useBakedBuildEnvKeysQuery + hideProviderIds
-  // for Databricks v1 gate; prospectiveRuntimeId default fallback for builtins.
-  // PR-B moves default/API-key derivation into shared hooks; the explicit
-  // hidden-key projection keeps the top-level secret out of Advanced rows.
-  // +6 (1195 -> 1201): rebase onto main — this PR's model-source label wiring
-  // lands on top of main's dialog growth. Queued to split.
-  ["src/features/agents/ui/AgentInstanceEditDialog.tsx", 1201],
-  // AgentDefinitionDialog grew past 1000 with the following load-bearing fixes:
-  // isRuntimeAutoSeededRef tracking for edit-mode seeding (Fizz shows models);
-  // runtimeSupportsLlmProviderSelection guard on discovery provider (codex fix);
-  // hideProviderIds computation for Databricks v1 gate. Queued to split.
-  ["src/features/agents/ui/AgentDefinitionDialog.tsx", 1035],
-]);
-
 await runFileSizeCheck({
   projectRoot,
   rules,
-  overrides,
   label: "Desktop",
-  scriptPath: "desktop/scripts/check-file-sizes.mjs",
 });
diff --git a/desktop/src-tauri/Cargo.lock b/desktop/src-tauri/Cargo.lock
index e0732f62dc4..d4f7a4a2d4c 100644
--- a/desktop/src-tauri/Cargo.lock
+++ b/desktop/src-tauri/Cargo.lock
@@ -991,6 +991,7 @@ dependencies = [
 name = "buzz-core"
 version = "0.1.0"
 dependencies = [
+ "base64 0.22.1",
  "chrono",
  "hex",
  "hmac 0.13.0",
@@ -1009,7 +1010,7 @@ dependencies = [
 
 [[package]]
 name = "buzz-desktop"
-version = "0.4.26"
+version = "0.5.1"
 dependencies = [
  "anyhow",
  "arboard",
@@ -2148,7 +2149,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ccc2776f0c61eca1ca32528f85548abd1a4be8fb53d1b21c013e4f18da1e7090"
 dependencies = [
  "data-encoding",
- "syn 2.0.118",
+ "syn 1.0.109",
 ]
 
 [[package]]
@@ -5916,9 +5917,9 @@ dependencies = [
 
 [[package]]
 name = "nostr"
-version = "0.44.4"
+version = "0.44.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "98cf5d15d70d1f8f4059e5f79923ac15891eb691d2843d01191e0585fb064d70"
+checksum = "e826dd648489de2c5b293920e20b92932ef820302007c1987c758d4d06eeb2cf"
 dependencies = [
  "base64 0.22.1",
  "bech32",
@@ -10149,7 +10150,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
 dependencies = [
  "fastrand",
- "getrandom 0.4.3",
+ "getrandom 0.3.4",
  "once_cell",
  "rustix 1.1.4",
  "windows-sys 0.61.2",
diff --git a/desktop/src-tauri/Cargo.toml b/desktop/src-tauri/Cargo.toml
index d689544688d..8bb643fea36 100644
--- a/desktop/src-tauri/Cargo.toml
+++ b/desktop/src-tauri/Cargo.toml
@@ -2,7 +2,7 @@
 
 [package]
 name = "buzz-desktop"
-version = "0.4.26"
+version = "0.5.1"
 description = "Buzz desktop app"
 authors = ["you"]
 edition = "2021"
diff --git a/desktop/src-tauri/src/archive/mod.rs b/desktop/src-tauri/src/archive/mod.rs
index a65b126a4d0..42c6812674e 100644
--- a/desktop/src-tauri/src/archive/mod.rs
+++ b/desktop/src-tauri/src/archive/mod.rs
@@ -483,21 +483,23 @@ pub async fn list_save_subscriptions(
 /// Does NOT purge already-archived event data — retention is decoupled in v1.
 /// GC of orphaned event rows happens in P4 purge commands, not here.
 #[tauri::command]
-pub fn delete_save_subscription(
+pub async fn delete_save_subscription(
     state: State<'_, AppState>,
     scope_type: ScopeType,
     scope_value: String,
 ) -> Result<bool, String> {
     let identity_pk = identity_pubkey(&state)?;
     let relay_url = relay_ws_url_with_override(&state);
-    let conn = open_db()?;
-    store::delete_save_subscription(
-        &conn,
-        &identity_pk,
-        &relay_url,
-        scope_type.as_str(),
-        &scope_value,
-    )
+    run_archive_db_task(move |conn| {
+        store::delete_save_subscription(
+            conn,
+            &identity_pk,
+            &relay_url,
+            scope_type.as_str(),
+            &scope_value,
+        )
+    })
+    .await
 }
 
 // ── read_archived_events ─────────────────────────────────────────────────────
@@ -516,7 +518,7 @@ pub fn delete_save_subscription(
 /// newest-first order. Compound cursor `(before_created_at, before_id)` works
 /// identically to `read_archived_events`.
 #[tauri::command]
-pub fn read_archived_observer_events_for_channel(
+pub async fn read_archived_observer_events_for_channel(
     state: State<'_, AppState>,
     channel_id: String,
     before_created_at: Option<i64>,
@@ -525,16 +527,18 @@ pub fn read_archived_observer_events_for_channel(
 ) -> Result<Vec<String>, String> {
     let identity_pk = identity_pubkey(&state)?;
     let relay_url = relay_ws_url_with_override(&state);
-    let conn = open_db()?;
-    store::read_archived_observer_events_for_channel(
-        &conn,
-        &identity_pk,
-        &relay_url,
-        &channel_id,
-        before_created_at,
-        before_id.as_deref(),
-        limit.unwrap_or(DEFAULT_READ_LIMIT),
-    )
+    run_archive_db_task(move |conn| {
+        store::read_archived_observer_events_for_channel(
+            conn,
+            &identity_pk,
+            &relay_url,
+            &channel_id,
+            before_created_at,
+            before_id.as_deref(),
+            limit.unwrap_or(DEFAULT_READ_LIMIT),
+        )
+    })
+    .await
 }
 
 // ── index_observer_channel_id ─────────────────────────────────────────────────
@@ -548,24 +552,26 @@ pub fn read_archived_observer_events_for_channel(
 ///
 /// Idempotent: rows that are already indexed are left unchanged.
 #[tauri::command]
-pub fn index_observer_channel_id(
+pub async fn index_observer_channel_id(
     state: State<'_, AppState>,
     entries: Vec<ObserverChannelIndexEntry>,
 ) -> Result<(), String> {
     let identity_pk = identity_pubkey(&state)?;
     let relay_url = relay_ws_url_with_override(&state);
-    let conn = open_db()?;
-    for entry in &entries {
-        store::upsert_observer_channel_index(
-            &conn,
-            &identity_pk,
-            &relay_url,
-            &entry.event_id,
-            entry.channel_id.as_deref(),
-            entry.created_at,
-        )?;
-    }
-    Ok(())
+    run_archive_db_task(move |conn| {
+        for entry in &entries {
+            store::upsert_observer_channel_index(
+                conn,
+                &identity_pk,
+                &relay_url,
+                &entry.event_id,
+                entry.channel_id.as_deref(),
+                entry.created_at,
+            )?;
+        }
+        Ok(())
+    })
+    .await
 }
 
 /// A single (event_id, channel_id?, created_at) record used by
@@ -591,21 +597,23 @@ pub struct ObserverChannelIndexEntry {
 /// Together these constitute the one-shot idempotent backfill required by the
 /// Slice 1 acceptance criteria (Thufir Pass 4).
 #[tauri::command]
-pub fn read_unindexed_observer_rows(
+pub async fn read_unindexed_observer_rows(
     state: State<'_, AppState>,
 ) -> Result<Vec<RawObserverRow>, String> {
     let identity_pk = identity_pubkey(&state)?;
     let relay_url = relay_ws_url_with_override(&state);
-    let conn = open_db()?;
-    let rows = store::read_unindexed_observer_rows(&conn, &identity_pk, &relay_url)?;
-    Ok(rows
-        .into_iter()
-        .map(|(id, raw_json, created_at)| RawObserverRow {
-            id,
-            raw_json,
-            created_at,
-        })
-        .collect())
+    run_archive_db_task(move |conn| {
+        let rows = store::read_unindexed_observer_rows(conn, &identity_pk, &relay_url)?;
+        Ok(rows
+            .into_iter()
+            .map(|(id, raw_json, created_at)| RawObserverRow {
+                id,
+                raw_json,
+                created_at,
+            })
+            .collect())
+    })
+    .await
 }
 
 /// Wire type returned by `read_unindexed_observer_rows`.
diff --git a/desktop/src-tauri/src/commands/agent_config.rs b/desktop/src-tauri/src/commands/agent_config.rs
index 461fed5dbd4..5a26f0f6450 100644
--- a/desktop/src-tauri/src/commands/agent_config.rs
+++ b/desktop/src-tauri/src/commands/agent_config.rs
@@ -21,8 +21,7 @@ use crate::{
 
 /// Subset of the goose file config exposed to the frontend for gate evaluation.
 ///
-/// Only the fields the dialog gate needs — not the full `RuntimeConfigSurface`.
-/// The gate uses this to know which requirements are already satisfied in the
+/// Only the fields the dialog gate needs. This tracks which requirements are already satisfied in the
 /// harness config file, so it can show "Set in goose config" rather than
 /// surfacing a false missing-key marker.
 #[derive(Debug, Serialize)]
@@ -685,8 +684,10 @@ mod tests {
             name_pool: Vec::new(),
             is_builtin: false,
             is_active: true,
+            shared: false,
             source_team: None,
             source_team_persona_slug: None,
+            catalog_source: None,
             definition_respond_to: None,
             definition_respond_to_allowlist: Vec::new(),
             definition_parallelism: None,
@@ -709,8 +710,10 @@ mod tests {
             name_pool: Vec::new(),
             is_builtin: false,
             is_active: true,
+            shared: false,
             source_team: None,
             source_team_persona_slug: None,
+            catalog_source: None,
             env_vars: Default::default(),
             respond_to: None,
             respond_to_allowlist: Vec::new(),
diff --git a/desktop/src-tauri/src/commands/agent_discovery.rs b/desktop/src-tauri/src/commands/agent_discovery.rs
index 84a00433c0b..d6429e04543 100644
--- a/desktop/src-tauri/src/commands/agent_discovery.rs
+++ b/desktop/src-tauri/src/commands/agent_discovery.rs
@@ -1,12 +1,11 @@
-use std::io::Read;
 use tauri::State;
 
 use crate::{
     app_state::AppState,
     managed_agents::{
         command_availability, is_npm_global_install, AcpRuntimeCatalogEntry,
-        DiscoverManagedAgentPrereqsRequest, InstallRuntimeResult, InstallStepResult,
-        ManagedAgentPrereqsInfo, RelayAgentInfo, DEFAULT_ACP_COMMAND,
+        DiscoverManagedAgentPrereqsRequest, InstallRuntimeResult, ManagedAgentPrereqsInfo,
+        RelayAgentInfo, DEFAULT_ACP_COMMAND,
     },
     nostr_convert,
     relay::query_relay,
@@ -26,7 +25,8 @@ fn active_installs() -> &'static std::sync::Mutex<std::collections::HashSet<Stri
 /// `None` if none was found).
 ///
 /// Returns `None` when no install is needed (adapter is present and current).
-/// Returns `Some(cmds)` when the adapter is missing or (for codex) outdated.
+/// Returns `Some(cmds)` when the adapter is missing or (for codex) below its
+/// minimum supported version.
 ///
 /// For the codex **outdated** case the returned sequence is a two-step
 /// reinstall: first uninstall the old `@zed-industries/codex-acp` package
@@ -862,72 +862,6 @@ pub(crate) fn install_shell_from(
     resolved.ok_or_else(|| crate::managed_agents::git_bash::GIT_BASH_INSTALL_HINT.to_string())
 }
 
-/// Maximum number of attempts for a transient-looking install command.
-const INSTALL_MAX_ATTEMPTS: u32 = 3;
-
-/// Run an install command, retrying transient failures with backoff.
-///
-/// Runtime installs pull artifacts over the network — Goose's `curl … | bash`
-/// fetches a native release-asset tarball from GitHub's CDN with no retry of
-/// its own, and the npm adapter installs hit the registry. A single blip there
-/// currently fails onboarding outright. This retries a command that ran to
-/// completion but exited nonzero (the transient-download signature) up to
-/// `INSTALL_MAX_ATTEMPTS` times. Failures with no exit code — a timeout or a
-/// shell that never spawned — are not retried, since re-running them just costs
-/// the user more time without a plausible path to success.
-fn run_install_command_with_retry(step: &str, command: &str) -> InstallStepResult {
-    run_install_with_retry(
-        INSTALL_MAX_ATTEMPTS,
-        |_attempt| run_install_command(step, command),
-        std::thread::sleep,
-    )
-}
-
-/// Core retry loop, decoupled from the real command runner and clock so it can
-/// be unit-tested without spawning shells or sleeping. `run` receives the
-/// 1-based attempt number.
-fn run_install_with_retry(
-    max_attempts: u32,
-    mut run: impl FnMut(u32) -> InstallStepResult,
-    mut sleep: impl FnMut(std::time::Duration),
-) -> InstallStepResult {
-    let mut attempt = 1;
-    loop {
-        let result = run(attempt);
-        if result.success || !install_failure_is_retryable(&result) || attempt >= max_attempts {
-            return if attempt > 1 && !result.success {
-                annotate_retry_attempts(result, attempt)
-            } else {
-                result
-            };
-        }
-        sleep(install_retry_backoff(attempt));
-        attempt += 1;
-    }
-}
-
-/// Only retry commands that actually ran and exited nonzero — the signature of
-/// a transient download failure. A missing exit code means the command timed
-/// out or the shell failed to spawn, neither of which a retry is likely to fix.
-fn install_failure_is_retryable(result: &InstallStepResult) -> bool {
-    !result.success && result.exit_code.is_some()
-}
-
-/// Linear backoff: 3s before attempt 2, 6s before attempt 3.
-fn install_retry_backoff(attempt: u32) -> std::time::Duration {
-    std::time::Duration::from_secs(3 * attempt as u64)
-}
-
-/// Prefix the surfaced error so the UI shows the install was retried rather than
-/// failed on a single unlucky attempt.
-fn annotate_retry_attempts(mut result: InstallStepResult, attempts: u32) -> InstallStepResult {
-    result.stderr = format!(
-        "install failed after {attempts} attempts (retried with backoff)\n{}",
-        result.stderr
-    );
-    result
-}
-
 /// Returns `true` when `command` is a Windows-native PowerShell invocation
 /// (i.e. begins with `powershell.exe`). These commands must NOT be routed
 /// through Git Bash: the Bash login shell prepends POSIX dirs to PATH, so
@@ -1081,179 +1015,9 @@ fn build_install_command(command: &str) -> Result<std::process::Command, String>
     install_shell_command(command)
 }
 
-fn run_install_command(step: &str, command: &str) -> InstallStepResult {
-    let mut cmd = match build_install_command(command) {
-        Ok(cmd) => cmd,
-        Err(hint) => {
-            return InstallStepResult {
-                step: step.to_string(),
-                command: command.to_string(),
-                success: false,
-                stdout: String::new(),
-                stderr: "no suitable shell found for install commands".to_string(),
-                exit_code: None,
-                hint: Some(hint),
-            };
-        }
-    };
-
-    let mut child = match cmd
-        .stdin(std::process::Stdio::null())
-        .stdout(std::process::Stdio::piped())
-        .stderr(std::process::Stdio::piped())
-        .spawn()
-    {
-        Ok(child) => child,
-        Err(e) => {
-            return InstallStepResult {
-                step: step.to_string(),
-                command: command.to_string(),
-                success: false,
-                stdout: String::new(),
-                stderr: format!("failed to spawn shell: {e}"),
-                exit_code: None,
-                hint: None,
-            };
-        }
-    };
-
-    // Drain stdout/stderr on background threads to prevent pipe buffer deadlock.
-    let stdout_pipe = child.stdout.take();
-    let stderr_pipe = child.stderr.take();
-
-    let stdout_thread = std::thread::spawn(move || {
-        let mut buf = String::new();
-        if let Some(mut pipe) = stdout_pipe {
-            let _ = pipe.read_to_string(&mut buf);
-        }
-        buf
-    });
-    let stderr_thread = std::thread::spawn(move || {
-        let mut buf = String::new();
-        if let Some(mut pipe) = stderr_pipe {
-            let _ = pipe.read_to_string(&mut buf);
-        }
-        buf
-    });
-
-    // Save the PID before moving `child` into the wait thread so we can
-    // kill the process on timeout.
-    let child_pid = child.id();
-
-    let (tx, rx) = std::sync::mpsc::channel();
-    let wait_thread = std::thread::spawn(move || {
-        let status = child.wait();
-        let _ = tx.send(status);
-    });
-
-    // 5-minute timeout for install commands.
-    let deadline = std::time::Instant::now() + std::time::Duration::from_secs(300);
-    loop {
-        let remaining = deadline.saturating_duration_since(std::time::Instant::now());
-        if remaining.is_zero() {
-            // Timeout: kill the child process via its PID, then join all
-            // threads so nothing leaks.
-            #[cfg(unix)]
-            unsafe {
-                libc::kill(child_pid as i32, libc::SIGTERM);
-            }
-            #[cfg(windows)]
-            {
-                let _ = crate::managed_agents::taskkill_tree(child_pid);
-            }
-            drop(rx);
-            let _ = wait_thread.join();
-            let _ = stdout_thread.join();
-            let _ = stderr_thread.join();
-            return InstallStepResult {
-                step: step.to_string(),
-                command: command.to_string(),
-                success: false,
-                stdout: String::new(),
-                stderr: "install command timed out after 5 minutes".to_string(),
-                exit_code: None,
-                hint: None,
-            };
-        }
-
-        match rx.recv_timeout(std::time::Duration::from_millis(200).min(remaining)) {
-            Ok(Ok(status)) => {
-                let _ = wait_thread.join();
-                let stdout = stdout_thread.join().unwrap_or_default();
-                let stderr_raw = stderr_thread.join().unwrap_or_default();
-                return InstallStepResult {
-                    step: step.to_string(),
-                    command: command.to_string(),
-                    success: status.success(),
-                    stdout: truncate_output(stdout),
-                    stderr: truncate_output(stderr_raw),
-                    exit_code: status.code(),
-                    hint: None,
-                };
-            }
-            Ok(Err(e)) => {
-                let _ = wait_thread.join();
-                let _ = stdout_thread.join();
-                let _ = stderr_thread.join();
-                return InstallStepResult {
-                    step: step.to_string(),
-                    command: command.to_string(),
-                    success: false,
-                    stdout: String::new(),
-                    stderr: format!("failed to check process status: {e}"),
-                    exit_code: None,
-                    hint: None,
-                };
-            }
-            Err(std::sync::mpsc::RecvTimeoutError::Timeout) => {
-                // Still running; loop and check deadline again.
-                continue;
-            }
-            Err(std::sync::mpsc::RecvTimeoutError::Disconnected) => {
-                // wait_thread dropped sender without sending — shouldn't happen.
-                let _ = wait_thread.join();
-                let _ = stdout_thread.join();
-                let _ = stderr_thread.join();
-                return InstallStepResult {
-                    step: step.to_string(),
-                    command: command.to_string(),
-                    success: false,
-                    stdout: String::new(),
-                    stderr: "internal error: wait thread disconnected".to_string(),
-                    exit_code: None,
-                    hint: None,
-                };
-            }
-        }
-    }
-}
-
-/// Cap output to head + tail to avoid flooding the UI with large error dumps,
-/// while preserving the most useful parts of the output.
-fn truncate_output(s: String) -> String {
-    const HEAD: usize = 512;
-    const TAIL: usize = 1024;
-    const LIMIT: usize = HEAD + TAIL;
-    if s.len() <= LIMIT {
-        return s;
-    }
-    let head_end = floor_char_boundary(&s, HEAD);
-    let tail_start = floor_char_boundary(&s, s.len().saturating_sub(TAIL));
-    let omitted = tail_start - head_end;
-    format!(
-        "{}\n... ({omitted} bytes omitted) ...\n{}",
-        &s[..head_end],
-        &s[tail_start..]
-    )
-}
-
-fn floor_char_boundary(s: &str, mut index: usize) -> usize {
-    index = index.min(s.len());
-    while index > 0 && !s.is_char_boundary(index) {
-        index -= 1;
-    }
-    index
-}
+// ── install command execution ─────────────────────────────────────────────────
+mod install_exec;
+use install_exec::run_install_command_with_retry;
 
 // ── managed Node/npm runtime ──────────────────────────────────────────────────
 mod managed_node;
@@ -1389,7 +1153,8 @@ mod tests {
     /// plan_adapter_install is the pure install-plan seam used by
     /// install_acp_runtime_blocking. These tests verify:
     ///   - A 0.x binary (AdapterOutdated) → uninstall-then-install sequence returned
-    ///   - A 1.x binary (Available) → None (no reinstall)
+    ///   - A current 1.x binary (Available) → None (no reinstall)
+    ///   - A 1.x binary below the floor → install plan returned
     ///   - Missing binary (None path) → catalog install commands returned
     #[cfg(unix)]
     #[test]
@@ -1429,10 +1194,10 @@ mod tests {
 
         let dir = tempfile::tempdir().unwrap();
         let bin = dir.path().join("codex-acp");
-        // Simulate 1.x adapter: outputs version and exits 0
+        // Simulate the minimum supported adapter version.
         std::fs::write(
             &bin,
-            "#!/bin/sh\necho '@agentclientprotocol/codex-acp 1.1.2'\nexit 0\n",
+            "#!/bin/sh\necho '@agentclientprotocol/codex-acp 1.1.7'\nexit 0\n",
         )
         .expect("write script");
         std::fs::set_permissions(&bin, std::fs::Permissions::from_mode(0o755))
@@ -1443,7 +1208,32 @@ mod tests {
 
         assert!(
             plan.is_none(),
-            "1.x codex adapter must not trigger install plan (no reinstall needed)"
+            "current codex adapter must not trigger install plan (no reinstall needed)"
+        );
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn test_plan_adapter_install_updates_older_1x_codex_binary() {
+        use std::os::unix::fs::PermissionsExt;
+
+        let dir = tempfile::tempdir().unwrap();
+        let bin = dir.path().join("codex-acp");
+        // A 1.x adapter below MIN_CODEX_ACP_VERSION must still be reinstalled.
+        std::fs::write(
+            &bin,
+            "#!/bin/sh\necho '@agentclientprotocol/codex-acp 1.1.5'\nexit 0\n",
+        )
+        .expect("write script");
+        std::fs::set_permissions(&bin, std::fs::Permissions::from_mode(0o755))
+            .expect("chmod script");
+
+        let install_cmds = &["npm install -g @agentclientprotocol/codex-acp"];
+        let plan = plan_adapter_install("codex", Some(&bin), install_cmds, Some("/usr/bin:/bin"));
+
+        assert!(
+            plan.is_some(),
+            "older 1.x codex adapter must trigger update plan"
         );
     }
 
@@ -2031,128 +1821,6 @@ mod tests {
             "Goose catalog command must dequote with bare $env: (no backslash before $)"
         );
     }
-
-    // ── install retry ─────────────────────────────────────────────────────────
-
-    /// Build an `InstallStepResult` with just the fields the retry loop reads.
-    fn step_result(success: bool, exit_code: Option<i32>, stderr: &str) -> InstallStepResult {
-        InstallStepResult {
-            step: "cli".to_string(),
-            command: "curl … | bash".to_string(),
-            success,
-            stdout: String::new(),
-            stderr: stderr.to_string(),
-            exit_code,
-            hint: None,
-        }
-    }
-
-    #[test]
-    fn test_retryable_only_for_nonzero_exit() {
-        // Ran to completion but exited nonzero — the transient-download signature.
-        assert!(install_failure_is_retryable(&step_result(
-            false,
-            Some(1),
-            ""
-        )));
-        // No exit code — timeout or shell-never-spawned; retry won't help.
-        assert!(!install_failure_is_retryable(&step_result(false, None, "")));
-        // Success is never retryable.
-        assert!(!install_failure_is_retryable(&step_result(
-            true,
-            Some(0),
-            ""
-        )));
-    }
-
-    #[test]
-    fn test_retry_backoff_is_linear() {
-        assert_eq!(install_retry_backoff(1), std::time::Duration::from_secs(3));
-        assert_eq!(install_retry_backoff(2), std::time::Duration::from_secs(6));
-    }
-
-    #[test]
-    fn test_retry_stops_on_first_success() {
-        let mut calls = 0;
-        let mut sleeps = 0;
-        let result = run_install_with_retry(
-            3,
-            |_| {
-                calls += 1;
-                step_result(true, Some(0), "")
-            },
-            |_| sleeps += 1,
-        );
-        assert!(result.success);
-        assert_eq!(calls, 1, "a first-attempt success must not re-run");
-        assert_eq!(sleeps, 0, "no backoff sleep when nothing is retried");
-    }
-
-    #[test]
-    fn test_retry_recovers_after_transient_failure() {
-        let mut calls = 0;
-        let result = run_install_with_retry(
-            3,
-            |attempt| {
-                calls += 1;
-                // Fail the first attempt with a nonzero exit, then succeed.
-                step_result(attempt >= 2, Some(if attempt >= 2 { 0 } else { 1 }), "blip")
-            },
-            |_| {},
-        );
-        assert!(result.success);
-        assert_eq!(calls, 2, "should retry once then succeed");
-        // A recovered install must not carry the retry-failure annotation.
-        assert!(!result.stderr.contains("attempts"));
-    }
-
-    #[test]
-    fn test_retry_does_not_retry_unretryable_failure() {
-        let mut calls = 0;
-        let result = run_install_with_retry(
-            3,
-            |_| {
-                calls += 1;
-                step_result(false, None, "timed out")
-            },
-            |_| {},
-        );
-        assert!(!result.success);
-        assert_eq!(calls, 1, "a failure with no exit code must not be retried");
-        assert_eq!(
-            result.stderr, "timed out",
-            "unretried failure is unannotated"
-        );
-    }
-
-    #[test]
-    fn test_retry_exhausts_attempts_and_annotates() {
-        let mut calls = 0;
-        let mut sleeps = 0;
-        let result = run_install_with_retry(
-            3,
-            |_| {
-                calls += 1;
-                step_result(false, Some(1), "download failed")
-            },
-            |_| sleeps += 1,
-        );
-        assert!(!result.success);
-        assert_eq!(calls, 3, "must try exactly max_attempts times");
-        assert_eq!(
-            sleeps, 2,
-            "backoff sleeps between attempts, not after the last"
-        );
-        assert!(
-            result.stderr.contains("after 3 attempts"),
-            "exhausted retries must surface the attempt count, got: {}",
-            result.stderr
-        );
-        assert!(
-            result.stderr.contains("download failed"),
-            "original stderr must be preserved"
-        );
-    }
 }
 
 /// Returns the Windows-only Git Bash prerequisite used by buzz-agent's shell MCP.
diff --git a/desktop/src-tauri/src/commands/agent_discovery/install_exec.rs b/desktop/src-tauri/src/commands/agent_discovery/install_exec.rs
new file mode 100644
index 00000000000..63163ceadc5
--- /dev/null
+++ b/desktop/src-tauri/src/commands/agent_discovery/install_exec.rs
@@ -0,0 +1,457 @@
+//! Execution of runtime install commands: spawning the built command,
+//! draining its output under a timeout, and retrying transient failures.
+//!
+//! Command *construction* stays in the parent module (`install_shell_command`,
+//! `install_powershell_command`, `build_install_command`); this module owns
+//! only what happens once a `Command` exists.
+
+use std::io::Read;
+
+use crate::managed_agents::InstallStepResult;
+
+/// Maximum number of attempts for a transient-looking install command.
+const INSTALL_MAX_ATTEMPTS: u32 = 3;
+
+/// Run an install command, retrying transient failures with backoff.
+///
+/// Runtime installs pull artifacts over the network — Goose's `curl … | bash`
+/// fetches a native release-asset tarball from GitHub's CDN with no retry of
+/// its own, and the npm adapter installs hit the registry. A single blip there
+/// currently fails onboarding outright. This retries a command that ran to
+/// completion but exited nonzero (the transient-download signature) up to
+/// `INSTALL_MAX_ATTEMPTS` times. Failures with no exit code — a timeout or a
+/// shell that never spawned — are not retried, since re-running them just costs
+/// the user more time without a plausible path to success.
+pub(super) fn run_install_command_with_retry(step: &str, command: &str) -> InstallStepResult {
+    run_install_with_retry(
+        INSTALL_MAX_ATTEMPTS,
+        |_attempt| run_install_command(step, command),
+        std::thread::sleep,
+    )
+}
+
+/// Core retry loop, decoupled from the real command runner and clock so it can
+/// be unit-tested without spawning shells or sleeping. `run` receives the
+/// 1-based attempt number.
+fn run_install_with_retry(
+    max_attempts: u32,
+    mut run: impl FnMut(u32) -> InstallStepResult,
+    mut sleep: impl FnMut(std::time::Duration),
+) -> InstallStepResult {
+    let mut attempt = 1;
+    loop {
+        let result = run(attempt);
+        if result.success || !install_failure_is_retryable(&result) || attempt >= max_attempts {
+            return if attempt > 1 && !result.success {
+                annotate_retry_attempts(result, attempt)
+            } else {
+                result
+            };
+        }
+        sleep(install_retry_backoff(attempt));
+        attempt += 1;
+    }
+}
+
+/// Only retry commands that actually ran and exited nonzero — the signature of
+/// a transient download failure. A missing exit code means the command timed
+/// out or the shell failed to spawn, neither of which a retry is likely to fix.
+fn install_failure_is_retryable(result: &InstallStepResult) -> bool {
+    !result.success && result.exit_code.is_some()
+}
+
+/// Linear backoff: 3s before attempt 2, 6s before attempt 3.
+fn install_retry_backoff(attempt: u32) -> std::time::Duration {
+    std::time::Duration::from_secs(3 * attempt as u64)
+}
+
+/// Prefix the surfaced error so the UI shows the install was retried rather than
+/// failed on a single unlucky attempt.
+fn annotate_retry_attempts(mut result: InstallStepResult, attempts: u32) -> InstallStepResult {
+    result.stderr = format!(
+        "install failed after {attempts} attempts (retried with backoff)\n{}",
+        result.stderr
+    );
+    result
+}
+
+/// Build the install command and point it at a writable working directory.
+///
+/// A packaged desktop launch inherits `/` as its working directory, and
+/// installers that write relative to the CWD then fail on a read-only root, so
+/// they run from Buzz's own default workdir instead (#2245).
+///
+/// This is the only command builder [`run_install_command`] calls, so anything
+/// it spawns is guaranteed to carry the workdir — which is what makes the
+/// working directory assertable without spawning a real login shell.
+fn prepare_install_command(command: &str) -> Result<std::process::Command, String> {
+    let mut cmd = super::build_install_command(command)?;
+    if let Some(workdir) = crate::managed_agents::default_agent_workdir() {
+        cmd.current_dir(workdir);
+    }
+    Ok(cmd)
+}
+
+fn run_install_command(step: &str, command: &str) -> InstallStepResult {
+    let mut cmd = match prepare_install_command(command) {
+        Ok(cmd) => cmd,
+        Err(hint) => {
+            return InstallStepResult {
+                step: step.to_string(),
+                command: command.to_string(),
+                success: false,
+                stdout: String::new(),
+                stderr: "no suitable shell found for install commands".to_string(),
+                exit_code: None,
+                hint: Some(hint),
+            };
+        }
+    };
+
+    let mut child = match cmd
+        .stdin(std::process::Stdio::null())
+        .stdout(std::process::Stdio::piped())
+        .stderr(std::process::Stdio::piped())
+        .spawn()
+    {
+        Ok(child) => child,
+        Err(e) => {
+            return InstallStepResult {
+                step: step.to_string(),
+                command: command.to_string(),
+                success: false,
+                stdout: String::new(),
+                stderr: format!("failed to spawn shell: {e}"),
+                exit_code: None,
+                hint: None,
+            };
+        }
+    };
+
+    // Drain stdout/stderr on background threads to prevent pipe buffer deadlock.
+    let stdout_pipe = child.stdout.take();
+    let stderr_pipe = child.stderr.take();
+
+    let stdout_thread = std::thread::spawn(move || {
+        let mut buf = String::new();
+        if let Some(mut pipe) = stdout_pipe {
+            let _ = pipe.read_to_string(&mut buf);
+        }
+        buf
+    });
+    let stderr_thread = std::thread::spawn(move || {
+        let mut buf = String::new();
+        if let Some(mut pipe) = stderr_pipe {
+            let _ = pipe.read_to_string(&mut buf);
+        }
+        buf
+    });
+
+    // Save the PID before moving `child` into the wait thread so we can
+    // kill the process on timeout.
+    let child_pid = child.id();
+
+    let (tx, rx) = std::sync::mpsc::channel();
+    let wait_thread = std::thread::spawn(move || {
+        let status = child.wait();
+        let _ = tx.send(status);
+    });
+
+    // 5-minute timeout for install commands.
+    let deadline = std::time::Instant::now() + std::time::Duration::from_secs(300);
+    loop {
+        let remaining = deadline.saturating_duration_since(std::time::Instant::now());
+        if remaining.is_zero() {
+            // Timeout: kill the child process via its PID, then join all
+            // threads so nothing leaks.
+            #[cfg(unix)]
+            unsafe {
+                libc::kill(child_pid as i32, libc::SIGTERM);
+            }
+            #[cfg(windows)]
+            {
+                let _ = crate::managed_agents::taskkill_tree(child_pid);
+            }
+            drop(rx);
+            let _ = wait_thread.join();
+            let _ = stdout_thread.join();
+            let _ = stderr_thread.join();
+            return InstallStepResult {
+                step: step.to_string(),
+                command: command.to_string(),
+                success: false,
+                stdout: String::new(),
+                stderr: "install command timed out after 5 minutes".to_string(),
+                exit_code: None,
+                hint: None,
+            };
+        }
+
+        match rx.recv_timeout(std::time::Duration::from_millis(200).min(remaining)) {
+            Ok(Ok(status)) => {
+                let _ = wait_thread.join();
+                let stdout = stdout_thread.join().unwrap_or_default();
+                let stderr_raw = stderr_thread.join().unwrap_or_default();
+                return InstallStepResult {
+                    step: step.to_string(),
+                    command: command.to_string(),
+                    success: status.success(),
+                    stdout: truncate_output(stdout),
+                    stderr: truncate_output(stderr_raw),
+                    exit_code: status.code(),
+                    hint: None,
+                };
+            }
+            Ok(Err(e)) => {
+                let _ = wait_thread.join();
+                let _ = stdout_thread.join();
+                let _ = stderr_thread.join();
+                return InstallStepResult {
+                    step: step.to_string(),
+                    command: command.to_string(),
+                    success: false,
+                    stdout: String::new(),
+                    stderr: format!("failed to check process status: {e}"),
+                    exit_code: None,
+                    hint: None,
+                };
+            }
+            Err(std::sync::mpsc::RecvTimeoutError::Timeout) => {
+                // Still running; loop and check deadline again.
+                continue;
+            }
+            Err(std::sync::mpsc::RecvTimeoutError::Disconnected) => {
+                // wait_thread dropped sender without sending — shouldn't happen.
+                let _ = wait_thread.join();
+                let _ = stdout_thread.join();
+                let _ = stderr_thread.join();
+                return InstallStepResult {
+                    step: step.to_string(),
+                    command: command.to_string(),
+                    success: false,
+                    stdout: String::new(),
+                    stderr: "internal error: wait thread disconnected".to_string(),
+                    exit_code: None,
+                    hint: None,
+                };
+            }
+        }
+    }
+}
+
+/// Cap output to head + tail to avoid flooding the UI with large error dumps,
+/// while preserving the most useful parts of the output.
+fn truncate_output(s: String) -> String {
+    const HEAD: usize = 512;
+    const TAIL: usize = 1024;
+    const LIMIT: usize = HEAD + TAIL;
+    if s.len() <= LIMIT {
+        return s;
+    }
+    let head_end = floor_char_boundary(&s, HEAD);
+    let tail_start = floor_char_boundary(&s, s.len().saturating_sub(TAIL));
+    let omitted = tail_start - head_end;
+    format!(
+        "{}\n... ({omitted} bytes omitted) ...\n{}",
+        &s[..head_end],
+        &s[tail_start..]
+    )
+}
+
+fn floor_char_boundary(s: &str, mut index: usize) -> usize {
+    index = index.min(s.len());
+    while index > 0 && !s.is_char_boundary(index) {
+        index -= 1;
+    }
+    index
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    // ── install retry ─────────────────────────────────────────────────────────
+
+    /// Build an `InstallStepResult` with just the fields the retry loop reads.
+    fn step_result(success: bool, exit_code: Option<i32>, stderr: &str) -> InstallStepResult {
+        InstallStepResult {
+            step: "cli".to_string(),
+            command: "curl … | bash".to_string(),
+            success,
+            stdout: String::new(),
+            stderr: stderr.to_string(),
+            exit_code,
+            hint: None,
+        }
+    }
+
+    #[test]
+    fn test_retryable_only_for_nonzero_exit() {
+        // Ran to completion but exited nonzero — the transient-download signature.
+        assert!(install_failure_is_retryable(&step_result(
+            false,
+            Some(1),
+            ""
+        )));
+        // No exit code — timeout or shell-never-spawned; retry won't help.
+        assert!(!install_failure_is_retryable(&step_result(false, None, "")));
+        // Success is never retryable.
+        assert!(!install_failure_is_retryable(&step_result(
+            true,
+            Some(0),
+            ""
+        )));
+    }
+
+    #[test]
+    fn test_retry_backoff_is_linear() {
+        assert_eq!(install_retry_backoff(1), std::time::Duration::from_secs(3));
+        assert_eq!(install_retry_backoff(2), std::time::Duration::from_secs(6));
+    }
+
+    #[test]
+    fn test_retry_stops_on_first_success() {
+        let mut calls = 0;
+        let mut sleeps = 0;
+        let result = run_install_with_retry(
+            3,
+            |_| {
+                calls += 1;
+                step_result(true, Some(0), "")
+            },
+            |_| sleeps += 1,
+        );
+        assert!(result.success);
+        assert_eq!(calls, 1, "a first-attempt success must not re-run");
+        assert_eq!(sleeps, 0, "no backoff sleep when nothing is retried");
+    }
+
+    #[test]
+    fn test_retry_recovers_after_transient_failure() {
+        let mut calls = 0;
+        let result = run_install_with_retry(
+            3,
+            |attempt| {
+                calls += 1;
+                // Fail the first attempt with a nonzero exit, then succeed.
+                step_result(attempt >= 2, Some(if attempt >= 2 { 0 } else { 1 }), "blip")
+            },
+            |_| {},
+        );
+        assert!(result.success);
+        assert_eq!(calls, 2, "should retry once then succeed");
+        // A recovered install must not carry the retry-failure annotation.
+        assert!(!result.stderr.contains("attempts"));
+    }
+
+    #[test]
+    fn test_retry_does_not_retry_unretryable_failure() {
+        let mut calls = 0;
+        let result = run_install_with_retry(
+            3,
+            |_| {
+                calls += 1;
+                step_result(false, None, "timed out")
+            },
+            |_| {},
+        );
+        assert!(!result.success);
+        assert_eq!(calls, 1, "a failure with no exit code must not be retried");
+        assert_eq!(
+            result.stderr, "timed out",
+            "unretried failure is unannotated"
+        );
+    }
+
+    #[test]
+    fn test_retry_exhausts_attempts_and_annotates() {
+        let mut calls = 0;
+        let mut sleeps = 0;
+        let result = run_install_with_retry(
+            3,
+            |_| {
+                calls += 1;
+                step_result(false, Some(1), "download failed")
+            },
+            |_| sleeps += 1,
+        );
+        assert!(!result.success);
+        assert_eq!(calls, 3, "must try exactly max_attempts times");
+        assert_eq!(
+            sleeps, 2,
+            "backoff sleeps between attempts, not after the last"
+        );
+        assert!(
+            result.stderr.contains("after 3 attempts"),
+            "exhausted retries must surface the attempt count, got: {}",
+            result.stderr
+        );
+        assert!(
+            result.stderr.contains("download failed"),
+            "original stderr must be preserved"
+        );
+    }
+
+    // ── install working directory ─────────────────────────────────────────────
+
+    /// Every install child must run from Buzz's writable default workdir. A
+    /// packaged launch inherits `/`, where installers that write relative to
+    /// the CWD fail on a read-only root (#2245).
+    ///
+    /// Asserts the prepared `Command` rather than spawning one: `run_install_command`
+    /// would start a real login shell, which is neither hermetic nor fast.
+    #[test]
+    fn test_prepared_install_command_uses_default_workdir() {
+        let expected = crate::managed_agents::default_agent_workdir()
+            .expect("a default workdir must resolve on any test host");
+
+        let cmd = prepare_install_command("echo test").expect("install shell must resolve");
+
+        assert_eq!(cmd.get_current_dir(), Some(expected.as_path()));
+    }
+
+    // ── output truncation ─────────────────────────────────────────────────────
+
+    /// Output within the cap is passed through byte-for-byte — no marker, no loss.
+    #[test]
+    fn test_truncate_output_leaves_short_output_untouched() {
+        let short = "a".repeat(1536);
+
+        assert_eq!(truncate_output(short.clone()), short);
+    }
+
+    /// Over the cap, both ends survive and the middle is replaced by a marker
+    /// naming the omitted byte count — the head keeps the command's opening
+    /// context and the tail keeps the error that usually trails.
+    #[test]
+    fn test_truncate_output_keeps_head_and_tail_with_marker() {
+        let input = format!(
+            "{}{}{}",
+            "H".repeat(512),
+            "M".repeat(4000),
+            "T".repeat(1024)
+        );
+
+        let out = truncate_output(input);
+
+        assert!(out.starts_with(&"H".repeat(512)));
+        assert!(out.ends_with(&"T".repeat(1024)));
+        assert!(
+            out.contains("... (4000 bytes omitted) ..."),
+            "marker must name the omitted byte count, got: {out}"
+        );
+    }
+
+    /// Truncation must not split a multi-byte character. Cutting mid-codepoint
+    /// would panic on the slice; the boundary floor prevents it.
+    #[test]
+    fn test_truncate_output_does_not_split_multibyte_characters() {
+        // "é" is 2 bytes, so every candidate cut index lands mid-character.
+        let input = "é".repeat(4000);
+
+        let out = truncate_output(input);
+
+        assert!(out.contains("bytes omitted"), "input must exceed the cap");
+        assert!(!out.contains('\u{fffd}'), "no replacement chars: {out}");
+    }
+}
diff --git a/desktop/src-tauri/src/commands/agent_discovery/managed_node.rs b/desktop/src-tauri/src/commands/agent_discovery/managed_node.rs
index 2d7e13d1d76..72108f02910 100644
--- a/desktop/src-tauri/src/commands/agent_discovery/managed_node.rs
+++ b/desktop/src-tauri/src/commands/agent_discovery/managed_node.rs
@@ -5,7 +5,7 @@ use std::{io::Read, io::Write};
 
 use crate::managed_agents::{is_npm_global_install, InstallStepResult};
 
-const MANAGED_NODE_VERSION: &str = "v24.11.0";
+const MANAGED_NODE_VERSION: &str = "v24.18.0";
 const MANAGED_NODE_MAX_BYTES: u64 = 90 * 1024 * 1024;
 
 #[derive(Debug, Clone, Copy)]
@@ -18,43 +18,43 @@ struct ManagedNodeArtifact {
 #[cfg(all(target_os = "macos", target_arch = "aarch64"))]
 const MANAGED_NODE_ARTIFACT: Option<ManagedNodeArtifact> = Some(ManagedNodeArtifact {
     platform: "darwin-arm64",
-    filename: "node-v24.11.0-darwin-arm64.tar.gz",
-    sha256: "0be2ab2816a4fa02d1acff014a434f29f56d8d956f5af6a98b70ced6c5f4d201",
+    filename: "node-v24.18.0-darwin-arm64.tar.gz",
+    sha256: "e1a97e14c99c803e96c7339403282ea05a499c32f8d83defe9ef5ec66f979ed1",
 });
 
 #[cfg(all(target_os = "macos", target_arch = "x86_64"))]
 const MANAGED_NODE_ARTIFACT: Option<ManagedNodeArtifact> = Some(ManagedNodeArtifact {
     platform: "darwin-x64",
-    filename: "node-v24.11.0-darwin-x64.tar.gz",
-    sha256: "3884671e87f46f773832d98a0a6cabcc5ec4f637084f0f3515b69e66ea27f2f1",
+    filename: "node-v24.18.0-darwin-x64.tar.gz",
+    sha256: "dfd0dbd3e721503434df7b7205e719f61b3a3a31b2bcf9729b8b91fea240f080",
 });
 
 #[cfg(all(target_os = "linux", target_arch = "x86_64"))]
 const MANAGED_NODE_ARTIFACT: Option<ManagedNodeArtifact> = Some(ManagedNodeArtifact {
     platform: "linux-x64",
-    filename: "node-v24.11.0-linux-x64.tar.gz",
-    sha256: "b3c071cdf47aab867c3b2aa287257df12ec5d7c962bf922b32fd33226c4295fd",
+    filename: "node-v24.18.0-linux-x64.tar.gz",
+    sha256: "783130984963db7ba9cbd01089eaf2c2efb055c7c1693c943174b967b3050cb8",
 });
 
 #[cfg(all(target_os = "linux", target_arch = "aarch64"))]
 const MANAGED_NODE_ARTIFACT: Option<ManagedNodeArtifact> = Some(ManagedNodeArtifact {
     platform: "linux-arm64",
-    filename: "node-v24.11.0-linux-arm64.tar.gz",
-    sha256: "4786d00c4d259d3ff0b2328307f764ef3ced65f2d6e9502d433e68d66238509d",
+    filename: "node-v24.18.0-linux-arm64.tar.gz",
+    sha256: "6b4484c2190274175df9aa8f28e2d758a819cb1c1fe6ab481e2f95b463ab8508",
 });
 
 #[cfg(all(target_os = "windows", target_arch = "x86_64"))]
 const MANAGED_NODE_ARTIFACT: Option<ManagedNodeArtifact> = Some(ManagedNodeArtifact {
     platform: "win-x64",
-    filename: "node-v24.11.0-win-x64.zip",
-    sha256: "1054540bce22b54ec7e50ebc078ec5d090700a77657607a58f6a64df21f49fdd",
+    filename: "node-v24.18.0-win-x64.zip",
+    sha256: "0ae68406b42d7725661da979b1403ec9926da205c6770827f33aac9d8f26e821",
 });
 
 #[cfg(all(target_os = "windows", target_arch = "aarch64"))]
 const MANAGED_NODE_ARTIFACT: Option<ManagedNodeArtifact> = Some(ManagedNodeArtifact {
     platform: "win-arm64",
-    filename: "node-v24.11.0-win-arm64.zip",
-    sha256: "12d3b1aa9696b7411e115a4fa2aef57f95560b5ee16bb62cd69843e535ec72be",
+    filename: "node-v24.18.0-win-arm64.zip",
+    sha256: "f274669adb93b1fd0fbf8f21fd078609e9dcc84333d4f2718d2dde3f9a161a01",
 });
 
 #[cfg(not(any(
@@ -615,9 +615,9 @@ mod tests {
     #[test]
     fn test_validate_zip_accepts_normal_entries() {
         let tmp = make_zip_with_entries(&[
-            "node-v24.11.0-win-x64/node.exe",
-            "node-v24.11.0-win-x64/npm.cmd",
-            "node-v24.11.0-win-x64/npm",
+            "node-v24.18.0-win-x64/node.exe",
+            "node-v24.18.0-win-x64/npm.cmd",
+            "node-v24.18.0-win-x64/npm",
         ]);
         let file = std::fs::File::open(tmp.path()).unwrap();
         let archive = zip::ZipArchive::new(file).unwrap();
@@ -677,7 +677,7 @@ mod tests {
     #[test]
     fn test_validate_zip_rejects_backslash_traversal() {
         // Path traversal using Windows separator — must reject on every host.
-        let tmp = make_zip_with_entries(&["node-v24.11.0-win-x64\\..\\..\\evil"]);
+        let tmp = make_zip_with_entries(&["node-v24.18.0-win-x64\\..\\..\\evil"]);
         let file = std::fs::File::open(tmp.path()).unwrap();
         let archive = zip::ZipArchive::new(file).unwrap();
         let err = validate_managed_node_zip_entries(&archive).unwrap_err();
diff --git a/desktop/src-tauri/src/commands/agent_logs.rs b/desktop/src-tauri/src/commands/agent_logs.rs
index 25d3d4d1c41..273654e32ac 100644
--- a/desktop/src-tauri/src/commands/agent_logs.rs
+++ b/desktop/src-tauri/src/commands/agent_logs.rs
@@ -3,7 +3,7 @@ use tauri::{AppHandle, Manager};
 use crate::{
     app_state::AppState,
     managed_agents::{
-        load_managed_agents, managed_agent_log_path, read_log_tail, BackendKind,
+        latest_managed_agent_log_path, load_managed_agents, read_log_tail, BackendKind,
         ManagedAgentLogResponse,
     },
 };
@@ -29,7 +29,7 @@ pub async fn get_managed_agent_log(
             return Err("logs are not available for remote agents".to_string());
         }
 
-        let log_path = managed_agent_log_path(&app, &pubkey)?;
+        let log_path = latest_managed_agent_log_path(&app, &pubkey)?;
         Ok(ManagedAgentLogResponse {
             content: read_log_tail(&log_path, line_count.unwrap_or(120) as usize)?,
             log_path: log_path.display().to_string(),
diff --git a/desktop/src-tauri/src/commands/agent_models_tests.rs b/desktop/src-tauri/src/commands/agent_models_tests.rs
index d98460109f5..b65f2409005 100644
--- a/desktop/src-tauri/src/commands/agent_models_tests.rs
+++ b/desktop/src-tauri/src/commands/agent_models_tests.rs
@@ -394,8 +394,10 @@ fn model_discovery_ignores_stale_record_for_linked_agent() {
         name_pool: Vec::new(),
         is_builtin: false,
         is_active: true,
+        shared: false,
         source_team: None,
         source_team_persona_slug: None,
+        catalog_source: None,
         env_vars: BTreeMap::new(),
         respond_to: None,
         respond_to_allowlist: Vec::new(),
diff --git a/desktop/src-tauri/src/commands/agents.rs b/desktop/src-tauri/src/commands/agents.rs
index 3b5ebeca4f6..0758fc3aac5 100644
--- a/desktop/src-tauri/src/commands/agents.rs
+++ b/desktop/src-tauri/src/commands/agents.rs
@@ -6,8 +6,8 @@ use crate::{
     managed_agents::{
         build_managed_agent_summary, current_instance_id, discover_provider_candidates,
         ensure_persona_is_active, find_managed_agent_mut, load_managed_agents, load_personas,
-        load_teams, managed_agent_avatar_url, managed_agents_base_dir, normalize_agent_args,
-        provider_deploy, resolve_provider_binary, save_managed_agents, start_managed_agent_process,
+        load_teams, managed_agent_avatar_url, normalize_agent_args, provider_deploy,
+        resolve_provider_binary, save_managed_agents, start_managed_agent_process,
         stop_managed_agent_process, stop_managed_agent_workspace_pair,
         sync_managed_agent_processes, try_regenerate_nest, validate_provider_config, BackendKind,
         CreateManagedAgentRequest, CreateManagedAgentResponse, ManagedAgentRecord,
@@ -18,8 +18,7 @@ use crate::{
     util::now_iso,
 };
 
-/// Read the workspace owner's pubkey hex from app state without holding the
-/// lock for longer than necessary. Used to populate `BUZZ_ACP_AGENT_OWNER`
+/// Read the workspace owner pubkey without holding the lock. Used to populate `BUZZ_ACP_AGENT_OWNER`
 /// as a fallback for legacy agent records that have no NIP-OA `auth_tag`.
 pub(super) fn workspace_owner_hex(state: &AppState) -> Result<String, String> {
     let keys = state.keys.lock().map_err(|e| e.to_string())?;
@@ -45,52 +44,15 @@ pub(super) fn retain_managed_agent_pending(
     state: &AppState,
     record: &ManagedAgentRecord,
 ) {
-    use crate::managed_agents::{
-        agent_events::{agent_event_content, build_agent_event},
-        persona_events::monotonic_created_at,
-        retention::{get_retained_event, open_retention_db, retain_event, RetainedEvent},
-    };
-    use buzz_core_pkg::kind::KIND_MANAGED_AGENT;
-    use nostr::JsonUtil;
+    use crate::managed_agents::{reconcile::retain_agent_record, retention::open_retention_db};
 
     let result = (|| -> Result<(), String> {
-        let conn = open_retention_db(&managed_agents_base_dir(app)?.join("retention.db"))?;
-        // The published content is the opt-IN projection JSON, independent of
-        // signing and created_at. Compute it once to drive the no-republish
-        // guard without signing twice.
-        let content = serde_json::to_string(&agent_event_content(record))
-            .map_err(|e| format!("failed to serialize managed-agent content: {e}"))?;
-        let (owner_pubkey, event) = {
-            let keys = state.signing_keys()?;
-            let owner_pubkey = keys.public_key().to_hex();
-            let existing =
-                get_retained_event(&conn, KIND_MANAGED_AGENT, &owner_pubkey, &record.pubkey)?;
-            // Skip re-publishing when the projection is unchanged: a start/stop
-            // or any edit that touched only excluded runtime/local fields
-            // produces an identical projection, so it is a no-op — operational
-            // churn never re-enqueues a publish.
-            if existing.as_ref().is_some_and(|row| row.content == content) {
-                return Ok(());
-            }
-            // Monotonic created_at: bump past the retained head (NIP-AP step 3).
-            let event = build_agent_event(record)?
-                .custom_created_at(monotonic_created_at(existing.map(|row| row.created_at)))
-                .sign_with_keys(&keys)
-                .map_err(|e| format!("failed to sign managed-agent event: {e}"))?;
-            (owner_pubkey, event)
-        };
-        retain_event(
-            &conn,
-            &RetainedEvent {
-                kind: KIND_MANAGED_AGENT,
-                pubkey: owner_pubkey,
-                d_tag: record.pubkey.clone(),
-                content: event.content.to_string(),
-                created_at: event.created_at.as_secs() as i64,
-                raw_event: event.as_json(),
-                pending_sync: true,
-            },
-        )
+        let scope = crate::managed_agents::retention::active_retention_scope(app, state)?;
+        let conn = open_retention_db(&scope.db_path)?;
+        // Shared engine with the boot-time reconcile: projection content diff
+        // (no republish for runtime-only churn) + monotonic created_at bump
+        // past the retained head (NIP-AP step 3).
+        retain_agent_record(&conn, &scope.owner_keys, record).map(|_| ())
     })();
     if let Err(e) = result {
         eprintln!("buzz-desktop: agent-retain: {e}");
@@ -126,15 +88,12 @@ pub(super) fn tombstone_managed_agent_pending(
     const KIND_DELETE: u32 = 5;
 
     let result = (|| -> Result<(), String> {
-        let (owner_pubkey, event) = {
-            let keys = state.signing_keys()?;
-            let owner_pubkey = keys.public_key().to_hex();
-            let event = build_agent_delete(agent_pubkey, &owner_pubkey)?
-                .sign_with_keys(&keys)
-                .map_err(|e| format!("failed to sign managed-agent tombstone: {e}"))?;
-            (owner_pubkey, event)
-        };
-        let conn = open_retention_db(&managed_agents_base_dir(app)?.join("retention.db"))?;
+        let scope = crate::managed_agents::retention::active_retention_scope(app, state)?;
+        let owner_pubkey = scope.owner_keys.public_key().to_hex();
+        let event = build_agent_delete(agent_pubkey, &owner_pubkey)?
+            .sign_with_keys(&scope.owner_keys)
+            .map_err(|e| format!("failed to sign managed-agent tombstone: {e}"))?;
+        let conn = open_retention_db(&scope.db_path)?;
         delete_retained_event(&conn, KIND_MANAGED_AGENT, &owner_pubkey, agent_pubkey)?;
         retain_event(
             &conn,
@@ -220,13 +179,10 @@ pub(super) fn archive_managed_agent_pending(app: &AppHandle, state: &AppState, a
     use nostr::JsonUtil;
 
     let result = (|| -> Result<(), String> {
-        let (owner_pubkey, event) = {
-            let keys = state.signing_keys()?;
-            let owner_pubkey = keys.public_key().to_hex();
-            let event = build_agent_archive_request(&keys, agent_pubkey)?;
-            (owner_pubkey, event)
-        };
-        let conn = open_retention_db(&managed_agents_base_dir(app)?.join("retention.db"))?;
+        let scope = crate::managed_agents::retention::active_retention_scope(app, state)?;
+        let owner_pubkey = scope.owner_keys.public_key().to_hex();
+        let event = build_agent_archive_request(&scope.owner_keys, agent_pubkey)?;
+        let conn = open_retention_db(&scope.db_path)?;
         retain_event(
             &conn,
             &RetainedEvent {
@@ -941,8 +897,10 @@ pub async fn create_managed_agent(
             name_pool: Vec::new(),
             is_builtin: false,
             is_active: true,
+            shared: false,
             source_team: None,
             source_team_persona_slug: None,
+            catalog_source: None,
             definition_respond_to: None,
             definition_respond_to_allowlist: Vec::new(),
             definition_parallelism: None,
diff --git a/desktop/src-tauri/src/commands/agents_tests.rs b/desktop/src-tauri/src/commands/agents_tests.rs
index e32fc1cfe4b..03389d1d18b 100644
--- a/desktop/src-tauri/src/commands/agents_tests.rs
+++ b/desktop/src-tauri/src/commands/agents_tests.rs
@@ -53,8 +53,10 @@ fn bare_agent_record(
         name_pool: vec![],
         is_builtin: false,
         is_active: true,
+        shared: false,
         source_team: None,
         source_team_persona_slug: None,
+        catalog_source: None,
         relay_mesh: None,
         auto_restart_on_config_change: false,
         definition_respond_to: None,
@@ -75,8 +77,10 @@ fn persona_record(id: &str, model: Option<&str>, provider: Option<&str>) -> Agen
         name_pool: vec![],
         is_builtin: false,
         is_active: true,
+        shared: false,
         source_team: None,
         source_team_persona_slug: None,
+        catalog_source: None,
         env_vars: BTreeMap::new(),
         respond_to: None,
         respond_to_allowlist: vec![],
diff --git a/desktop/src-tauri/src/commands/identity.rs b/desktop/src-tauri/src/commands/identity.rs
index 33783c05a57..2840c0ade68 100644
--- a/desktop/src-tauri/src/commands/identity.rs
+++ b/desktop/src-tauri/src/commands/identity.rs
@@ -135,23 +135,29 @@ pub async fn sign_event(
 }
 
 #[tauri::command]
-pub fn decrypt_observer_event(
+pub async fn decrypt_observer_event(
     event_json: String,
     state: State<'_, AppState>,
 ) -> Result<serde_json::Value, String> {
     let keys = state.signing_keys()?;
-    let event = Event::from_json(event_json).map_err(|error| format!("invalid event: {error}"))?;
 
-    // Defense-in-depth: verify event ID and signature before decrypting.
-    if !event.verify_id() {
-        return Err("observer event has invalid ID".into());
-    }
-    if !event.verify_signature() {
-        return Err("observer event has invalid signature".into());
-    }
+    tauri::async_runtime::spawn_blocking(move || {
+        let event =
+            Event::from_json(event_json).map_err(|error| format!("invalid event: {error}"))?;
 
-    buzz_core_pkg::observer::decrypt_observer_payload(&keys, &event)
-        .map_err(|error| format!("decrypt observer event failed: {error}"))
+        // Defense-in-depth: verify event ID and signature before decrypting.
+        if !event.verify_id() {
+            return Err("observer event has invalid ID".into());
+        }
+        if !event.verify_signature() {
+            return Err("observer event has invalid signature".into());
+        }
+
+        buzz_core_pkg::observer::decrypt_observer_payload(&keys, &event)
+            .map_err(|error| format!("decrypt observer event failed: {error}"))
+    })
+    .await
+    .map_err(|e| format!("spawn_blocking failed: {e}"))?
 }
 
 #[tauri::command]
diff --git a/desktop/src-tauri/src/commands/join_policy.rs b/desktop/src-tauri/src/commands/join_policy.rs
new file mode 100644
index 00000000000..d2a357c4f94
--- /dev/null
+++ b/desktop/src-tauri/src/commands/join_policy.rs
@@ -0,0 +1,193 @@
+use futures_util::StreamExt;
+use serde_json::Value;
+use std::time::Duration;
+use url::Url;
+
+// Each relay policy document is capped at 256 KiB before JSON encoding. Four
+// MiB covers two maximally escaped documents plus the response envelope.
+const MAX_JOIN_POLICY_RESPONSE_BYTES: usize = 4 * 1024 * 1024;
+const JOIN_POLICY_REQUEST_TIMEOUT: Duration = Duration::from_secs(15);
+
+fn join_policy_url(relay_url: &str) -> Result<Url, String> {
+    let mut url = Url::parse(relay_url.trim()).map_err(|_| "invalid relay URL".to_string())?;
+    let http_scheme = match url.scheme() {
+        "wss" => "https",
+        "ws" => "http",
+        _ => return Err("relay URL must use ws:// or wss://".to_string()),
+    };
+    url.set_scheme(http_scheme)
+        .map_err(|_| "invalid relay URL scheme".to_string())?;
+
+    if !url.username().is_empty() || url.password().is_some() {
+        return Err("relay URL must not contain credentials".to_string());
+    }
+
+    let base_path = url.path().trim_end_matches('/');
+    url.set_path(&format!("{base_path}/api/join-policy"));
+    url.set_query(None);
+    url.set_fragment(None);
+    Ok(url)
+}
+
+/// Fetch an arbitrary relay's optional join policy through native networking.
+#[tauri::command]
+pub async fn fetch_join_policy(relay_url: String) -> Result<Option<Value>, String> {
+    let url = join_policy_url(&relay_url)?;
+    let client = reqwest::Client::builder()
+        .redirect(reqwest::redirect::Policy::none())
+        .build()
+        .map_err(|error| format!("failed to build join policy client: {error}"))?;
+    let response = client
+        .get(url)
+        .timeout(JOIN_POLICY_REQUEST_TIMEOUT)
+        .send()
+        .await
+        .map_err(|error| format!("join policy request failed: {error}"))?;
+
+    if response.status() == reqwest::StatusCode::NOT_FOUND {
+        return Ok(None);
+    }
+    if !response.status().is_success() {
+        return Err(format!("HTTP {}", response.status().as_u16()));
+    }
+
+    let body = read_join_policy_json(response).await?;
+    Ok(body
+        .get("policy")
+        .filter(|policy| !policy.is_null())
+        .cloned())
+}
+
+async fn read_join_policy_json(response: reqwest::Response) -> Result<Value, String> {
+    if response
+        .content_length()
+        .is_some_and(|length| length > MAX_JOIN_POLICY_RESPONSE_BYTES as u64)
+    {
+        return Err("relay returned oversized join policy".to_string());
+    }
+
+    let mut stream = response.bytes_stream();
+    let mut bytes = Vec::new();
+    while let Some(chunk) = stream.next().await {
+        let chunk = chunk.map_err(|error| format!("reading join policy failed: {error}"))?;
+        if bytes.len().saturating_add(chunk.len()) > MAX_JOIN_POLICY_RESPONSE_BYTES {
+            return Err("relay returned oversized join policy".to_string());
+        }
+        bytes.extend_from_slice(&chunk);
+    }
+
+    serde_json::from_slice(&bytes).map_err(|_| "relay returned malformed join policy".to_string())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use axum::{
+        body::{Body, Bytes},
+        http::Response,
+        response::Redirect,
+        routing::get,
+        Json, Router,
+    };
+    use std::convert::Infallible;
+
+    async fn test_relay(router: Router) -> String {
+        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+        let address = listener.local_addr().unwrap();
+        tokio::spawn(async move {
+            axum::serve(listener, router).await.unwrap();
+        });
+        format!("ws://{address}")
+    }
+
+    #[test]
+    fn converts_relay_urls_to_join_policy_urls() {
+        assert_eq!(
+            join_policy_url("wss://relay.example.com/")
+                .unwrap()
+                .as_str(),
+            "https://relay.example.com/api/join-policy"
+        );
+        assert_eq!(
+            join_policy_url("ws://localhost:3000/base")
+                .unwrap()
+                .as_str(),
+            "http://localhost:3000/base/api/join-policy"
+        );
+    }
+
+    #[test]
+    fn rejects_non_relay_schemes_and_credentials() {
+        assert!(join_policy_url("https://relay.example.com").is_err());
+        assert!(join_policy_url("wss://user:secret@relay.example.com").is_err());
+    }
+
+    #[tokio::test]
+    async fn reads_an_optional_policy_without_webview_cors() {
+        let relay_url = test_relay(Router::new().route(
+            "/api/join-policy",
+            get(|| async {
+                Json(serde_json::json!({
+                    "policy": {
+                        "terms_markdown": "# Terms",
+                        "age_attestation_required": true,
+                        "version": "v1"
+                    }
+                }))
+            }),
+        ))
+        .await;
+
+        let policy = fetch_join_policy(relay_url).await.unwrap().unwrap();
+        assert_eq!(policy["version"], "v1");
+        assert_eq!(policy["age_attestation_required"], true);
+    }
+
+    #[tokio::test]
+    async fn refuses_join_policy_redirects() {
+        let relay_url = test_relay(Router::new().route(
+            "/api/join-policy",
+            get(|| async { Redirect::temporary("http://127.0.0.1:1/private") }),
+        ))
+        .await;
+
+        assert_eq!(fetch_join_policy(relay_url).await.unwrap_err(), "HTTP 307");
+    }
+
+    #[tokio::test]
+    async fn rejects_declared_oversized_join_policy() {
+        let relay_url = test_relay(Router::new().route(
+            "/api/join-policy",
+            get(|| async {
+                Response::builder()
+                    .body(Body::from(vec![b'x'; MAX_JOIN_POLICY_RESPONSE_BYTES + 1]))
+                    .unwrap()
+            }),
+        ))
+        .await;
+
+        assert_eq!(
+            fetch_join_policy(relay_url).await.unwrap_err(),
+            "relay returned oversized join policy"
+        );
+    }
+
+    #[tokio::test]
+    async fn rejects_chunked_oversized_join_policy() {
+        let relay_url = test_relay(Router::new().route(
+            "/api/join-policy",
+            get(|| async {
+                let chunk = Bytes::from(vec![b'x'; MAX_JOIN_POLICY_RESPONSE_BYTES + 1]);
+                Body::from_stream(futures_util::stream::once(async move {
+                    Ok::<_, Infallible>(chunk)
+                }))
+            }),
+        ))
+        .await;
+
+        assert_eq!(
+            fetch_join_policy(relay_url).await.unwrap_err(),
+            "relay returned oversized join policy"
+        );
+    }
+}
diff --git a/desktop/src-tauri/src/commands/media.rs b/desktop/src-tauri/src/commands/media.rs
index bf8692ff700..ed3b3402388 100644
--- a/desktop/src-tauri/src/commands/media.rs
+++ b/desktop/src-tauri/src/commands/media.rs
@@ -411,7 +411,7 @@ fn should_retry_legacy_upload(status: reqwest::StatusCode) -> bool {
 }
 
 async fn send_upload_attempt(
-    state: &State<'_, AppState>,
+    state: &AppState,
     url: String,
     auth_header: &str,
     mime: &str,
@@ -455,10 +455,22 @@ async fn send_upload_attempt(
     response.map_err(|error| classify_request_error(&error))
 }
 
+pub(crate) async fn upload_image_bytes(
+    body: Vec<u8>,
+    state: &AppState,
+) -> Result<BlobDescriptor, String> {
+    let mime = detect_and_validate_mime(&body)?;
+    if !mime.starts_with("image/") {
+        return Err("profile avatar must be an image".to_string());
+    }
+    let body = sanitize_image_for_upload(body, &mime)?;
+    do_upload(body, &mime, state, None).await
+}
+
 async fn do_upload(
     body: Vec<u8>,
     mime: &str,
-    state: &State<'_, AppState>,
+    state: &AppState,
     progress: Option<(tauri::AppHandle, String)>,
 ) -> Result<BlobDescriptor, String> {
     let sha256 = hex::encode(Sha256::digest(&body));
@@ -559,7 +571,7 @@ pub async fn upload_media(
 /// files from ever leaving the client on image-only surfaces.
 async fn process_picked_path(
     path: std::path::PathBuf,
-    state: &State<'_, AppState>,
+    state: &AppState,
     images_only: bool,
 ) -> Result<BlobDescriptor, String> {
     // Pin the inode by opening the fd BEFORE spawn_blocking. This prevents a
diff --git a/desktop/src-tauri/src/commands/media_download.rs b/desktop/src-tauri/src/commands/media_download.rs
index 016865878e0..6086af218b6 100644
--- a/desktop/src-tauri/src/commands/media_download.rs
+++ b/desktop/src-tauri/src/commands/media_download.rs
@@ -49,9 +49,13 @@ fn validate_download_url(url: &str, relay_base: &str) -> Result<(), String> {
         return Err("download URL must match the relay origin".to_string());
     }
 
-    // Path must be /media/{filename}.
+    // Path must contain a /media/{filename} segment. The segment may be preceded
+    // by a base path when the relay is served under one (BUZZ_BASE_PATH), e.g.
+    // /relay/media/<hash>.png. Requiring the full segment still rejects
+    // near-misses such as /media-evil/<hash>, and the origin check above already
+    // pins the request to the relay.
     let path = parsed.path();
-    if !path.starts_with("/media/") {
+    if !path.contains("/media/") {
         return Err("download URL must be a /media/ path".to_string());
     }
 
@@ -610,6 +614,7 @@ mod tests {
             version: FORMAT_VERSION,
             definition: AgentSnapshotDefinition {
                 name: "test".to_string(),
+                source_is_builtin: false,
                 system_prompt: None,
                 runtime: None,
                 model: None,
@@ -659,6 +664,7 @@ mod tests {
             version: FORMAT_VERSION,
             definition: AgentSnapshotDefinition {
                 name: "test".to_string(),
+                source_is_builtin: false,
                 system_prompt: None,
                 runtime: None,
                 model: None,
@@ -704,6 +710,7 @@ mod tests {
             version: FORMAT_VERSION,
             definition: AgentSnapshotDefinition {
                 name: "test".to_string(),
+                source_is_builtin: false,
                 system_prompt: None,
                 runtime: None,
                 model: None,
@@ -788,6 +795,34 @@ mod tests {
         );
     }
 
+    #[test]
+    fn test_validate_download_url_accepts_base_path_prefixed_media() {
+        // A relay served under BUZZ_BASE_PATH hosts media at <prefix>/media/<hash>.
+        assert!(validate_download_url(
+            "https://relay.example.com/relay/media/abc123.png",
+            RELAY_BASE,
+        )
+        .is_ok());
+        assert!(validate_download_url(
+            "https://relay.example.com/buzz/relay/media/abc123.png",
+            RELAY_BASE,
+        )
+        .is_ok());
+    }
+
+    #[test]
+    fn test_validate_download_url_rejects_media_lookalike_segment() {
+        // The full /media/ segment is still required, prefix or not.
+        let result =
+            validate_download_url("https://relay.example.com/media-evil/abc123.png", RELAY_BASE);
+        assert!(result.is_err());
+        let prefixed = validate_download_url(
+            "https://relay.example.com/relay/media-evil/abc123.png",
+            RELAY_BASE,
+        );
+        assert!(prefixed.is_err());
+    }
+
     #[test]
     fn test_validate_download_url_non_relay_origin_rejected() {
         let result = validate_download_url("https://evil.example.com/media/abc123.jpg", RELAY_BASE);
diff --git a/desktop/src-tauri/src/commands/media_snapshot_png.rs b/desktop/src-tauri/src/commands/media_snapshot_png.rs
index f2593ff9e0f..734d8f5dc8a 100644
--- a/desktop/src-tauri/src/commands/media_snapshot_png.rs
+++ b/desktop/src-tauri/src/commands/media_snapshot_png.rs
@@ -158,6 +158,7 @@ mod tests {
             version: 1,
             definition: AgentSnapshotDefinition {
                 name: "Tree Trunks".to_string(),
+                source_is_builtin: false,
                 system_prompt: Some("You are a helpful agent.".to_string()),
                 runtime: Some("goose".to_string()),
                 model: None,
diff --git a/desktop/src-tauri/src/commands/messages.rs b/desktop/src-tauri/src/commands/messages.rs
index afe94cdfe62..b7c37bec3df 100644
--- a/desktop/src-tauri/src/commands/messages.rs
+++ b/desktop/src-tauri/src/commands/messages.rs
@@ -138,7 +138,14 @@ pub async fn get_feed(
     })
 }
 
-fn build_search_messages_filter(q: &str, cap: u32, channel_id: Option<&str>) -> serde_json::Value {
+fn build_search_messages_filter(
+    q: &str,
+    cap: u32,
+    channel_id: Option<&str>,
+    authors: Option<&[String]>,
+    since: Option<i64>,
+    until: Option<i64>,
+) -> serde_json::Value {
     let mut filter = serde_json::Map::new();
     filter.insert(
         "kinds".to_string(),
@@ -153,6 +160,25 @@ fn build_search_messages_filter(q: &str, cap: u32, channel_id: Option<&str>) ->
     if let Some(cid) = channel_id {
         filter.insert("#h".to_string(), serde_json::json!([cid]));
     }
+    // Optional operators from the desktop search parser (#2853). The relay
+    // already maps authors/since/until onto FTS; search remains never the
+    // access boundary (hits are refetched and re-authorized).
+    if let Some(authors) = authors {
+        let cleaned: Vec<&str> = authors
+            .iter()
+            .map(|a| a.trim())
+            .filter(|a| !a.is_empty())
+            .collect();
+        if !cleaned.is_empty() {
+            filter.insert("authors".to_string(), serde_json::json!(cleaned));
+        }
+    }
+    if let Some(since) = since {
+        filter.insert("since".to_string(), serde_json::json!(since));
+    }
+    if let Some(until) = until {
+        filter.insert("until".to_string(), serde_json::json!(until));
+    }
     serde_json::Value::Object(filter)
 }
 
@@ -161,10 +187,20 @@ pub async fn search_messages(
     q: String,
     limit: Option<u32>,
     channel_id: Option<String>,
+    authors: Option<Vec<String>>,
+    since: Option<i64>,
+    until: Option<i64>,
     state: State<'_, AppState>,
 ) -> Result<SearchResponse, String> {
     let cap = limit.unwrap_or(20).min(100);
-    let filter = build_search_messages_filter(&q, cap, channel_id.as_deref());
+    let filter = build_search_messages_filter(
+        &q,
+        cap,
+        channel_id.as_deref(),
+        authors.as_deref(),
+        since,
+        until,
+    );
 
     let events = query_relay(&state, &[filter]).await?;
     Ok(nostr_convert::search_response_from_events(&events))
diff --git a/desktop/src-tauri/src/commands/messages_tests.rs b/desktop/src-tauri/src/commands/messages_tests.rs
index 3c08f0f1130..a907a3dff1d 100644
--- a/desktop/src-tauri/src/commands/messages_tests.rs
+++ b/desktop/src-tauri/src/commands/messages_tests.rs
@@ -80,12 +80,38 @@ fn managed_agent_message_builder_rejects_invalid_mentions() {
 }
 #[test]
 fn search_messages_filter_requests_prefix_mode_for_topbar_typeahead() {
-    let filter = build_search_messages_filter("  pro  ", 12, Some("channel-1"));
+    let filter = build_search_messages_filter("  pro  ", 12, Some("channel-1"), None, None, None);
 
     assert_eq!(filter["search"], serde_json::json!("pro"));
     assert_eq!(filter["search_mode"], serde_json::json!("prefix"));
     assert_eq!(filter["limit"], serde_json::json!(12));
     assert_eq!(filter["#h"], serde_json::json!(["channel-1"]));
+    assert!(filter.get("authors").is_none());
+    assert!(filter.get("since").is_none());
+    assert!(filter.get("until").is_none());
+}
+
+#[test]
+fn search_messages_filter_emits_operator_fields() {
+    let authors =
+        vec!["aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899".to_string()];
+    let filter = build_search_messages_filter(
+        "deploy",
+        20,
+        Some("channel-uuid"),
+        Some(&authors),
+        Some(1_700_000_000),
+        Some(1_700_086_400),
+    );
+
+    assert_eq!(filter["search"], serde_json::json!("deploy"));
+    assert_eq!(filter["#h"], serde_json::json!(["channel-uuid"]));
+    assert_eq!(
+        filter["authors"],
+        serde_json::json!(["aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899"])
+    );
+    assert_eq!(filter["since"], serde_json::json!(1_700_000_000));
+    assert_eq!(filter["until"], serde_json::json!(1_700_086_400));
 }
 
 #[test]
diff --git a/desktop/src-tauri/src/commands/mod.rs b/desktop/src-tauri/src/commands/mod.rs
index a048ad24af5..1c89ee4f771 100644
--- a/desktop/src-tauri/src/commands/mod.rs
+++ b/desktop/src-tauri/src/commands/mod.rs
@@ -21,6 +21,7 @@ mod export_util;
 mod global_agent_config;
 mod identity;
 mod identity_archive;
+mod join_policy;
 mod legacy_storage;
 mod link_preview;
 pub(crate) mod media;
@@ -78,6 +79,7 @@ pub use engrams::*;
 pub use global_agent_config::*;
 pub use identity::*;
 pub use identity_archive::*;
+pub use join_policy::*;
 pub use legacy_storage::*;
 pub use link_preview::*;
 pub use media::*;
diff --git a/desktop/src-tauri/src/commands/personas/create.rs b/desktop/src-tauri/src/commands/personas/create.rs
new file mode 100644
index 00000000000..c00de1c6da1
--- /dev/null
+++ b/desktop/src-tauri/src/commands/personas/create.rs
@@ -0,0 +1,85 @@
+//! The persona creation command surface, split from `mod.rs` (file-size cap)
+//! as the sibling of [`super::update`].
+
+use tauri::AppHandle;
+use uuid::Uuid;
+
+use crate::{
+    app_state::AppState,
+    managed_agents::{
+        apply_persona_behavior, load_personas, save_personas, try_regenerate_nest, AgentDefinition,
+        CatalogSource, CreatePersonaRequest,
+    },
+    util::now_iso,
+};
+
+use super::{pending, retain_persona_pending, trim_optional, trim_required};
+
+#[tauri::command]
+pub async fn create_persona(
+    input: CreatePersonaRequest,
+    app: AppHandle,
+) -> Result<AgentDefinition, String> {
+    use tauri::Manager;
+    tokio::task::spawn_blocking(move || {
+        let state = app.state::<AppState>();
+        let display_name = trim_required(&input.display_name, "Display name")?;
+        // System prompt optional: core memory is auto-injected. Empty is valid.
+        let system_prompt = input.system_prompt.trim().to_string();
+        let avatar_url = trim_optional(input.avatar_url);
+        let runtime = trim_optional(input.runtime);
+        let model = trim_optional(input.model);
+        let provider = trim_optional(input.provider);
+        // Normalized before the store is touched: a coordinate that can't match
+        // a publication is worse than no coordinate, because it silently
+        // re-enables the duplicate add it exists to prevent.
+        let catalog_source = input
+            .catalog_source
+            .map(CatalogSource::normalized)
+            .transpose()?;
+        let now = now_iso();
+        let _store_guard = state
+            .managed_agents_store_lock
+            .lock()
+            .map_err(|error| error.to_string())?;
+        let mut personas = load_personas(&app)?;
+        pending::project_active_persona_sharing(&app, &state, &mut personas);
+        let name_pool: Vec<String> = input
+            .name_pool
+            .into_iter()
+            .map(|s| s.trim().to_string())
+            .filter(|s| !s.is_empty())
+            .collect();
+        crate::managed_agents::validate_user_env_keys(&input.env_vars)?;
+        let mut persona = AgentDefinition {
+            id: Uuid::new_v4().to_string(),
+            display_name,
+            avatar_url,
+            system_prompt,
+            runtime,
+            model,
+            provider,
+            name_pool,
+            is_builtin: false,
+            is_active: true,
+            shared: false,
+            source_team: None,
+            source_team_persona_slug: None,
+            catalog_source,
+            env_vars: input.env_vars,
+            respond_to: None,
+            respond_to_allowlist: Vec::new(),
+            parallelism: None,
+            created_at: now.clone(),
+            updated_at: now,
+        };
+        apply_persona_behavior(&mut persona, input.behavior)?;
+        personas.push(persona.clone());
+        save_personas(&app, &personas)?;
+        retain_persona_pending(&app, &state, &persona);
+        try_regenerate_nest(&app);
+        Ok(persona)
+    })
+    .await
+    .map_err(|e| format!("spawn_blocking failed: {e}"))?
+}
diff --git a/desktop/src-tauri/src/commands/personas/delete_cascade_tests.rs b/desktop/src-tauri/src/commands/personas/delete_cascade_tests.rs
index 316af5f72d0..8ff7cfbd9bd 100644
--- a/desktop/src-tauri/src/commands/personas/delete_cascade_tests.rs
+++ b/desktop/src-tauri/src/commands/personas/delete_cascade_tests.rs
@@ -61,8 +61,10 @@ fn make_agent(
         name_pool: vec![],
         is_builtin: false,
         is_active: true,
+        shared: false,
         source_team: None,
         source_team_persona_slug: None,
+        catalog_source: None,
         relay_mesh: None,
         auto_restart_on_config_change: false,
         definition_respond_to: None,
diff --git a/desktop/src-tauri/src/commands/personas/inbound.rs b/desktop/src-tauri/src/commands/personas/inbound.rs
new file mode 100644
index 00000000000..d7ffecef2d6
--- /dev/null
+++ b/desktop/src-tauri/src/commands/personas/inbound.rs
@@ -0,0 +1,450 @@
+//! Inbound relay → local store reconciliation for persona/team/managed-agent
+//! projections and their NIP-09 tombstones. Extracted from the parent module to
+//! keep it under the file-size cap.
+
+use tauri::{AppHandle, Emitter, Manager};
+
+use crate::{
+    app_state::AppState,
+    managed_agents::{
+        agent_events::ManagedAgentEventContent, load_personas, persona_events::persona_d_tag,
+        save_personas, team_events::TeamEventContent, try_regenerate_nest, AgentDefinition,
+        ManagedAgentRecord, TeamRecord,
+    },
+    util::now_iso,
+};
+
+#[cfg(test)]
+mod inbound_tests;
+
+/// Apply an inbound kind:30175 persona event from the relay onto the local
+/// store. The frontend's live subscription invokes this per event for our own
+/// authored coordinate so Device B inherits Device A's edits.
+///
+/// Retention is a sync channel that writes INTO `personas.json`, never an
+/// authoritative read source — `load_personas` is untouched, so every agent
+/// keeps resolving its persona by UUID and keeps its provider keys.
+///
+/// MATCH KEY (single source of truth, both directions): an inbound event
+/// matches the local record whose `persona_d_tag(record)` equals the event's
+/// d-tag. Reusing the same derivation the outbound path uses guarantees the
+/// inbound key can never drift from the outbound key — in particular, an
+/// in-app persona (`source_team_persona_slug == None`) whose d-tag IS its
+/// `id` matches its existing UUID row instead of minting a duplicate.
+///
+/// On match: patch ONLY the projected fields; preserve local `id`, `env_vars`,
+/// `source_team`, and `created_at`. On no match: insert the parsed record as-is
+/// — `persona_from_event` already sets `id = d_tag`, so an in-app persona reuses
+/// its d-tag as the id and a re-received event stays idempotent (no duplicate).
+///
+/// The retention store decides whether the inbound event wins over a pending
+/// local edit (`retain_inbound_event`): `personas.json` is only patched when the
+/// retain reports [`InboundOutcome::Applied`], so an equal-second collision with
+/// a pending local edit leaves the local record — and its queued publish —
+/// untouched.
+///
+/// `arrival_relay_url` is the relay the calling subscription is bound to. The
+/// retention store this event belongs to is decided by the community that
+/// DELIVERED it, not by whichever community happens to be active when the
+/// reconcile runs — a workspace switch in flight would otherwise file community
+/// A's event into community B's scoped database. An event whose arrival relay is
+/// no longer the active scope is dropped: it was already durable in its own
+/// community's store when it arrived there, and that community's next boot
+/// reconcile refetches it.
+#[tauri::command]
+pub async fn reconcile_inbound_persona_event(
+    event_json: String,
+    arrival_relay_url: String,
+    app: AppHandle,
+) -> Result<(), String> {
+    tokio::task::spawn_blocking(move || {
+        reconcile_inbound_persona_event_blocking(event_json, arrival_relay_url, app)
+    })
+    .await
+    .map_err(|e| format!("spawn_blocking failed: {e}"))?
+}
+
+fn reconcile_inbound_persona_event_blocking(
+    event_json: String,
+    arrival_relay_url: String,
+    app: AppHandle,
+) -> Result<(), String> {
+    use crate::managed_agents::{
+        agent_events::managed_agent_content_from_event,
+        load_managed_agents, load_teams,
+        persona_events::persona_from_event,
+        retention::{open_retention_db, retain_inbound_event, InboundOutcome, RetainedEvent},
+        save_managed_agents, save_teams,
+        team_events::team_content_from_event,
+    };
+    use buzz_core_pkg::kind::{KIND_DELETION, KIND_MANAGED_AGENT, KIND_PERSONA, KIND_TEAM};
+    use nostr::JsonUtil;
+
+    let state = app.state::<AppState>();
+    let event = parse_verified_inbound_event(&event_json)?;
+
+    // The live filter subscribes to 30175/30176/30177 (upserts) plus kind:5
+    // (NIP-09 deletions). d-tags are NOT unique across kinds, so every path
+    // below dispatches on kind FIRST and only ever touches its own store — a
+    // cross-kind d-tag collision can never link a team to a persona or agent.
+    let kind = event.kind.as_u16() as u32;
+
+    // kind:5 deletion: a tombstone removes the local record at the coordinate
+    // in its `a` tag (`<target_kind>:<owner>:<d_tag>`). Handled before the
+    // upsert dispatch because its coordinate and retention key differ.
+    if kind == KIND_DELETION {
+        return reconcile_inbound_tombstone(&event, &arrival_relay_url, &app, &state);
+    }
+
+    if !matches!(kind, KIND_PERSONA | KIND_TEAM | KIND_MANAGED_AGENT) {
+        return Ok(());
+    }
+
+    // The d-tag identifies the record within its kind. Persona derives it from
+    // the parsed record (`persona_d_tag`); team/agent carry it as the event's
+    // d-tag directly. The persona is parsed once here and reused in the apply
+    // branch below — team/agent content is parsed in-branch since their d-tag
+    // comes from the event tag, not the content.
+    let inbound_persona = (kind == KIND_PERSONA)
+        .then(|| persona_from_event(&event))
+        .transpose()?;
+    let d_tag = match &inbound_persona {
+        Some(persona) => persona_d_tag(persona),
+        None => event_d_tag(&event)?,
+    };
+
+    let _store_guard = state
+        .managed_agents_store_lock
+        .lock()
+        .map_err(|error| error.to_string())?;
+
+    // Resolve inbound vs. any pending local edit before touching the store, in
+    // the scope the event ARRIVED on. A workspace switch since arrival leaves
+    // this event to its own community's store — dropping it here is what keeps
+    // community A's head out of community B's database.
+    let Some(scope) = crate::managed_agents::retention::arrival_retention_scope(
+        &app,
+        &state,
+        &arrival_relay_url,
+    )?
+    else {
+        return Ok(());
+    };
+    let conn = open_retention_db(&scope.db_path)?;
+    let outcome = retain_inbound_event(
+        &conn,
+        &RetainedEvent {
+            kind,
+            pubkey: event.pubkey.to_hex(),
+            d_tag: d_tag.clone(),
+            content: event.content.to_string(),
+            created_at: event.created_at.as_secs() as i64,
+            raw_event: event.as_json(),
+            pending_sync: false,
+        },
+    )?;
+    if outcome == InboundOutcome::Skipped {
+        return Ok(());
+    }
+
+    match kind {
+        KIND_PERSONA => {
+            let mut personas = load_personas(&app)?;
+            // `inbound_persona` is `Some` for KIND_PERSONA (set above).
+            apply_inbound_persona(
+                &mut personas,
+                inbound_persona.expect("persona parsed above"),
+            );
+            save_personas(&app, &personas)?;
+        }
+        KIND_TEAM => {
+            let mut teams = load_teams(&app)?;
+            apply_inbound_team(&mut teams, d_tag, team_content_from_event(&event)?);
+            save_teams(&app, &teams)?;
+        }
+        KIND_MANAGED_AGENT => {
+            let mut agents = load_managed_agents(&app)?;
+            apply_inbound_managed_agent(
+                &mut agents,
+                &d_tag,
+                managed_agent_content_from_event(&event)?,
+            );
+            save_managed_agents(&app, &agents)?;
+        }
+        _ => unreachable!("kind gated above"),
+    }
+    try_regenerate_nest(&app);
+
+    // Signal the live UI to refetch agents data — inbound relay events otherwise
+    // land on disk silently, leaving the Agents tab stale until restart.
+    let _ = app.emit("agents-data-changed", ());
+
+    Ok(())
+}
+
+/// Parse an inbound wire event and enforce the signature gate. Everything
+/// downstream trusts `event.pubkey` (ownership routing, tombstone scoping,
+/// behavioral-quad application), so a forged pubkey must die here — the
+/// TS-side owner filter reads the same attacker-controlled field and is no
+/// defense.
+fn parse_verified_inbound_event(event_json: &str) -> Result<nostr::Event, String> {
+    use nostr::JsonUtil;
+    let event = nostr::Event::from_json(event_json)
+        .map_err(|e| format!("failed to parse inbound event: {e}"))?;
+    event
+        .verify()
+        .map_err(|e| format!("inbound event failed signature verification: {e}"))?;
+    Ok(event)
+}
+
+/// Parse a NIP-09 `a`-tag coordinate `<kind>:<owner_pubkey>:<d_tag>` into its
+/// target kind and d-tag. Returns `None` if the tag is absent or malformed, so
+/// the caller no-ops on a tombstone it can't route.
+fn parse_deletion_coordinate(event: &nostr::Event) -> Option<(u32, String)> {
+    event.tags.iter().find_map(|tag| {
+        let values: Vec<&str> = tag.as_slice().iter().map(|s| s.as_str()).collect();
+        if values.first() != Some(&"a") {
+            return None;
+        }
+        let coord = values.get(1)?;
+        // `<kind>:<owner>:<d_tag>` — d_tag may itself contain ':' so split at
+        // most twice and keep the remainder as the d_tag.
+        let mut parts = coord.splitn(3, ':');
+        let kind: u32 = parts.next()?.parse().ok()?;
+        let owner = parts.next()?;
+        // NIP-09 scoping: only the record's author may tombstone it. The
+        // signature gate upstream proves `event.pubkey`; requiring the
+        // coordinate owner to match closes the other half — a validly
+        // signed kind:5 naming ANOTHER owner's coordinate must no-op.
+        if owner != event.pubkey.to_hex() {
+            return None;
+        }
+        let d_tag = parts.next()?;
+        Some((kind, d_tag.to_string()))
+    })
+}
+
+/// Apply an inbound kind:5 NIP-09 deletion: remove the local record at the
+/// tombstone's target coordinate, scoped per-kind. Mirrors the upsert spine —
+/// arrival-scoped retention resolution under the store lock, then a per-kind
+/// store mutation — but removes rather than patches. Unknown/malformed
+/// coordinates no-op, as does a tombstone whose arrival community is no longer
+/// active.
+fn reconcile_inbound_tombstone(
+    event: &nostr::Event,
+    arrival_relay_url: &str,
+    app: &AppHandle,
+    state: &AppState,
+) -> Result<(), String> {
+    use crate::managed_agents::{
+        load_managed_agents, load_teams,
+        retention::{
+            open_retention_db, retain_inbound_event, tombstone_retention_d_tag, InboundOutcome,
+            RetainedEvent,
+        },
+        save_managed_agents, save_teams,
+    };
+    use buzz_core_pkg::kind::{KIND_DELETION, KIND_MANAGED_AGENT, KIND_PERSONA, KIND_TEAM};
+    use nostr::JsonUtil;
+
+    let Some((target_kind, target_d_tag)) = parse_deletion_coordinate(event) else {
+        return Ok(()); // no routable coordinate — nothing to delete
+    };
+    if !matches!(target_kind, KIND_PERSONA | KIND_TEAM | KIND_MANAGED_AGENT) {
+        return Ok(()); // deletion for a kind we don't track locally
+    }
+
+    let _store_guard = state
+        .managed_agents_store_lock
+        .lock()
+        .map_err(|error| error.to_string())?;
+
+    // Resolve against the retained tombstone row (keyed by the target
+    // coordinate, F2c) so a re-received tombstone or one older than a pending
+    // local edit is a no-op. Scoped to the arrival community, so a workspace
+    // switch since arrival drops the tombstone instead of retaining it — and
+    // deleting a record — in the wrong community's store.
+    let Some(scope) =
+        crate::managed_agents::retention::arrival_retention_scope(app, state, arrival_relay_url)?
+    else {
+        return Ok(());
+    };
+    let conn = open_retention_db(&scope.db_path)?;
+    let outcome = retain_inbound_event(
+        &conn,
+        &RetainedEvent {
+            kind: KIND_DELETION,
+            pubkey: event.pubkey.to_hex(),
+            d_tag: tombstone_retention_d_tag(target_kind, &target_d_tag),
+            content: event.content.to_string(),
+            created_at: event.created_at.as_secs() as i64,
+            raw_event: event.as_json(),
+            pending_sync: false,
+        },
+    )?;
+    if outcome == InboundOutcome::Skipped {
+        return Ok(());
+    }
+
+    // Remove the local record using the SAME per-kind match rule the apply fns
+    // use: persona by `persona_d_tag`, team by `id`, managed-agent by `pubkey`.
+    match target_kind {
+        KIND_PERSONA => {
+            let mut personas = load_personas(app)?;
+            personas.retain(|record| persona_d_tag(record) != target_d_tag);
+            save_personas(app, &personas)?;
+        }
+        KIND_TEAM => {
+            let mut teams = load_teams(app)?;
+            teams.retain(|record| record.id != target_d_tag);
+            save_teams(app, &teams)?;
+        }
+        KIND_MANAGED_AGENT => {
+            let mut agents = load_managed_agents(app)?;
+            agents.retain(|record| record.pubkey != target_d_tag);
+            save_managed_agents(app, &agents)?;
+        }
+        _ => unreachable!("target kind gated above"),
+    }
+    try_regenerate_nest(app);
+
+    // Refresh the live UI on inbound deletion — a removal is as user-visible as
+    // an upsert and the Agents tab must drop the tombstoned record without restart.
+    let _ = app.emit("agents-data-changed", ());
+
+    Ok(())
+}
+
+/// Extract the `d` tag value from an event, the match key for team (= team id)
+/// and managed-agent (= agent pubkey) inbound reconcile.
+fn event_d_tag(event: &nostr::Event) -> Result<String, String> {
+    event
+        .tags
+        .iter()
+        .find_map(|tag| {
+            let values: Vec<&str> = tag.as_slice().iter().map(|s| s.as_str()).collect();
+            (values.first() == Some(&"d"))
+                .then(|| values.get(1).map(|s| s.to_string()))
+                .flatten()
+        })
+        .ok_or_else(|| "inbound event missing d-tag".to_string())
+}
+
+/// Merge a parsed inbound persona into the local set: patch the matching record
+/// in place, or push it when none matches.
+///
+/// The match key is `persona_d_tag` — the same derivation the outbound path
+/// uses — so the inbound and outbound keys can never drift. On match, only the
+/// projected fields are overwritten; local `id`, `env_vars`, `source_team`, and
+/// `created_at` survive. On no match, the parsed record is inserted as-is; since
+/// `persona_from_event` sets `id = d_tag`, an in-app persona reuses its d-tag as
+/// the id and a re-received event stays idempotent (no duplicate row).
+fn apply_inbound_persona(personas: &mut Vec<AgentDefinition>, inbound: AgentDefinition) {
+    let d_tag = persona_d_tag(&inbound);
+    match personas
+        .iter_mut()
+        .find(|record| persona_d_tag(record) == d_tag)
+    {
+        Some(local) => {
+            local.display_name = inbound.display_name;
+            local.avatar_url = inbound.avatar_url;
+            local.system_prompt = inbound.system_prompt;
+            local.runtime = inbound.runtime;
+            local.model = inbound.model;
+            local.provider = inbound.provider;
+            local.name_pool = inbound.name_pool;
+            local.respond_to = inbound.respond_to;
+            local.respond_to_allowlist = inbound.respond_to_allowlist;
+            local.parallelism = inbound.parallelism;
+            local.shared = inbound.shared;
+            local.updated_at = inbound.updated_at;
+        }
+        None => personas.push(inbound),
+    }
+}
+
+/// Merge an inbound kind:30177 managed-agent projection into the local set.
+///
+/// Matches the local record whose `pubkey` equals the event's d-tag (the d-tag
+/// IS the agent pubkey — see `build_agent_event`). On match, overwrite ONLY the
+/// 10 projected fields; every secret (`private_key_nsec`, `auth_tag`,
+/// `env_vars`, `backend`), the harness pins (`agent_command`,
+/// `agent_command_override`), and all runtime/local fields are preserved
+/// untouched. The projection type carries none of them, so they cannot be
+/// reached here even if a foreign event tried to inject them.
+///
+/// No match is a no-op: managed agents carry device-local secrets and are never
+/// minted from a relay event — an agent that does not already exist locally has
+/// no secret key to run with, so inserting a secretless shell would be useless
+/// and misleading. This diverges from the persona path, which DOES insert on no
+/// match (personas are secretless definitions). Flagged in the reconcile docs.
+fn apply_inbound_managed_agent(
+    agents: &mut [ManagedAgentRecord],
+    d_tag: &str,
+    inbound: ManagedAgentEventContent,
+) {
+    if let Some(local) = agents.iter_mut().find(|record| record.pubkey == d_tag) {
+        local.name = inbound.name;
+        // Mirror of the slimmed writer (agent_event_content): a
+        // definition-linked event omits the definition quad because those
+        // fields resolve through the kind:30175 definition — absent means
+        // "not carried", never "clear". Definition-less events still carry
+        // the quad and apply it unconditionally (including clears).
+        let definition_linked = inbound.persona_id.is_some();
+        local.persona_id = inbound.persona_id;
+        if !definition_linked {
+            local.system_prompt = inbound.system_prompt;
+            local.model = inbound.model;
+            local.provider = inbound.provider;
+            local.persona_source_version = inbound.persona_source_version;
+        }
+        local.parallelism = inbound.parallelism;
+        local.respond_to = inbound.respond_to;
+        local.respond_to_allowlist = inbound.respond_to_allowlist;
+    }
+}
+
+/// Merge an inbound kind:30176 team projection into the local set.
+///
+/// Matches the local record whose `id` equals the event's d-tag (the d-tag IS
+/// the team id — see `build_team_event`). On match, overwrite ONLY the three
+/// shared fields (`name`, `description`, `persona_ids`); install-specific local
+/// fields (`source_dir`, `is_symlink`, `symlink_target`, `is_builtin`,
+/// `version`, `created_at`) are preserved. On no match, insert a fresh record
+/// reusing the d-tag as the id so a re-received event stays idempotent —
+/// symmetric to the persona path, since a team (like a persona) is a secretless
+/// definition that another device may legitimately learn about from the relay.
+fn apply_inbound_team(teams: &mut Vec<TeamRecord>, d_tag: String, inbound: TeamEventContent) {
+    match teams.iter_mut().find(|record| record.id == d_tag) {
+        Some(local) => {
+            local.name = inbound.name;
+            local.description = inbound.description;
+            // `None` means the event came from a client that predates
+            // always-publish — its true value is unknown, so preserve
+            // local. Only `Some` (including the explicit-clear variants)
+            // overwrites. See `TeamEventContent` for the wire rules.
+            if let Some(instructions) = inbound.instructions {
+                local.instructions = instructions;
+            }
+            if let Some(persona_ids) = inbound.persona_ids {
+                local.persona_ids = persona_ids;
+            }
+        }
+        None => teams.push(TeamRecord {
+            id: d_tag,
+            name: inbound.name,
+            description: inbound.description,
+            // Fresh insert has no local value to preserve; `None` from a
+            // pre-fix client simply means no known value.
+            instructions: inbound.instructions.unwrap_or_default(),
+            persona_ids: inbound.persona_ids.unwrap_or_default(),
+            is_builtin: false,
+            source_dir: None,
+            is_symlink: false,
+            symlink_target: None,
+            version: None,
+            created_at: now_iso(),
+            updated_at: now_iso(),
+        }),
+    }
+}
diff --git a/desktop/src-tauri/src/commands/personas/inbound_tests.rs b/desktop/src-tauri/src/commands/personas/inbound/inbound_tests.rs
similarity index 99%
rename from desktop/src-tauri/src/commands/personas/inbound_tests.rs
rename to desktop/src-tauri/src/commands/personas/inbound/inbound_tests.rs
index 1000e48b70c..1005a83432d 100644
--- a/desktop/src-tauri/src/commands/personas/inbound_tests.rs
+++ b/desktop/src-tauri/src/commands/personas/inbound/inbound_tests.rs
@@ -20,8 +20,10 @@ fn local_in_app() -> AgentDefinition {
         name_pool: vec!["Local".to_string()],
         is_builtin: false,
         is_active: true,
+        shared: false,
         source_team: Some("team-1".to_string()),
         source_team_persona_slug: None,
+        catalog_source: None,
         env_vars: BTreeMap::from([("API_KEY".to_string(), "secret".to_string())]),
         respond_to: None,
         respond_to_allowlist: Vec::new(),
@@ -45,8 +47,10 @@ fn inbound_for(d_tag: &str, display_name: &str) -> AgentDefinition {
         name_pool: vec!["Remote".to_string()],
         is_builtin: false,
         is_active: true,
+        shared: false,
         source_team: None,
         source_team_persona_slug: Some(d_tag.to_string()),
+        catalog_source: None,
         env_vars: BTreeMap::new(),
         respond_to: None,
         respond_to_allowlist: Vec::new(),
@@ -203,8 +207,10 @@ fn local_agent() -> ManagedAgentRecord {
         name_pool: Vec::new(),
         is_builtin: false,
         is_active: true,
+        shared: false,
         source_team: None,
         source_team_persona_slug: None,
+        catalog_source: None,
         definition_respond_to: None,
         definition_respond_to_allowlist: Vec::new(),
         definition_parallelism: None,
diff --git a/desktop/src-tauri/src/commands/personas/mod.rs b/desktop/src-tauri/src/commands/personas/mod.rs
index 6437d4b1a88..66f7296a251 100644
--- a/desktop/src-tauri/src/commands/personas/mod.rs
+++ b/desktop/src-tauri/src/commands/personas/mod.rs
@@ -1,16 +1,12 @@
-use tauri::{AppHandle, Emitter, Manager};
-use uuid::Uuid;
+use tauri::AppHandle;
 
 use crate::{
     app_state::AppState,
     managed_agents::{
-        agent_events::ManagedAgentEventContent, apply_persona_behavior, current_instance_id,
-        delete_agent_key, effective_agent_command, load_managed_agents, load_personas, load_teams,
-        managed_agent_avatar_url, persona_events::persona_d_tag, save_managed_agents,
-        save_personas, stop_managed_agent_process, sync_managed_agent_processes,
-        team_events::TeamEventContent, try_regenerate_nest, validate_persona_activation_change,
-        validate_persona_deletion, AgentDefinition, CreatePersonaRequest, ManagedAgentRecord,
-        TeamRecord, UpdatePersonaRequest,
+        current_instance_id, delete_agent_key, load_managed_agents, load_personas, load_teams,
+        save_managed_agents, save_personas, stop_managed_agent_process,
+        sync_managed_agent_processes, try_regenerate_nest, validate_persona_activation_change,
+        validate_persona_deletion, AgentDefinition, ManagedAgentRecord,
     },
     util::now_iso,
 };
@@ -33,289 +29,35 @@ fn trim_optional(value: Option<String>) -> Option<String> {
 mod pending;
 pub(in crate::commands) use pending::retain_persona_pending;
 pub(super) use pending::tombstone_persona_pending;
+mod create;
+pub use create::create_persona;
+mod sharing;
+pub use sharing::set_persona_shared;
+pub use sharing::update_persona_and_publish;
+mod update;
+pub use update::update_persona;
+mod inbound;
+pub use inbound::reconcile_inbound_persona_event;
 
 #[tauri::command]
 pub async fn list_personas(app: AppHandle) -> Result<Vec<AgentDefinition>, String> {
     use tauri::Manager;
     tokio::task::spawn_blocking(move || {
         let state = app.state::<AppState>();
-        let _store_guard = state
-            .managed_agents_store_lock
-            .lock()
-            .map_err(|error| error.to_string())?;
-        load_personas(&app)
-    })
-    .await
-    .map_err(|e| format!("spawn_blocking failed: {e}"))?
-}
-
-#[tauri::command]
-pub async fn create_persona(
-    input: CreatePersonaRequest,
-    app: AppHandle,
-) -> Result<AgentDefinition, String> {
-    use tauri::Manager;
-    tokio::task::spawn_blocking(move || {
-        let state = app.state::<AppState>();
-        let display_name = trim_required(&input.display_name, "Display name")?;
-        // System prompt optional: core memory is auto-injected. Empty is valid.
-        let system_prompt = input.system_prompt.trim().to_string();
-        let avatar_url = trim_optional(input.avatar_url);
-        let runtime = trim_optional(input.runtime);
-        let model = trim_optional(input.model);
-        let provider = trim_optional(input.provider);
-        let now = now_iso();
         let _store_guard = state
             .managed_agents_store_lock
             .lock()
             .map_err(|error| error.to_string())?;
         let mut personas = load_personas(&app)?;
-        let name_pool: Vec<String> = input
-            .name_pool
-            .into_iter()
-            .map(|s| s.trim().to_string())
-            .filter(|s| !s.is_empty())
-            .collect();
-        crate::managed_agents::validate_user_env_keys(&input.env_vars)?;
-        let mut persona = AgentDefinition {
-            id: Uuid::new_v4().to_string(),
-            display_name,
-            avatar_url,
-            system_prompt,
-            runtime,
-            model,
-            provider,
-            name_pool,
-            is_builtin: false,
-            is_active: true,
-            source_team: None,
-            source_team_persona_slug: None,
-            env_vars: input.env_vars,
-            respond_to: None,
-            respond_to_allowlist: Vec::new(),
-            parallelism: None,
-            created_at: now.clone(),
-            updated_at: now,
-        };
-        apply_persona_behavior(&mut persona, input.behavior)?;
-        personas.push(persona.clone());
-        save_personas(&app, &personas)?;
-        retain_persona_pending(&app, &state, &persona);
-        try_regenerate_nest(&app);
-        Ok(persona)
+        pending::project_active_persona_sharing(&app, &state, &mut personas);
+        Ok(personas)
     })
     .await
     .map_err(|e| format!("spawn_blocking failed: {e}"))?
 }
 
-/// Return value of the `update_persona` command. Uses flatten so all
-/// `AgentDefinition` fields appear at the top level of the JSON response —
-/// backward-compatible with callers that already destructure a raw persona object.
-#[derive(Debug, serde::Serialize)]
-pub struct UpdatePersonaResult {
-    #[serde(flatten)]
-    persona: AgentDefinition,
-}
-
-/// Propagate a persona definition's display_name rename to linked agent instances.
-/// Only instances whose current `name` equals `old_display_name` are updated;
-/// pool-named instances (e.g. "Birch", "Compass") keep their individualised name.
-/// Updates both `record.name` (relay display name) and `record.display_name`.
-/// Returns the pubkeys of the records that were renamed.
-fn propagate_persona_name_rename(
-    records: &mut [ManagedAgentRecord],
-    persona_id: &str,
-    old_display_name: &str,
-    new_display_name: &str,
-) -> Vec<String> {
-    let mut renamed = Vec::new();
-    for record in records.iter_mut() {
-        if record.persona_id.as_deref() != Some(persona_id) {
-            continue;
-        }
-        if record.name != old_display_name {
-            continue; // pool-named instance — keep its individualised name
-        }
-        record.name = new_display_name.to_string();
-        record.display_name = Some(new_display_name.to_string());
-        renamed.push(record.pubkey.clone());
-    }
-    renamed
-}
-
-#[tauri::command]
-pub async fn update_persona(
-    input: UpdatePersonaRequest,
-    app: AppHandle,
-) -> Result<UpdatePersonaResult, String> {
-    use tauri::Manager;
-
-    /// Profile sync params collected under the store lock for async relay publish.
-    type ProfileSyncParams = Vec<(nostr::Keys, String, String, Option<String>, Option<String>)>;
-
-    // Phase 1: synchronous save (persona record + linked agent avatar updates)
-    let (result, profile_sync_params) = tokio::task::spawn_blocking({
-        let app = app.clone();
-        move || -> Result<(AgentDefinition, ProfileSyncParams), String> {
-            let state = app.state::<AppState>();
-            let display_name = trim_required(&input.display_name, "Display name")?;
-            let system_prompt = input.system_prompt.clone();
-            let avatar_url = trim_optional(input.avatar_url);
-            let runtime = trim_optional(input.runtime);
-            let model = trim_optional(input.model);
-            let provider = trim_optional(input.provider);
-
-            let _store_guard = state
-                .managed_agents_store_lock
-                .lock()
-                .map_err(|error| error.to_string())?;
-            let mut personas = load_personas(&app)?;
-            let persona = personas
-                .iter_mut()
-                .find(|record| record.id == input.id)
-                .ok_or_else(|| format!("agent {} not found", input.id))?;
-
-            // Track what changed so we can propagate to linked agent records.
-            let avatar_changed = persona.avatar_url != avatar_url;
-            let name_changed = persona.display_name != display_name;
-            let old_display_name = persona.display_name.clone();
-
-            persona.display_name = display_name;
-            persona.avatar_url = avatar_url;
-            persona.system_prompt = system_prompt;
-            persona.runtime = runtime;
-            persona.model = model;
-            persona.provider = provider;
-            persona.name_pool = input
-                .name_pool
-                .into_iter()
-                .map(|s| s.trim().to_string())
-                .filter(|s| !s.is_empty())
-                .collect();
-            if let Some(env_vars) = input.env_vars {
-                crate::managed_agents::validate_user_env_keys(&env_vars)?;
-                persona.env_vars = env_vars;
-            }
-            apply_persona_behavior(persona, input.behavior)?;
-            persona.updated_at = now_iso();
-
-            let result = persona.clone();
-            save_personas(&app, &personas)?;
-
-            retain_persona_pending(&app, &state, &result);
-            try_regenerate_nest(&app);
-
-            // If the avatar or display_name changed, propagate to linked agent
-            // records and collect relay profile sync params for the async phase.
-            let sync_params: ProfileSyncParams = if avatar_changed || name_changed {
-                let mut records = load_managed_agents(&app)?;
-                let mut params: ProfileSyncParams = Vec::new();
-                let mut agents_modified = false;
-                let workspace_relay = crate::relay::relay_ws_url_with_override(&state);
-
-                // Propagate the display_name rename to instances that still
-                // carry the old definition display_name (pool-named instances
-                // keep their individualised name) in one pass; the loop below
-                // only decides which records need a relay profile sync.
-                let renamed: Vec<String> = if name_changed {
-                    propagate_persona_name_rename(
-                        &mut records,
-                        &result.id,
-                        &old_display_name,
-                        &result.display_name,
-                    )
-                } else {
-                    Vec::new()
-                };
-
-                for record in records.iter_mut() {
-                    if record.persona_id.as_deref() != Some(&result.id) {
-                        continue;
-                    }
-                    let mut record_changed = renamed.contains(&record.pubkey);
-
-                    if avatar_changed {
-                        // Update the persisted avatar so reconciliation on next
-                        // start agrees with what we're about to publish.
-                        // When the persona avatar is cleared, fall back to the
-                        // command-default icon so the record never stores `None`
-                        // (which reconcile_agent_profile treats as "un-migrated").
-                        let effective_cmd = effective_agent_command(
-                            record.persona_id.as_deref(),
-                            std::slice::from_ref(&result),
-                            record.agent_command_override.as_deref(),
-                        );
-                        record.avatar_url = result
-                            .avatar_url
-                            .clone()
-                            .or_else(|| managed_agent_avatar_url(&effective_cmd));
-                        record_changed = true;
-                    }
-
-                    if record_changed {
-                        agents_modified = true;
-                        if let Ok(agent_keys) = nostr::Keys::parse(&record.private_key_nsec) {
-                            let relay_url = crate::relay::effective_agent_relay_url(
-                                &record.relay_url,
-                                &workspace_relay,
-                            );
-                            params.push((
-                                agent_keys,
-                                relay_url,
-                                record.name.clone(),
-                                record.avatar_url.clone(),
-                                record.auth_tag.clone(),
-                            ));
-                        }
-                    }
-                }
-
-                if agents_modified {
-                    save_managed_agents(&app, &records)?;
-                }
-
-                params
-            } else {
-                Vec::new()
-            };
-
-            Ok((result, sync_params))
-        }
-    })
-    .await
-    .map_err(|e| format!("spawn_blocking failed: {e}"))??;
-
-    // Phase 2: await relay profile sync for linked agents whose avatar or
-    // display_name was just updated. We await (rather than fire-and-forget)
-    // so the frontend cache invalidation that follows the mutation settlement
-    // sees the fresh relay profile. Best-effort — failures are logged, not surfaced.
-    if !profile_sync_params.is_empty() {
-        let state = app.state::<AppState>();
-        for (agent_keys, relay_url, display_name, avatar_url, auth_tag) in profile_sync_params {
-            if let Err(e) = crate::relay::sync_managed_agent_profile(
-                &state,
-                &relay_url,
-                &agent_keys,
-                &display_name,
-                avatar_url.as_deref(),
-                auth_tag.as_deref(),
-            )
-            .await
-            {
-                eprintln!("buzz-desktop: relay profile sync failed after persona update: {e}");
-            }
-        }
-    }
-
-    Ok(UpdatePersonaResult { persona: result })
-}
-
 #[cfg(test)]
 mod delete_cascade_tests;
-#[cfg(test)]
-mod inbound_tests;
-#[cfg(test)]
-mod name_propagation_tests;
 
 /// Return pubkeys of every managed agent whose definition is the given persona.
 ///
@@ -510,403 +252,6 @@ pub async fn delete_persona(id: String, app: AppHandle) -> Result<(), String> {
     .map_err(|e| format!("spawn_blocking failed: {e}"))?
 }
 
-/// Apply an inbound kind:30175 persona event from the relay onto the local
-/// store. The frontend's live subscription invokes this per event for our own
-/// authored coordinate so Device B inherits Device A's edits.
-///
-/// Retention is a sync channel that writes INTO `personas.json`, never an
-/// authoritative read source — `load_personas` is untouched, so every agent
-/// keeps resolving its persona by UUID and keeps its provider keys.
-///
-/// MATCH KEY (single source of truth, both directions): an inbound event
-/// matches the local record whose `persona_d_tag(record)` equals the event's
-/// d-tag. Reusing the same derivation the outbound path uses guarantees the
-/// inbound key can never drift from the outbound key — in particular, an
-/// in-app persona (`source_team_persona_slug == None`) whose d-tag IS its
-/// `id` matches its existing UUID row instead of minting a duplicate.
-///
-/// On match: patch ONLY the projected fields; preserve local `id`, `env_vars`,
-/// `source_team`, and `created_at`. On no match: insert the parsed record as-is
-/// — `persona_from_event` already sets `id = d_tag`, so an in-app persona reuses
-/// its d-tag as the id and a re-received event stays idempotent (no duplicate).
-///
-/// The retention store decides whether the inbound event wins over a pending
-/// local edit (`retain_inbound_event`): `personas.json` is only patched when the
-/// retain reports [`InboundOutcome::Applied`], so an equal-second collision with
-/// a pending local edit leaves the local record — and its queued publish —
-/// untouched.
-#[tauri::command]
-pub async fn reconcile_inbound_persona_event(
-    event_json: String,
-    app: AppHandle,
-) -> Result<(), String> {
-    tokio::task::spawn_blocking(move || reconcile_inbound_persona_event_blocking(event_json, app))
-        .await
-        .map_err(|e| format!("spawn_blocking failed: {e}"))?
-}
-
-fn reconcile_inbound_persona_event_blocking(
-    event_json: String,
-    app: AppHandle,
-) -> Result<(), String> {
-    use crate::managed_agents::{
-        agent_events::managed_agent_content_from_event,
-        load_managed_agents, load_teams, managed_agents_base_dir,
-        persona_events::persona_from_event,
-        retention::{open_retention_db, retain_inbound_event, InboundOutcome, RetainedEvent},
-        save_managed_agents, save_teams,
-        team_events::team_content_from_event,
-    };
-    use buzz_core_pkg::kind::{KIND_DELETION, KIND_MANAGED_AGENT, KIND_PERSONA, KIND_TEAM};
-    use nostr::JsonUtil;
-
-    let state = app.state::<AppState>();
-    let event = parse_verified_inbound_event(&event_json)?;
-
-    // The live filter subscribes to 30175/30176/30177 (upserts) plus kind:5
-    // (NIP-09 deletions). d-tags are NOT unique across kinds, so every path
-    // below dispatches on kind FIRST and only ever touches its own store — a
-    // cross-kind d-tag collision can never link a team to a persona or agent.
-    let kind = event.kind.as_u16() as u32;
-
-    // kind:5 deletion: a tombstone removes the local record at the coordinate
-    // in its `a` tag (`<target_kind>:<owner>:<d_tag>`). Handled before the
-    // upsert dispatch because its coordinate and retention key differ.
-    if kind == KIND_DELETION {
-        return reconcile_inbound_tombstone(&event, &app, &state);
-    }
-
-    if !matches!(kind, KIND_PERSONA | KIND_TEAM | KIND_MANAGED_AGENT) {
-        return Ok(());
-    }
-
-    // The d-tag identifies the record within its kind. Persona derives it from
-    // the parsed record (`persona_d_tag`); team/agent carry it as the event's
-    // d-tag directly. The persona is parsed once here and reused in the apply
-    // branch below — team/agent content is parsed in-branch since their d-tag
-    // comes from the event tag, not the content.
-    let inbound_persona = (kind == KIND_PERSONA)
-        .then(|| persona_from_event(&event))
-        .transpose()?;
-    let d_tag = match &inbound_persona {
-        Some(persona) => persona_d_tag(persona),
-        None => event_d_tag(&event)?,
-    };
-
-    let _store_guard = state
-        .managed_agents_store_lock
-        .lock()
-        .map_err(|error| error.to_string())?;
-
-    // Resolve inbound vs. any pending local edit before touching the store.
-    let conn = open_retention_db(&managed_agents_base_dir(&app)?.join("retention.db"))?;
-    let outcome = retain_inbound_event(
-        &conn,
-        &RetainedEvent {
-            kind,
-            pubkey: event.pubkey.to_hex(),
-            d_tag: d_tag.clone(),
-            content: event.content.to_string(),
-            created_at: event.created_at.as_secs() as i64,
-            raw_event: event.as_json(),
-            pending_sync: false,
-        },
-    )?;
-    if outcome == InboundOutcome::Skipped {
-        return Ok(());
-    }
-
-    match kind {
-        KIND_PERSONA => {
-            let mut personas = load_personas(&app)?;
-            // `inbound_persona` is `Some` for KIND_PERSONA (set above).
-            apply_inbound_persona(
-                &mut personas,
-                inbound_persona.expect("persona parsed above"),
-            );
-            save_personas(&app, &personas)?;
-        }
-        KIND_TEAM => {
-            let mut teams = load_teams(&app)?;
-            apply_inbound_team(&mut teams, d_tag, team_content_from_event(&event)?);
-            save_teams(&app, &teams)?;
-        }
-        KIND_MANAGED_AGENT => {
-            let mut agents = load_managed_agents(&app)?;
-            apply_inbound_managed_agent(
-                &mut agents,
-                &d_tag,
-                managed_agent_content_from_event(&event)?,
-            );
-            save_managed_agents(&app, &agents)?;
-        }
-        _ => unreachable!("kind gated above"),
-    }
-    try_regenerate_nest(&app);
-
-    // Signal the live UI to refetch agents data — inbound relay events otherwise
-    // land on disk silently, leaving the Agents tab stale until restart.
-    let _ = app.emit("agents-data-changed", ());
-
-    Ok(())
-}
-
-/// Parse an inbound wire event and enforce the signature gate. Everything
-/// downstream trusts `event.pubkey` (ownership routing, tombstone scoping,
-/// behavioral-quad application), so a forged pubkey must die here — the
-/// TS-side owner filter reads the same attacker-controlled field and is no
-/// defense.
-fn parse_verified_inbound_event(event_json: &str) -> Result<nostr::Event, String> {
-    use nostr::JsonUtil;
-    let event = nostr::Event::from_json(event_json)
-        .map_err(|e| format!("failed to parse inbound event: {e}"))?;
-    event
-        .verify()
-        .map_err(|e| format!("inbound event failed signature verification: {e}"))?;
-    Ok(event)
-}
-
-/// Parse a NIP-09 `a`-tag coordinate `<kind>:<owner_pubkey>:<d_tag>` into its
-/// target kind and d-tag. Returns `None` if the tag is absent or malformed, so
-/// the caller no-ops on a tombstone it can't route.
-fn parse_deletion_coordinate(event: &nostr::Event) -> Option<(u32, String)> {
-    event.tags.iter().find_map(|tag| {
-        let values: Vec<&str> = tag.as_slice().iter().map(|s| s.as_str()).collect();
-        if values.first() != Some(&"a") {
-            return None;
-        }
-        let coord = values.get(1)?;
-        // `<kind>:<owner>:<d_tag>` — d_tag may itself contain ':' so split at
-        // most twice and keep the remainder as the d_tag.
-        let mut parts = coord.splitn(3, ':');
-        let kind: u32 = parts.next()?.parse().ok()?;
-        let owner = parts.next()?;
-        // NIP-09 scoping: only the record's author may tombstone it. The
-        // signature gate upstream proves `event.pubkey`; requiring the
-        // coordinate owner to match closes the other half — a validly
-        // signed kind:5 naming ANOTHER owner's coordinate must no-op.
-        if owner != event.pubkey.to_hex() {
-            return None;
-        }
-        let d_tag = parts.next()?;
-        Some((kind, d_tag.to_string()))
-    })
-}
-
-/// Apply an inbound kind:5 NIP-09 deletion: remove the local record at the
-/// tombstone's target coordinate, scoped per-kind. Mirrors the upsert spine —
-/// retention resolution under the store lock, then a per-kind store mutation —
-/// but removes rather than patches. Unknown/malformed coordinates no-op.
-fn reconcile_inbound_tombstone(
-    event: &nostr::Event,
-    app: &AppHandle,
-    state: &AppState,
-) -> Result<(), String> {
-    use crate::managed_agents::{
-        load_managed_agents, load_teams, managed_agents_base_dir,
-        retention::{
-            open_retention_db, retain_inbound_event, tombstone_retention_d_tag, InboundOutcome,
-            RetainedEvent,
-        },
-        save_managed_agents, save_teams,
-    };
-    use buzz_core_pkg::kind::{KIND_DELETION, KIND_MANAGED_AGENT, KIND_PERSONA, KIND_TEAM};
-    use nostr::JsonUtil;
-
-    let Some((target_kind, target_d_tag)) = parse_deletion_coordinate(event) else {
-        return Ok(()); // no routable coordinate — nothing to delete
-    };
-    if !matches!(target_kind, KIND_PERSONA | KIND_TEAM | KIND_MANAGED_AGENT) {
-        return Ok(()); // deletion for a kind we don't track locally
-    }
-
-    let _store_guard = state
-        .managed_agents_store_lock
-        .lock()
-        .map_err(|error| error.to_string())?;
-
-    // Resolve against the retained tombstone row (keyed by the target
-    // coordinate, F2c) so a re-received tombstone or one older than a pending
-    // local edit is a no-op.
-    let conn = open_retention_db(&managed_agents_base_dir(app)?.join("retention.db"))?;
-    let outcome = retain_inbound_event(
-        &conn,
-        &RetainedEvent {
-            kind: KIND_DELETION,
-            pubkey: event.pubkey.to_hex(),
-            d_tag: tombstone_retention_d_tag(target_kind, &target_d_tag),
-            content: event.content.to_string(),
-            created_at: event.created_at.as_secs() as i64,
-            raw_event: event.as_json(),
-            pending_sync: false,
-        },
-    )?;
-    if outcome == InboundOutcome::Skipped {
-        return Ok(());
-    }
-
-    // Remove the local record using the SAME per-kind match rule the apply fns
-    // use: persona by `persona_d_tag`, team by `id`, managed-agent by `pubkey`.
-    match target_kind {
-        KIND_PERSONA => {
-            let mut personas = load_personas(app)?;
-            personas.retain(|record| persona_d_tag(record) != target_d_tag);
-            save_personas(app, &personas)?;
-        }
-        KIND_TEAM => {
-            let mut teams = load_teams(app)?;
-            teams.retain(|record| record.id != target_d_tag);
-            save_teams(app, &teams)?;
-        }
-        KIND_MANAGED_AGENT => {
-            let mut agents = load_managed_agents(app)?;
-            agents.retain(|record| record.pubkey != target_d_tag);
-            save_managed_agents(app, &agents)?;
-        }
-        _ => unreachable!("target kind gated above"),
-    }
-    try_regenerate_nest(app);
-
-    // Refresh the live UI on inbound deletion — a removal is as user-visible as
-    // an upsert and the Agents tab must drop the tombstoned record without restart.
-    let _ = app.emit("agents-data-changed", ());
-
-    Ok(())
-}
-
-/// Extract the `d` tag value from an event, the match key for team (= team id)
-/// and managed-agent (= agent pubkey) inbound reconcile.
-fn event_d_tag(event: &nostr::Event) -> Result<String, String> {
-    event
-        .tags
-        .iter()
-        .find_map(|tag| {
-            let values: Vec<&str> = tag.as_slice().iter().map(|s| s.as_str()).collect();
-            (values.first() == Some(&"d"))
-                .then(|| values.get(1).map(|s| s.to_string()))
-                .flatten()
-        })
-        .ok_or_else(|| "inbound event missing d-tag".to_string())
-}
-
-/// Merge a parsed inbound persona into the local set: patch the matching record
-/// in place, or push it when none matches.
-///
-/// The match key is `persona_d_tag` — the same derivation the outbound path
-/// uses — so the inbound and outbound keys can never drift. On match, only the
-/// projected fields are overwritten; local `id`, `env_vars`, `source_team`, and
-/// `created_at` survive. On no match, the parsed record is inserted as-is; since
-/// `persona_from_event` sets `id = d_tag`, an in-app persona reuses its d-tag as
-/// the id and a re-received event stays idempotent (no duplicate row).
-fn apply_inbound_persona(personas: &mut Vec<AgentDefinition>, inbound: AgentDefinition) {
-    let d_tag = persona_d_tag(&inbound);
-    match personas
-        .iter_mut()
-        .find(|record| persona_d_tag(record) == d_tag)
-    {
-        Some(local) => {
-            local.display_name = inbound.display_name;
-            local.avatar_url = inbound.avatar_url;
-            local.system_prompt = inbound.system_prompt;
-            local.runtime = inbound.runtime;
-            local.model = inbound.model;
-            local.provider = inbound.provider;
-            local.name_pool = inbound.name_pool;
-            local.respond_to = inbound.respond_to;
-            local.respond_to_allowlist = inbound.respond_to_allowlist;
-            local.parallelism = inbound.parallelism;
-            local.updated_at = inbound.updated_at;
-        }
-        None => personas.push(inbound),
-    }
-}
-
-/// Merge an inbound kind:30177 managed-agent projection into the local set.
-///
-/// Matches the local record whose `pubkey` equals the event's d-tag (the d-tag
-/// IS the agent pubkey — see `build_agent_event`). On match, overwrite ONLY the
-/// 10 projected fields; every secret (`private_key_nsec`, `auth_tag`,
-/// `env_vars`, `backend`), the harness pins (`agent_command`,
-/// `agent_command_override`), and all runtime/local fields are preserved
-/// untouched. The projection type carries none of them, so they cannot be
-/// reached here even if a foreign event tried to inject them.
-///
-/// No match is a no-op: managed agents carry device-local secrets and are never
-/// minted from a relay event — an agent that does not already exist locally has
-/// no secret key to run with, so inserting a secretless shell would be useless
-/// and misleading. This diverges from the persona path, which DOES insert on no
-/// match (personas are secretless definitions). Flagged in the reconcile docs.
-fn apply_inbound_managed_agent(
-    agents: &mut [ManagedAgentRecord],
-    d_tag: &str,
-    inbound: ManagedAgentEventContent,
-) {
-    if let Some(local) = agents.iter_mut().find(|record| record.pubkey == d_tag) {
-        local.name = inbound.name;
-        // Mirror of the slimmed writer (agent_event_content): a
-        // definition-linked event omits the definition quad because those
-        // fields resolve through the kind:30175 definition — absent means
-        // "not carried", never "clear". Definition-less events still carry
-        // the quad and apply it unconditionally (including clears).
-        let definition_linked = inbound.persona_id.is_some();
-        local.persona_id = inbound.persona_id;
-        if !definition_linked {
-            local.system_prompt = inbound.system_prompt;
-            local.model = inbound.model;
-            local.provider = inbound.provider;
-            local.persona_source_version = inbound.persona_source_version;
-        }
-        local.parallelism = inbound.parallelism;
-        local.respond_to = inbound.respond_to;
-        local.respond_to_allowlist = inbound.respond_to_allowlist;
-    }
-}
-
-/// Merge an inbound kind:30176 team projection into the local set.
-///
-/// Matches the local record whose `id` equals the event's d-tag (the d-tag IS
-/// the team id — see `build_team_event`). On match, overwrite ONLY the three
-/// shared fields (`name`, `description`, `persona_ids`); install-specific local
-/// fields (`source_dir`, `is_symlink`, `symlink_target`, `is_builtin`,
-/// `version`, `created_at`) are preserved. On no match, insert a fresh record
-/// reusing the d-tag as the id so a re-received event stays idempotent —
-/// symmetric to the persona path, since a team (like a persona) is a secretless
-/// definition that another device may legitimately learn about from the relay.
-fn apply_inbound_team(teams: &mut Vec<TeamRecord>, d_tag: String, inbound: TeamEventContent) {
-    match teams.iter_mut().find(|record| record.id == d_tag) {
-        Some(local) => {
-            local.name = inbound.name;
-            local.description = inbound.description;
-            // `None` means the event came from a client that predates
-            // always-publish — its true value is unknown, so preserve
-            // local. Only `Some` (including the explicit-clear variants)
-            // overwrites. See `TeamEventContent` for the wire rules.
-            if let Some(instructions) = inbound.instructions {
-                local.instructions = instructions;
-            }
-            if let Some(persona_ids) = inbound.persona_ids {
-                local.persona_ids = persona_ids;
-            }
-        }
-        None => teams.push(TeamRecord {
-            id: d_tag,
-            name: inbound.name,
-            description: inbound.description,
-            // Fresh insert has no local value to preserve; `None` from a
-            // pre-fix client simply means no known value.
-            instructions: inbound.instructions.unwrap_or_default(),
-            persona_ids: inbound.persona_ids.unwrap_or_default(),
-            is_builtin: false,
-            source_dir: None,
-            is_symlink: false,
-            symlink_target: None,
-            version: None,
-            created_at: now_iso(),
-            updated_at: now_iso(),
-        }),
-    }
-}
-
 #[tauri::command]
 pub async fn set_persona_active(
     id: String,
diff --git a/desktop/src-tauri/src/commands/personas/pending.rs b/desktop/src-tauri/src/commands/personas/pending.rs
index 4d887ca39e9..a4003329bca 100644
--- a/desktop/src-tauri/src/commands/personas/pending.rs
+++ b/desktop/src-tauri/src/commands/personas/pending.rs
@@ -5,7 +5,17 @@
 use tauri::AppHandle;
 
 use crate::app_state::AppState;
-use crate::managed_agents::AgentDefinition;
+use crate::managed_agents::{
+    retention::{RetainedEvent, RetentionScope},
+    AgentDefinition,
+};
+
+pub(super) struct PreparedPersonaPublication {
+    pub scope: RetentionScope,
+    pub event: nostr::Event,
+    pub retained: RetainedEvent,
+    pub persona: AgentDefinition,
+}
 
 /// Retain a freshly authored persona event in the local store, flagged for
 /// relay sync. Called inside a command's `managed_agents_store_lock`-held body
@@ -16,58 +26,162 @@ use crate::managed_agents::AgentDefinition;
 /// newer-or-equal guard. `pending_sync = 1` enqueues it for the flush loop,
 /// which is the sole publisher. Best-effort: a failure here is logged and
 /// swallowed so a retention hiccup never blocks the disk-authoritative write.
+/// The explicit catalog toggle uses [`prepare_persona_publication`] directly
+/// so its durable enqueue failure reaches the UI.
 ///
 /// Unlike `retain_managed_agent_pending`, this has no projection-equality
 /// short-circuit: personas have no start/stop runtime churn, so a republish
-/// only happens on a genuine create/update/delete user edit (`set_persona_active`
-/// does not retain, so the local-only `is_active` toggle never republishes, and
-/// a byte-identical user-save republish is harmlessly NIP-33-replaced). The
-/// guard is intentionally omitted.
+/// only happens on a genuine create/update/delete/share user edit
+/// (`set_persona_active` does not retain, so the local-only `is_active` toggle
+/// never republishes, while `set_persona_shared` must retain because the tag is
+/// relay-authoritative). A byte-identical user-save republish is harmlessly
+/// NIP-33-replaced. The guard is intentionally omitted.
 pub(in crate::commands) fn retain_persona_pending(
     app: &AppHandle,
     state: &AppState,
     persona: &AgentDefinition,
 ) {
+    if let Err(e) = prepare_persona_publication(app, state, persona, None) {
+        eprintln!("buzz-desktop: persona-retain: {e}");
+    }
+}
+
+/// Build, sign, and durably retain a persona event in the active relay+owner
+/// scope.
+///
+/// Ordinary definition writes pass `None` and preserve the scoped head's
+/// exact share tag. The explicit share toggle passes `Some(shared)`. Returning
+/// the retained event lets that command immediately await relay acceptance
+/// without rebuilding or re-signing a different NIP-33 head.
+pub(super) fn prepare_persona_publication(
+    app: &AppHandle,
+    state: &AppState,
+    persona: &AgentDefinition,
+    shared_override: Option<bool>,
+) -> Result<PreparedPersonaPublication, String> {
+    let scope = crate::managed_agents::retention::active_retention_scope(app, state)?;
+    let (event, retained, persona) = prepare_persona_publication_at(
+        &scope.db_path,
+        &scope.owner_keys,
+        persona,
+        shared_override,
+    )?;
+    Ok(PreparedPersonaPublication {
+        scope,
+        event,
+        retained,
+        persona,
+    })
+}
+
+fn retained_persona_is_shared(row: Option<&RetainedEvent>) -> bool {
+    use buzz_core_pkg::kind::persona_event_is_shared;
+    use nostr::JsonUtil;
+
+    row.and_then(|retained| nostr::Event::from_json(&retained.raw_event).ok())
+        .is_some_and(|event| persona_event_is_shared(&event))
+}
+
+/// Project each persona's catalog visibility from the active relay+owner
+/// scope's retained head.
+///
+/// Infallible by design. The scope needs `signing_keys()`, which fails for the
+/// whole process whenever the identity is lost or the keyring is locked, and a
+/// propagated error there would break listing, creating, and updating EVERY
+/// agent. Share state is a view projection, so an unresolvable scope degrades
+/// to "not shared" — the safe direction: it can under-report visibility but can
+/// never present an unshared persona as published. The durable share state
+/// lives in the retention head, so nothing is lost: the true value reappears
+/// once the identity is signable again.
+pub(super) fn project_active_persona_sharing(
+    app: &AppHandle,
+    state: &AppState,
+    personas: &mut [AgentDefinition],
+) {
+    let scope = crate::managed_agents::retention::active_retention_scope(app, state);
+    project_scoped_persona_sharing(scope, personas);
+}
+
+fn project_scoped_persona_sharing(
+    scope: Result<RetentionScope, String>,
+    personas: &mut [AgentDefinition],
+) {
+    let projected = scope.and_then(|scope| {
+        project_persona_sharing_at(
+            &scope.db_path,
+            &scope.owner_keys.public_key().to_hex(),
+            personas,
+        )
+    });
+    if let Err(error) = projected {
+        eprintln!("buzz-desktop: persona-share-projection unavailable, reporting every agent as unshared: {error}");
+        for persona in personas {
+            persona.shared = false;
+        }
+    }
+}
+
+fn project_persona_sharing_at(
+    db_path: &std::path::Path,
+    owner_pubkey: &str,
+    personas: &mut [AgentDefinition],
+) -> Result<(), String> {
+    use crate::managed_agents::{
+        persona_events::persona_d_tag,
+        retention::{get_retained_event, open_retention_db},
+    };
+    use buzz_core_pkg::kind::KIND_PERSONA;
+
+    let conn = open_retention_db(db_path)?;
+    for persona in personas {
+        if persona.is_builtin {
+            persona.shared = false;
+            continue;
+        }
+        let retained =
+            get_retained_event(&conn, KIND_PERSONA, owner_pubkey, &persona_d_tag(persona))?;
+        persona.shared = retained_persona_is_shared(retained.as_ref());
+    }
+    Ok(())
+}
+
+pub(super) fn prepare_persona_publication_at(
+    db_path: &std::path::Path,
+    keys: &nostr::Keys,
+    persona: &AgentDefinition,
+    shared_override: Option<bool>,
+) -> Result<(nostr::Event, RetainedEvent, AgentDefinition), String> {
     use crate::managed_agents::{
-        managed_agents_base_dir,
         persona_events::{build_persona_event, monotonic_created_at, persona_d_tag},
         retention::{get_retained_event, open_retention_db, retain_event, RetainedEvent},
     };
     use buzz_core_pkg::kind::KIND_PERSONA;
     use nostr::JsonUtil;
 
-    let result = (|| -> Result<(), String> {
-        let d_tag = persona_d_tag(persona);
-        let conn = open_retention_db(&managed_agents_base_dir(app)?.join("retention.db"))?;
-        let (pubkey, event) = {
-            let keys = state.keys.lock().map_err(|e| e.to_string())?;
-            // Monotonic created_at: read the retained head for this coordinate
-            // and bump past it (NIP-AP step 3) so a same-second edit supersedes.
-            let prior =
-                get_retained_event(&conn, KIND_PERSONA, &keys.public_key().to_hex(), &d_tag)?
-                    .map(|row| row.created_at);
-            let event = build_persona_event(persona)?
-                .custom_created_at(monotonic_created_at(prior))
-                .sign_with_keys(&keys)
-                .map_err(|e| format!("failed to sign persona event: {e}"))?;
-            (keys.public_key().to_hex(), event)
-        };
-        retain_event(
-            &conn,
-            &RetainedEvent {
-                kind: KIND_PERSONA,
-                pubkey,
-                d_tag,
-                content: event.content.to_string(),
-                created_at: event.created_at.as_secs() as i64,
-                raw_event: event.as_json(),
-                pending_sync: true,
-            },
-        )
-    })();
-    if let Err(e) = result {
-        eprintln!("buzz-desktop: persona-retain: {e}");
-    }
+    let d_tag = persona_d_tag(persona);
+    let pubkey = keys.public_key().to_hex();
+    let conn = open_retention_db(db_path)?;
+    let existing = get_retained_event(&conn, KIND_PERSONA, &pubkey, &d_tag)?;
+    let mut scoped_persona = persona.clone();
+    scoped_persona.shared =
+        shared_override.unwrap_or_else(|| retained_persona_is_shared(existing.as_ref()));
+    let event = build_persona_event(&scoped_persona)?
+        .custom_created_at(monotonic_created_at(
+            existing.as_ref().map(|row| row.created_at),
+        ))
+        .sign_with_keys(keys)
+        .map_err(|e| format!("failed to sign persona event: {e}"))?;
+    let retained = RetainedEvent {
+        kind: KIND_PERSONA,
+        pubkey,
+        d_tag,
+        content: event.content.to_string(),
+        created_at: event.created_at.as_secs() as i64,
+        raw_event: event.as_json(),
+        pending_sync: true,
+    };
+    retain_event(&conn, &retained)?;
+    Ok((event, retained, scoped_persona))
 }
 
 /// Purge a deleted persona's pending row and enqueue a NIP-09 tombstone, both
@@ -88,7 +202,6 @@ pub(in crate::commands) fn tombstone_persona_pending(
     d_tag: &str,
 ) {
     use crate::managed_agents::{
-        managed_agents_base_dir,
         persona_events::build_persona_delete,
         retention::{
             delete_retained_event, open_retention_db, retain_event, tombstone_retention_d_tag,
@@ -101,15 +214,12 @@ pub(in crate::commands) fn tombstone_persona_pending(
     const KIND_DELETE: u32 = 5;
 
     let result = (|| -> Result<(), String> {
-        let (pubkey, event) = {
-            let keys = state.keys.lock().map_err(|e| e.to_string())?;
-            let pubkey = keys.public_key().to_hex();
-            let event = build_persona_delete(d_tag, &pubkey)?
-                .sign_with_keys(&keys)
-                .map_err(|e| format!("failed to sign persona tombstone: {e}"))?;
-            (pubkey, event)
-        };
-        let conn = open_retention_db(&managed_agents_base_dir(app)?.join("retention.db"))?;
+        let scope = crate::managed_agents::retention::active_retention_scope(app, state)?;
+        let pubkey = scope.owner_keys.public_key().to_hex();
+        let event = build_persona_delete(d_tag, &pubkey)?
+            .sign_with_keys(&scope.owner_keys)
+            .map_err(|e| format!("failed to sign persona tombstone: {e}"))?;
+        let conn = open_retention_db(&scope.db_path)?;
         // Purge the persona row first so an unpublished edit can never resurrect
         // it after the tombstone publishes.
         delete_retained_event(&conn, KIND_PERSONA, &pubkey, d_tag)?;
@@ -132,3 +242,158 @@ pub(in crate::commands) fn tombstone_persona_pending(
         eprintln!("buzz-desktop: persona-tombstone: {e}");
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::managed_agents::retention::{
+        get_retained_event, open_retention_db, scoped_retention_db_path,
+    };
+    use buzz_core_pkg::kind::KIND_PERSONA;
+    use std::collections::BTreeMap;
+
+    fn persona() -> AgentDefinition {
+        AgentDefinition {
+            id: "catalog-reviewer".to_string(),
+            display_name: "Catalog Reviewer".to_string(),
+            avatar_url: None,
+            system_prompt: "Review the catalog.".to_string(),
+            runtime: None,
+            model: None,
+            provider: None,
+            name_pool: Vec::new(),
+            is_builtin: false,
+            is_active: true,
+            shared: false,
+            source_team: None,
+            source_team_persona_slug: None,
+            catalog_source: None,
+            env_vars: BTreeMap::new(),
+            respond_to: None,
+            respond_to_allowlist: Vec::new(),
+            parallelism: None,
+            created_at: "2026-07-27T00:00:00Z".to_string(),
+            updated_at: "2026-07-27T00:00:00Z".to_string(),
+        }
+    }
+
+    #[test]
+    fn share_state_and_pending_heads_are_scoped_by_relay_and_owner() {
+        let dir = tempfile::tempdir().unwrap();
+        let keys = nostr::Keys::generate();
+        let owner = keys.public_key().to_hex();
+        let community_a = scoped_retention_db_path(dir.path(), "wss://a.example", &owner);
+        let community_b = scoped_retention_db_path(dir.path(), "wss://b.example", &owner);
+        std::fs::create_dir_all(community_a.parent().unwrap()).unwrap();
+
+        let (_, _, shared_in_a) =
+            prepare_persona_publication_at(&community_a, &keys, &persona(), Some(true)).unwrap();
+        assert!(shared_in_a.shared);
+
+        let (_, _, unshared_in_b) =
+            prepare_persona_publication_at(&community_b, &keys, &persona(), None).unwrap();
+        assert!(!unshared_in_b.shared);
+
+        let mut edited = persona();
+        edited.system_prompt = "Review the latest catalog.".to_string();
+        let (_, _, edited_in_a) =
+            prepare_persona_publication_at(&community_a, &keys, &edited, None).unwrap();
+        assert!(
+            edited_in_a.shared,
+            "ordinary edits preserve only the active scope's share choice"
+        );
+
+        let conn_a = open_retention_db(&community_a).unwrap();
+        let conn_b = open_retention_db(&community_b).unwrap();
+        assert!(retained_persona_is_shared(
+            get_retained_event(&conn_a, KIND_PERSONA, &owner, "catalog-reviewer")
+                .unwrap()
+                .as_ref()
+        ));
+        assert!(!retained_persona_is_shared(
+            get_retained_event(&conn_b, KIND_PERSONA, &owner, "catalog-reviewer")
+                .unwrap()
+                .as_ref()
+        ));
+    }
+
+    /// A `shared = true` persona plus the scope that says so.
+    fn shared_persona_scope(dir: &std::path::Path) -> (RetentionScope, Vec<AgentDefinition>) {
+        let keys = nostr::Keys::generate();
+        let db_path = scoped_retention_db_path(dir, "wss://a.example", &keys.public_key().to_hex());
+        std::fs::create_dir_all(db_path.parent().unwrap()).unwrap();
+        prepare_persona_publication_at(&db_path, &keys, &persona(), Some(true)).unwrap();
+        (
+            RetentionScope {
+                db_path,
+                relay_url: "wss://a.example".to_string(),
+                owner_keys: keys,
+            },
+            vec![persona()],
+        )
+    }
+
+    #[test]
+    fn test_resolvable_scope_projects_the_retained_share_state() {
+        let dir = tempfile::tempdir().unwrap();
+        let (scope, mut personas) = shared_persona_scope(dir.path());
+
+        project_scoped_persona_sharing(Ok(scope), &mut personas);
+
+        assert!(personas[0].shared);
+    }
+
+    #[test]
+    fn test_recovery_mode_identity_projects_unshared_instead_of_failing() {
+        let dir = tempfile::tempdir().unwrap();
+        let (_scope, mut personas) = shared_persona_scope(dir.path());
+        personas[0].shared = true;
+
+        // The real recovery-mode failure: `active_retention_scope` cannot
+        // resolve a scope without signing keys, which is exactly what
+        // `identity_lost` / `keyring_locked` withhold.
+        let state = crate::app_state::build_app_state();
+        state
+            .identity_lost
+            .store(true, std::sync::atomic::Ordering::Release);
+        let error = state
+            .signing_keys()
+            .expect_err("recovery mode must withhold signing keys");
+
+        project_scoped_persona_sharing(Err(error), &mut personas);
+
+        assert!(
+            !personas[0].shared,
+            "an unresolvable scope degrades to unshared so list/create/update keep working"
+        );
+    }
+
+    #[test]
+    fn test_unopenable_retention_db_projects_unshared_instead_of_failing() {
+        let dir = tempfile::tempdir().unwrap();
+        let keys = nostr::Keys::generate();
+        let mut personas = vec![persona()];
+        personas[0].shared = true;
+
+        project_scoped_persona_sharing(
+            Ok(RetentionScope {
+                // A directory cannot be opened as the retention database.
+                db_path: dir.path().to_path_buf(),
+                relay_url: "wss://a.example".to_string(),
+                owner_keys: keys,
+            }),
+            &mut personas,
+        );
+
+        assert!(!personas[0].shared);
+    }
+
+    #[test]
+    fn explicit_share_enqueue_failure_is_returned() {
+        let dir = tempfile::tempdir().unwrap();
+        let keys = nostr::Keys::generate();
+        let error = prepare_persona_publication_at(dir.path(), &keys, &persona(), Some(true))
+            .expect_err("a directory cannot be opened as the retention database");
+        assert!(error.contains("failed to open retention db"));
+    }
+}
diff --git a/desktop/src-tauri/src/commands/personas/sharing.rs b/desktop/src-tauri/src/commands/personas/sharing.rs
new file mode 100644
index 00000000000..914c56252d0
--- /dev/null
+++ b/desktop/src-tauri/src/commands/personas/sharing.rs
@@ -0,0 +1,391 @@
+use tauri::{AppHandle, Manager};
+
+use crate::{
+    app_state::AppState,
+    managed_agents::{
+        load_personas,
+        retention::{mark_synced, open_retention_db},
+        AgentDefinition,
+    },
+};
+
+use super::pending::{prepare_persona_publication, PreparedPersonaPublication};
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, serde::Serialize)]
+#[serde(rename_all = "kebab-case")]
+pub enum PersonaSharePublicationStatus {
+    Published,
+    Queued,
+}
+
+#[derive(Debug, serde::Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SetPersonaSharedResult {
+    pub persona: AgentDefinition,
+    pub publication_status: PersonaSharePublicationStatus,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub relay_message: Option<String>,
+}
+
+#[tauri::command]
+pub async fn set_persona_shared(
+    id: String,
+    shared: bool,
+    app: AppHandle,
+) -> Result<SetPersonaSharedResult, String> {
+    let prepared = tokio::task::spawn_blocking({
+        let app = app.clone();
+        move || {
+            let state = app.state::<AppState>();
+            let _store_guard = state
+                .managed_agents_store_lock
+                .lock()
+                .map_err(|error| error.to_string())?;
+            let personas = load_personas(&app)?;
+            let persona = personas
+                .iter()
+                .find(|record| record.id == id)
+                .ok_or_else(|| format!("agent {id} not found"))?;
+
+            if persona.is_builtin {
+                return Err("Built-in agents cannot be shared to the catalog.".to_string());
+            }
+
+            // Strict path: unlike ordinary definition saves, an enqueue failure
+            // for this privacy-sensitive toggle must reach the command/UI.
+            prepare_persona_publication(&app, &state, persona, Some(shared))
+        }
+    })
+    .await
+    .map_err(|e| format!("spawn_blocking failed: {e}"))??;
+
+    let state = app.state::<AppState>();
+    publish_prepared_persona(&state, prepared).await
+}
+
+/// Save a persona edit AND publish its catalog head, returning the same
+/// `published | queued` outcome as [`set_persona_shared`].
+///
+/// The "save and publish" affordance in the edit dialog promises the change
+/// reaches the catalog on save. Plain `update_persona` only enqueues
+/// best-effort, so the UI could not report whether the relay accepted it. This
+/// takes the identical input and reuses the strict preparation path, then awaits
+/// the relay exactly like the share toggle does — a rejection or an unreachable
+/// relay stays durably queued for the flush loop and is reported as `queued`.
+#[tauri::command]
+pub async fn update_persona_and_publish(
+    input: crate::managed_agents::UpdatePersonaRequest,
+    app: AppHandle,
+) -> Result<SetPersonaSharedResult, String> {
+    let (_, prepared) =
+        super::update::update_persona_with(input, app.clone(), |app, state, persona| {
+            // Strict path: this command's contract is to report the publication
+            // outcome, so an enqueue failure must reach the UI rather than being
+            // logged and swallowed.
+            prepare_persona_publication(app, state, persona, None)
+        })
+        .await?;
+
+    let state = app.state::<AppState>();
+    publish_prepared_persona(&state, prepared).await
+}
+
+async fn publish_prepared_persona(
+    state: &AppState,
+    prepared: PreparedPersonaPublication,
+) -> Result<SetPersonaSharedResult, String> {
+    let api_base_url = crate::relay::relay_http_base_url(&prepared.scope.relay_url);
+    let publish_result = crate::relay::submit_signed_event_at_with_keys(
+        &prepared.event,
+        state,
+        &api_base_url,
+        &prepared.scope.owner_keys,
+    )
+    .await;
+
+    match publish_result {
+        Ok(_) => {
+            let conn = open_retention_db(&prepared.scope.db_path)?;
+            mark_synced(
+                &conn,
+                prepared.retained.kind,
+                &prepared.retained.pubkey,
+                &prepared.retained.d_tag,
+                prepared.retained.created_at,
+                &prepared.retained.content,
+            )?;
+            Ok(SetPersonaSharedResult {
+                persona: prepared.persona,
+                publication_status: PersonaSharePublicationStatus::Published,
+                relay_message: None,
+            })
+        }
+        Err(error) => Ok(SetPersonaSharedResult {
+            persona: prepared.persona,
+            publication_status: PersonaSharePublicationStatus::Queued,
+            relay_message: Some(error),
+        }),
+    }
+}
+
+#[cfg(all(test, not(target_os = "windows")))]
+mod tests {
+    use super::*;
+    use crate::{
+        app_state::build_app_state,
+        commands::personas::pending::prepare_persona_publication_at,
+        managed_agents::{
+            retention::{get_retained_event, open_retention_db, RetentionScope},
+            AgentDefinition,
+        },
+    };
+    use std::collections::BTreeMap;
+
+    fn persona() -> AgentDefinition {
+        AgentDefinition {
+            id: "catalog-reviewer".to_string(),
+            display_name: "Catalog Reviewer".to_string(),
+            avatar_url: None,
+            system_prompt: "Review the catalog.".to_string(),
+            runtime: None,
+            model: None,
+            provider: None,
+            name_pool: Vec::new(),
+            is_builtin: false,
+            is_active: true,
+            shared: false,
+            source_team: None,
+            source_team_persona_slug: None,
+            catalog_source: None,
+            env_vars: BTreeMap::new(),
+            respond_to: None,
+            respond_to_allowlist: Vec::new(),
+            parallelism: None,
+            created_at: "2026-07-27T00:00:00Z".to_string(),
+            updated_at: "2026-07-27T00:00:00Z".to_string(),
+        }
+    }
+
+    async fn spawn_relay(accepted: bool) -> String {
+        use axum::{routing::post, Router};
+
+        let app = Router::new().route(
+            "/events",
+            post(move |body: String| async move {
+                let event: serde_json::Value = serde_json::from_str(&body).unwrap_or_default();
+                serde_json::json!({
+                    "event_id": event.get("id").and_then(serde_json::Value::as_str).unwrap_or(""),
+                    "accepted": accepted,
+                    "message": if accepted { "" } else { "policy rejection" }
+                })
+                .to_string()
+            }),
+        );
+        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+        let addr = listener.local_addr().unwrap();
+        tokio::spawn(async move {
+            axum::serve(listener, app).await.ok();
+        });
+        format!("http://{addr}")
+    }
+
+    fn prepared(
+        db_path: &std::path::Path,
+        relay_url: String,
+        keys: nostr::Keys,
+        shared_override: Option<bool>,
+    ) -> PreparedPersonaPublication {
+        let (event, retained, persona) =
+            prepare_persona_publication_at(db_path, &keys, &persona(), shared_override).unwrap();
+        PreparedPersonaPublication {
+            scope: RetentionScope {
+                db_path: db_path.to_path_buf(),
+                relay_url,
+                owner_keys: keys,
+            },
+            event,
+            retained,
+            persona,
+        }
+    }
+
+    #[tokio::test]
+    async fn relay_rejection_stays_durably_queued() {
+        let dir = tempfile::tempdir().unwrap();
+        let db_path = dir.path().join("retention.db");
+        let keys = nostr::Keys::generate();
+        let owner = keys.public_key().to_hex();
+        let prepared = prepared(&db_path, spawn_relay(false).await, keys, Some(true));
+        let state = build_app_state();
+
+        let result = publish_prepared_persona(&state, prepared).await.unwrap();
+
+        assert_eq!(
+            result.publication_status,
+            PersonaSharePublicationStatus::Queued
+        );
+        assert!(result
+            .relay_message
+            .as_deref()
+            .is_some_and(|message| message.contains("relay rejected event")));
+        assert!(
+            get_retained_event(
+                &open_retention_db(&db_path).unwrap(),
+                buzz_core_pkg::kind::KIND_PERSONA,
+                &owner,
+                "catalog-reviewer"
+            )
+            .unwrap()
+            .unwrap()
+            .pending_sync
+        );
+    }
+
+    #[tokio::test]
+    async fn unavailable_relay_stays_durably_queued() {
+        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+        let relay_url = format!("http://{}", listener.local_addr().unwrap());
+        drop(listener);
+        let dir = tempfile::tempdir().unwrap();
+        let db_path = dir.path().join("retention.db");
+        let keys = nostr::Keys::generate();
+        let owner = keys.public_key().to_hex();
+        let prepared = prepared(&db_path, relay_url, keys, Some(true));
+        let state = build_app_state();
+
+        let result = publish_prepared_persona(&state, prepared).await.unwrap();
+
+        assert_eq!(
+            result.publication_status,
+            PersonaSharePublicationStatus::Queued
+        );
+        assert!(result
+            .relay_message
+            .as_deref()
+            .is_some_and(|message| message.starts_with("relay unreachable:")));
+        assert!(
+            get_retained_event(
+                &open_retention_db(&db_path).unwrap(),
+                buzz_core_pkg::kind::KIND_PERSONA,
+                &owner,
+                "catalog-reviewer"
+            )
+            .unwrap()
+            .unwrap()
+            .pending_sync
+        );
+    }
+
+    #[tokio::test]
+    async fn relay_acceptance_marks_the_scoped_head_synced() {
+        let dir = tempfile::tempdir().unwrap();
+        let db_path = dir.path().join("retention.db");
+        let keys = nostr::Keys::generate();
+        let owner = keys.public_key().to_hex();
+        let prepared = prepared(&db_path, spawn_relay(true).await, keys, Some(true));
+        let state = build_app_state();
+
+        let result = publish_prepared_persona(&state, prepared).await.unwrap();
+
+        assert_eq!(
+            result.publication_status,
+            PersonaSharePublicationStatus::Published
+        );
+        assert!(
+            !get_retained_event(
+                &open_retention_db(&db_path).unwrap(),
+                buzz_core_pkg::kind::KIND_PERSONA,
+                &owner,
+                "catalog-reviewer"
+            )
+            .unwrap()
+            .unwrap()
+            .pending_sync
+        );
+    }
+
+    /// `update_persona_and_publish` differs from the share toggle in one way:
+    /// it passes no share override, so the edit must keep whatever the scoped
+    /// head already says, and it reports the relay outcome to the caller.
+    #[tokio::test]
+    async fn test_update_and_publish_acceptance_publishes_the_edit_at_the_current_share_state() {
+        let dir = tempfile::tempdir().unwrap();
+        let db_path = dir.path().join("retention.db");
+        let keys = nostr::Keys::generate();
+        let owner = keys.public_key().to_hex();
+        // The persona is already shared in this scope.
+        prepare_persona_publication_at(&db_path, &keys, &persona(), Some(true)).unwrap();
+        let prepared = prepared(&db_path, spawn_relay(true).await, keys, None);
+        let state = build_app_state();
+
+        let result = publish_prepared_persona(&state, prepared).await.unwrap();
+
+        assert_eq!(
+            result.publication_status,
+            PersonaSharePublicationStatus::Published
+        );
+        assert!(
+            result.persona.shared,
+            "an ordinary edit must not silently unshare the persona"
+        );
+        assert!(
+            !get_retained_event(
+                &open_retention_db(&db_path).unwrap(),
+                buzz_core_pkg::kind::KIND_PERSONA,
+                &owner,
+                "catalog-reviewer"
+            )
+            .unwrap()
+            .unwrap()
+            .pending_sync
+        );
+    }
+
+    #[tokio::test]
+    async fn test_update_and_publish_relay_rejection_reports_queued_not_failure() {
+        let dir = tempfile::tempdir().unwrap();
+        let db_path = dir.path().join("retention.db");
+        let keys = nostr::Keys::generate();
+        let owner = keys.public_key().to_hex();
+        prepare_persona_publication_at(&db_path, &keys, &persona(), Some(true)).unwrap();
+        let prepared = prepared(&db_path, spawn_relay(false).await, keys, None);
+        let state = build_app_state();
+
+        let result = publish_prepared_persona(&state, prepared).await.unwrap();
+
+        assert_eq!(
+            result.publication_status,
+            PersonaSharePublicationStatus::Queued
+        );
+        assert!(result
+            .relay_message
+            .as_deref()
+            .is_some_and(|message| message.contains("relay rejected event")));
+        assert!(
+            get_retained_event(
+                &open_retention_db(&db_path).unwrap(),
+                buzz_core_pkg::kind::KIND_PERSONA,
+                &owner,
+                "catalog-reviewer"
+            )
+            .unwrap()
+            .unwrap()
+            .pending_sync,
+            "the edit stays queued for the flush loop"
+        );
+    }
+
+    /// The save path swallows enqueue failures (`retain_persona_pending` logs
+    /// them). This command promises a publication outcome, so the strict
+    /// preparation it uses must surface the failure instead.
+    #[tokio::test]
+    async fn test_update_and_publish_enqueue_failure_is_returned() {
+        let dir = tempfile::tempdir().unwrap();
+        let keys = nostr::Keys::generate();
+
+        let error = prepare_persona_publication_at(dir.path(), &keys, &persona(), None)
+            .expect_err("a directory cannot be opened as the retention database");
+
+        assert!(error.contains("failed to open retention db"));
+    }
+}
diff --git a/desktop/src-tauri/src/commands/personas/snapshot.rs b/desktop/src-tauri/src/commands/personas/snapshot.rs
index e4d8a5d1bc9..583296dac0c 100644
--- a/desktop/src-tauri/src/commands/personas/snapshot.rs
+++ b/desktop/src-tauri/src/commands/personas/snapshot.rs
@@ -164,6 +164,33 @@ fn parse_format_is_png(s: &str) -> Result<bool, String> {
     }
 }
 
+fn materialize_portable_runtime_defaults(
+    record: &mut ManagedAgentRecord,
+    global: &crate::managed_agents::GlobalAgentConfig,
+) {
+    if record
+        .model
+        .as_deref()
+        .is_none_or(|value| value.trim().is_empty())
+    {
+        record.model = global.model.clone();
+    }
+    if record
+        .provider
+        .as_deref()
+        .is_none_or(|value| value.trim().is_empty())
+    {
+        record.provider = global.provider.clone();
+    }
+    if record
+        .runtime
+        .as_deref()
+        .is_none_or(|value| value.trim().is_empty())
+    {
+        record.runtime = global.preferred_runtime.clone();
+    }
+}
+
 /// Shared production encoding path.
 ///
 /// Resolves the agent definition, validates inputs, fetches optional memory,
@@ -196,6 +223,13 @@ pub(crate) async fn materialize_snapshot_bytes(
         let definitions = load_agent_definitions(&app)?;
         let (def_record, is_definition) = resolve_from_lists(&id, &instances, &definitions)
             .map(|(r, is_def)| (r.clone(), is_def))?;
+        let mut def_record = def_record;
+        // A snapshot is a verbatim portable copy of the effective runtime,
+        // provider, and model configuration, not a pointer to the sender's
+        // machine-wide defaults. This does not translate or substitute values
+        // for a different recipient setup.
+        let global = crate::managed_agents::load_global_agent_config(&app).unwrap_or_default();
+        materialize_portable_runtime_defaults(&mut def_record, &global);
 
         let memory_pubkey = if memory_level != MemoryLevel::None {
             let mpk = memory_source_pubkey.as_deref().unwrap_or("");
@@ -400,6 +434,8 @@ pub async fn encode_agent_snapshot_for_send(
     })
 }
 
+#[cfg(test)]
+mod fidelity_tests;
 #[cfg(test)]
 mod tests;
 
@@ -432,6 +468,7 @@ mod png_body_tests {
             version: crate::managed_agents::agent_snapshot::FORMAT_VERSION,
             definition: crate::managed_agents::agent_snapshot::AgentSnapshotDefinition {
                 name: "Agent".to_string(),
+                source_is_builtin: false,
                 system_prompt: None,
                 runtime: None,
                 model: None,
diff --git a/desktop/src-tauri/src/commands/personas/snapshot/fidelity_tests.rs b/desktop/src-tauri/src/commands/personas/snapshot/fidelity_tests.rs
new file mode 100644
index 00000000000..00a14573938
--- /dev/null
+++ b/desktop/src-tauri/src/commands/personas/snapshot/fidelity_tests.rs
@@ -0,0 +1,210 @@
+use super::import::decode_snapshot_from_bytes;
+use super::*;
+use crate::managed_agents::{
+    agent_snapshot::{
+        AgentSnapshot, AgentSnapshotDefinition, AgentSnapshotMemory, AgentSnapshotProfile,
+        FORMAT_DISCRIMINATOR, FORMAT_VERSION,
+    },
+    BackendKind, ManagedAgentRecord, RespondTo,
+};
+use std::collections::BTreeMap;
+
+fn make_definition(slug: &str) -> ManagedAgentRecord {
+    ManagedAgentRecord {
+        pubkey: String::new(),
+        slug: Some(slug.to_string()),
+        name: slug.to_string(),
+        display_name: None,
+        persona_id: None,
+        private_key_nsec: String::new(),
+        auth_tag: None,
+        relay_url: String::new(),
+        avatar_url: None,
+        acp_command: String::new(),
+        agent_command: String::new(),
+        agent_command_override: None,
+        agent_args: vec![],
+        mcp_command: String::new(),
+        turn_timeout_seconds: 0,
+        idle_timeout_seconds: None,
+        max_turn_duration_seconds: None,
+        parallelism: 1,
+        system_prompt: None,
+        model: None,
+        provider: None,
+        persona_source_version: None,
+        env_vars: BTreeMap::new(),
+        start_on_app_launch: false,
+        auto_restart_on_config_change: false,
+        runtime_pid: None,
+        backend: BackendKind::Local,
+        backend_agent_id: None,
+        provider_binary_path: None,
+        team_id: None,
+        persona_team_dir: None,
+        persona_name_in_team: None,
+        created_at: String::new(),
+        updated_at: String::new(),
+        last_started_at: None,
+        last_stopped_at: None,
+        last_exit_code: None,
+        last_error: None,
+        last_error_code: None,
+        respond_to: RespondTo::default(),
+        respond_to_allowlist: vec![],
+        runtime: None,
+        name_pool: vec![],
+        is_builtin: false,
+        is_active: false,
+        shared: false,
+        source_team: None,
+        source_team_persona_slug: None,
+        catalog_source: None,
+        definition_respond_to: None,
+        definition_respond_to_allowlist: vec![],
+        definition_parallelism: None,
+        relay_mesh: None,
+    }
+}
+
+/// Build a minimal valid AgentSnapshot for import tests.
+fn make_snapshot(
+    memory_level: MemoryLevel,
+    entries: Vec<AgentSnapshotMemoryEntry>,
+) -> AgentSnapshot {
+    AgentSnapshot {
+        format: FORMAT_DISCRIMINATOR.to_string(),
+        version: FORMAT_VERSION,
+        definition: AgentSnapshotDefinition {
+            name: "Test Agent".to_string(),
+            source_is_builtin: false,
+            system_prompt: Some("You are helpful.".to_string()),
+            runtime: None,
+            model: None,
+            provider: None,
+            parallelism: None,
+            respond_to: None,
+            respond_to_allowlist: vec![],
+            name_pool: vec![],
+            idle_timeout_seconds: None,
+            max_turn_duration_seconds: None,
+        },
+        profile: AgentSnapshotProfile {
+            display_name: "Test Agent".to_string(),
+            about: None,
+            avatar_data_url: None,
+            avatar_url: None,
+        },
+        memory: AgentSnapshotMemory {
+            level: memory_level,
+            entries,
+        },
+    }
+}
+
+// ── Portable effective configuration ─────────────────────────────────────
+
+#[test]
+fn inherited_runtime_provider_and_model_are_materialized_for_export() {
+    let mut record = make_definition("wren");
+    let global = crate::managed_agents::GlobalAgentConfig {
+        preferred_runtime: Some("goose".to_string()),
+        provider: Some("databricks_v2".to_string()),
+        model: Some("databricks-gpt-5-6-sol".to_string()),
+        ..Default::default()
+    };
+
+    materialize_portable_runtime_defaults(&mut record, &global);
+
+    assert_eq!(record.runtime.as_deref(), Some("goose"));
+    assert_eq!(record.provider.as_deref(), Some("databricks_v2"));
+    assert_eq!(record.model.as_deref(), Some("databricks-gpt-5-6-sol"));
+}
+
+#[test]
+fn explicit_runtime_provider_and_model_win_over_global_defaults() {
+    let mut record = make_definition("wren");
+    record.runtime = Some("claude".to_string());
+    record.provider = Some("anthropic".to_string());
+    record.model = Some("claude-opus-5".to_string());
+    let global = crate::managed_agents::GlobalAgentConfig {
+        preferred_runtime: Some("goose".to_string()),
+        provider: Some("databricks_v2".to_string()),
+        model: Some("databricks-gpt-5-6-sol".to_string()),
+        ..Default::default()
+    };
+
+    materialize_portable_runtime_defaults(&mut record, &global);
+
+    assert_eq!(record.runtime.as_deref(), Some("claude"));
+    assert_eq!(record.provider.as_deref(), Some("anthropic"));
+    assert_eq!(record.model.as_deref(), Some("claude-opus-5"));
+}
+
+/// PNG image-body avatar overrides manifest avatar fields and all definition
+/// config survives the exact production decoder.
+#[test]
+fn import_png_body_avatar_and_full_model_round_trip() {
+    use crate::managed_agents::agent_snapshot::{decode_avatar_data_url, encode_snapshot_png};
+
+    let mut snapshot = make_snapshot(MemoryLevel::None, vec![]);
+    snapshot.definition.runtime = Some("goose".to_string());
+    snapshot.definition.model = Some("databricks-gpt-5-6-sol".to_string());
+    snapshot.definition.provider = Some("databricks_v2".to_string());
+    snapshot.profile.avatar_data_url = None;
+    snapshot.profile.avatar_url = Some("https://sender.invalid/avatar.png".to_string());
+
+    let avatar = image::DynamicImage::ImageRgba8(image::RgbaImage::from_pixel(
+        4,
+        3,
+        image::Rgba([23, 91, 177, 255]),
+    ));
+    let mut avatar_png = std::io::Cursor::new(Vec::new());
+    avatar
+        .write_to(&mut avatar_png, image::ImageFormat::Png)
+        .unwrap();
+    let png_bytes = encode_snapshot_png(&snapshot, Some(avatar_png.get_ref())).unwrap();
+
+    let decoded = decode_snapshot_from_bytes(&png_bytes).unwrap();
+    assert_eq!(decoded.definition.runtime.as_deref(), Some("goose"));
+    assert_eq!(
+        decoded.definition.model.as_deref(),
+        Some("databricks-gpt-5-6-sol")
+    );
+    assert_eq!(
+        decoded.definition.provider.as_deref(),
+        Some("databricks_v2")
+    );
+    assert_eq!(
+        decoded.profile.avatar_url.as_deref(),
+        Some("https://sender.invalid/avatar.png")
+    );
+
+    let avatar_data_url = decoded
+        .profile
+        .avatar_data_url
+        .as_deref()
+        .expect("PNG image body must become the effective portable avatar");
+    let avatar_bytes = decode_avatar_data_url(avatar_data_url).unwrap();
+    let imported_avatar = image::load_from_memory(&avatar_bytes).unwrap();
+    assert_eq!((imported_avatar.width(), imported_avatar.height()), (4, 3));
+    assert_eq!(
+        imported_avatar.to_rgba8().get_pixel(0, 0).0,
+        [23, 91, 177, 255]
+    );
+}
+
+/// The transparent 1×1 no-avatar card must not override a manifest fallback.
+#[test]
+fn import_png_placeholder_keeps_manifest_avatar_fallback() {
+    use crate::managed_agents::agent_snapshot::encode_snapshot_png;
+
+    let mut snapshot = make_snapshot(MemoryLevel::None, vec![]);
+    snapshot.profile.avatar_data_url = None;
+    snapshot.profile.avatar_url = Some("https://example.com/avatar.png".to_string());
+    let png_bytes = encode_snapshot_png(&snapshot, None).unwrap();
+
+    let decoded = decode_snapshot_from_bytes(&png_bytes).unwrap();
+    assert!(decoded.profile.avatar_data_url.is_none());
+    assert_eq!(decoded.profile.avatar_url, snapshot.profile.avatar_url);
+}
diff --git a/desktop/src-tauri/src/commands/personas/snapshot/import.rs b/desktop/src-tauri/src/commands/personas/snapshot/import.rs
index ac5c0eace6b..d23efe7730e 100644
--- a/desktop/src-tauri/src/commands/personas/snapshot/import.rs
+++ b/desktop/src-tauri/src/commands/personas/snapshot/import.rs
@@ -13,7 +13,7 @@ use tauri::{AppHandle, Emitter, State};
 use crate::{
     app_state::AppState,
     managed_agents::{
-        agent_snapshot::{decode_snapshot_json, decode_snapshot_png, MemoryLevel},
+        agent_snapshot::{decode_snapshot_json, decode_snapshot_png, AgentSnapshot, MemoryLevel},
         load_managed_agents, load_personas, save_managed_agents, save_personas, AgentDefinition,
         ManagedAgentRecord, RespondTo,
     },
@@ -50,6 +50,13 @@ pub(super) fn reject_legacy_persona_filename(file_name: &str) -> Result<(), Stri
 pub struct AgentSnapshotImportPreview {
     /// Agent display name from the snapshot.
     pub display_name: String,
+    /// Whether the exported source definition was built in. This is display
+    /// metadata only; confirmed imports are always independent custom agents.
+    pub is_builtin: bool,
+    /// Preferred model from the exported definition.
+    pub model: Option<String>,
+    /// Preferred runtime from the exported definition.
+    pub runtime: Option<String>,
     /// System prompt, if any.
     pub system_prompt: Option<String>,
     /// Effective avatar: data URL if present, otherwise the source URL fallback.
@@ -213,7 +220,15 @@ pub(crate) fn decode_snapshot_from_bytes(
                 file_bytes.len() / (1024 * 1024)
             ));
         }
-        let snapshot = decode_snapshot_png(file_bytes)?;
+        let mut snapshot = decode_snapshot_png(file_bytes)?;
+        // The PNG image body is the portable avatar. It deliberately wins over
+        // manifest avatar fields, whose URL may only be reachable by the
+        // sender. A 1×1 export placeholder leaves the manifest fallback intact.
+        if let Some(avatar_data_url) =
+            crate::managed_agents::snapshot_avatar::snapshot_png_avatar_data_url(file_bytes)?
+        {
+            snapshot.profile.avatar_data_url = Some(avatar_data_url);
+        }
         if snapshot.memory.level == MemoryLevel::None && !snapshot.memory.entries.is_empty() {
             return Err(
                 "Snapshot is malformed: memory.level is 'none' but entries are present."
@@ -241,6 +256,24 @@ pub(crate) fn decode_snapshot_from_bytes(
     Ok(snapshot)
 }
 
+async fn materialize_import_avatar<F, Fut>(
+    avatar_data_url: Option<&str>,
+    avatar_url: Option<&str>,
+    upload: F,
+) -> Result<Option<String>, String>
+where
+    F: FnOnce(Vec<u8>) -> Fut,
+    Fut: std::future::Future<Output = Result<String, String>>,
+{
+    let Some(avatar_data_url) = avatar_data_url else {
+        return Ok(avatar_url.map(str::to_string));
+    };
+    let avatar_bytes =
+        crate::managed_agents::agent_snapshot::decode_avatar_data_url(avatar_data_url)
+            .ok_or_else(|| "Snapshot avatar data is malformed.".to_string())?;
+    upload(avatar_bytes).await.map(Some)
+}
+
 // ── `preview_agent_snapshot_import` ──────────────────────────────────────────
 
 /// Decode and validate a snapshot file, returning a preview for the
@@ -262,32 +295,41 @@ pub async fn preview_agent_snapshot_import(
         reject_legacy_persona_filename(&file_name)?;
         let snapshot = decode_snapshot_from_bytes(&file_bytes)?;
 
-        let memory_level = match snapshot.memory.level {
-            MemoryLevel::None => "none",
-            MemoryLevel::Core => "core",
-            MemoryLevel::Everything => "everything",
-        }
-        .to_string();
-
-        Ok(AgentSnapshotImportPreview {
-            display_name: snapshot.profile.display_name.clone(),
-            system_prompt: snapshot.definition.system_prompt.clone(),
-            // Effective avatar: data URL wins; URL fallback if no data URL.
-            avatar_url: snapshot
-                .profile
-                .avatar_data_url
-                .clone()
-                .or_else(|| snapshot.profile.avatar_url.clone()),
-            memory_level,
-            memory_entry_count: snapshot.memory.entries.len(),
-            source_allowlist_count: snapshot.definition.respond_to_allowlist.len(),
-            has_source_allowlist: !snapshot.definition.respond_to_allowlist.is_empty(),
-        })
+        Ok(build_agent_snapshot_import_preview(&snapshot))
     })
     .await
     .map_err(|e| format!("spawn_blocking failed: {e}"))?
 }
 
+pub(crate) fn build_agent_snapshot_import_preview(
+    snapshot: &AgentSnapshot,
+) -> AgentSnapshotImportPreview {
+    let memory_level = match snapshot.memory.level {
+        MemoryLevel::None => "none",
+        MemoryLevel::Core => "core",
+        MemoryLevel::Everything => "everything",
+    }
+    .to_string();
+
+    AgentSnapshotImportPreview {
+        display_name: snapshot.profile.display_name.clone(),
+        is_builtin: snapshot.definition.source_is_builtin,
+        model: snapshot.definition.model.clone(),
+        runtime: snapshot.definition.runtime.clone(),
+        system_prompt: snapshot.definition.system_prompt.clone(),
+        // Effective avatar: data URL wins; URL fallback if no data URL.
+        avatar_url: snapshot
+            .profile
+            .avatar_data_url
+            .clone()
+            .or_else(|| snapshot.profile.avatar_url.clone()),
+        memory_level,
+        memory_entry_count: snapshot.memory.entries.len(),
+        source_allowlist_count: snapshot.definition.respond_to_allowlist.len(),
+        has_source_allowlist: !snapshot.definition.respond_to_allowlist.is_empty(),
+    }
+}
+
 // ── `confirm_agent_snapshot_import` ──────────────────────────────────────────
 
 /// Import a `buzz-agent-snapshot v1` file as a brand-new agent.
@@ -330,12 +372,21 @@ pub async fn confirm_agent_snapshot_import(
     )?;
     let minted_parallelism = minted.parallelism;
 
-    // Effective avatar: data URL wins; URL fallback when data URL is absent.
-    let effective_avatar: Option<String> = snapshot
-        .profile
-        .avatar_data_url
-        .clone()
-        .or_else(|| snapshot.profile.avatar_url.clone());
+    // Profile metadata must contain a hosted URL. Inline avatar data can be far
+    // larger than the relay's kind:0 content limit, so upload imported pixels
+    // before minting or persisting the new agent. Failing here keeps import
+    // atomic instead of creating an agent whose profile can never publish.
+    let effective_avatar = materialize_import_avatar(
+        snapshot.profile.avatar_data_url.as_deref(),
+        snapshot.profile.avatar_url.as_deref(),
+        |avatar_bytes| async {
+            crate::commands::media::upload_image_bytes(avatar_bytes, &state)
+                .await
+                .map(|descriptor| descriptor.url)
+                .map_err(|error| format!("Could not upload the imported avatar: {error}"))
+        },
+    )
+    .await?;
 
     // Wire-format string for the persona definition's respond_to field.
     // Omit when it is the default (owner-only) to keep definitions clean.
@@ -408,8 +459,10 @@ pub async fn confirm_agent_snapshot_import(
             name_pool: snapshot.definition.name_pool.clone(),
             is_builtin: false,
             is_active: true,
+            shared: false,
             source_team: None,
             source_team_persona_slug: None,
+            catalog_source: None,
             env_vars: std::collections::BTreeMap::new(),
             respond_to: respond_to_wire.clone(),
             respond_to_allowlist: minted.respond_to_allowlist.clone(),
@@ -476,8 +529,10 @@ pub async fn confirm_agent_snapshot_import(
             respond_to_allowlist: minted.respond_to_allowlist.clone(),
             is_builtin: false,
             is_active: true,
+            shared: false,
             source_team: None,
             source_team_persona_slug: None,
+            catalog_source: None,
             definition_respond_to: respond_to_wire.clone(),
             definition_respond_to_allowlist: minted.respond_to_allowlist.clone(),
             definition_parallelism: minted_parallelism,
@@ -585,7 +640,6 @@ pub async fn confirm_agent_snapshot_import(
 fn retain_agent_pending(app: &AppHandle, state: &AppState, record: &ManagedAgentRecord) {
     use crate::managed_agents::{
         agent_events::{agent_event_content, build_agent_event},
-        managed_agents_base_dir,
         persona_events::monotonic_created_at,
         retention::{get_retained_event, open_retention_db, retain_event, RetainedEvent},
     };
@@ -593,11 +647,12 @@ fn retain_agent_pending(app: &AppHandle, state: &AppState, record: &ManagedAgent
     use nostr::JsonUtil;
 
     let result = (|| -> Result<(), String> {
-        let conn = open_retention_db(&managed_agents_base_dir(app)?.join("retention.db"))?;
+        let scope = crate::managed_agents::retention::active_retention_scope(app, state)?;
+        let conn = open_retention_db(&scope.db_path)?;
         let content = serde_json::to_string(&agent_event_content(record))
             .map_err(|e| format!("failed to serialize agent content: {e}"))?;
         let (owner_pubkey, event) = {
-            let keys = state.signing_keys()?;
+            let keys = &scope.owner_keys;
             let owner_pubkey = keys.public_key().to_hex();
             let existing =
                 get_retained_event(&conn, KIND_MANAGED_AGENT, &owner_pubkey, &record.pubkey)?;
@@ -606,7 +661,7 @@ fn retain_agent_pending(app: &AppHandle, state: &AppState, record: &ManagedAgent
             }
             let event = build_agent_event(record)?
                 .custom_created_at(monotonic_created_at(existing.map(|row| row.created_at)))
-                .sign_with_keys(&keys)
+                .sign_with_keys(keys)
                 .map_err(|e| format!("failed to sign agent event: {e}"))?;
             (owner_pubkey, event)
         };
@@ -683,3 +738,114 @@ async fn submit_engram_event(
     }
     Ok(())
 }
+
+#[cfg(test)]
+mod import_avatar_tests {
+    use super::materialize_import_avatar;
+    use std::cell::Cell;
+
+    #[tokio::test]
+    async fn inline_avatar_is_uploaded_and_replaced_with_hosted_url() {
+        let uploaded = Cell::new(false);
+        let result = materialize_import_avatar(
+            Some("data:image/png;base64,iVBORw0KGgo="),
+            Some("https://sender.invalid/avatar.png"),
+            |bytes| {
+                uploaded.set(true);
+                async move {
+                    assert_eq!(bytes, b"\x89PNG\r\n\x1a\n");
+                    Ok("https://relay.example/media/avatar.png".to_string())
+                }
+            },
+        )
+        .await
+        .unwrap();
+
+        assert!(uploaded.get());
+        assert_eq!(
+            result.as_deref(),
+            Some("https://relay.example/media/avatar.png")
+        );
+    }
+
+    #[tokio::test]
+    async fn hosted_avatar_skips_upload() {
+        let result =
+            materialize_import_avatar(None, Some("https://sender.example/avatar.png"), |_| async {
+                panic!("hosted avatars must not be uploaded")
+            })
+            .await
+            .unwrap();
+
+        assert_eq!(result.as_deref(), Some("https://sender.example/avatar.png"));
+    }
+
+    #[tokio::test]
+    async fn relay_sized_inline_avatar_becomes_bounded_signed_profile() {
+        use base64::{engine::general_purpose::STANDARD, Engine};
+        use image::ImageEncoder;
+        use nostr::JsonUtil;
+
+        let mut pixels = vec![0_u8; 512 * 512 * 4];
+        let mut seed = 0x1234_5678_u32;
+        for byte in &mut pixels {
+            seed ^= seed << 13;
+            seed ^= seed >> 17;
+            seed ^= seed << 5;
+            *byte = seed as u8;
+        }
+        let mut source = Vec::new();
+        image::codecs::png::PngEncoder::new(&mut source)
+            .write_image(&pixels, 512, 512, image::ExtendedColorType::Rgba8)
+            .unwrap();
+        assert!(source.len() > 256 * 1024);
+        let data_url = format!("data:image/png;base64,{}", STANDARD.encode(&source));
+        assert!(data_url.len() > 256 * 1024);
+
+        let avatar = materialize_import_avatar(Some(&data_url), None, |bytes| async move {
+            let mime = crate::commands::media::detect_and_validate_mime(&bytes)?;
+            assert_eq!(mime, "image/png");
+            let sanitized = crate::commands::media::sanitize_image_for_upload(bytes, &mime)?;
+            image::load_from_memory(&sanitized).map_err(|error| error.to_string())?;
+            Ok("https://relay.example/media/avatar.png".to_string())
+        })
+        .await
+        .unwrap()
+        .unwrap();
+
+        let event =
+            crate::events::build_profile(Some("Imported agent"), None, Some(&avatar), None, None)
+                .unwrap()
+                .sign_with_keys(&nostr::Keys::generate())
+                .unwrap();
+        assert!(event.content.len() < 64 * 1024);
+        assert!(!event.content.contains("data:image/"));
+        assert!(event
+            .content
+            .contains("https://relay.example/media/avatar.png"));
+        assert!(event.as_json().len() < 256 * 1024);
+    }
+
+    #[tokio::test]
+    async fn upload_failure_aborts_avatar_materialization() {
+        let result = materialize_import_avatar(
+            Some("data:image/png;base64,iVBORw0KGgo="),
+            None,
+            |_| async { Err("relay upload failed".to_string()) },
+        )
+        .await;
+
+        assert_eq!(result.unwrap_err(), "relay upload failed");
+    }
+
+    #[tokio::test]
+    async fn malformed_inline_avatar_fails_before_upload() {
+        let result =
+            materialize_import_avatar(Some("data:image/png;base64,not-base64!"), None, |_| async {
+                panic!("malformed avatars must not be uploaded")
+            })
+            .await;
+
+        assert_eq!(result.unwrap_err(), "Snapshot avatar data is malformed.");
+    }
+}
diff --git a/desktop/src-tauri/src/commands/personas/snapshot/tests.rs b/desktop/src-tauri/src/commands/personas/snapshot/tests.rs
index b1d19f06b6e..42893102807 100644
--- a/desktop/src-tauri/src/commands/personas/snapshot/tests.rs
+++ b/desktop/src-tauri/src/commands/personas/snapshot/tests.rs
@@ -1,6 +1,7 @@
 use super::import::{
-    decode_snapshot_from_bytes, reject_legacy_persona_filename, resolve_snapshot_import_behavior,
-    AgentSnapshotImportResult, MAX_SNAPSHOT_JSON_BYTES, MAX_SNAPSHOT_PNG_BYTES,
+    build_agent_snapshot_import_preview, decode_snapshot_from_bytes,
+    reject_legacy_persona_filename, resolve_snapshot_import_behavior, AgentSnapshotImportResult,
+    MAX_SNAPSHOT_JSON_BYTES, MAX_SNAPSHOT_PNG_BYTES,
 };
 use super::*;
 use crate::managed_agents::{
@@ -64,8 +65,10 @@ fn make_definition(slug: &str) -> ManagedAgentRecord {
         name_pool: vec![],
         is_builtin: false,
         is_active: false,
+        shared: false,
         source_team: None,
         source_team_persona_slug: None,
+        catalog_source: None,
         definition_respond_to: None,
         definition_respond_to_allowlist: vec![],
         definition_parallelism: None,
@@ -94,6 +97,7 @@ fn make_snapshot(
         version: FORMAT_VERSION,
         definition: AgentSnapshotDefinition {
             name: "Test Agent".to_string(),
+            source_is_builtin: false,
             system_prompt: Some("You are helpful.".to_string()),
             runtime: None,
             model: None,
@@ -551,6 +555,22 @@ fn import_preview_flags_non_empty_source_allowlist() {
     );
 }
 
+#[test]
+fn import_preview_includes_exported_definition_metadata() {
+    let mut snapshot = make_snapshot(MemoryLevel::None, vec![]);
+    snapshot.definition.source_is_builtin = true;
+    snapshot.definition.model = Some("claude-opus-4-5".to_string());
+    snapshot.definition.runtime = Some("goose".to_string());
+    let bytes = crate::managed_agents::agent_snapshot::encode_snapshot_json(&snapshot).unwrap();
+    let decoded = decode_snapshot_from_bytes(&bytes).unwrap();
+
+    let preview = build_agent_snapshot_import_preview(&decoded);
+
+    assert!(preview.is_builtin);
+    assert_eq!(preview.model.as_deref(), Some("claude-opus-4-5"));
+    assert_eq!(preview.runtime.as_deref(), Some("goose"));
+}
+
 // ── Import: resolve_snapshot_import_behavior — the production selection path
 //
 // All tests below call `resolve_snapshot_import_behavior` directly.  This is
@@ -614,6 +634,14 @@ fn import_non_allowlist_mode_preserved_when_keep_false() {
     );
 }
 
+#[test]
+fn import_catalog_owner_only_without_allowlist_succeeds() {
+    let minted = resolve_snapshot_import_behavior(Some("owner-only"), &[], None, false).unwrap();
+
+    assert_eq!(minted.respond_to, RespondTo::OwnerOnly);
+    assert!(minted.respond_to_allowlist.is_empty());
+}
+
 /// Non-allowlist mode with a non-empty list and keep=true: preserve mode + list.
 /// The toggle WAS shown (list is non-empty) so keep_allowlist applies.
 #[test]
diff --git a/desktop/src-tauri/src/commands/personas/update.rs b/desktop/src-tauri/src/commands/personas/update.rs
new file mode 100644
index 00000000000..ed2472d54ea
--- /dev/null
+++ b/desktop/src-tauri/src/commands/personas/update.rs
@@ -0,0 +1,252 @@
+//! The persona edit command surface: `update_persona` (best-effort enqueue)
+//! and the `update_persona_with` seam that `update_persona_and_publish` reuses
+//! to await relay acceptance for the same save.
+
+use tauri::AppHandle;
+
+use crate::{
+    app_state::AppState,
+    managed_agents::{
+        apply_persona_behavior, effective_agent_command, load_managed_agents, load_personas,
+        managed_agent_avatar_url, save_managed_agents, save_personas, try_regenerate_nest,
+        AgentDefinition, ManagedAgentRecord, UpdatePersonaRequest,
+    },
+    util::now_iso,
+};
+
+use super::{pending, retain_persona_pending, trim_optional, trim_required};
+
+#[cfg(test)]
+mod name_propagation_tests;
+
+/// Return value of the `update_persona` command. Uses flatten so all
+/// `AgentDefinition` fields appear at the top level of the JSON response —
+/// backward-compatible with callers that already destructure a raw persona object.
+#[derive(Debug, serde::Serialize)]
+pub struct UpdatePersonaResult {
+    #[serde(flatten)]
+    persona: AgentDefinition,
+}
+
+/// Propagate a persona definition's display_name rename to linked agent instances.
+/// Only instances whose current `name` equals `old_display_name` are updated;
+/// pool-named instances (e.g. "Birch", "Compass") keep their individualised name.
+/// Updates both `record.name` (relay display name) and `record.display_name`.
+/// Returns the pubkeys of the records that were renamed.
+fn propagate_persona_name_rename(
+    records: &mut [ManagedAgentRecord],
+    persona_id: &str,
+    old_display_name: &str,
+    new_display_name: &str,
+) -> Vec<String> {
+    let mut renamed = Vec::new();
+    for record in records.iter_mut() {
+        if record.persona_id.as_deref() != Some(persona_id) {
+            continue;
+        }
+        if record.name != old_display_name {
+            continue; // pool-named instance — keep its individualised name
+        }
+        record.name = new_display_name.to_string();
+        record.display_name = Some(new_display_name.to_string());
+        renamed.push(record.pubkey.clone());
+    }
+    renamed
+}
+
+/// Profile sync params collected under the store lock for async relay publish.
+type ProfileSyncParams = Vec<(nostr::Keys, String, String, Option<String>, Option<String>)>;
+
+#[tauri::command]
+pub async fn update_persona(
+    input: UpdatePersonaRequest,
+    app: AppHandle,
+) -> Result<UpdatePersonaResult, String> {
+    let (persona, ()) = update_persona_with(input, app, |app, state, persona| {
+        retain_persona_pending(app, state, persona);
+        Ok(())
+    })
+    .await?;
+    Ok(UpdatePersonaResult { persona })
+}
+
+/// Save an edited persona, hand the saved record to `retain` while the store
+/// lock is still held, then sync the relay profiles of linked agent instances.
+///
+/// `retain` is the only difference between the two update commands:
+/// [`update_persona`] enqueues best-effort, while
+/// [`sharing::update_persona_and_publish`] prepares a strict publication and
+/// returns the event so the caller can await relay acceptance.
+pub(super) async fn update_persona_with<R: Send + 'static>(
+    input: UpdatePersonaRequest,
+    app: AppHandle,
+    retain: impl FnOnce(&AppHandle, &AppState, &AgentDefinition) -> Result<R, String> + Send + 'static,
+) -> Result<(AgentDefinition, R), String> {
+    use tauri::Manager;
+
+    // Phase 1: synchronous save (persona record + linked agent avatar updates)
+    let (result, retained, profile_sync_params) = tokio::task::spawn_blocking({
+        let app = app.clone();
+        move || -> Result<(AgentDefinition, R, ProfileSyncParams), String> {
+            let state = app.state::<AppState>();
+            let display_name = trim_required(&input.display_name, "Display name")?;
+            let system_prompt = input.system_prompt.clone();
+            let avatar_url = trim_optional(input.avatar_url);
+            let runtime = trim_optional(input.runtime);
+            let model = trim_optional(input.model);
+            let provider = trim_optional(input.provider);
+
+            let _store_guard = state
+                .managed_agents_store_lock
+                .lock()
+                .map_err(|error| error.to_string())?;
+            let mut personas = load_personas(&app)?;
+            pending::project_active_persona_sharing(&app, &state, &mut personas);
+            let persona = personas
+                .iter_mut()
+                .find(|record| record.id == input.id)
+                .ok_or_else(|| format!("agent {} not found", input.id))?;
+
+            // Track what changed so we can propagate to linked agent records.
+            let avatar_changed = persona.avatar_url != avatar_url;
+            let name_changed = persona.display_name != display_name;
+            let old_display_name = persona.display_name.clone();
+
+            persona.display_name = display_name;
+            persona.avatar_url = avatar_url;
+            persona.system_prompt = system_prompt;
+            persona.runtime = runtime;
+            persona.model = model;
+            persona.provider = provider;
+            persona.name_pool = input
+                .name_pool
+                .into_iter()
+                .map(|s| s.trim().to_string())
+                .filter(|s| !s.is_empty())
+                .collect();
+            if let Some(env_vars) = input.env_vars {
+                crate::managed_agents::validate_user_env_keys(&env_vars)?;
+                persona.env_vars = env_vars;
+            }
+            apply_persona_behavior(persona, input.behavior)?;
+            persona.updated_at = now_iso();
+
+            let result = persona.clone();
+            save_personas(&app, &personas)?;
+
+            let retained = retain(&app, &state, &result)?;
+            try_regenerate_nest(&app);
+
+            // If the avatar or display_name changed, propagate to linked agent
+            // records and collect relay profile sync params for the async phase.
+            let sync_params: ProfileSyncParams = if avatar_changed || name_changed {
+                let mut records = load_managed_agents(&app)?;
+                let mut params: ProfileSyncParams = Vec::new();
+                let mut agents_modified = false;
+                let workspace_relay = crate::relay::relay_ws_url_with_override(&state);
+
+                // Propagate the display_name rename to instances that still
+                // carry the old definition display_name (pool-named instances
+                // keep their individualised name) in one pass; the loop below
+                // only decides which records need a relay profile sync.
+                let renamed: Vec<String> = if name_changed {
+                    propagate_persona_name_rename(
+                        &mut records,
+                        &result.id,
+                        &old_display_name,
+                        &result.display_name,
+                    )
+                } else {
+                    Vec::new()
+                };
+
+                for record in records.iter_mut() {
+                    if record.persona_id.as_deref() != Some(&result.id) {
+                        continue;
+                    }
+                    let mut record_changed = renamed.contains(&record.pubkey);
+
+                    if avatar_changed {
+                        // Update the persisted avatar so reconciliation on next
+                        // start agrees with what we're about to publish.
+                        // When the persona avatar is cleared, fall back to the
+                        // command-default icon so the record never stores `None`
+                        // (which reconcile_agent_profile treats as "un-migrated").
+                        let effective_cmd = effective_agent_command(
+                            record.persona_id.as_deref(),
+                            std::slice::from_ref(&result),
+                            record.agent_command_override.as_deref(),
+                        );
+                        record.avatar_url = result
+                            .avatar_url
+                            .clone()
+                            .or_else(|| managed_agent_avatar_url(&effective_cmd));
+                        record_changed = true;
+                    }
+
+                    if record_changed {
+                        agents_modified = true;
+                        if let Ok(agent_keys) = nostr::Keys::parse(&record.private_key_nsec) {
+                            let relay_url = crate::relay::effective_agent_relay_url(
+                                &record.relay_url,
+                                &workspace_relay,
+                            );
+                            params.push((
+                                agent_keys,
+                                relay_url,
+                                record.name.clone(),
+                                record.avatar_url.clone(),
+                                record.auth_tag.clone(),
+                            ));
+                        }
+                    }
+                }
+
+                if agents_modified {
+                    save_managed_agents(&app, &records)?;
+                    // Keep retained kind:30177 identity records in lockstep with
+                    // the rename (#2423): `record.name` is part of the published
+                    // identity projection, so skipping this strands the relay on
+                    // the stale name→pubkey binding until the next boot reconcile.
+                    // Avatar-only edits are excluded — the avatar is not in the
+                    // projection, so retaining would be a guaranteed no-op.
+                    for record in records.iter().filter(|r| renamed.contains(&r.pubkey)) {
+                        crate::commands::agents::retain_managed_agent_pending(&app, &state, record);
+                    }
+                }
+
+                params
+            } else {
+                Vec::new()
+            };
+
+            Ok((result, retained, sync_params))
+        }
+    })
+    .await
+    .map_err(|e| format!("spawn_blocking failed: {e}"))??;
+
+    // Phase 2: await relay profile sync for linked agents whose avatar or
+    // display_name was just updated. We await (rather than fire-and-forget)
+    // so the frontend cache invalidation that follows the mutation settlement
+    // sees the fresh relay profile. Best-effort — failures are logged, not surfaced.
+    if !profile_sync_params.is_empty() {
+        let state = app.state::<AppState>();
+        for (agent_keys, relay_url, display_name, avatar_url, auth_tag) in profile_sync_params {
+            if let Err(e) = crate::relay::sync_managed_agent_profile(
+                &state,
+                &relay_url,
+                &agent_keys,
+                &display_name,
+                avatar_url.as_deref(),
+                auth_tag.as_deref(),
+            )
+            .await
+            {
+                eprintln!("buzz-desktop: relay profile sync failed after persona update: {e}");
+            }
+        }
+    }
+
+    Ok((result, retained))
+}
diff --git a/desktop/src-tauri/src/commands/personas/name_propagation_tests.rs b/desktop/src-tauri/src/commands/personas/update/name_propagation_tests.rs
similarity index 99%
rename from desktop/src-tauri/src/commands/personas/name_propagation_tests.rs
rename to desktop/src-tauri/src/commands/personas/update/name_propagation_tests.rs
index ba855ccbd64..c60215ae4dd 100644
--- a/desktop/src-tauri/src/commands/personas/name_propagation_tests.rs
+++ b/desktop/src-tauri/src/commands/personas/update/name_propagation_tests.rs
@@ -50,8 +50,10 @@ fn agent(persona_id: &str, name: &str, display_name: Option<&str>) -> ManagedAge
         name_pool: vec![],
         is_builtin: false,
         is_active: true,
+        shared: false,
         source_team: None,
         source_team_persona_slug: None,
+        catalog_source: None,
         definition_respond_to: None,
         definition_respond_to_allowlist: vec![],
         definition_parallelism: None,
diff --git a/desktop/src-tauri/src/commands/project_git_exec.rs b/desktop/src-tauri/src/commands/project_git_exec.rs
index 186c1a1cf6c..e4a8ad7b410 100644
--- a/desktop/src-tauri/src/commands/project_git_exec.rs
+++ b/desktop/src-tauri/src/commands/project_git_exec.rs
@@ -173,12 +173,23 @@ fn configure_git_auth(command: &mut Command, auth: &GitAuthConfig, needs_credent
             return apply_git_config(command, &entries);
         };
         command.env("NOSTR_PRIVATE_KEY", &auth.nsec);
-        entries.push(("credential.helper", cred_helper.display().to_string()));
+        entries.push((
+            "credential.helper",
+            credential_helper_config_value(cred_helper),
+        ));
         entries.push(("credential.useHttpPath", "true".to_string()));
     }
     apply_git_config(command, &entries);
 }
 
+/// Format a path for git `credential.helper`.
+///
+/// Git for Windows invokes helpers via MinGW bash, which treats `\` as
+/// escapes. Forward slashes work on every platform git supports.
+fn credential_helper_config_value(path: &std::path::Path) -> String {
+    path.to_string_lossy().replace('\\', "/")
+}
+
 fn apply_git_config(command: &mut Command, entries: &[(&str, String)]) {
     command.env("GIT_CONFIG_COUNT", entries.len().to_string());
     for (index, (key, value)) in entries.iter().enumerate() {
@@ -316,10 +327,20 @@ fn validate_clone_url_against_relay(clone_url: &str, relay_base: &str) -> Result
 #[cfg(test)]
 mod tests {
     use super::{
-        clean_branch, clean_target_ref, git_needs_credentials, git_subcommand, validate_clone_url,
-        validate_clone_url_against_relay,
+        clean_branch, clean_target_ref, credential_helper_config_value, git_needs_credentials,
+        git_subcommand, validate_clone_url, validate_clone_url_against_relay,
     };
 
+    #[test]
+    fn credential_helper_config_value_uses_forward_slashes() {
+        let path =
+            std::path::PathBuf::from(r"C:\Users\x\AppData\Local\Buzz\git-credential-nostr.exe");
+        assert_eq!(
+            credential_helper_config_value(&path),
+            "C:/Users/x/AppData/Local/Buzz/git-credential-nostr.exe",
+        );
+    }
+
     #[test]
     fn git_subcommand_skips_global_config_options() {
         assert_eq!(
diff --git a/desktop/src-tauri/src/commands/team_snapshot.rs b/desktop/src-tauri/src/commands/team_snapshot.rs
index 0476be79a99..91a0126f582 100644
--- a/desktop/src-tauri/src/commands/team_snapshot.rs
+++ b/desktop/src-tauri/src/commands/team_snapshot.rs
@@ -129,8 +129,10 @@ fn definition_from_snapshot(
         name_pool: member.definition.name_pool.clone(),
         is_builtin: false,
         is_active: true,
+        shared: false,
         source_team: None,
         source_team_persona_slug: None,
+        catalog_source: None,
         env_vars: Default::default(),
         respond_to,
         respond_to_allowlist: behavior.respond_to_allowlist,
@@ -599,8 +601,10 @@ pub async fn confirm_team_snapshot_import(
             respond_to_allowlist: definition.respond_to_allowlist.clone(),
             is_builtin: false,
             is_active: true,
+            shared: false,
             source_team: None,
             source_team_persona_slug: None,
+            catalog_source: None,
             definition_respond_to: respond_to_wire.clone(),
             definition_respond_to_allowlist: definition.respond_to_allowlist.clone(),
             definition_parallelism: minted_parallelism,
@@ -846,7 +850,6 @@ pub async fn confirm_team_snapshot_import(
 fn retain_agent_pending(app: &AppHandle, state: &AppState, record: &ManagedAgentRecord) {
     use crate::managed_agents::{
         agent_events::{agent_event_content, build_agent_event},
-        managed_agents_base_dir,
         persona_events::monotonic_created_at,
         retention::{get_retained_event, open_retention_db, retain_event, RetainedEvent},
     };
@@ -854,11 +857,12 @@ fn retain_agent_pending(app: &AppHandle, state: &AppState, record: &ManagedAgent
     use nostr::JsonUtil;
 
     let result = (|| -> Result<(), String> {
-        let conn = open_retention_db(&managed_agents_base_dir(app)?.join("retention.db"))?;
+        let scope = crate::managed_agents::retention::active_retention_scope(app, state)?;
+        let conn = open_retention_db(&scope.db_path)?;
         let content = serde_json::to_string(&agent_event_content(record))
             .map_err(|e| format!("failed to serialize agent content: {e}"))?;
         let (owner_pubkey, event) = {
-            let keys = state.signing_keys()?;
+            let keys = &scope.owner_keys;
             let owner_pubkey = keys.public_key().to_hex();
             let existing =
                 get_retained_event(&conn, KIND_MANAGED_AGENT, &owner_pubkey, &record.pubkey)?;
@@ -867,7 +871,7 @@ fn retain_agent_pending(app: &AppHandle, state: &AppState, record: &ManagedAgent
             }
             let event = build_agent_event(record)?
                 .custom_created_at(monotonic_created_at(existing.map(|row| row.created_at)))
-                .sign_with_keys(&keys)
+                .sign_with_keys(keys)
                 .map_err(|e| format!("failed to sign agent event: {e}"))?;
             (owner_pubkey, event)
         };
diff --git a/desktop/src-tauri/src/commands/team_snapshot/tests.rs b/desktop/src-tauri/src/commands/team_snapshot/tests.rs
index ca7dc61830d..06164113079 100644
--- a/desktop/src-tauri/src/commands/team_snapshot/tests.rs
+++ b/desktop/src-tauri/src/commands/team_snapshot/tests.rs
@@ -13,6 +13,7 @@ fn member(name: &str) -> AgentSnapshot {
         version: crate::managed_agents::agent_snapshot::FORMAT_VERSION,
         definition: AgentSnapshotDefinition {
             name: name.to_string(),
+            source_is_builtin: false,
             system_prompt: Some(format!("{name} prompt")),
             runtime: Some("goose".to_string()),
             model: None,
@@ -64,8 +65,10 @@ fn team_export_round_trip_preserves_team_and_excludes_member_memory() {
             name_pool: vec![],
             is_builtin: false,
             is_active: true,
+            shared: false,
             source_team: None,
             source_team_persona_slug: None,
+            catalog_source: None,
             env_vars: Default::default(),
             respond_to: None,
             respond_to_allowlist: vec![],
@@ -84,8 +87,10 @@ fn team_export_round_trip_preserves_team_and_excludes_member_memory() {
             name_pool: vec![],
             is_builtin: false,
             is_active: true,
+            shared: false,
             source_team: None,
             source_team_persona_slug: None,
+            catalog_source: None,
             env_vars: Default::default(),
             respond_to: None,
             respond_to_allowlist: vec![],
@@ -145,8 +150,10 @@ fn team_export_with_instance_and_memory_level_uses_supplied_entries() {
         name_pool: vec![],
         is_builtin: false,
         is_active: true,
+        shared: false,
         source_team: None,
         source_team_persona_slug: None,
+        catalog_source: None,
         env_vars: Default::default(),
         respond_to: None,
         respond_to_allowlist: vec![],
@@ -214,8 +221,10 @@ fn team_export_with_instance_and_memory_level_uses_supplied_entries() {
         respond_to_allowlist: vec![],
         is_builtin: false,
         is_active: true,
+        shared: false,
         source_team: None,
         source_team_persona_slug: None,
+        catalog_source: None,
         definition_respond_to: None,
         definition_respond_to_allowlist: vec![],
         definition_parallelism: None,
diff --git a/desktop/src-tauri/src/commands/teams.rs b/desktop/src-tauri/src/commands/teams.rs
index ea9a6a49582..4377ddaa434 100644
--- a/desktop/src-tauri/src/commands/teams.rs
+++ b/desktop/src-tauri/src/commands/teams.rs
@@ -39,7 +39,6 @@ fn trim_optional(value: Option<String>) -> Option<String> {
 /// happens on an actual user edit. The guard is intentionally omitted.
 pub(super) fn retain_team_pending(app: &AppHandle, state: &AppState, team: &TeamRecord) {
     use crate::managed_agents::{
-        managed_agents_base_dir,
         persona_events::monotonic_created_at,
         retention::{get_retained_event, open_retention_db, retain_event, RetainedEvent},
         team_events::build_team_event,
@@ -48,19 +47,16 @@ pub(super) fn retain_team_pending(app: &AppHandle, state: &AppState, team: &Team
     use nostr::JsonUtil;
 
     let result = (|| -> Result<(), String> {
-        let conn = open_retention_db(&managed_agents_base_dir(app)?.join("retention.db"))?;
-        let (pubkey, event) = {
-            let keys = state.keys.lock().map_err(|e| e.to_string())?;
-            let pubkey = keys.public_key().to_hex();
-            // Monotonic created_at: bump past the retained head (NIP-AP step 3).
-            let prior =
-                get_retained_event(&conn, KIND_TEAM, &pubkey, &team.id)?.map(|row| row.created_at);
-            let event = build_team_event(team)?
-                .custom_created_at(monotonic_created_at(prior))
-                .sign_with_keys(&keys)
-                .map_err(|e| format!("failed to sign team event: {e}"))?;
-            (pubkey, event)
-        };
+        let scope = crate::managed_agents::retention::active_retention_scope(app, state)?;
+        let conn = open_retention_db(&scope.db_path)?;
+        let pubkey = scope.owner_keys.public_key().to_hex();
+        // Monotonic created_at: bump past the retained head (NIP-AP step 3).
+        let prior =
+            get_retained_event(&conn, KIND_TEAM, &pubkey, &team.id)?.map(|row| row.created_at);
+        let event = build_team_event(team)?
+            .custom_created_at(monotonic_created_at(prior))
+            .sign_with_keys(&scope.owner_keys)
+            .map_err(|e| format!("failed to sign team event: {e}"))?;
         retain_event(
             &conn,
             &RetainedEvent {
@@ -90,7 +86,6 @@ pub(super) fn retain_team_pending(app: &AppHandle, state: &AppState, team: &Team
 /// disk-authoritative delete.
 fn tombstone_team_pending(app: &AppHandle, state: &AppState, d_tag: &str) {
     use crate::managed_agents::{
-        managed_agents_base_dir,
         retention::{
             delete_retained_event, open_retention_db, retain_event, tombstone_retention_d_tag,
             RetainedEvent,
@@ -103,15 +98,12 @@ fn tombstone_team_pending(app: &AppHandle, state: &AppState, d_tag: &str) {
     const KIND_DELETE: u32 = 5;
 
     let result = (|| -> Result<(), String> {
-        let (pubkey, event) = {
-            let keys = state.keys.lock().map_err(|e| e.to_string())?;
-            let pubkey = keys.public_key().to_hex();
-            let event = build_team_delete(d_tag, &pubkey)?
-                .sign_with_keys(&keys)
-                .map_err(|e| format!("failed to sign team tombstone: {e}"))?;
-            (pubkey, event)
-        };
-        let conn = open_retention_db(&managed_agents_base_dir(app)?.join("retention.db"))?;
+        let scope = crate::managed_agents::retention::active_retention_scope(app, state)?;
+        let pubkey = scope.owner_keys.public_key().to_hex();
+        let event = build_team_delete(d_tag, &pubkey)?
+            .sign_with_keys(&scope.owner_keys)
+            .map_err(|e| format!("failed to sign team tombstone: {e}"))?;
+        let conn = open_retention_db(&scope.db_path)?;
         delete_retained_event(&conn, KIND_TEAM, &pubkey, d_tag)?;
         retain_event(
             &conn,
diff --git a/desktop/src-tauri/src/commands/workspace.rs b/desktop/src-tauri/src/commands/workspace.rs
index 561e9019987..731a99d9d9b 100644
--- a/desktop/src-tauri/src/commands/workspace.rs
+++ b/desktop/src-tauri/src/commands/workspace.rs
@@ -10,6 +10,31 @@ use crate::managed_agents::{
 };
 use crate::relay;
 
+/// Adopt the pre-scoping global retention database's pending rows into `scope`.
+///
+/// Best-effort: a failure is logged and the boot proceeds. The migration's own
+/// crash-safety guards make the next launch retry safely, and blocking the
+/// workspace apply on it would be worse than a delayed publish.
+fn migrate_legacy_retention_into(
+    app: &AppHandle,
+    scope: &crate::managed_agents::retention::RetentionScope,
+) {
+    let Ok(base_dir) = crate::managed_agents::managed_agents_base_dir(app) else {
+        return;
+    };
+    match crate::managed_agents::retention::migrate_legacy_retention_db(
+        &base_dir,
+        &scope.db_path,
+        &scope.owner_keys.public_key().to_hex(),
+    ) {
+        Ok(0) => {}
+        Ok(copied) => {
+            eprintln!("buzz-desktop: adopted {copied} legacy retained event(s) into this community")
+        }
+        Err(error) => eprintln!("buzz-desktop: legacy retention migration failed: {error}"),
+    }
+}
+
 #[derive(Deserialize)]
 struct RelayInfoIcon {
     #[serde(default)]
@@ -187,6 +212,27 @@ pub async fn apply_workspace(
     .map_err(|e| format!("spawn_blocking failed: {e}"))??;
 
     let state = restore_app.state::<AppState>();
+    // Backfill this exact relay+owner scope only after the workspace has been
+    // applied. Running at process boot would target the fallback relay and
+    // collapse every community into one pending-event store.
+    match crate::managed_agents::retention::active_retention_scope(&restore_app, &state) {
+        Ok(scope) => {
+            // Adopt whatever the pre-scoping release left queued in the global
+            // retention database BEFORE the scoped reconcile and flush run, so
+            // stranded tombstones and archive requests publish on this boot
+            // instead of being abandoned by the storage cutover.
+            migrate_legacy_retention_into(&restore_app, &scope);
+            crate::event_sync::spawn_event_sync(
+                restore_app.clone(),
+                scope.owner_keys,
+                scope.db_path,
+            )
+        }
+        Err(error) => {
+            eprintln!("buzz-desktop: scoped event-sync unavailable after workspace apply: {error}");
+        }
+    }
+
     let restore_pending = state
         .managed_agent_restore_pending
         .swap(false, Ordering::AcqRel);
diff --git a/desktop/src-tauri/src/event_sync.rs b/desktop/src-tauri/src/event_sync.rs
index 2ec5aa1c0ee..d9fe6acdb99 100644
--- a/desktop/src-tauri/src/event_sync.rs
+++ b/desktop/src-tauri/src/event_sync.rs
@@ -13,10 +13,10 @@ use std::path::Path;
 /// `sync_team_personas` wrote in [`crate::migration::run_boot_migrations`]
 /// (see its `# Ordering` guard). Event signing needs the resolved owner keys,
 /// so this runs after identity resolution, not in the boot migrations.
-pub fn run_event_sync(app: &tauri::AppHandle, owner_keys: &nostr::Keys) {
-    migrate_personas_to_events(app, owner_keys);
-    migrate_teams_to_events(app, owner_keys);
-    crate::managed_agents::reconcile::reconcile_agents_to_events(app, owner_keys);
+pub fn run_event_sync(app: &tauri::AppHandle, owner_keys: &nostr::Keys, db_path: &Path) {
+    migrate_personas_to_events(app, owner_keys, db_path);
+    migrate_teams_to_events(app, owner_keys, db_path);
+    crate::managed_agents::reconcile::reconcile_agents_to_events(app, owner_keys, db_path);
 }
 
 /// Spawn the best-effort event reconcile off the synchronous Tauri setup path.
@@ -25,10 +25,14 @@ pub fn run_event_sync(app: &tauri::AppHandle, owner_keys: &nostr::Keys) {
 /// `AppState::keys` mutex. The reconcile itself is still synchronous JSON,
 /// SQLite, and signing work, so it runs on the blocking pool rather than an
 /// async worker.
-pub fn spawn_event_sync(app: tauri::AppHandle, owner_keys: nostr::Keys) {
+pub fn spawn_event_sync(
+    app: tauri::AppHandle,
+    owner_keys: nostr::Keys,
+    db_path: std::path::PathBuf,
+) {
     tauri::async_runtime::spawn(async move {
         if let Err(e) = tauri::async_runtime::spawn_blocking(move || {
-            run_event_sync(&app, &owner_keys);
+            run_event_sync(&app, &owner_keys, &db_path);
         })
         .await
         {
@@ -57,14 +61,14 @@ pub fn spawn_event_sync(app: tauri::AppHandle, owner_keys: nostr::Keys) {
 /// `pending_sync = 1` for later relay publish. Migration succeeds on local
 /// write, not relay acknowledgment. Every retained row is a real signed
 /// event — there is no placeholder path.
-pub fn migrate_personas_to_events(app: &tauri::AppHandle, keys: &nostr::Keys) {
+pub fn migrate_personas_to_events(app: &tauri::AppHandle, keys: &nostr::Keys, db_path: &Path) {
     use crate::managed_agents::managed_agents_base_dir;
 
     let Ok(base_dir) = managed_agents_base_dir(app) else {
         return;
     };
 
-    match migrate_personas_in_dir(&base_dir, keys) {
+    match migrate_personas_in_dir_at(&base_dir, keys, db_path) {
         Ok(0) => {}
         Ok(migrated) => {
             eprintln!(
@@ -82,7 +86,16 @@ pub fn migrate_personas_to_events(app: &tauri::AppHandle, keys: &nostr::Keys) {
 /// Returns the number of personas (re)written to the retention store. Returns
 /// `Ok(0)` when every non-builtin persona already has a matching retained row
 /// (or there are none to reconcile).
+#[cfg(test)]
 fn migrate_personas_in_dir(base_dir: &Path, keys: &nostr::Keys) -> Result<u32, String> {
+    migrate_personas_in_dir_at(base_dir, keys, &base_dir.join("retention.db"))
+}
+
+fn migrate_personas_in_dir_at(
+    base_dir: &Path,
+    keys: &nostr::Keys,
+    db_path: &Path,
+) -> Result<u32, String> {
     use crate::managed_agents::{
         persona_events::{build_persona_event, monotonic_created_at, persona_d_tag},
         retention::{get_retained_event, open_retention_db, retain_event, RetainedEvent},
@@ -127,9 +140,8 @@ fn migrate_personas_in_dir(base_dir: &Path, keys: &nostr::Keys) -> Result<u32, S
     }
 
     // Open (or create) the retention database.
-    let db_path = base_dir.join("retention.db");
     let conn =
-        open_retention_db(&db_path).map_err(|e| format!("failed to open retention db: {e}"))?;
+        open_retention_db(db_path).map_err(|e| format!("failed to open retention db: {e}"))?;
 
     let mut migrated = 0u32;
 
@@ -149,7 +161,12 @@ fn migrate_personas_in_dir(base_dir: &Path, keys: &nostr::Keys) -> Result<u32, S
         // bump (F1) so a changed body always lands.
         let existing = get_retained_event(&conn, KIND_PERSONA, &pubkey, &d_tag)?;
 
-        let event = build_persona_event(record)
+        let mut scoped_record = record.clone();
+        scoped_record.shared = existing
+            .as_ref()
+            .and_then(|row| nostr::Event::from_json(&row.raw_event).ok())
+            .is_some_and(|event| buzz_core_pkg::kind::persona_event_is_shared(&event));
+        let event = build_persona_event(&scoped_record)
             .map_err(|e| format!("failed to build event for '{}': {e}", record.display_name))?
             .custom_created_at(monotonic_created_at(
                 existing.as_ref().map(|row| row.created_at),
@@ -202,14 +219,14 @@ fn migrate_personas_in_dir(base_dir: &Path, keys: &nostr::Keys) -> Result<u32, S
 ///
 /// Must run after the persisted identity is resolved (it signs each event with
 /// the owner's keys).
-pub fn migrate_teams_to_events(app: &tauri::AppHandle, keys: &nostr::Keys) {
+pub fn migrate_teams_to_events(app: &tauri::AppHandle, keys: &nostr::Keys, db_path: &Path) {
     use crate::managed_agents::managed_agents_base_dir;
 
     let Ok(base_dir) = managed_agents_base_dir(app) else {
         return;
     };
 
-    match migrate_teams_in_dir(&base_dir, keys) {
+    match migrate_teams_in_dir_at(&base_dir, keys, db_path) {
         Ok(0) => {}
         Ok(migrated) => {
             eprintln!("buzz-desktop: team-event-migration: {migrated} teams migrated to retention");
@@ -225,7 +242,16 @@ pub fn migrate_teams_to_events(app: &tauri::AppHandle, keys: &nostr::Keys) {
 /// Returns the number of teams (re)written to the retention store. The
 /// per-coordinate content compare matches [`migrate_personas_in_dir`]: an
 /// unchanged team is skipped so a launch does not churn `pending_sync`.
+#[cfg(test)]
 fn migrate_teams_in_dir(base_dir: &Path, keys: &nostr::Keys) -> Result<u32, String> {
+    migrate_teams_in_dir_at(base_dir, keys, &base_dir.join("retention.db"))
+}
+
+fn migrate_teams_in_dir_at(
+    base_dir: &Path,
+    keys: &nostr::Keys,
+    db_path: &Path,
+) -> Result<u32, String> {
     use crate::managed_agents::{
         persona_events::monotonic_created_at,
         retention::{get_retained_event, open_retention_db, retain_event, RetainedEvent},
@@ -252,9 +278,8 @@ fn migrate_teams_in_dir(base_dir: &Path, keys: &nostr::Keys) -> Result<u32, Stri
         return Ok(0);
     }
 
-    let db_path = base_dir.join("retention.db");
     let conn =
-        open_retention_db(&db_path).map_err(|e| format!("failed to open retention db: {e}"))?;
+        open_retention_db(db_path).map_err(|e| format!("failed to open retention db: {e}"))?;
 
     let mut migrated = 0u32;
 
diff --git a/desktop/src-tauri/src/lib.rs b/desktop/src-tauri/src/lib.rs
index 64405d04403..35f4eae866a 100644
--- a/desktop/src-tauri/src/lib.rs
+++ b/desktop/src-tauri/src/lib.rs
@@ -29,6 +29,8 @@ mod secret_store;
 mod shutdown;
 mod templates;
 mod util;
+#[cfg(target_os = "linux")]
+pub mod webkit_rendering;
 use app_state::{build_app_state, resolve_persisted_identity, AppState};
 use builderlab::*;
 use commands::*;
@@ -418,16 +420,6 @@ pub fn run() {
                 .load(std::sync::atomic::Ordering::Acquire);
             let recovery_mode = identity_lost || keyring_locked;
 
-            // Snapshot owner keys after identity resolution; the best-effort
-            // event reconcile itself runs off the synchronous setup path below.
-            let owner_keys = match state.keys.lock() {
-                Ok(k) => k.clone(),
-                Err(e) => {
-                    eprintln!("buzz-desktop: fatal: owner keys lock poisoned: {e}");
-                    std::process::exit(1);
-                }
-            };
-
             // Backfill the pinned persona snapshot for any pre-existing agent
             // that predates the record-authoritative-spawn cutover (persona_id
             // set but no source_version). Must run before
@@ -547,15 +539,6 @@ pub fn run() {
 
             try_regenerate_nest(&app_handle);
 
-            // Sync team-dir edits and reconcile persona/team/agent events after
-            // setup can continue. It is best-effort retention backfill, unlike
-            // identity resolution above, so JSON/SQLite/signing work must not
-            // hold the boot path hostage. Skipped in recovery mode — the owner
-            // key is ephemeral.
-            if !recovery_mode {
-                event_sync::spawn_event_sync(app_handle.clone(), owner_keys);
-            }
-
             if let Some(mgr) = huddle::models::global_model_manager() {
                 mgr.start_stt_download(state.http_client.clone());
                 mgr.start_tts_download(state.http_client.clone());
@@ -638,17 +621,13 @@ pub fn run() {
                 tauri::async_runtime::spawn(async move {
                     use std::time::Duration;
                     use tauri::Manager;
-                    let Ok(db_path) = managed_agents::managed_agents_base_dir(&flush_handle)
-                        .map(|d| d.join("retention.db"))
-                    else {
-                        eprintln!("buzz-desktop: event-flush: cannot resolve retention db path");
-                        return;
-                    };
                     loop {
                         let state = flush_handle.state::<AppState>();
-                        if let Err(e) =
-                            managed_agents::persona_events::flush_pending_events(&db_path, &state)
-                                .await
+                        if let Err(e) = managed_agents::persona_events::flush_active_pending_events(
+                            &flush_handle,
+                            &state,
+                        )
+                        .await
                         {
                             eprintln!("buzz-desktop: event-flush: {e}");
                         }
@@ -826,8 +805,10 @@ pub fn run() {
             list_personas,
             create_persona,
             update_persona,
+            update_persona_and_publish,
             delete_persona,
             set_persona_active,
+            set_persona_shared,
             reconcile_inbound_persona_event,
             list_channel_templates,
             create_channel_template,
@@ -895,6 +876,7 @@ pub fn run() {
             validate_repos_dir,
             get_active_workspace,
             fetch_workspace_icon,
+            fetch_join_policy,
             set_prevent_sleep_active,
             get_agent_memory,
             relay_reconnect_hook,
diff --git a/desktop/src-tauri/src/main.rs b/desktop/src-tauri/src/main.rs
index 13cb6c1b709..ebcc127683a 100644
--- a/desktop/src-tauri/src/main.rs
+++ b/desktop/src-tauri/src/main.rs
@@ -2,5 +2,15 @@
 #![cfg_attr(not(debug_assertions), windows_subsystem = "windows")]
 
 fn main() {
+    // Before anything else: WebKitGTK reads its rendering environment once at
+    // process start, and this is the only point where the process is still
+    // single threaded and no GTK object exists yet, which is what makes
+    // `std::env::set_var` sound.
+    #[cfg(target_os = "linux")]
+    if let Err(diagnostic) = buzz_lib::webkit_rendering::apply() {
+        eprintln!("buzz-desktop: {diagnostic}");
+        std::process::exit(1);
+    }
+
     buzz_lib::run()
 }
diff --git a/desktop/src-tauri/src/managed_agents/agent_events.rs b/desktop/src-tauri/src/managed_agents/agent_events.rs
index ba4407d164d..4a7b80079d8 100644
--- a/desktop/src-tauri/src/managed_agents/agent_events.rs
+++ b/desktop/src-tauri/src/managed_agents/agent_events.rs
@@ -208,8 +208,10 @@ mod tests {
             name_pool: vec!["poolname".to_string()],
             is_builtin: true,
             is_active: false,
+            shared: false,
             source_team: None,
             source_team_persona_slug: None,
+            catalog_source: None,
             definition_respond_to: None,
             definition_respond_to_allowlist: Vec::new(),
             definition_parallelism: None,
diff --git a/desktop/src-tauri/src/managed_agents/agent_snapshot.rs b/desktop/src-tauri/src/managed_agents/agent_snapshot.rs
index b0bf8f59913..16a0d35b23d 100644
--- a/desktop/src-tauri/src/managed_agents/agent_snapshot.rs
+++ b/desktop/src-tauri/src/managed_agents/agent_snapshot.rs
@@ -31,7 +31,11 @@
 //!   - lineage ids: `persona_id`, `team_id`, `source_team`, `source_team_persona_slug`,
 //!     `persona_source_version`
 //!   - internal bookkeeping: `start_on_app_launch`,
-//!     `auto_restart_on_config_change`, `is_builtin`
+//!     `auto_restart_on_config_change`
+//!
+//! The portable `sourceIsBuiltIn` hint preserves how the exported definition
+//! should be described in an import preview. It never grants built-in status
+//! to the newly imported definition.
 //!
 //! These exclusions are enforced by construction (only explicit fields are
 //! placed into `AgentSnapshotDefinition`) and asserted by unit tests.
@@ -87,6 +91,10 @@ pub enum MemoryLevel {
 #[serde(rename_all = "camelCase")]
 pub struct AgentSnapshotDefinition {
     pub name: String,
+    /// Portable source classification for import-preview metadata. Imported
+    /// definitions are still created as custom agents with fresh identities.
+    #[serde(default)]
+    pub source_is_builtin: bool,
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub system_prompt: Option<String>,
     #[serde(default, skip_serializing_if = "Option::is_none")]
@@ -191,6 +199,7 @@ pub fn build_snapshot(
             .display_name
             .clone()
             .unwrap_or_else(|| record.name.clone()),
+        source_is_builtin: record.is_builtin,
         system_prompt: record.system_prompt.clone(),
         runtime: record.runtime.clone(),
         model: record.model.clone(),
@@ -526,9 +535,11 @@ mod tests {
             name_pool: vec!["Alice".to_string(), "Bob".to_string()],
             is_builtin: false,
             is_active: true,
+            shared: false,
             source_team: Some("team-id-123".to_string()), // MUST NOT appear
             source_team_persona_slug: Some("lep".to_string()), // MUST NOT appear
             definition_respond_to: Some("allowlist".to_string()),
+            catalog_source: None,
             definition_respond_to_allowlist: vec!["abc123def".to_string()],
             definition_parallelism: Some(4),
             relay_mesh: None,
@@ -913,6 +924,7 @@ mod tests {
         let snapshot = build_snapshot(&record, MemoryLevel::None, vec![], None);
 
         assert_eq!(snapshot.definition.name, "Test Agent Display");
+        assert!(!snapshot.definition.source_is_builtin);
         assert_eq!(
             snapshot.definition.system_prompt.as_deref(),
             Some("You are a test agent.")
diff --git a/desktop/src-tauri/src/managed_agents/config_bridge/reader_tests.rs b/desktop/src-tauri/src/managed_agents/config_bridge/reader_tests.rs
index 4c11cd6c49e..4ee4ec79c32 100644
--- a/desktop/src-tauri/src/managed_agents/config_bridge/reader_tests.rs
+++ b/desktop/src-tauri/src/managed_agents/config_bridge/reader_tests.rs
@@ -106,8 +106,10 @@ fn test_record() -> ManagedAgentRecord {
         name_pool: Vec::new(),
         is_builtin: false,
         is_active: true,
+        shared: false,
         source_team: None,
         source_team_persona_slug: None,
+        catalog_source: None,
         definition_respond_to: None,
         definition_respond_to_allowlist: Vec::new(),
         definition_parallelism: None,
diff --git a/desktop/src-tauri/src/managed_agents/discovery.rs b/desktop/src-tauri/src/managed_agents/discovery.rs
index 2b7264b4295..eecbf4de3ef 100644
--- a/desktop/src-tauri/src/managed_agents/discovery.rs
+++ b/desktop/src-tauri/src/managed_agents/discovery.rs
@@ -58,6 +58,12 @@ fn common_binary_paths() -> &'static [PathBuf] {
                         .join("bin"),
                 );
             }
+            // Goose's legacy Windows installer (superseded by #2680) unpacked
+            // to %USERPROFILE%\goose\goose.exe, which is on no standard PATH —
+            // without this probe those installs stay permanently undiscovered.
+            if let Some(profile) = std::env::var_os("USERPROFILE") {
+                paths.push(PathBuf::from(profile).join("goose"));
+            }
         }
         paths
     })
@@ -80,7 +86,7 @@ const KNOWN_ACP_RUNTIMES: &[KnownAcpRuntime] = &[
         adapter_install_commands: &[],
         cli_install_instructions_url: "https://goose-docs.ai/docs/getting-started/installation/",
         adapter_install_instructions_url: "",
-        cli_install_hint: "Buzz requires the Goose CLI; the desktop app alone is not enough.",
+        cli_install_hint: "Buzz talks to Goose through the Goose CLI.",
         adapter_install_hint: "",
         skill_dir: Some(".goose/skills"),
         supports_acp_model_switching: false,
@@ -112,8 +118,8 @@ const KNOWN_ACP_RUNTIMES: &[KnownAcpRuntime] = &[
         adapter_install_commands: &["npm install -g @agentclientprotocol/claude-agent-acp"],
         cli_install_instructions_url: "https://code.claude.com/docs/en/getting-started",
         adapter_install_instructions_url: "https://github.com/agentclientprotocol/claude-agent-acp",
-        cli_install_hint: "Buzz requires the Claude Code CLI; the desktop app alone is not enough.",
-        adapter_install_hint: "Install the Claude Code ACP adapter via npm.",
+        cli_install_hint: "Buzz talks to Claude Code through the Claude Code CLI.",
+        adapter_install_hint: "Buzz talks to the Claude Code CLI through an ACP adapter. Install it with: npm install -g @agentclientprotocol/claude-agent-acp.",
         skill_dir: Some(".claude/skills"),
         supports_acp_model_switching: false,
         model_env_var: None,
@@ -144,8 +150,8 @@ const KNOWN_ACP_RUNTIMES: &[KnownAcpRuntime] = &[
         adapter_install_commands: &["npm install -g @agentclientprotocol/codex-acp"],
         cli_install_instructions_url: "https://developers.openai.com/codex/cli/",
         adapter_install_instructions_url: "https://github.com/agentclientprotocol/codex-acp",
-        cli_install_hint: "Buzz requires the Codex CLI; the desktop app alone is not enough.",
-        adapter_install_hint: "Install the Codex ACP adapter via npm.",
+        cli_install_hint: "Buzz talks to Codex through the Codex CLI.",
+        adapter_install_hint: "Buzz talks to the Codex CLI through an ACP adapter. Install it with: npm install -g @agentclientprotocol/codex-acp.",
         skill_dir: Some(".codex/skills"),
         supports_acp_model_switching: false,
         model_env_var: None,
@@ -597,7 +603,7 @@ pub fn clear_resolve_cache() {
 //
 // `build_managed_agent_summary` needs to compare the spawn-time adapter
 // availability against the *current* availability without triggering a live
-// `probe_codex_acp_major_version` subprocess on every poll cycle.  This cache
+// `probe_codex_acp_version` subprocess on every poll cycle.  This cache
 // stores the last availability status of the codex-acp binary at its resolved
 // path.  It is warmed by `discover_acp_runtimes` (which already probes), so
 // the badge path reads warm data, and is invalidated by `clear_resolve_cache`
@@ -1157,15 +1163,30 @@ pub(crate) fn classify_runtime(
     }
 }
 
-/// Probe the major version of a `codex-acp` binary by running `--version`.
+/// The oldest `codex-acp` version supported by Buzz managed agents.
+///
+/// Older 1.x adapters are detected successfully, but can still bundle a Codex runtime
+/// that does not reliably give `buzz` CLI subprocesses outbound relay access.
+///
+/// Bump policy: raise this only when a newer adapter fixes a defect that breaks managed
+/// agents, and only to a version already published on npm — every user below the floor is
+/// offered a reinstall on their next discovery pass.
+pub(crate) const MIN_CODEX_ACP_VERSION: (u64, u64, u64) = (1, 1, 7);
+
+/// Probe the full version of a `codex-acp` binary by running `--version`.
 ///
 /// The 1.x adapter (`@agentclientprotocol/codex-acp`) outputs
 /// `@agentclientprotocol/codex-acp <major>.<minor>.<patch>` on stdout and exits 0.
 /// The old 0.16.x adapter (`@zed-industries/codex-acp`) is a Rust binary that does
 /// not recognise `--version` and exits non-zero.
 ///
-/// Returns the major version on success, `None` on any failure (non-zero exit,
-/// unparseable output, timeout, or missing binary).
+/// Returns the `(major, minor, patch)` triple on success, `None` on any failure
+/// (non-zero exit, unparseable output, timeout, or missing binary).
+///
+/// The parse is deliberately strict: exactly three numeric dot-separated components.
+/// Partial versions (`1.2`) and prerelease tags (`1.2.0-rc1`) return `None` and so
+/// classify as [`AcpAvailabilityStatus::AdapterOutdated`] — failing closed offers a
+/// reinstall rather than running an adapter whose version cannot be compared.
 ///
 /// The probe is bounded by a 5-second deadline. The child is polled with
 /// [`std::process::Child::try_wait`] (the repo's standard deadline pattern) and
@@ -1174,16 +1195,16 @@ pub(crate) fn classify_runtime(
 /// Stdout is redirected to a temporary file rather than a pipe, so forked
 /// descendants cannot hold EOF open. Reads from a regular file return EOF at its
 /// current write position regardless of inherited file descriptors, cross-platform.
-pub(crate) fn probe_codex_acp_major_version(binary_path: &Path) -> Option<u64> {
-    probe_codex_acp_major_version_with_path(
+pub(crate) fn probe_codex_acp_version(binary_path: &Path) -> Option<(u64, u64, u64)> {
+    probe_codex_acp_version_with_path(
         binary_path,
         crate::managed_agents::readiness::cli_probe::augmented_path().as_deref(),
     )
 }
-pub(crate) fn probe_codex_acp_major_version_with_path(
+pub(crate) fn probe_codex_acp_version_with_path(
     binary_path: &Path,
     augmented_path: Option<&str>,
-) -> Option<u64> {
+) -> Option<(u64, u64, u64)> {
     use std::io::{Read as _, Seek as _, SeekFrom};
     use std::time::{Duration, Instant};
     const VERSION_PROBE_TIMEOUT: Duration = Duration::from_secs(5);
@@ -1239,30 +1260,35 @@ pub(crate) fn probe_codex_acp_major_version_with_path(
     let stdout = String::from_utf8_lossy(&buf);
     // Output format: "<package-name> <major>.<minor>.<patch>"
     let version_str = stdout.split_whitespace().last()?;
-    let major_str = version_str.split('.').next()?;
-    major_str.parse::<u64>().ok()
+    let mut components = version_str.split('.');
+    let major = components.next()?.parse::<u64>().ok()?;
+    let minor = components.next()?.parse::<u64>().ok()?;
+    let patch = components.next()?.parse::<u64>().ok()?;
+    if components.next().is_some() {
+        return None;
+    }
+    Some((major, minor, patch))
 }
 
 /// Classifies a resolved codex-acp binary path as [`AcpAvailabilityStatus::Available`]
 /// or [`AcpAvailabilityStatus::AdapterOutdated`].
 ///
 /// The 0.16.x adapter (`@zed-industries/codex-acp`) does not recognise `--version`
-/// and exits non-zero — that probe failure yields `AdapterOutdated`. The 1.x adapter
-/// (`@agentclientprotocol/codex-acp`) prints its version and exits 0; major ≥ 1
-/// yields `Available`.
+/// and exits non-zero — that probe failure yields `AdapterOutdated`. An adapter is
+/// available only when its version is at least [`MIN_CODEX_ACP_VERSION`].
 ///
 /// Used by `discover_acp_runtimes`, `cli_login_requirements`, and
 /// `install_acp_runtime_blocking` so the version-gate logic is not duplicated.
 pub(crate) fn codex_adapter_availability(path: &Path) -> AcpAvailabilityStatus {
-    match probe_codex_acp_major_version(path) {
-        Some(major) if major >= 1 => AcpAvailabilityStatus::Available,
+    match probe_codex_acp_version(path) {
+        Some(version) if version >= MIN_CODEX_ACP_VERSION => AcpAvailabilityStatus::Available,
         _ => AcpAvailabilityStatus::AdapterOutdated,
     }
 }
 
-/// Returns `true` when the codex-acp binary at `path` is outdated (major version < 1)
-/// or cannot be probed using `augmented_path`. Thin wrapper around
-/// [`codex_adapter_is_outdated_with_path`].
+/// Returns `true` when the codex-acp binary at `path` is below
+/// [`MIN_CODEX_ACP_VERSION`] or cannot be probed using `augmented_path`. Thin wrapper
+/// around [`codex_adapter_is_outdated_with_path`].
 #[cfg(test)]
 pub(crate) fn codex_adapter_is_outdated(path: &Path) -> bool {
     codex_adapter_is_outdated_with_path(
@@ -1271,15 +1297,15 @@ pub(crate) fn codex_adapter_is_outdated(path: &Path) -> bool {
     )
 }
 
-/// Returns `true` when the codex-acp binary at `path` is outdated (major version < 1)
-/// or cannot be probed with the supplied PATH.
+/// Returns `true` when the codex-acp binary at `path` is below
+/// [`MIN_CODEX_ACP_VERSION`] or cannot be probed with the supplied PATH.
 pub(crate) fn codex_adapter_is_outdated_with_path(
     path: &Path,
     augmented_path: Option<&str>,
 ) -> bool {
     !matches!(
-        probe_codex_acp_major_version_with_path(path, augmented_path),
-        Some(major) if major >= 1
+        probe_codex_acp_version_with_path(path, augmented_path),
+        Some(version) if version >= MIN_CODEX_ACP_VERSION
     )
 }
 
@@ -1302,9 +1328,8 @@ fn discover_acp_runtime_phase1(runtime: &'static KnownAcpRuntime) -> PartialEntr
     let (mut availability, command, binary_path) =
         classify_runtime(adapter_result, runtime.underlying_cli, underlying_cli_found);
 
-    // For codex-acp: when the adapter resolves as Available, probe the
-    // version. An adapter with major version < 1 is treated as outdated —
-    // the CODEX_CONFIG spawn contract requires 1.x.
+    // For codex-acp: when the adapter resolves as Available, probe its full
+    // version. An adapter below MIN_CODEX_ACP_VERSION is treated as outdated.
     if runtime.id == "codex"
         && availability == AcpAvailabilityStatus::Available
         && command.as_deref() == Some("codex-acp")
@@ -1519,7 +1544,7 @@ const PRESET_HARNESSES: &[PresetHarness] = &[
         command: "cursor-agent",
         args: &["acp"],
         install_instructions_url: "https://cursor.com/downloads",
-        install_hint: "Install Cursor from cursor.com/downloads.",
+        install_hint: "Buzz talks to Cursor through the cursor-agent CLI's ACP mode.",
         underlying_cli: None,
     },
     PresetHarness {
@@ -1528,7 +1553,7 @@ const PRESET_HARNESSES: &[PresetHarness] = &[
         command: "omp",
         args: &["acp"],
         install_instructions_url: "https://github.com/can1357/oh-my-pi",
-        install_hint: "Install Oh My Pi from github.com/can1357/oh-my-pi.",
+        install_hint: "Buzz talks to Oh My Pi through its CLI's ACP mode (omp acp).",
         underlying_cli: None,
     },
     PresetHarness {
@@ -1537,7 +1562,7 @@ const PRESET_HARNESSES: &[PresetHarness] = &[
         command: "grok",
         args: &["agent", "--always-approve", "stdio"],
         install_instructions_url: "https://build.x.ai/docs",
-        install_hint: "Install Grok Build from build.x.ai.",
+        install_hint: "Buzz talks to Grok Build through its CLI's agent stdio mode.",
         underlying_cli: None,
     },
     PresetHarness {
@@ -1546,7 +1571,7 @@ const PRESET_HARNESSES: &[PresetHarness] = &[
         command: "opencode",
         args: &["acp"],
         install_instructions_url: "https://opencode.ai/docs",
-        install_hint: "Install OpenCode from opencode.ai/docs.",
+        install_hint: "Buzz talks to OpenCode through its CLI's ACP mode (opencode acp).",
         underlying_cli: None,
     },
     PresetHarness {
@@ -1555,7 +1580,7 @@ const PRESET_HARNESSES: &[PresetHarness] = &[
         command: "kimi",
         args: &["acp"],
         install_instructions_url: "https://kimi.ai/download",
-        install_hint: "Install Kimi Code from kimi.ai/download.",
+        install_hint: "Buzz talks to Kimi Code through its CLI's ACP mode (kimi acp).",
         underlying_cli: None,
     },
     PresetHarness {
@@ -1564,7 +1589,7 @@ const PRESET_HARNESSES: &[PresetHarness] = &[
         command: "amp-acp",
         args: &[],
         install_instructions_url: "https://github.com/tao12345666333/amp-acp",
-        install_hint: "Install the amp-acp npm adapter: npm install -g amp-acp.",
+        install_hint: "Buzz talks to the Amp CLI through the amp-acp adapter. Follow the setup guide to install the adapter so the amp-acp command is on your PATH.",
         underlying_cli: Some("amp"),
     },
     PresetHarness {
@@ -1573,7 +1598,7 @@ const PRESET_HARNESSES: &[PresetHarness] = &[
         command: "hermes-acp",
         args: &[],
         install_instructions_url: "https://hermes-agent.nousresearch.com",
-        install_hint: "Install Hermes Agent from hermes-agent.nousresearch.com.",
+        install_hint: "Buzz talks to Hermes Agent through its hermes-acp command.",
         underlying_cli: None,
     },
     PresetHarness {
@@ -1582,7 +1607,7 @@ const PRESET_HARNESSES: &[PresetHarness] = &[
         command: "openclaw",
         args: &["acp"],
         install_instructions_url: "https://docs.openclaw.ai/start/getting-started",
-        install_hint: "Install OpenClaw: npm install -g openclaw@latest.\n\n\
+        install_hint: "Buzz talks to OpenClaw through its ACP mode (openclaw acp), which relies on the OpenClaw Gateway daemon. Follow the setup guide to install both.\n\n\
             ⚠️  Execution-locus note: `openclaw acp` runs tools inside the \
             OpenClaw Gateway daemon, not in the Desktop process. \
             Desktop-injected BUZZ_* env vars are visible to the `openclaw` \
diff --git a/desktop/src-tauri/src/managed_agents/discovery/runtime_metadata.rs b/desktop/src-tauri/src/managed_agents/discovery/runtime_metadata.rs
index 2fb6a471d48..fdfe9b8be71 100644
--- a/desktop/src-tauri/src/managed_agents/discovery/runtime_metadata.rs
+++ b/desktop/src-tauri/src/managed_agents/discovery/runtime_metadata.rs
@@ -93,7 +93,7 @@ mod tests {
             "https://goose-docs.ai/docs/getting-started/installation/"
         );
         assert!(goose.adapter_install_instructions_url.is_empty());
-        assert!(goose.cli_install_hint.contains("desktop app alone"));
+        assert!(goose.cli_install_hint.contains("Goose CLI"));
         assert!(goose
             .cli_install_commands_windows
             .iter()
@@ -111,7 +111,7 @@ mod tests {
         assert!(claude
             .adapter_install_instructions_url
             .contains("claude-agent-acp"));
-        assert!(claude.cli_install_hint.contains("desktop app alone"));
+        assert!(claude.cli_install_hint.contains("Claude Code CLI"));
 
         let codex = known_acp_runtime_exact("codex").unwrap();
         assert_eq!(
@@ -119,6 +119,6 @@ mod tests {
             "https://developers.openai.com/codex/cli/"
         );
         assert!(codex.adapter_install_instructions_url.contains("codex-acp"));
-        assert!(codex.cli_install_hint.contains("desktop app alone"));
+        assert!(codex.cli_install_hint.contains("Codex CLI"));
     }
 }
diff --git a/desktop/src-tauri/src/managed_agents/discovery/tests.rs b/desktop/src-tauri/src/managed_agents/discovery/tests.rs
index 48e8d5479c4..1b587dca0e5 100644
--- a/desktop/src-tauri/src/managed_agents/discovery/tests.rs
+++ b/desktop/src-tauri/src/managed_agents/discovery/tests.rs
@@ -6,7 +6,7 @@ use super::{
     codex_adapter_is_outdated, create_time_agent_command_override, default_agent_command,
     effective_agent_command, find_nvm_default_bin, find_via_login_shell,
     is_login_shell_path_uninit, is_safe_nvm_tag, managed_agent_avatar_url, normalize_agent_args,
-    parse_semver_tag, preset_catalog_entry, probe_codex_acp_major_version, record_agent_command,
+    parse_semver_tag, preset_catalog_entry, probe_codex_acp_version, record_agent_command,
     refresh_login_shell_path, try_record_agent_command, PresetHarness, BUZZ_AGENT_AVATAR_URL,
     CLAUDE_CODE_AVATAR_URL, CODEX_AVATAR_URL, GOOSE_AVATAR_URL,
 };
@@ -46,10 +46,8 @@ fn returns_none_for_unknown_commands() {
 
 #[test]
 fn default_agent_command_resolves_bundled_buzz_agent() {
-    // The create-path default must be the bundled buzz-agent, never the
-    // bare `goose` that isn't on PATH on a stock Windows install.
+    // The default must be bundled buzz-agent, never bare `goose` on a stock Windows install.
     assert_eq!(default_agent_command(), "buzz-agent");
-    // And buzz-agent takes no `acp` arg — confirm no arg leakage from the default.
     assert_eq!(
         normalize_agent_args(&default_agent_command(), vec!["acp".into()]),
         Vec::<String>::new()
@@ -285,8 +283,10 @@ fn persona_with_runtime(id: &str, runtime: Option<&str>) -> crate::managed_agent
         name_pool: Vec::new(),
         is_builtin: false,
         is_active: true,
+        shared: false,
         source_team: None,
         source_team_persona_slug: None,
+        catalog_source: None,
         env_vars: std::collections::BTreeMap::new(),
         respond_to: None,
         respond_to_allowlist: Vec::new(),
@@ -359,8 +359,10 @@ fn record_with(
         name_pool: Vec::new(),
         is_builtin: false,
         is_active: true,
+        shared: false,
         source_team: None,
         source_team_persona_slug: None,
+        catalog_source: None,
         definition_respond_to: None,
         definition_respond_to_allowlist: Vec::new(),
         definition_parallelism: None,
@@ -749,37 +751,41 @@ fn apply_agent_command_update_concrete_pin_keeps_materialized_runtime() {
     assert_eq!(record_agent_command(&record, &personas), "codex-acp");
 }
 
-// ── probe_codex_acp_major_version ─────────────────────────────────────────────
+// ── probe_codex_acp_version ───────────────────────────────────────────────────
 
 mod managed_path_resolution;
 
 #[cfg(unix)]
 #[test]
-fn probe_codex_acp_major_version_parses_1x_output() {
+fn probe_codex_acp_version_parses_full_semver_output() {
     use std::os::unix::fs::PermissionsExt;
 
-    // Simulate `@agentclientprotocol/codex-acp 1.1.2` output (1.x adapter)
+    // Simulate a current `@agentclientprotocol/codex-acp` output.
     let dir = std::env::temp_dir().join(format!("buzz-probe-1x-{}", uuid::Uuid::new_v4()));
     std::fs::create_dir_all(&dir).expect("create temp dir");
     let bin = dir.join("codex-acp");
     std::fs::write(
         &bin,
-        "#!/bin/sh\necho '@agentclientprotocol/codex-acp 1.1.2'\nexit 0\n",
+        "#!/bin/sh\necho '@agentclientprotocol/codex-acp 1.1.7'\nexit 0\n",
     )
     .expect("write script");
     std::fs::set_permissions(&bin, std::fs::Permissions::from_mode(0o755)).expect("chmod script");
 
-    let major = probe_codex_acp_major_version(&bin);
+    let version = probe_codex_acp_version(&bin);
     let _ = std::fs::remove_dir_all(dir);
 
-    assert_eq!(major, Some(1), "1.x adapter must return major version 1");
+    assert_eq!(
+        version,
+        Some((1, 1, 7)),
+        "adapter output must parse to its full semantic version"
+    );
 }
 
 mod codex_version;
 
 #[cfg(unix)]
 #[test]
-fn probe_codex_acp_major_version_returns_none_for_nonzero_exit() {
+fn probe_codex_acp_version_returns_none_for_nonzero_exit() {
     use std::os::unix::fs::PermissionsExt;
 
     // Simulate old 0.16.x adapter: `--version` is unrecognised, exits non-zero
@@ -789,21 +795,21 @@ fn probe_codex_acp_major_version_returns_none_for_nonzero_exit() {
     std::fs::write(&bin, "#!/bin/sh\nexit 1\n").expect("write script");
     std::fs::set_permissions(&bin, std::fs::Permissions::from_mode(0o755)).expect("chmod script");
 
-    let major = probe_codex_acp_major_version(&bin);
+    let version = probe_codex_acp_version(&bin);
     let _ = std::fs::remove_dir_all(dir);
 
     assert_eq!(
-        major, None,
+        version, None,
         "old 0.16.x adapter (non-zero exit) must return None"
     );
 }
 
 #[cfg(unix)]
 #[test]
-fn probe_codex_acp_major_version_returns_none_for_missing_binary() {
+fn probe_codex_acp_version_returns_none_for_missing_binary() {
     let path = std::path::Path::new("/nonexistent/path/codex-acp-does-not-exist");
-    let major = probe_codex_acp_major_version(path);
-    assert_eq!(major, None, "missing binary must return None");
+    let version = probe_codex_acp_version(path);
+    assert_eq!(version, None, "missing binary must return None");
 }
 
 // ── codex_adapter_availability / codex_adapter_is_outdated ───────────────────
@@ -813,7 +819,7 @@ fn probe_codex_acp_major_version_returns_none_for_missing_binary() {
 
 #[cfg(unix)]
 #[test]
-fn codex_adapter_availability_available_for_1x_binary() {
+fn codex_adapter_availability_available_for_minimum_supported_binary() {
     use std::os::unix::fs::PermissionsExt;
 
     let dir = std::env::temp_dir().join(format!("buzz-avail-1x-{}", uuid::Uuid::new_v4()));
@@ -821,7 +827,7 @@ fn codex_adapter_availability_available_for_1x_binary() {
     let bin = dir.join("codex-acp");
     std::fs::write(
         &bin,
-        "#!/bin/sh\necho '@agentclientprotocol/codex-acp 1.1.2'\nexit 0\n",
+        "#!/bin/sh\necho '@agentclientprotocol/codex-acp 1.1.7'\nexit 0\n",
     )
     .expect("write script");
     std::fs::set_permissions(&bin, std::fs::Permissions::from_mode(0o755)).expect("chmod script");
@@ -832,7 +838,7 @@ fn codex_adapter_availability_available_for_1x_binary() {
     assert_eq!(
         status,
         AcpAvailabilityStatus::Available,
-        "1.x adapter must classify as Available"
+        "minimum supported adapter must classify as Available"
     );
 }
 
@@ -858,6 +864,53 @@ fn codex_adapter_availability_outdated_for_0x_binary() {
     );
 }
 
+#[cfg(unix)]
+#[test]
+fn codex_adapter_availability_outdated_for_older_1x_binary() {
+    use std::os::unix::fs::PermissionsExt;
+
+    let dir = tempfile::tempdir().expect("temp dir");
+    let bin = dir.path().join("codex-acp");
+    std::fs::write(
+        &bin,
+        "#!/bin/sh\necho '@agentclientprotocol/codex-acp 1.1.5'\nexit 0\n",
+    )
+    .expect("write script");
+    std::fs::set_permissions(&bin, std::fs::Permissions::from_mode(0o755)).expect("chmod script");
+
+    assert_eq!(
+        codex_adapter_availability(&bin),
+        AcpAvailabilityStatus::AdapterOutdated,
+        "a 1.x adapter below the floor must be offered an upgrade"
+    );
+}
+
+/// The strict three-component parse fails closed: a version Buzz cannot compare
+/// against the floor is treated as outdated rather than assumed current.
+#[cfg(unix)]
+#[test]
+fn codex_adapter_availability_outdated_for_uncomparable_version() {
+    use std::os::unix::fs::PermissionsExt;
+
+    for version in ["1.2", "1.2.0-rc1"] {
+        let dir = tempfile::tempdir().expect("temp dir");
+        let bin = dir.path().join("codex-acp");
+        std::fs::write(
+            &bin,
+            format!("#!/bin/sh\necho '@agentclientprotocol/codex-acp {version}'\nexit 0\n"),
+        )
+        .expect("write script");
+        std::fs::set_permissions(&bin, std::fs::Permissions::from_mode(0o755))
+            .expect("chmod script");
+
+        assert_eq!(
+            codex_adapter_availability(&bin),
+            AcpAvailabilityStatus::AdapterOutdated,
+            "version {version} is not comparable to the floor and must fail closed"
+        );
+    }
+}
+
 #[cfg(unix)]
 #[test]
 fn codex_adapter_availability_outdated_for_missing_binary() {
@@ -876,7 +929,7 @@ fn codex_adapter_availability_outdated_for_missing_binary() {
 
 #[cfg(unix)]
 #[test]
-fn probe_codex_acp_major_version_returns_none_for_hung_direct_child() {
+fn probe_codex_acp_version_returns_none_for_hung_direct_child() {
     use std::os::unix::fs::PermissionsExt;
     use std::time::Instant;
 
@@ -894,12 +947,12 @@ fn probe_codex_acp_major_version_returns_none_for_hung_direct_child() {
     std::fs::set_permissions(&bin, std::fs::Permissions::from_mode(0o755)).expect("chmod script");
 
     let start = Instant::now();
-    let major = probe_codex_acp_major_version(&bin);
+    let version = probe_codex_acp_version(&bin);
     let elapsed = start.elapsed();
     let _ = std::fs::remove_dir_all(dir);
 
     assert_eq!(
-        major, None,
+        version, None,
         "hung binary must return None (timeout kills child)"
     );
     // The timeout is 5 s; give a 10 s margin for parallel pre-push suites.
@@ -911,7 +964,7 @@ fn probe_codex_acp_major_version_returns_none_for_hung_direct_child() {
 
 #[cfg(unix)]
 #[test]
-fn probe_codex_acp_major_version_returns_version_when_descendant_holds_pipe_open() {
+fn probe_codex_acp_version_returns_version_when_descendant_holds_pipe_open() {
     use std::os::unix::fs::PermissionsExt;
     use std::time::Instant;
 
@@ -923,20 +976,20 @@ fn probe_codex_acp_major_version_returns_version_when_descendant_holds_pipe_open
     // (the parent closed its write end), read_to_end() returns immediately
     // without waiting for the descendant to close its inherited fd.
     //
-    // `(exec sleep 60 &)` forks a subshell that execs `sleep 60`; the subshell
-    // inherits the parent's stdout fd and keeps it open.
+    // `sleep 60 &` starts a descendant that inherits the parent's stdout fd
+    // without making the direct child wait for a nested subshell to exit.
     let dir = std::env::temp_dir().join(format!("buzz-probe-descendant-{}", uuid::Uuid::new_v4()));
     std::fs::create_dir_all(&dir).expect("create temp dir");
     let bin = dir.join("codex-acp");
     std::fs::write(
         &bin,
-        "#!/bin/sh\necho '@agentclientprotocol/codex-acp 1.1.2'\n(exec sleep 60 &)\nexit 0\n",
+        "#!/bin/sh\necho '@agentclientprotocol/codex-acp 1.1.2'\nsleep 60 &\nexit 0\n",
     )
     .expect("write script");
     std::fs::set_permissions(&bin, std::fs::Permissions::from_mode(0o755)).expect("chmod script");
 
     let start = Instant::now();
-    let major = probe_codex_acp_major_version(&bin);
+    let version = probe_codex_acp_version(&bin);
     let elapsed = start.elapsed();
     let _ = std::fs::remove_dir_all(dir);
 
@@ -947,9 +1000,9 @@ fn probe_codex_acp_major_version_returns_version_when_descendant_holds_pipe_open
         "probe must not block on descendant pipe; elapsed: {elapsed:?}"
     );
     assert_eq!(
-        major,
-        Some(1),
-        "1.x version must be parsed even when descendant holds pipe open"
+        version,
+        Some((1, 1, 2)),
+        "version must be parsed even when descendant holds pipe open"
     );
 }
 
diff --git a/desktop/src-tauri/src/managed_agents/discovery/tests/codex_version.rs b/desktop/src-tauri/src/managed_agents/discovery/tests/codex_version.rs
index 5886a439909..82bfd27f325 100644
--- a/desktop/src-tauri/src/managed_agents/discovery/tests/codex_version.rs
+++ b/desktop/src-tauri/src/managed_agents/discovery/tests/codex_version.rs
@@ -1,8 +1,8 @@
-use super::super::probe_codex_acp_major_version_with_path;
+use super::super::probe_codex_acp_version_with_path;
 
 #[cfg(unix)]
 #[test]
-fn probe_codex_acp_major_version_uses_augmented_path_for_env_shebang_interpreter() {
+fn probe_codex_acp_version_uses_augmented_path_for_env_shebang_interpreter() {
     use std::fs;
     use std::os::unix::fs::PermissionsExt;
     let temp = tempfile::tempdir().expect("temp dir");
@@ -31,7 +31,7 @@ fn probe_codex_acp_major_version_uses_augmented_path_for_env_shebang_interpreter
         .to_string_lossy()
         .into_owned();
     assert_eq!(
-        probe_codex_acp_major_version_with_path(&shim_path, Some(&scrubbed_path)),
+        probe_codex_acp_version_with_path(&shim_path, Some(&scrubbed_path)),
         None,
         "with a scrubbed PATH, /usr/bin/env should not find node"
     );
@@ -41,8 +41,8 @@ fn probe_codex_acp_major_version_uses_augmented_path_for_env_shebang_interpreter
         .to_string_lossy()
         .into_owned();
     assert_eq!(
-        probe_codex_acp_major_version_with_path(&shim_path, Some(&augmented_path)),
-        Some(1),
+        probe_codex_acp_version_with_path(&shim_path, Some(&augmented_path)),
+        Some((1, 1, 2)),
         "the injected augmented PATH should allow /usr/bin/env to find node"
     );
 }
diff --git a/desktop/src-tauri/src/managed_agents/discovery/tests/managed_path_resolution.rs b/desktop/src-tauri/src/managed_agents/discovery/tests/managed_path_resolution.rs
index 2f6b038deb7..0795bb2345e 100644
--- a/desktop/src-tauri/src/managed_agents/discovery/tests/managed_path_resolution.rs
+++ b/desktop/src-tauri/src/managed_agents/discovery/tests/managed_path_resolution.rs
@@ -1,5 +1,31 @@
 use crate::managed_agents::discovery::{clear_resolve_cache, resolve_command};
 
+/// The legacy Goose Windows installer wrote `%USERPROFILE%\goose\goose.exe`,
+/// a directory on no standard PATH. `resolve_command_uncached` finds binaries
+/// outside PATH only by scanning `common_binary_paths()`, so that directory
+/// must appear there or those installs stay undiscovered (#2239 residual).
+///
+/// Asserts the probe list rather than a planted binary: `common_binary_paths`
+/// is a process-lifetime `OnceLock`, so a test cannot re-seed `USERPROFILE`
+/// deterministically, and planting an executable under the real user profile
+/// is not an acceptable test side effect.
+#[cfg(windows)]
+#[test]
+fn common_binary_paths_probes_legacy_goose_install_dir() {
+    use std::path::PathBuf;
+
+    let profile = std::env::var_os("USERPROFILE").expect("USERPROFILE is always set on Windows");
+    let legacy_dir = PathBuf::from(profile).join("goose");
+
+    let probed = super::super::common_binary_paths();
+
+    assert!(
+        probed.contains(&legacy_dir),
+        "legacy Goose install dir {} must be probed, got: {probed:?}",
+        legacy_dir.display()
+    );
+}
+
 #[cfg(unix)]
 #[test]
 fn resolve_command_prefers_buzz_managed_npm_shim_over_path() {
diff --git a/desktop/src-tauri/src/managed_agents/effective_config/tests.rs b/desktop/src-tauri/src/managed_agents/effective_config/tests.rs
index 81c2611d5c5..c8e437809ce 100644
--- a/desktop/src-tauri/src/managed_agents/effective_config/tests.rs
+++ b/desktop/src-tauri/src/managed_agents/effective_config/tests.rs
@@ -18,8 +18,10 @@ fn definition(
         name_pool: vec![],
         is_builtin: false,
         is_active: true,
+        shared: false,
         source_team: None,
         source_team_persona_slug: None,
+        catalog_source: None,
         env_vars: BTreeMap::new(),
         respond_to: None,
         respond_to_allowlist: vec![],
@@ -81,8 +83,10 @@ fn record(
         name_pool: vec![],
         is_builtin: false,
         is_active: true,
+        shared: false,
         source_team: None,
         source_team_persona_slug: None,
+        catalog_source: None,
         relay_mesh: None,
         auto_restart_on_config_change: false,
         definition_respond_to: None,
diff --git a/desktop/src-tauri/src/managed_agents/global_config/tests.rs b/desktop/src-tauri/src/managed_agents/global_config/tests.rs
index 33b93d8a52e..553596e226c 100644
--- a/desktop/src-tauri/src/managed_agents/global_config/tests.rs
+++ b/desktop/src-tauri/src/managed_agents/global_config/tests.rs
@@ -343,8 +343,10 @@ fn bare_record() -> ManagedAgentRecord {
         name_pool: vec![],
         is_builtin: false,
         is_active: true,
+        shared: false,
         source_team: None,
         source_team_persona_slug: None,
+        catalog_source: None,
         relay_mesh: None,
         auto_restart_on_config_change: false,
         definition_respond_to: None,
@@ -365,8 +367,10 @@ fn persona(id: &str, model: Option<&str>, provider: Option<&str>) -> AgentDefini
         name_pool: vec![],
         is_builtin: false,
         is_active: true,
+        shared: false,
         source_team: None,
         source_team_persona_slug: None,
+        catalog_source: None,
         env_vars: BTreeMap::new(),
         respond_to: None,
         respond_to_allowlist: vec![],
@@ -624,8 +628,10 @@ fn record_runtime_wins_over_persona_runtime_for_command_resolution() {
         name_pool: vec![],
         is_builtin: false,
         is_active: true,
+        shared: false,
         source_team: None,
         source_team_persona_slug: None,
+        catalog_source: None,
         env_vars: BTreeMap::new(),
         respond_to: None,
         respond_to_allowlist: vec![],
diff --git a/desktop/src-tauri/src/managed_agents/managed_node_paths.rs b/desktop/src-tauri/src/managed_agents/managed_node_paths.rs
index e4b4c36967b..ffcdea8181d 100644
--- a/desktop/src-tauri/src/managed_agents/managed_node_paths.rs
+++ b/desktop/src-tauri/src/managed_agents/managed_node_paths.rs
@@ -4,7 +4,7 @@ pub(crate) fn buzz_managed_npm_prefix() -> Option<PathBuf> {
     dirs::data_dir().map(|dir| dir.join("Buzz").join("node-tools"))
 }
 
-const BUZZ_MANAGED_NODE_VERSION: &str = "v24.11.0";
+const BUZZ_MANAGED_NODE_VERSION: &str = "v24.18.0";
 
 pub(crate) fn buzz_managed_node_root() -> Option<PathBuf> {
     dirs::data_dir().map(|dir| dir.join("Buzz").join("runtimes").join("node"))
diff --git a/desktop/src-tauri/src/managed_agents/mod.rs b/desktop/src-tauri/src/managed_agents/mod.rs
index b0e86f8edb5..be9b07cf11f 100644
--- a/desktop/src-tauri/src/managed_agents/mod.rs
+++ b/desktop/src-tauri/src/managed_agents/mod.rs
@@ -29,6 +29,7 @@ pub mod retention;
 mod runtime;
 mod runtime_commands;
 mod runtime_types;
+pub(crate) mod snapshot_avatar;
 pub(crate) mod spawn_hash;
 pub(crate) mod storage;
 pub(crate) mod team_events;
diff --git a/desktop/src-tauri/src/managed_agents/nest/tests.rs b/desktop/src-tauri/src/managed_agents/nest/tests.rs
index a9593816036..d2c415e725c 100644
--- a/desktop/src-tauri/src/managed_agents/nest/tests.rs
+++ b/desktop/src-tauri/src/managed_agents/nest/tests.rs
@@ -422,8 +422,10 @@ fn make_persona(id: &str, display_name: &str) -> AgentDefinition {
         name_pool: vec![],
         is_builtin: false,
         is_active: true,
+        shared: false,
         source_team: None,
         source_team_persona_slug: None,
+        catalog_source: None,
         env_vars: std::collections::BTreeMap::new(),
         respond_to: None,
         respond_to_allowlist: Vec::new(),
@@ -480,8 +482,10 @@ fn make_agent(name: &str, persona_id: Option<&str>) -> ManagedAgentRecord {
         name_pool: Vec::new(),
         is_builtin: false,
         is_active: true,
+        shared: false,
         source_team: None,
         source_team_persona_slug: None,
+        catalog_source: None,
         definition_respond_to: None,
         definition_respond_to_allowlist: Vec::new(),
         definition_parallelism: None,
diff --git a/desktop/src-tauri/src/managed_agents/persona_events.rs b/desktop/src-tauri/src/managed_agents/persona_events.rs
index 5b62615a8c1..ea61a811dbc 100644
--- a/desktop/src-tauri/src/managed_agents/persona_events.rs
+++ b/desktop/src-tauri/src/managed_agents/persona_events.rs
@@ -5,7 +5,7 @@
 
 use std::collections::BTreeMap;
 
-use buzz_core_pkg::kind::KIND_PERSONA;
+use buzz_core_pkg::kind::{persona_event_is_shared, KIND_PERSONA};
 use nostr::{EventBuilder, Kind, Tag};
 use serde::{Deserialize, Serialize};
 
@@ -138,7 +138,11 @@ pub fn build_persona_event(record: &AgentDefinition) -> Result<EventBuilder, Str
         .map_err(|e| format!("failed to serialize persona content: {e}"))?;
 
     let d_tag = persona_d_tag(record);
-    let tags = vec![Tag::parse(["d", d_tag.as_str()]).map_err(|e| format!("invalid d-tag: {e}"))?];
+    let mut tags =
+        vec![Tag::parse(["d", d_tag.as_str()]).map_err(|e| format!("invalid d-tag: {e}"))?];
+    if record.shared {
+        tags.push(Tag::parse(["shared", "true"]).map_err(|e| format!("invalid shared tag: {e}"))?);
+    }
 
     Ok(EventBuilder::new(Kind::Custom(KIND_PERSONA as u16), content_json).tags(tags))
 }
@@ -188,8 +192,10 @@ pub fn persona_from_event(event: &nostr::Event) -> Result<AgentDefinition, Strin
         name_pool: content.name_pool,
         is_builtin: false,
         is_active: true,
+        shared: persona_event_is_shared(event),
         source_team: None,
         source_team_persona_slug: Some(d_tag),
+        catalog_source: None,
         env_vars: BTreeMap::new(),
         respond_to: content.respond_to,
         respond_to_allowlist: content.respond_to_allowlist,
@@ -218,9 +224,34 @@ pub fn persona_from_event(event: &nostr::Event) -> Result<AgentDefinition, Strin
 /// Returns the number of events the relay accepted. Best-effort: a relay
 /// failure on one row leaves it pending for the next sweep and does not abort
 /// the remaining rows.
+#[cfg(test)]
 pub async fn flush_pending_events(
     db_path: &std::path::Path,
     state: &AppState,
+) -> Result<u32, String> {
+    let relay_url = crate::relay::relay_ws_url_with_override(state);
+    let owner_keys = state.signing_keys()?;
+    flush_pending_events_at(db_path, state, &relay_url, &owner_keys).await
+}
+
+/// Resolve and flush only the currently active `(relay, owner)` scope.
+///
+/// The scope snapshots its relay, owner keys, and database path together
+/// before network work starts. Switching communities during the flush cannot
+/// redirect rows from the old scope into the new relay.
+pub async fn flush_active_pending_events(
+    app: &tauri::AppHandle,
+    state: &AppState,
+) -> Result<u32, String> {
+    let scope = crate::managed_agents::retention::active_retention_scope(app, state)?;
+    flush_pending_events_at(&scope.db_path, state, &scope.relay_url, &scope.owner_keys).await
+}
+
+async fn flush_pending_events_at(
+    db_path: &std::path::Path,
+    state: &AppState,
+    relay_url: &str,
+    owner_keys: &nostr::Keys,
 ) -> Result<u32, String> {
     use crate::managed_agents::retention::{
         deferred_behind_failed_tombstone, get_pending_sync, get_retained_event, mark_synced,
@@ -228,6 +259,8 @@ pub async fn flush_pending_events(
     };
     use nostr::JsonUtil;
 
+    let owner_pubkey = owner_keys.public_key().to_hex();
+    let relay_api_base = crate::relay::relay_http_base_url(relay_url);
     let pending = {
         let conn = open_retention_db(db_path)?;
         get_pending_sync(&conn)?
@@ -237,6 +270,9 @@ pub async fn flush_pending_events(
     let mut failed_tombstones: std::collections::HashSet<(String, String)> =
         std::collections::HashSet::new();
     for row in pending {
+        if row.pubkey != owner_pubkey {
+            continue;
+        }
         if deferred_behind_failed_tombstone(row.kind, &row.pubkey, &row.d_tag, &failed_tombstones) {
             continue; // its tombstone failed this sweep; next sweep re-orders them
         }
@@ -270,9 +306,14 @@ pub async fn flush_pending_events(
             event
         };
 
-        if crate::relay::submit_signed_event(&event, state)
-            .await
-            .is_err()
+        if crate::relay::submit_signed_event_at_with_keys(
+            &event,
+            state,
+            &relay_api_base,
+            owner_keys,
+        )
+        .await
+        .is_err()
         {
             if current.kind == 5 {
                 failed_tombstones.insert((current.pubkey.clone(), current.d_tag.clone()));
diff --git a/desktop/src-tauri/src/managed_agents/persona_events/tests.rs b/desktop/src-tauri/src/managed_agents/persona_events/tests.rs
index 27d3b0ce066..b9542f9a879 100644
--- a/desktop/src-tauri/src/managed_agents/persona_events/tests.rs
+++ b/desktop/src-tauri/src/managed_agents/persona_events/tests.rs
@@ -50,8 +50,10 @@ fn sample_record() -> ManagedAgentRecord {
         name_pool: Vec::new(),
         is_builtin: false,
         is_active: true,
+        shared: false,
         source_team: None,
         source_team_persona_slug: None,
+        catalog_source: None,
         definition_respond_to: None,
         definition_respond_to_allowlist: Vec::new(),
         definition_parallelism: None,
@@ -149,8 +151,10 @@ fn sample_persona() -> AgentDefinition {
         name_pool: vec!["Alpha".to_string(), "Beta".to_string()],
         is_builtin: false,
         is_active: true,
+        shared: false,
         source_team: None,
         source_team_persona_slug: Some("test-slug".to_string()),
+        catalog_source: None,
         env_vars: BTreeMap::from([("KEY".to_string(), "value".to_string())]),
         respond_to: None,
         respond_to_allowlist: Vec::new(),
@@ -250,6 +254,25 @@ fn build_persona_event_produces_correct_kind() {
     assert_eq!(event.kind.as_u16() as u32, KIND_PERSONA);
 }
 
+#[test]
+fn shared_persona_event_has_exact_tag_and_round_trips() {
+    let mut record = sample_persona();
+    record.shared = true;
+    let event = build_persona_event(&record)
+        .unwrap()
+        .sign_with_keys(&nostr::Keys::generate())
+        .unwrap();
+
+    let shared_tags: Vec<Vec<&str>> = event
+        .tags
+        .iter()
+        .filter(|tag| tag.as_slice().first().is_some_and(|part| part == "shared"))
+        .map(|tag| tag.as_slice().iter().map(String::as_str).collect())
+        .collect();
+    assert_eq!(shared_tags, vec![vec!["shared", "true"]]);
+    assert!(persona_from_event(&event).unwrap().shared);
+}
+
 #[test]
 fn round_trip_serialization() {
     let record = sample_persona();
@@ -355,8 +378,10 @@ fn content_matches_nip_ap_vector() {
         name_pool: vec!["Alpha".to_string(), "Beta".to_string()],
         is_builtin: false,
         is_active: true,
+        shared: false,
         source_team: None,
         source_team_persona_slug: None,
+        catalog_source: None,
         env_vars: BTreeMap::new(),
         respond_to: None,
         respond_to_allowlist: Vec::new(),
@@ -384,8 +409,10 @@ fn round_trip_minimal_persona() {
         name_pool: vec![],
         is_builtin: true,
         is_active: false,
+        shared: false,
         source_team: Some("team-1".to_string()),
         source_team_persona_slug: None,
+        catalog_source: None,
         env_vars: BTreeMap::new(),
         respond_to: None,
         respond_to_allowlist: Vec::new(),
@@ -479,8 +506,10 @@ fn quad_absent_definition_hash_stable_across_activation() {
         name_pool: vec!["nib".to_string()],
         is_builtin: false,
         is_active: true,
+        shared: false,
         source_team: None,
         source_team_persona_slug: None,
+        catalog_source: None,
         env_vars: BTreeMap::new(),
         respond_to: None,
         respond_to_allowlist: Vec::new(),
@@ -521,8 +550,10 @@ fn persona_from_event_content_for_test(content: PersonaEventContent) -> AgentDef
         name_pool: content.name_pool,
         is_builtin: false,
         is_active: true,
+        shared: false,
         source_team: None,
         source_team_persona_slug: None,
+        catalog_source: None,
         env_vars: BTreeMap::new(),
         respond_to: content.respond_to,
         respond_to_allowlist: content.respond_to_allowlist,
@@ -880,6 +911,7 @@ mod flush_barrier {
         }
 
         let state = build_app_state();
+        *state.keys.lock().unwrap() = keys;
         *state.relay_url_override.lock().unwrap() = Some(spawn_stub_relay().await);
 
         let flushed = flush_pending_events(&db_path, &state).await.expect("flush");
diff --git a/desktop/src-tauri/src/managed_agents/personas.rs b/desktop/src-tauri/src/managed_agents/personas.rs
index b0d874dc782..9bf7ab74b01 100644
--- a/desktop/src-tauri/src/managed_agents/personas.rs
+++ b/desktop/src-tauri/src/managed_agents/personas.rs
@@ -121,8 +121,10 @@ fn built_in_persona_records(now: &str) -> Vec<AgentDefinition> {
             name_pool: persona.name_pool.iter().map(|s| s.to_string()).collect(),
             is_builtin: true,
             is_active: persona.default_active,
+            shared: false,
             source_team: None,
             source_team_persona_slug: None,
+            catalog_source: None,
             env_vars: std::collections::BTreeMap::new(),
             respond_to: None,
             respond_to_allowlist: Vec::new(),
@@ -254,10 +256,7 @@ pub fn ensure_persona_is_active(
         .ok_or_else(|| format!("agent {persona_id} not found"))?;
 
     if !persona.is_active {
-        return Err(format!(
-            "{} is not in My Agents. Choose it from Agent Catalog first.",
-            persona.display_name
-        ));
+        return Err(format!("{} is not in My Agents.", persona.display_name));
     }
 
     Ok(())
diff --git a/desktop/src-tauri/src/managed_agents/personas/tests.rs b/desktop/src-tauri/src/managed_agents/personas/tests.rs
index e924345e8be..387b4d72c65 100644
--- a/desktop/src-tauri/src/managed_agents/personas/tests.rs
+++ b/desktop/src-tauri/src/managed_agents/personas/tests.rs
@@ -18,8 +18,10 @@ fn custom_persona(id: &str, display_name: &str) -> AgentDefinition {
         name_pool: Vec::new(),
         is_builtin: false,
         is_active: true,
+        shared: false,
         source_team: None,
         source_team_persona_slug: None,
+        catalog_source: None,
         env_vars: std::collections::BTreeMap::new(),
         respond_to: None,
         respond_to_allowlist: Vec::new(),
@@ -171,10 +173,7 @@ fn ensure_persona_is_active_rejects_inactive_personas() {
 
     let err = ensure_persona_is_active(&[persona], "builtin:fizz").unwrap_err();
 
-    assert_eq!(
-        err,
-        "Fizz is not in My Agents. Choose it from Agent Catalog first."
-    );
+    assert_eq!(err, "Fizz is not in My Agents.");
 }
 
 #[test]
@@ -317,6 +316,7 @@ fn migrate_preserves_customized_personas() {
         system_prompt: "My custom research workflow with special instructions".to_string(),
         is_builtin: false,
         is_active: true,
+        shared: false,
         ..custom_persona("builtin:researcher", "My Researcher")
     }];
 
@@ -350,6 +350,7 @@ fn migrate_is_idempotent() {
         system_prompt: "My custom prompt".to_string(),
         is_builtin: false,
         is_active: false,
+        shared: false,
         ..custom_persona("builtin:researcher", "Researcher (retired)")
     }];
     assert!(
@@ -365,6 +366,7 @@ fn migrate_is_idempotent() {
         system_prompt: "Custom review prompt".to_string(),
         is_builtin: true,
         is_active: true,
+        shared: false,
         ..custom_persona("builtin:reviewer", "Reviewer")
     }];
     assert!(migrate_retired_personas(&mut stored_pre_demotion, now));
diff --git a/desktop/src-tauri/src/managed_agents/readiness.rs b/desktop/src-tauri/src/managed_agents/readiness.rs
index c5480b24793..c053d933c53 100644
--- a/desktop/src-tauri/src/managed_agents/readiness.rs
+++ b/desktop/src-tauri/src/managed_agents/readiness.rs
@@ -1510,8 +1510,10 @@ mod tests {
             name_pool: Vec::new(),
             is_builtin: false,
             is_active: true,
+            shared: false,
             source_team: None,
             source_team_persona_slug: None,
+            catalog_source: None,
             definition_respond_to: None,
             definition_respond_to_allowlist: Vec::new(),
             definition_parallelism: None,
diff --git a/desktop/src-tauri/src/managed_agents/reconcile.rs b/desktop/src-tauri/src/managed_agents/reconcile.rs
index dc73bc97392..90f05c5750d 100644
--- a/desktop/src-tauri/src/managed_agents/reconcile.rs
+++ b/desktop/src-tauri/src/managed_agents/reconcile.rs
@@ -32,12 +32,16 @@ use nostr::JsonUtil;
 /// Reconcile `managed-agents.json` into kind:30177 events in the retention
 /// store. Boot-time entry point, called from `event_sync::run_event_sync`
 /// after the persona and team legs.
-pub(crate) fn reconcile_agents_to_events(app: &tauri::AppHandle, keys: &nostr::Keys) {
+pub(crate) fn reconcile_agents_to_events(
+    app: &tauri::AppHandle,
+    keys: &nostr::Keys,
+    db_path: &Path,
+) {
     let Ok(base_dir) = super::managed_agents_base_dir(app) else {
         return;
     };
 
-    match reconcile_agents_in_dir(&base_dir, keys) {
+    match reconcile_agents_in_dir_at(&base_dir, keys, db_path) {
         Ok(0) => {}
         Ok(reconciled) => {
             eprintln!(
@@ -61,7 +65,16 @@ pub(crate) fn reconcile_agents_to_events(app: &tauri::AppHandle, keys: &nostr::K
 /// never churns `pending_sync`.
 ///
 /// Returns the number of agents (re)written to the retention store.
+#[cfg(test)]
 pub(crate) fn reconcile_agents_in_dir(base_dir: &Path, keys: &nostr::Keys) -> Result<u32, String> {
+    reconcile_agents_in_dir_at(base_dir, keys, &base_dir.join("retention.db"))
+}
+
+fn reconcile_agents_in_dir_at(
+    base_dir: &Path,
+    keys: &nostr::Keys,
+    db_path: &Path,
+) -> Result<u32, String> {
     let store_path = base_dir.join("managed-agents.json");
     if !store_path.exists() {
         return Ok(0);
@@ -79,11 +92,8 @@ pub(crate) fn reconcile_agents_in_dir(base_dir: &Path, keys: &nostr::Keys) -> Re
         return Ok(0);
     }
 
-    let owner_pubkey = keys.public_key().to_hex();
-
-    let db_path = base_dir.join("retention.db");
     let conn =
-        open_retention_db(&db_path).map_err(|e| format!("failed to open retention db: {e}"))?;
+        open_retention_db(db_path).map_err(|e| format!("failed to open retention db: {e}"))?;
 
     let mut reconciled = 0u32;
 
@@ -94,46 +104,66 @@ pub(crate) fn reconcile_agents_in_dir(base_dir: &Path, keys: &nostr::Keys) -> Re
             continue;
         }
 
-        let existing =
-            get_retained_event(&conn, KIND_MANAGED_AGENT, &owner_pubkey, &record.pubkey)?;
-
-        // Build the event first and compare ITS content, so the comparison and
-        // the retained row share one serialization of the projection (mirrors
-        // `migrate_personas_in_dir`). Serializing the projection independently
-        // here would silently diverge if `build_agent_event` ever changed how
-        // it serializes — republishing every agent every boot. Content is
-        // timestamp-independent, so the monotonic bump below never forces a
-        // spurious republish; an unchanged agent is still a true no-op.
-        let event = build_agent_event(record)?
-            .custom_created_at(monotonic_created_at(
-                existing.as_ref().map(|row| row.created_at),
-            ))
-            .sign_with_keys(keys)
-            .map_err(|e| format!("failed to sign event for '{}': {e}", record.name))?;
-
-        let content = event.content.clone();
-        if existing.as_ref().is_some_and(|row| row.content == content) {
-            continue;
+        if retain_agent_record(&conn, keys, record)? {
+            reconciled += 1;
         }
-
-        retain_event(
-            &conn,
-            &RetainedEvent {
-                kind: KIND_MANAGED_AGENT,
-                pubkey: owner_pubkey.clone(),
-                d_tag: record.pubkey.clone(),
-                content,
-                created_at: event.created_at.as_secs() as i64,
-                raw_event: event.as_json(),
-                pending_sync: true,
-            },
-        )
-        .map_err(|e| format!("failed to retain '{}': {e}", record.name))?;
-        reconciled += 1;
     }
 
     Ok(reconciled)
 }
 
+/// Retain `record`'s kind:30177 identity record, marking it `pending_sync`
+/// for the flush loop, when its projection differs from the retained head.
+/// Returns `Ok(true)` when a row was (re)written and `Ok(false)` when the
+/// retained content already matches (a true no-op — no `pending_sync` churn).
+///
+/// This is the single content-diff + monotonic-bump engine shared by the
+/// boot-time reconcile above and the interactive edit paths
+/// (`retain_managed_agent_pending`, persona-rename propagation). Every
+/// mutation of an agent's published identity must go through it so the
+/// retained record can never silently drift from `managed-agents.json`.
+pub(crate) fn retain_agent_record(
+    conn: &rusqlite::Connection,
+    keys: &nostr::Keys,
+    record: &ManagedAgentRecord,
+) -> Result<bool, String> {
+    let owner_pubkey = keys.public_key().to_hex();
+    let existing = get_retained_event(conn, KIND_MANAGED_AGENT, &owner_pubkey, &record.pubkey)?;
+
+    // Build the event first and compare ITS content, so the comparison and
+    // the retained row share one serialization of the projection (mirrors
+    // `migrate_personas_in_dir`). Serializing the projection independently
+    // here would silently diverge if `build_agent_event` ever changed how
+    // it serializes — republishing every agent every boot. Content is
+    // timestamp-independent, so the monotonic bump below never forces a
+    // spurious republish; an unchanged agent is still a true no-op.
+    let event = build_agent_event(record)?
+        .custom_created_at(monotonic_created_at(
+            existing.as_ref().map(|row| row.created_at),
+        ))
+        .sign_with_keys(keys)
+        .map_err(|e| format!("failed to sign event for '{}': {e}", record.name))?;
+
+    let content = event.content.clone();
+    if existing.as_ref().is_some_and(|row| row.content == content) {
+        return Ok(false);
+    }
+
+    retain_event(
+        conn,
+        &RetainedEvent {
+            kind: KIND_MANAGED_AGENT,
+            pubkey: owner_pubkey,
+            d_tag: record.pubkey.clone(),
+            content,
+            created_at: event.created_at.as_secs() as i64,
+            raw_event: event.as_json(),
+            pending_sync: true,
+        },
+    )
+    .map_err(|e| format!("failed to retain '{}': {e}", record.name))?;
+    Ok(true)
+}
+
 #[cfg(test)]
 mod tests;
diff --git a/desktop/src-tauri/src/managed_agents/reconcile/tests.rs b/desktop/src-tauri/src/managed_agents/reconcile/tests.rs
index 5af05f99d6e..c9269dbf002 100644
--- a/desktop/src-tauri/src/managed_agents/reconcile/tests.rs
+++ b/desktop/src-tauri/src/managed_agents/reconcile/tests.rs
@@ -300,3 +300,103 @@ fn slimming_republish_wave_is_one_time() {
         "second boot must be a no-op (idempotence)"
     );
 }
+
+// ── retain_agent_record (interactive-edit engine) ────────────────────────────
+//
+// #2423: renaming an agent must re-retain its kind:30177 identity record
+// IMMEDIATELY, not at the next boot-time reconcile. These tests pin the shared
+// engine both the boot reconcile and the interactive edit paths
+// (`retain_managed_agent_pending`, persona-rename propagation) run on.
+
+/// A rename re-retains the identity record under the SAME coordinate (the
+/// agent pubkey) with the new name, queued for publish, with a created_at
+/// strictly past the retained head so the relay's replaceable-event rule
+/// accepts it. Without this, the relay keeps the old name→pubkey binding
+/// until the next restart — the identity desync in #2423.
+#[test]
+fn rename_re_retains_identity_record_with_new_name() {
+    let dir = TempDir::new().unwrap();
+    let keys = nostr::Keys::generate();
+    let conn = open_retention_db(&dir.path().join("retention.db")).unwrap();
+    let owner = keys.public_key().to_hex();
+    let pubkey = "9".repeat(64);
+    let mut record = sample_record(&pubkey, "Fizz");
+
+    assert!(retain_agent_record(&conn, &keys, &record).unwrap());
+    let first = get_retained_event(&conn, KIND_MANAGED_AGENT, &owner, &pubkey)
+        .unwrap()
+        .unwrap();
+    // Simulate the flush loop confirming the initial publish.
+    mark_synced(
+        &conn,
+        first.kind,
+        &first.pubkey,
+        &first.d_tag,
+        first.created_at,
+        &first.content,
+    )
+    .unwrap();
+
+    record.name = "Spark".to_string();
+    assert!(
+        retain_agent_record(&conn, &keys, &record).unwrap(),
+        "a renamed record must re-retain its identity record"
+    );
+
+    let row = get_retained_event(&conn, KIND_MANAGED_AGENT, &owner, &pubkey)
+        .unwrap()
+        .unwrap();
+    assert_eq!(row.d_tag, pubkey, "coordinate stays keyed by agent pubkey");
+    assert!(
+        row.content.contains("Spark"),
+        "retained identity record must carry the new name"
+    );
+    assert!(
+        !row.content.contains("Fizz"),
+        "the stale name must not survive the rename"
+    );
+    assert!(row.pending_sync, "a rename must queue a republish");
+    assert!(
+        row.created_at > first.created_at,
+        "created_at must bump past the retained head (replaceable-event rule)"
+    );
+}
+
+/// An unchanged record is a true no-op: no rewrite, no `pending_sync` churn.
+/// This is what lets every edit path call the engine unconditionally.
+#[test]
+fn retain_agent_record_is_noop_when_unchanged() {
+    let dir = TempDir::new().unwrap();
+    let keys = nostr::Keys::generate();
+    let conn = open_retention_db(&dir.path().join("retention.db")).unwrap();
+    let pubkey = "8".repeat(64);
+    let record = sample_record(&pubkey, "steady-agent");
+
+    assert!(retain_agent_record(&conn, &keys, &record).unwrap());
+    let row = get_retained_event(
+        &conn,
+        KIND_MANAGED_AGENT,
+        &keys.public_key().to_hex(),
+        &pubkey,
+    )
+    .unwrap()
+    .unwrap();
+    mark_synced(
+        &conn,
+        row.kind,
+        &row.pubkey,
+        &row.d_tag,
+        row.created_at,
+        &row.content,
+    )
+    .unwrap();
+
+    assert!(
+        !retain_agent_record(&conn, &keys, &record).unwrap(),
+        "an unchanged projection must not re-retain"
+    );
+    assert!(
+        get_pending_sync(&conn).unwrap().is_empty(),
+        "no pending_sync churn for an unchanged record"
+    );
+}
diff --git a/desktop/src-tauri/src/managed_agents/retention.rs b/desktop/src-tauri/src/managed_agents/retention.rs
index 5df566dbbea..7e97fa1f566 100644
--- a/desktop/src-tauri/src/managed_agents/retention.rs
+++ b/desktop/src-tauri/src/managed_agents/retention.rs
@@ -5,10 +5,106 @@
 //! keyed on `(kind, pubkey, d_tag)`, replacing only on a newer-or-equal
 //! `created_at` for NIP-33 latest-wins semantics.
 
-use std::path::Path;
+use std::path::{Path, PathBuf};
 use std::time::{Duration, Instant};
 
 use rusqlite::{params, Connection, OptionalExtension};
+use sha2::{Digest, Sha256};
+use tauri::AppHandle;
+
+use crate::app_state::AppState;
+
+mod legacy_migration;
+pub use legacy_migration::migrate_legacy_retention_db;
+
+/// Durable event-retention scope for one community relay and owner identity.
+///
+/// Persona, team, and managed-agent definitions are workspace-global, but
+/// their relay heads and pending publications are not. Keeping a separate
+/// database per `(relay_url, owner_pubkey)` prevents a pending write created in
+/// community A from being drained into community B after a workspace switch.
+pub struct RetentionScope {
+    pub db_path: PathBuf,
+    pub relay_url: String,
+    pub owner_keys: nostr::Keys,
+}
+
+/// Decide whether `scope` — the workspace's active retention scope — is the one
+/// that owns an event delivered by `arrival_relay_url`.
+///
+/// Inbound reconcile resolves its retention database when it PROCESSES an event,
+/// while the event belongs to the community that DELIVERED it. `None` means a
+/// workspace switch happened in between and the caller must drop the event
+/// rather than file community A's event into community B's store.
+///
+/// The comparison goes through the same normalization
+/// [`scoped_retention_db_path`] hashes, so "same relay" can never disagree with
+/// "same database".
+pub fn scope_for_arrival(scope: RetentionScope, arrival_relay_url: &str) -> Option<RetentionScope> {
+    let same_scope =
+        normalized_relay_scope(&scope.relay_url) == normalized_relay_scope(arrival_relay_url);
+    same_scope.then_some(scope)
+}
+
+/// Relay-URL form that identifies a retention scope: equivalent workspace URLs
+/// (surrounding space, trailing slash) must resolve to one scope.
+fn normalized_relay_scope(relay_url: &str) -> &str {
+    relay_url.trim().trim_end_matches('/')
+}
+
+/// Resolve the retention database path for a relay + owner pair.
+///
+/// The normalized scope is hashed so relay URLs never become path components.
+/// Trimming a trailing slash keeps equivalent workspace URLs on one scope.
+pub fn scoped_retention_db_path(base_dir: &Path, relay_url: &str, owner_pubkey: &str) -> PathBuf {
+    let normalized_relay = normalized_relay_scope(relay_url);
+    let mut hasher = Sha256::new();
+    hasher.update(owner_pubkey.trim().to_ascii_lowercase().as_bytes());
+    hasher.update(b"\0");
+    hasher.update(normalized_relay.as_bytes());
+    let scope_id = hex::encode(hasher.finalize());
+    base_dir.join("retention").join(format!("{scope_id}.db"))
+}
+
+/// Snapshot the active relay + owner and resolve their durable event store.
+///
+/// Callers keep the returned relay and keys alongside the path whenever work
+/// crosses an `.await`; a later workspace switch cannot retarget that work.
+pub fn active_retention_scope(app: &AppHandle, state: &AppState) -> Result<RetentionScope, String> {
+    let relay_url = crate::relay::relay_ws_url_with_override(state);
+    let owner_keys = state.signing_keys()?;
+    let base_dir = super::managed_agents_base_dir(app)?;
+    let db_path =
+        scoped_retention_db_path(&base_dir, &relay_url, &owner_keys.public_key().to_hex());
+    let parent = db_path
+        .parent()
+        .ok_or_else(|| "retention scope path has no parent".to_string())?;
+    std::fs::create_dir_all(parent)
+        .map_err(|error| format!("failed to create retention scope directory: {error}"))?;
+    Ok(RetentionScope {
+        db_path,
+        relay_url,
+        owner_keys,
+    })
+}
+
+/// Snapshot the active relay + owner, but only when it is the scope that owns
+/// events delivered by `arrival_relay_url`.
+///
+/// Resolving the scope and matching it in one step is what closes the gap: the
+/// returned scope is both the one that will be written to and the one the event
+/// arrived on. `Ok(None)` means the arrival community is no longer active and
+/// the caller must drop the event — see [`scope_for_arrival`].
+pub fn arrival_retention_scope(
+    app: &AppHandle,
+    state: &AppState,
+    arrival_relay_url: &str,
+) -> Result<Option<RetentionScope>, String> {
+    Ok(scope_for_arrival(
+        active_retention_scope(app, state)?,
+        arrival_relay_url,
+    ))
+}
 
 /// A retained persona event row.
 #[derive(Debug, Clone)]
@@ -368,6 +464,64 @@ pub fn get_retained_event(
 mod tests {
     use super::*;
 
+    #[test]
+    fn retention_scope_is_stable_and_separates_relay_and_owner() {
+        let base = Path::new("/tmp/buzz-retention-test");
+        let owner_a = "a".repeat(64);
+        let owner_b = "b".repeat(64);
+        let community_a = scoped_retention_db_path(base, "wss://a.example/", &owner_a);
+        assert_eq!(
+            community_a,
+            scoped_retention_db_path(base, "wss://a.example", &owner_a)
+        );
+        assert_ne!(
+            community_a,
+            scoped_retention_db_path(base, "wss://b.example", &owner_a)
+        );
+        assert_ne!(
+            community_a,
+            scoped_retention_db_path(base, "wss://a.example", &owner_b)
+        );
+    }
+
+    #[test]
+    fn test_arrival_relay_matching_agrees_with_database_identity() {
+        let base = Path::new("/tmp/buzz-retention-test");
+        let keys = nostr::Keys::generate();
+        let owner = keys.public_key().to_hex();
+        let scope = |relay: &str| RetentionScope {
+            db_path: scoped_retention_db_path(base, relay, &owner),
+            relay_url: relay.to_string(),
+            owner_keys: keys.clone(),
+        };
+        let community_a = scoped_retention_db_path(base, "wss://a.example", &owner);
+
+        // "Same relay" and "same database" must never disagree: every URL the
+        // match accepts has to hash to the scope's own db path, and every URL it
+        // rejects has to hash somewhere else.
+        for equivalent in ["wss://a.example", "wss://a.example/", " wss://a.example "] {
+            assert_eq!(
+                scope_for_arrival(scope("wss://a.example"), equivalent).map(|scope| scope.db_path),
+                Some(community_a.clone()),
+                "{equivalent}"
+            );
+            assert_eq!(
+                scoped_retention_db_path(base, equivalent, &owner),
+                community_a,
+                "{equivalent}"
+            );
+        }
+
+        assert!(
+            scope_for_arrival(scope("wss://b.example"), "wss://a.example").is_none(),
+            "an event from community A must not be filed while community B is active"
+        );
+        assert_ne!(
+            scoped_retention_db_path(base, "wss://b.example", &owner),
+            community_a
+        );
+    }
+
     #[test]
     fn concurrent_open_waits_for_initialization_lock() {
         let dir = tempfile::tempdir().unwrap();
diff --git a/desktop/src-tauri/src/managed_agents/retention/legacy_migration.rs b/desktop/src-tauri/src/managed_agents/retention/legacy_migration.rs
new file mode 100644
index 00000000000..1975f5d6df9
--- /dev/null
+++ b/desktop/src-tauri/src/managed_agents/retention/legacy_migration.rs
@@ -0,0 +1,212 @@
+//! One-time migration of the pre-scoping global retention database into the
+//! active relay+owner scope.
+//!
+//! Before community scoping, every durable event lived in one
+//! `<managed-agents-base>/retention.db`. Scoped storage
+//! ([`super::scoped_retention_db_path`]) reads a different file, so an upgrade
+//! would otherwise abandon whatever the previous release left pending —
+//! including signed kind:5 tombstones and NIP-IA archive requests queued while
+//! offline, which no reconcile can reconstruct (boot reconcile rebuilds upserts
+//! from records still on disk, and deletions have no reconcile at all).
+//!
+//! # Crash safety
+//!
+//! Two guards, each written transactionally, make the migration exactly-once
+//! without a completion file:
+//!
+//! 1. A **claim** in the legacy database naming the scope that owns its rows.
+//!    Legacy rows were queued for whichever single relay the old build had
+//!    active, so exactly one scope may take them; every other scope skips. This
+//!    is what keeps the migration from fanning one community's pending events
+//!    out to all of them — the leak class scoping exists to close.
+//! 2. A **marker** in the scoped database, committed in the same transaction as
+//!    the copied rows. A crash mid-copy therefore leaves neither rows nor
+//!    marker, and the next boot copies from scratch; once the marker is there
+//!    the copy never repeats.
+//!
+//! The relay dimension is not recoverable from the legacy file — only the owner
+//! pubkey is — so the claiming scope is the first one this owner activates after
+//! upgrading. That is the workspace the app restores at launch, i.e. the same
+//! relay the stranded rows were queued for in all but a contrived
+//! switch-before-first-flush case.
+
+use std::path::{Path, PathBuf};
+
+use rusqlite::{params, Connection, OptionalExtension};
+
+use super::{open_retention_db, RetainedEvent};
+
+/// Marker/claim identifier for this migration.
+const MIGRATION_NAME: &str = "legacy_global_retention_db";
+
+/// The pre-scoping global retention database path.
+pub fn legacy_retention_db_path(base_dir: &Path) -> PathBuf {
+    base_dir.join("retention.db")
+}
+
+/// Copy the legacy global database's rows for `owner_pubkey` into the scoped
+/// database at `scope_db_path`.
+///
+/// Returns the number of rows copied — `0` both when there is nothing to do and
+/// when another scope already claimed the legacy rows. Best-effort by design:
+/// the caller logs a failure and proceeds, and the guards make a later retry
+/// safe.
+pub fn migrate_legacy_retention_db(
+    base_dir: &Path,
+    scope_db_path: &Path,
+    owner_pubkey: &str,
+) -> Result<usize, String> {
+    let legacy_path = legacy_retention_db_path(base_dir);
+    if !legacy_path.exists() || legacy_path == scope_db_path {
+        return Ok(0);
+    }
+
+    let scope_id = scope_identifier(scope_db_path);
+    let mut scope_conn = open_retention_db(scope_db_path)?;
+    if migration_marker_present(&scope_conn)? {
+        return Ok(0);
+    }
+
+    let legacy_conn = open_retention_db(&legacy_path)?;
+    if !claim_legacy_rows(&legacy_conn, &scope_id)? {
+        return Ok(0); // another scope owns these rows
+    }
+
+    let rows = legacy_rows_for_owner(&legacy_conn, owner_pubkey)?;
+    let copied = rows.len();
+
+    let transaction = scope_conn
+        .transaction()
+        .map_err(|e| format!("failed to open retention migration transaction: {e}"))?;
+    for row in &rows {
+        // The scoped database is authoritative for any coordinate it already
+        // holds: those rows were written after the upgrade, so they are newer
+        // than anything legacy by construction. Legacy rows only fill gaps.
+        transaction
+            .execute(
+                "INSERT INTO persona_events
+                    (kind, pubkey, d_tag, content, created_at, raw_event, pending_sync)
+                 VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7)
+                 ON CONFLICT (kind, pubkey, d_tag) DO NOTHING",
+                params![
+                    row.kind,
+                    row.pubkey,
+                    row.d_tag,
+                    row.content,
+                    row.created_at,
+                    row.raw_event,
+                    row.pending_sync as i32,
+                ],
+            )
+            .map_err(|e| format!("failed to copy legacy retained event: {e}"))?;
+    }
+    write_migration_marker(&transaction, &scope_id)?;
+    transaction
+        .commit()
+        .map_err(|e| format!("failed to commit retention migration: {e}"))?;
+
+    Ok(copied)
+}
+
+/// Read every retained row authored by `owner_pubkey` from the legacy database.
+///
+/// Owner-filtered because the flush loop only publishes rows matching the
+/// active owner anyway; a different identity's rows belong to that identity's
+/// scope, not this one.
+fn legacy_rows_for_owner(
+    conn: &Connection,
+    owner_pubkey: &str,
+) -> Result<Vec<RetainedEvent>, String> {
+    let mut stmt = conn
+        .prepare(
+            "SELECT kind, pubkey, d_tag, content, created_at, raw_event, pending_sync
+             FROM persona_events
+             WHERE pubkey = ?1
+             ORDER BY (kind != 5), created_at ASC",
+        )
+        .map_err(|e| format!("failed to prepare legacy retention query: {e}"))?;
+
+    let rows = stmt
+        .query_map(params![owner_pubkey], |row| {
+            Ok(RetainedEvent {
+                kind: row.get(0)?,
+                pubkey: row.get(1)?,
+                d_tag: row.get(2)?,
+                content: row.get(3)?,
+                created_at: row.get(4)?,
+                raw_event: row.get(5)?,
+                pending_sync: row.get::<_, i32>(6)? != 0,
+            })
+        })
+        .map_err(|e| format!("failed to query legacy retained events: {e}"))?;
+
+    rows.collect::<Result<Vec<_>, _>>()
+        .map_err(|e| format!("failed to read legacy retained row: {e}"))
+}
+
+/// Identify a scope by its database file stem — the relay+owner hash
+/// [`super::scoped_retention_db_path`] already computes.
+fn scope_identifier(scope_db_path: &Path) -> String {
+    scope_db_path
+        .file_stem()
+        .map(|stem| stem.to_string_lossy().to_string())
+        .unwrap_or_default()
+}
+
+fn ensure_migration_table(conn: &Connection) -> Result<(), String> {
+    conn.execute_batch(
+        "CREATE TABLE IF NOT EXISTS retention_migrations (
+            name TEXT PRIMARY KEY,
+            scope_id TEXT NOT NULL
+        );",
+    )
+    .map_err(|e| format!("failed to create retention migration table: {e}"))
+}
+
+fn migration_marker_present(conn: &Connection) -> Result<bool, String> {
+    ensure_migration_table(conn)?;
+    conn.query_row(
+        "SELECT EXISTS(SELECT 1 FROM retention_migrations WHERE name = ?1)",
+        params![MIGRATION_NAME],
+        |row| row.get(0),
+    )
+    .map_err(|e| format!("failed to read retention migration marker: {e}"))
+}
+
+fn write_migration_marker(conn: &Connection, scope_id: &str) -> Result<(), String> {
+    ensure_migration_table(conn)?;
+    conn.execute(
+        "INSERT OR REPLACE INTO retention_migrations (name, scope_id) VALUES (?1, ?2)",
+        params![MIGRATION_NAME, scope_id],
+    )
+    .map_err(|e| format!("failed to write retention migration marker: {e}"))?;
+    Ok(())
+}
+
+/// Record `scope_id` as the owner of the legacy rows, or confirm it already is.
+///
+/// `INSERT OR IGNORE` then read-back is atomic enough for this purpose: the
+/// loser of a race reads the winner's scope id and returns `false`.
+fn claim_legacy_rows(legacy_conn: &Connection, scope_id: &str) -> Result<bool, String> {
+    ensure_migration_table(legacy_conn)?;
+    legacy_conn
+        .execute(
+            "INSERT OR IGNORE INTO retention_migrations (name, scope_id) VALUES (?1, ?2)",
+            params![MIGRATION_NAME, scope_id],
+        )
+        .map_err(|e| format!("failed to claim legacy retention rows: {e}"))?;
+
+    let claimed_by: Option<String> = legacy_conn
+        .query_row(
+            "SELECT scope_id FROM retention_migrations WHERE name = ?1",
+            params![MIGRATION_NAME],
+            |row| row.get(0),
+        )
+        .optional()
+        .map_err(|e| format!("failed to read legacy retention claim: {e}"))?;
+
+    Ok(claimed_by.as_deref() == Some(scope_id))
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/desktop/src-tauri/src/managed_agents/retention/legacy_migration/tests.rs b/desktop/src-tauri/src/managed_agents/retention/legacy_migration/tests.rs
new file mode 100644
index 00000000000..75da221320e
--- /dev/null
+++ b/desktop/src-tauri/src/managed_agents/retention/legacy_migration/tests.rs
@@ -0,0 +1,186 @@
+use super::*;
+use crate::managed_agents::retention::{
+    get_pending_sync, get_retained_event, retain_event, scoped_retention_db_path,
+    tombstone_retention_d_tag,
+};
+use buzz_core_pkg::kind::KIND_PERSONA;
+
+const KIND_DELETE: u32 = 5;
+const OWNER: &str = "a1b2c3";
+
+fn pending_tombstone(d_tag: &str) -> RetainedEvent {
+    RetainedEvent {
+        kind: KIND_DELETE,
+        pubkey: OWNER.to_string(),
+        d_tag: tombstone_retention_d_tag(KIND_PERSONA, d_tag),
+        content: String::new(),
+        created_at: 1_700_000_000,
+        raw_event: format!(r#"{{"kind":5,"d":"{d_tag}"}}"#),
+        pending_sync: true,
+    }
+}
+
+fn seed_legacy(base_dir: &Path, events: &[RetainedEvent]) {
+    let conn = open_retention_db(&legacy_retention_db_path(base_dir)).unwrap();
+    for event in events {
+        retain_event(&conn, event).unwrap();
+    }
+}
+
+fn scope_path(base_dir: &Path, relay: &str) -> PathBuf {
+    let path = scoped_retention_db_path(base_dir, relay, OWNER);
+    std::fs::create_dir_all(path.parent().unwrap()).unwrap();
+    path
+}
+
+#[test]
+fn test_pending_legacy_tombstone_migrates_into_the_active_scope_and_stays_pending() {
+    let dir = tempfile::tempdir().unwrap();
+    seed_legacy(dir.path(), &[pending_tombstone("retired-agent")]);
+    let scope = scope_path(dir.path(), "wss://a.example");
+
+    let copied = migrate_legacy_retention_db(dir.path(), &scope, OWNER).unwrap();
+
+    assert_eq!(copied, 1);
+    let conn = open_retention_db(&scope).unwrap();
+    let migrated = get_retained_event(
+        &conn,
+        KIND_DELETE,
+        OWNER,
+        &tombstone_retention_d_tag(KIND_PERSONA, "retired-agent"),
+    )
+    .unwrap()
+    .expect("legacy tombstone lands in the scoped db");
+    assert!(
+        migrated.pending_sync,
+        "the tombstone must still be queued for the flush loop"
+    );
+    assert_eq!(
+        migrated.raw_event,
+        pending_tombstone("retired-agent").raw_event
+    );
+    assert_eq!(get_pending_sync(&conn).unwrap().len(), 1);
+}
+
+#[test]
+fn test_repeat_migration_of_the_same_scope_copies_nothing_further() {
+    let dir = tempfile::tempdir().unwrap();
+    seed_legacy(dir.path(), &[pending_tombstone("retired-agent")]);
+    let scope = scope_path(dir.path(), "wss://a.example");
+
+    assert_eq!(
+        migrate_legacy_retention_db(dir.path(), &scope, OWNER).unwrap(),
+        1
+    );
+
+    // Simulate the flush loop clearing the row, then boot again: the marker
+    // must stop the legacy row from being resurrected as pending.
+    let conn = open_retention_db(&scope).unwrap();
+    conn.execute("UPDATE persona_events SET pending_sync = 0", [])
+        .unwrap();
+    drop(conn);
+
+    assert_eq!(
+        migrate_legacy_retention_db(dir.path(), &scope, OWNER).unwrap(),
+        0
+    );
+    let conn = open_retention_db(&scope).unwrap();
+    assert!(
+        get_pending_sync(&conn).unwrap().is_empty(),
+        "a published row must not be re-queued by a second migration pass"
+    );
+}
+
+#[test]
+fn test_second_community_does_not_receive_another_communitys_legacy_rows() {
+    let dir = tempfile::tempdir().unwrap();
+    seed_legacy(dir.path(), &[pending_tombstone("retired-agent")]);
+    let first = scope_path(dir.path(), "wss://a.example");
+    let second = scope_path(dir.path(), "wss://b.example");
+
+    assert_eq!(
+        migrate_legacy_retention_db(dir.path(), &first, OWNER).unwrap(),
+        1
+    );
+    assert_eq!(
+        migrate_legacy_retention_db(dir.path(), &second, OWNER).unwrap(),
+        0,
+        "legacy rows belong to exactly one relay scope"
+    );
+
+    let conn = open_retention_db(&second).unwrap();
+    assert!(get_pending_sync(&conn).unwrap().is_empty());
+}
+
+#[test]
+fn test_rows_authored_by_another_identity_are_left_behind() {
+    let dir = tempfile::tempdir().unwrap();
+    let mut foreign = pending_tombstone("someone-elses");
+    foreign.pubkey = "ffffff".to_string();
+    seed_legacy(dir.path(), &[pending_tombstone("mine"), foreign]);
+    let scope = scope_path(dir.path(), "wss://a.example");
+
+    assert_eq!(
+        migrate_legacy_retention_db(dir.path(), &scope, OWNER).unwrap(),
+        1
+    );
+
+    let conn = open_retention_db(&scope).unwrap();
+    let pending = get_pending_sync(&conn).unwrap();
+    assert_eq!(pending.len(), 1);
+    assert_eq!(pending[0].pubkey, OWNER);
+}
+
+#[test]
+fn test_post_upgrade_scoped_row_is_not_overwritten_by_its_legacy_ancestor() {
+    let dir = tempfile::tempdir().unwrap();
+    let legacy_head = RetainedEvent {
+        kind: KIND_PERSONA,
+        pubkey: OWNER.to_string(),
+        d_tag: "reviewer".to_string(),
+        content: r#"{"display_name":"Old"}"#.to_string(),
+        created_at: 1_700_000_000,
+        raw_event: r#"{"content":"old"}"#.to_string(),
+        pending_sync: true,
+    };
+    seed_legacy(dir.path(), &[legacy_head]);
+    let scope = scope_path(dir.path(), "wss://a.example");
+
+    // An edit made after the upgrade already occupies the coordinate.
+    let conn = open_retention_db(&scope).unwrap();
+    retain_event(
+        &conn,
+        &RetainedEvent {
+            kind: KIND_PERSONA,
+            pubkey: OWNER.to_string(),
+            d_tag: "reviewer".to_string(),
+            content: r#"{"display_name":"New"}"#.to_string(),
+            created_at: 1_700_000_500,
+            raw_event: r#"{"content":"new"}"#.to_string(),
+            pending_sync: true,
+        },
+    )
+    .unwrap();
+    drop(conn);
+
+    migrate_legacy_retention_db(dir.path(), &scope, OWNER).unwrap();
+
+    let conn = open_retention_db(&scope).unwrap();
+    let row = get_retained_event(&conn, KIND_PERSONA, OWNER, "reviewer")
+        .unwrap()
+        .unwrap();
+    assert_eq!(row.created_at, 1_700_000_500);
+    assert_eq!(row.raw_event, r#"{"content":"new"}"#);
+}
+
+#[test]
+fn test_absent_legacy_database_is_a_no_op() {
+    let dir = tempfile::tempdir().unwrap();
+    let scope = scope_path(dir.path(), "wss://a.example");
+
+    assert_eq!(
+        migrate_legacy_retention_db(dir.path(), &scope, OWNER).unwrap(),
+        0
+    );
+    assert!(!legacy_retention_db_path(dir.path()).exists());
+}
diff --git a/desktop/src-tauri/src/managed_agents/runtime.rs b/desktop/src-tauri/src/managed_agents/runtime.rs
index 32b3b328e9b..f3b4cb67fd5 100644
--- a/desktop/src-tauri/src/managed_agents/runtime.rs
+++ b/desktop/src-tauri/src/managed_agents/runtime.rs
@@ -21,7 +21,10 @@ pub(crate) use path::should_skip_claude_executable;
 pub(crate) use path::should_use_inherited;
 
 mod metadata;
-pub(crate) use metadata::{resolve_effective_prompt_model_provider, runtime_metadata_env_vars};
+pub(crate) use metadata::{
+    resolve_effective_prompt_model_provider, resolve_session_title, runtime_metadata_env_vars,
+    SESSION_TITLE_ENV_VAR,
+};
 
 mod stop;
 pub(crate) use stop::managed_agent_runtime_keys;
@@ -766,6 +769,15 @@ pub fn spawn_agent_child(
     } else {
         command.env_remove("BUZZ_ACP_MODEL");
     }
+    // Session title for the harness to pass out-of-band on `session/new`. The
+    // adapter names the session after it; it never reaches the prompt, so this
+    // is display metadata only. `spawn_config_hash` hashes the same resolve, so
+    // a rename raises the restart badge instead of leaving the process stale.
+    if let Some(title) = resolve_session_title(record.display_name.as_deref(), &record.name) {
+        command.env(SESSION_TITLE_ENV_VAR, title);
+    } else {
+        command.env_remove(SESSION_TITLE_ENV_VAR);
+    }
     build_buzz_agent_provider_defaults(&mut command);
     if let Some(meta) = runtime_meta {
         for (key, value) in runtime_metadata_env_vars(
@@ -823,7 +835,8 @@ pub fn spawn_agent_child(
             "GIT_CONFIG_KEY_0",
             format!("credential.{relay_http_url}/git.helper"),
         );
-        command.env("GIT_CONFIG_VALUE_0", cred_helper.display().to_string());
+        let helper = cred_helper.to_string_lossy().replace('\\', "/");
+        command.env("GIT_CONFIG_VALUE_0", helper);
         command.env(
             "GIT_CONFIG_KEY_1",
             format!("credential.{relay_http_url}/git.useHttpPath"),
diff --git a/desktop/src-tauri/src/managed_agents/runtime/metadata.rs b/desktop/src-tauri/src/managed_agents/runtime/metadata.rs
index ac9e3a0a3fc..288ce06b0ad 100644
--- a/desktop/src-tauri/src/managed_agents/runtime/metadata.rs
+++ b/desktop/src-tauri/src/managed_agents/runtime/metadata.rs
@@ -24,6 +24,39 @@ pub(crate) fn runtime_metadata_env_vars<'a>(
     vars
 }
 
+/// Env var carrying the session title to the harness. Shared with
+/// `spawn_hash` so the restart badge hashes the same key the spawn writes.
+pub(crate) const SESSION_TITLE_ENV_VAR: &str = "BUZZ_ACP_SESSION_TITLE";
+
+/// Resolve the session title for an agent: its `display_name` when it has one,
+/// otherwise its unique `name` handle. `None` when both are blank, so the
+/// caller clears the env var rather than exporting an empty title.
+///
+/// Control characters are stripped **here**, not left to the harness: an
+/// interior NUL cannot cross the environment boundary at all, so
+/// `Command::env` fails the whole spawn rather than passing it through (see
+/// the same guard applied to user-supplied env in `env_vars::merged_user_env`).
+/// A display name that is nothing but control characters therefore falls back
+/// to `name` instead of turning display chrome into a spawn failure.
+///
+/// The harness still owns whitespace collapsing, the length cap, and channel
+/// qualification — see `sanitize_session_title` and `compose_session_title` in
+/// `buzz-acp`.
+pub(crate) fn resolve_session_title(display_name: Option<&str>, name: &str) -> Option<String> {
+    [display_name, Some(name)]
+        .into_iter()
+        .flatten()
+        .map(|value| {
+            value
+                .chars()
+                .filter(|c| !c.is_control())
+                .collect::<String>()
+                .trim()
+                .to_string()
+        })
+        .find(|value| !value.is_empty())
+}
+
 /// Resolve effective prompt/model/provider using definition-authoritative
 /// semantics for linked instances.
 ///
@@ -49,3 +82,69 @@ pub(crate) fn resolve_effective_prompt_model_provider(
         None => (record_prompt, record_model, record_provider),
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::resolve_session_title;
+
+    #[test]
+    fn resolve_session_title_prefers_display_name() {
+        assert_eq!(
+            resolve_session_title(Some("Fizz"), "fizz-1").as_deref(),
+            Some("Fizz")
+        );
+    }
+
+    #[test]
+    fn resolve_session_title_falls_back_to_name_when_display_name_blank() {
+        assert_eq!(
+            resolve_session_title(None, "fizz-1").as_deref(),
+            Some("fizz-1")
+        );
+        assert_eq!(
+            resolve_session_title(Some("  "), "fizz-1").as_deref(),
+            Some("fizz-1")
+        );
+    }
+
+    #[test]
+    fn resolve_session_title_returns_none_when_both_are_blank() {
+        assert_eq!(resolve_session_title(Some(""), "   "), None);
+    }
+
+    #[test]
+    fn resolve_session_title_trims_surrounding_whitespace() {
+        assert_eq!(
+            resolve_session_title(Some("  Fizz  "), "fizz-1").as_deref(),
+            Some("Fizz")
+        );
+    }
+
+    /// An interior NUL cannot cross the env boundary — `Command::env` returns
+    /// `Err` for the whole spawn. Stripping it here keeps a corrupted record
+    /// from turning display chrome into a spawn failure.
+    #[test]
+    fn resolve_session_title_strips_control_chars_that_would_fail_the_spawn() {
+        let title = resolve_session_title(Some("Fi\u{0}zz\u{7}"), "fizz-1")
+            .expect("a name with strippable controls still yields a title");
+        assert_eq!(title, "Fizz");
+        assert!(!title.contains('\u{0}'));
+    }
+
+    /// A display name that is *only* control characters is not a title, so the
+    /// unique handle takes over rather than exporting an empty value.
+    #[test]
+    fn resolve_session_title_falls_back_to_name_when_display_name_is_all_control_chars() {
+        assert_eq!(
+            resolve_session_title(Some("\u{0}\u{1}"), "fizz-1").as_deref(),
+            Some("fizz-1")
+        );
+    }
+
+    /// Both candidates unusable — the caller clears the env var instead of
+    /// exporting a NUL-bearing or empty title.
+    #[test]
+    fn resolve_session_title_returns_none_when_both_candidates_are_control_chars_only() {
+        assert_eq!(resolve_session_title(Some("\u{0}"), "\u{0}"), None);
+    }
+}
diff --git a/desktop/src-tauri/src/managed_agents/runtime/tests.rs b/desktop/src-tauri/src/managed_agents/runtime/tests.rs
index 8deb0c4da92..3f6ee996f6c 100644
--- a/desktop/src-tauri/src/managed_agents/runtime/tests.rs
+++ b/desktop/src-tauri/src/managed_agents/runtime/tests.rs
@@ -53,8 +53,7 @@ fn identifier_exact_match_at_end_of_buffer() {
 
 #[test]
 fn longer_id_matches_when_short_prefix_also_present() {
-    // Searching for the longer ID finds it even when a shorter prefix token
-    // appears earlier — Thufir's "longer-of-prefix must match" case.
+    // The longer ID still matches when a shorter prefix token appears earlier.
     let mut buf = b"xyz.block.buzz.app".to_vec();
     buf.push(0);
     buf.extend_from_slice(br#""identifier":"xyz.block.buzz.app.dev""#);
@@ -72,8 +71,7 @@ fn identifier_empty_returns_false() {
 
 #[test]
 fn marker_entry_is_namespaced_by_instance_id() {
-    // The spawn stamp and the sweep matcher must produce identical bytes;
-    // both go through buzz_marker_entry, so this pins the on-the-wire
+    // The spawn stamp and sweep matcher both go through buzz_marker_entry, pinning the on-the-wire
     // format and guards against a dev build (`...app.dev`) matching a
     // release build's (`...app`) agents.
     assert_eq!(
@@ -175,8 +173,10 @@ fn fixture(
         name_pool: Vec::new(),
         is_builtin: false,
         is_active: true,
+        shared: false,
         source_team: None,
         source_team_persona_slug: None,
+        catalog_source: None,
         definition_respond_to: None,
         definition_respond_to_allowlist: Vec::new(),
         definition_parallelism: None,
@@ -294,8 +294,10 @@ fn persona_with_provider(
         name_pool: Vec::new(),
         is_builtin: false,
         is_active: true,
+        shared: false,
         source_team: None,
         source_team_persona_slug: None,
+        catalog_source: None,
         env_vars: std::collections::BTreeMap::new(),
         respond_to: None,
         respond_to_allowlist: Vec::new(),
diff --git a/desktop/src-tauri/src/managed_agents/snapshot_avatar.rs b/desktop/src-tauri/src/managed_agents/snapshot_avatar.rs
new file mode 100644
index 00000000000..a1044b31f46
--- /dev/null
+++ b/desktop/src-tauri/src/managed_agents/snapshot_avatar.rs
@@ -0,0 +1,42 @@
+use base64::{engine::general_purpose::STANDARD, Engine as _};
+use image::ImageDecoder;
+use std::io::Cursor;
+
+const MAX_AVATAR_INLINE_BYTES: usize = 2 * 1024 * 1024;
+const MAX_AVATAR_DIMENSION: u32 = 2048;
+const MAX_AVATAR_DECODE_ALLOC: u64 = 32 * 1024 * 1024;
+
+/// Materialize a snapshot PNG's visible pixels as a bounded portable avatar.
+/// The exact transparent 1×1 no-avatar placeholder and images that cannot fit
+/// the persisted inline-avatar budget leave the manifest fallback intact.
+pub(crate) fn snapshot_png_avatar_data_url(png_bytes: &[u8]) -> Result<Option<String>, String> {
+    let reader = image::ImageReader::with_format(Cursor::new(png_bytes), image::ImageFormat::Png);
+    let mut decoder = reader
+        .into_decoder()
+        .map_err(|e| format!("Failed to decode snapshot avatar: {e}"))?;
+    let mut limits = image::Limits::default();
+    limits.max_image_width = Some(MAX_AVATAR_DIMENSION);
+    limits.max_image_height = Some(MAX_AVATAR_DIMENSION);
+    limits.max_alloc = Some(MAX_AVATAR_DECODE_ALLOC);
+    decoder
+        .set_limits(limits)
+        .map_err(|e| format!("Snapshot avatar exceeds safe decoding limits: {e}"))?;
+    let (width, height) = decoder.dimensions();
+    let image = image::DynamicImage::from_decoder(decoder)
+        .map_err(|e| format!("Failed to decode snapshot avatar: {e}"))?;
+    if width == 1 && height == 1 && image.to_rgba8().get_pixel(0, 0).0 == [0, 0, 0, 0] {
+        return Ok(None);
+    }
+
+    let mut clean_png = Vec::new();
+    image
+        .write_to(&mut Cursor::new(&mut clean_png), image::ImageFormat::Png)
+        .map_err(|e| format!("Failed to encode snapshot avatar: {e}"))?;
+    if clean_png.len() > MAX_AVATAR_INLINE_BYTES {
+        return Ok(None);
+    }
+    Ok(Some(format!(
+        "data:image/png;base64,{}",
+        STANDARD.encode(clean_png)
+    )))
+}
diff --git a/desktop/src-tauri/src/managed_agents/spawn_hash.rs b/desktop/src-tauri/src/managed_agents/spawn_hash.rs
index e2884bfa153..648cc62bbed 100644
--- a/desktop/src-tauri/src/managed_agents/spawn_hash.rs
+++ b/desktop/src-tauri/src/managed_agents/spawn_hash.rs
@@ -31,6 +31,7 @@ use super::{
     effective_config::{resolve_effective_config, EffectiveConfigResult},
     known_acp_runtime, normalize_agent_args,
     persona_events::preview_prospective_persona_snapshot,
+    runtime::{resolve_session_title, SESSION_TITLE_ENV_VAR},
     types::{AgentDefinition, ManagedAgentRecord, TeamRecord},
     GlobalAgentConfig,
 };
@@ -124,6 +125,16 @@ pub(crate) fn spawn_config_hash(
     resolved_prompt.hash(&mut hasher);
     resolved_model.hash(&mut hasher);
     resolved_provider.hash(&mut hasher);
+    // Session title: the same resolve `spawn_agent_child` performs for its env
+    // write, so a rename raises the restart badge. Skipped when a user env
+    // override shadows it — spawn writes the title BEFORE the user env layer,
+    // so the override is what actually runs, and it already reaches this hash
+    // through `descriptor.env` above. Hashing the record-derived value under an
+    // override would badge a rename that changes nothing.
+    let effective_session_title = (!descriptor.env.contains_key(SESSION_TITLE_ENV_VAR))
+        .then(|| resolve_session_title(record.display_name.as_deref(), &record.name))
+        .flatten();
+    effective_session_title.hash(&mut hasher);
     record.auth_tag.hash(&mut hasher);
     record.respond_to.as_str().hash(&mut hasher);
     // The allowlist is hashed as the env receives it: spawn sets
diff --git a/desktop/src-tauri/src/managed_agents/spawn_hash/tests.rs b/desktop/src-tauri/src/managed_agents/spawn_hash/tests.rs
index 292cdbbb79f..f4ad4048143 100644
--- a/desktop/src-tauri/src/managed_agents/spawn_hash/tests.rs
+++ b/desktop/src-tauri/src/managed_agents/spawn_hash/tests.rs
@@ -49,8 +49,10 @@ fn record() -> ManagedAgentRecord {
         name_pool: Vec::new(),
         is_builtin: false,
         is_active: true,
+        shared: false,
         source_team: None,
         source_team_persona_slug: None,
+        catalog_source: None,
         definition_respond_to: None,
         definition_respond_to_allowlist: Vec::new(),
         definition_parallelism: None,
@@ -70,8 +72,10 @@ fn persona(id: &str, runtime: Option<&str>, prompt: &str) -> AgentDefinition {
         name_pool: vec![],
         is_builtin: false,
         is_active: true,
+        shared: false,
         source_team: None,
         source_team_persona_slug: None,
+        catalog_source: None,
         env_vars: BTreeMap::new(),
         respond_to: None,
         respond_to_allowlist: Vec::new(),
@@ -543,6 +547,72 @@ fn linked_instance_stale_prompt_bytes_are_inert_at_hash_time() {
     );
 }
 
+#[test]
+fn display_name_edit_changes_hash() {
+    // The spawn writes BUZZ_ACP_SESSION_TITLE from display_name-or-name, so a
+    // rename must trip the badge: the running process keeps the old title
+    // until it restarts, and the operator has to be told that.
+    let rec = record();
+    let mut renamed = record();
+    renamed.display_name = Some("Fizz".into());
+    assert_ne!(
+        spawn_config_hash(&rec, &[], &[], "wss://ws.example", &Default::default()),
+        spawn_config_hash(&renamed, &[], &[], "wss://ws.example", &Default::default()),
+        "a display-name rename changes the spawned session title and must badge"
+    );
+}
+
+#[test]
+fn name_edit_changes_hash_when_display_name_is_absent() {
+    // With no display_name the title falls back to the unique handle, so the
+    // handle is what the env write carries and what must be hashed.
+    let rec = record();
+    let mut renamed = record();
+    renamed.name = "agent-2".into();
+    assert_ne!(
+        spawn_config_hash(&rec, &[], &[], "wss://ws.example", &Default::default()),
+        spawn_config_hash(&renamed, &[], &[], "wss://ws.example", &Default::default()),
+        "the fallback title source must reach the hash too"
+    );
+}
+
+#[test]
+fn display_name_edit_does_not_change_hash_under_an_explicit_title_override() {
+    // User env is written AFTER the Buzz-set title (last-wins), so an explicit
+    // BUZZ_ACP_SESSION_TITLE is what the child actually runs with. Renaming the
+    // record changes nothing about the spawned process, so badging it would be
+    // a false restart prompt. The override itself still reaches the hash
+    // through the effective env.
+    let mut rec = record();
+    rec.env_vars
+        .insert("BUZZ_ACP_SESSION_TITLE".into(), "Pinned Title".into());
+    let mut renamed = rec.clone();
+    renamed.display_name = Some("Fizz".into());
+    assert_eq!(
+        spawn_config_hash(&rec, &[], &[], "wss://ws.example", &Default::default()),
+        spawn_config_hash(&renamed, &[], &[], "wss://ws.example", &Default::default()),
+        "a rename shadowed by an explicit title override must not badge"
+    );
+}
+
+#[test]
+fn title_override_edit_changes_hash() {
+    // Counterpart to the test above: the override is not inert — editing it
+    // changes what the child runs with and must badge.
+    let mut rec = record();
+    rec.env_vars
+        .insert("BUZZ_ACP_SESSION_TITLE".into(), "Pinned Title".into());
+    let mut edited = record();
+    edited
+        .env_vars
+        .insert("BUZZ_ACP_SESSION_TITLE".into(), "Other Title".into());
+    assert_ne!(
+        spawn_config_hash(&rec, &[], &[], "wss://ws.example", &Default::default()),
+        spawn_config_hash(&edited, &[], &[], "wss://ws.example", &Default::default()),
+        "editing an explicit title override must badge"
+    );
+}
+
 #[test]
 fn linked_instance_prompt_model_provider_resolve_from_one_call() {
     // The prompt for a linked instance must track the definition, exactly
diff --git a/desktop/src-tauri/src/managed_agents/storage.rs b/desktop/src-tauri/src/managed_agents/storage.rs
index b9c6c7e6cde..f6f89ed8989 100644
--- a/desktop/src-tauri/src/managed_agents/storage.rs
+++ b/desktop/src-tauri/src/managed_agents/storage.rs
@@ -65,6 +65,41 @@ pub fn managed_agent_runtime_log_path(
     Ok(managed_agents_logs_dir(app)?.join(format!("{}.log", key.runtime_id())))
 }
 
+/// Log path to surface for an agent whose runtime is not tracked in memory:
+/// the most recently written of its pair-scoped logs, falling back to the
+/// legacy single-runtime path when the agent has not run since harnesses
+/// became per (agent, relay) pair.
+pub fn latest_managed_agent_log_path(app: &AppHandle, pubkey: &str) -> Result<PathBuf, String> {
+    match newest_agent_log_in_dir(&managed_agents_logs_dir(app)?, pubkey) {
+        Some(path) => Ok(path),
+        None => managed_agent_log_path(app, pubkey),
+    }
+}
+
+/// Newest log in `dir` belonging to `pubkey` — either a pair-scoped
+/// `{pubkey}__{relay_hash}.log` or the legacy `{pubkey}.log`. Ties break
+/// toward the higher filename so the choice is deterministic.
+fn newest_agent_log_in_dir(dir: &Path, pubkey: &str) -> Option<PathBuf> {
+    let legacy_name = format!("{pubkey}.log");
+    let pair_prefix = format!("{pubkey}__");
+    fs::read_dir(dir)
+        .ok()?
+        .flatten()
+        .filter_map(|entry| {
+            let name = entry.file_name();
+            let matches = name.to_str().is_some_and(|name| {
+                name == legacy_name || (name.starts_with(&pair_prefix) && name.ends_with(".log"))
+            });
+            if !matches {
+                return None;
+            }
+            let modified = entry.metadata().ok()?.modified().ok()?;
+            Some((modified, name, entry.path()))
+        })
+        .max_by(|left, right| left.0.cmp(&right.0).then_with(|| left.1.cmp(&right.1)))
+        .map(|(_, _, path)| path)
+}
+
 /// The keyring operations the migration chokepoint needs. Abstracted so the
 /// migrate-and-strip decision logic ([`migrate_inline_key`]) can be unit-tested
 /// against a fake without touching the live OS keyring.
@@ -786,597 +821,5 @@ pub fn meaningful_agent_error_from_log(path: &Path) -> Option<AgentLogError> {
 }
 
 #[cfg(test)]
-mod tests {
-    use std::cell::RefCell;
-    use std::collections::HashMap;
-    use std::io::Write as _;
-
-    use tempfile::NamedTempFile;
-
-    use super::{
-        agent_keyring_name, hydrate_keys_with, migrate_inline_key, persist_agent_keys_with,
-        KeyMigration, KeyStore, KeyringProbe, ManagedAgentRecord,
-    };
-
-    /// In-memory [`KeyStore`] for testing the migrate decision without the OS
-    /// keyring. `reachable=false` simulates a backend outage; `fail_verify`
-    /// simulates a write whose read-back does not confirm.
-    struct FakeKeyStore {
-        reachable: bool,
-        fail_verify: bool,
-        stored: RefCell<HashMap<String, String>>,
-        write_count: RefCell<usize>,
-        read_count: RefCell<usize>,
-    }
-
-    impl FakeKeyStore {
-        fn reachable() -> Self {
-            Self {
-                reachable: true,
-                fail_verify: false,
-                stored: RefCell::new(HashMap::new()),
-                write_count: RefCell::new(0),
-                read_count: RefCell::new(0),
-            }
-        }
-        fn unreachable() -> Self {
-            Self {
-                reachable: false,
-                fail_verify: false,
-                stored: RefCell::new(HashMap::new()),
-                write_count: RefCell::new(0),
-                read_count: RefCell::new(0),
-            }
-        }
-        fn verify_fails() -> Self {
-            Self {
-                reachable: true,
-                fail_verify: true,
-                stored: RefCell::new(HashMap::new()),
-                write_count: RefCell::new(0),
-                read_count: RefCell::new(0),
-            }
-        }
-        /// Seed a key as already present in the keyring.
-        fn with_key(self, name: &str, value: &str) -> Self {
-            self.stored
-                .borrow_mut()
-                .insert(name.to_string(), value.to_string());
-            self
-        }
-    }
-
-    impl KeyStore for FakeKeyStore {
-        fn probe(&self, _name: &str) -> KeyringProbe {
-            if self.reachable {
-                KeyringProbe::ReachableButEmpty
-            } else {
-                KeyringProbe::Unreachable
-            }
-        }
-        fn load(&self, name: &str) -> Result<Option<String>, String> {
-            // An unreachable backend errors on read (outage), distinct from a
-            // reachable backend returning `Ok(None)` for an absent entry.
-            if !self.reachable {
-                return Err("keyring backend unreachable".to_string());
-            }
-            *self.read_count.borrow_mut() += 1;
-            Ok(self.stored.borrow().get(name).cloned())
-        }
-        fn load_all_readonly(&self) -> Result<Option<HashMap<String, String>>, String> {
-            if !self.reachable {
-                return Err("keyring backend unreachable".to_string());
-            }
-            *self.read_count.borrow_mut() += 1;
-            let map = self.stored.borrow().clone();
-            // Return None when completely empty (simulates no blob written yet).
-            if map.is_empty() {
-                Ok(None)
-            } else {
-                Ok(Some(map))
-            }
-        }
-        fn write_and_verify(&self, name: &str, value: &str) -> Result<(), String> {
-            if self.fail_verify {
-                return Err("read-back verify failed".to_string());
-            }
-            *self.write_count.borrow_mut() += 1;
-            self.stored
-                .borrow_mut()
-                .insert(name.to_string(), value.to_string());
-            Ok(())
-        }
-        fn store_all(&self, entries: &HashMap<String, String>) -> Result<(), String> {
-            if !self.reachable {
-                return Err("keyring backend unreachable".to_string());
-            }
-            if self.fail_verify {
-                return Err("read-back verify failed".to_string());
-            }
-            *self.write_count.borrow_mut() += 1;
-            let mut stored = self.stored.borrow_mut();
-            for (k, v) in entries {
-                stored.insert(k.clone(), v.clone());
-            }
-            Ok(())
-        }
-    }
-
-    fn record_with_key(nsec: &str) -> ManagedAgentRecord {
-        record_with_pubkey_and_key("agent-pubkey", nsec)
-    }
-
-    fn record_with_pubkey_and_key(pubkey: &str, nsec: &str) -> ManagedAgentRecord {
-        serde_json::from_str(&format!(
-            r#"{{
-                "pubkey": "{pubkey}",
-                "name": "test-agent",
-                "private_key_nsec": "{nsec}",
-                "relay_url": "wss://localhost:3000",
-                "acp_command": "buzz-acp",
-                "agent_command": "goose",
-                "agent_args": [],
-                "mcp_command": "",
-                "turn_timeout_seconds": 320,
-                "created_at": "2026-01-01T00:00:00Z",
-                "updated_at": "2026-01-01T00:00:00Z"
-            }}"#
-        ))
-        .expect("sample record")
-    }
-
-    #[test]
-    fn migrate_persists_and_signals_stripping_when_keyring_reachable() {
-        // Item 2: an inline key (residue from a prior keyring-unreachable save)
-        // is written to the keyring and verified when the backend is reachable,
-        // so the next save can drop it from JSON.
-        let store = FakeKeyStore::reachable();
-        let record = record_with_key("nsec1realkey");
-
-        let outcome = migrate_inline_key(&store, &record);
-
-        assert_eq!(outcome, KeyMigration::Persisted);
-        assert_eq!(
-            store
-                .stored
-                .borrow()
-                .get(&agent_keyring_name("agent-pubkey"))
-                .map(String::as_str),
-            Some("nsec1realkey")
-        );
-    }
-
-    #[test]
-    fn migrate_keeps_inline_when_keyring_unreachable() {
-        // No-resurrection guard: a transient outage must NOT migrate; the key
-        // stays inline (file fallback) so it is not lost.
-        let store = FakeKeyStore::unreachable();
-        let record = record_with_key("nsec1realkey");
-
-        let outcome = migrate_inline_key(&store, &record);
-
-        assert_eq!(outcome, KeyMigration::KeptInline);
-        assert!(store.stored.borrow().is_empty());
-    }
-
-    #[test]
-    fn migrate_keeps_inline_when_verify_fails() {
-        // A write whose read-back does not confirm must keep the key inline —
-        // never drop plaintext on an unverified write.
-        let store = FakeKeyStore::verify_fails();
-        let record = record_with_key("nsec1realkey");
-
-        assert_eq!(
-            migrate_inline_key(&store, &record),
-            KeyMigration::KeptInline
-        );
-    }
-
-    #[test]
-    fn migrate_reports_nothing_for_empty_key() {
-        // A record whose key already lives in the keyring (empty inline) has
-        // nothing to migrate. It must NOT be reported as `Persisted` — an
-        // empty key after a keyring outage means the secret is unavailable,
-        // not verified present (Wes storage.rs:158).
-        let store = FakeKeyStore::reachable();
-        let record = record_with_key("");
-
-        assert_eq!(migrate_inline_key(&store, &record), KeyMigration::Nothing);
-        assert!(store.stored.borrow().is_empty());
-    }
-
-    #[test]
-    fn hydrate_fills_key_from_keyring_when_reachable() {
-        // The normal keyring-backed case: an empty inline key is filled from
-        // the keyring on load.
-        let store =
-            FakeKeyStore::reachable().with_key(&agent_keyring_name("agent-pubkey"), "nsec1stored");
-        let mut records = vec![record_with_key("")];
-
-        hydrate_keys_with(&store, &mut records);
-
-        assert_eq!(records[0].private_key_nsec, "nsec1stored");
-    }
-
-    #[test]
-    fn hydrate_leaves_key_empty_on_keyring_outage() {
-        // Outage edge (Wes storage.rs:158): when the keyring read ERRORS, the
-        // key must be left empty — never silently treated as resolved — so the
-        // spawn path refuses rather than launching the agent with no identity.
-        let store = FakeKeyStore::unreachable();
-        let mut records = vec![record_with_key("")];
-
-        hydrate_keys_with(&store, &mut records);
-
-        assert!(
-            records[0].private_key_nsec.is_empty(),
-            "an unreadable key must stay empty, not be fabricated"
-        );
-    }
-
-    #[test]
-    fn spawn_refused_when_private_key_empty() {
-        // The spawn path MUST refuse a record left empty by an outage/absence
-        // before injecting an empty BUZZ_PRIVATE_KEY / NOSTR_PRIVATE_KEY — never
-        // launch an agent with no identity (Wes storage.rs:158).
-        let record = record_with_key("");
-        assert!(
-            super::spawn_key_refusal(&record).is_some(),
-            "an agent with no private key must be refused"
-        );
-    }
-
-    #[test]
-    fn spawn_allowed_when_private_key_present() {
-        // A record carrying a key must not be blocked by the refusal guard.
-        let record = record_with_key("nsec1realkey");
-        assert!(super::spawn_key_refusal(&record).is_none());
-    }
-
-    #[test]
-    fn persist_agent_keys_issues_zero_writes_when_inline_keys_already_cleared() {
-        // This is the dominant prompt-storm scenario: after the first successful
-        // persist all inline copies are cleared, so subsequent saves (e.g. a
-        // model change) must issue zero keychain writes. `migrate_inline_key`
-        // returns `Nothing` for empty-key records, and `persist_agent_keys_with`
-        // must propagate that guarantee — write_count stays at 0.
-        let store = FakeKeyStore::reachable();
-        // Records whose inline key is already blank (key lives in the keyring).
-        let mut records = vec![record_with_key(""), record_with_key("")];
-
-        persist_agent_keys_with(&store, &mut records);
-
-        assert_eq!(
-            *store.write_count.borrow(),
-            0,
-            "a save with no inline keys must issue zero keychain writes"
-        );
-    }
-
-    #[test]
-    fn persist_agent_keys_writes_once_per_record_with_inline_key() {
-        // A record carrying an inline key (e.g. first save, or keyring-outage
-        // residue) must trigger exactly one write_and_verify per record — and
-        // once persisted the inline copy is cleared so the next save is free.
-        // Records use distinct pubkeys so each maps to a distinct keyring name,
-        // verifying the "per record" behaviour rather than a single-key overwrite.
-        let store = FakeKeyStore::reachable();
-        let mut records = vec![
-            record_with_pubkey_and_key("pubkey-agent-alpha", "nsec1key_a"),
-            record_with_pubkey_and_key("pubkey-agent-beta", "nsec1key_b"),
-        ];
-
-        persist_agent_keys_with(&store, &mut records);
-
-        assert_eq!(
-            *store.write_count.borrow(),
-            2,
-            "each record with an inline key must trigger exactly one write"
-        );
-        // Verify the correct keyring name was used for each agent.
-        assert_eq!(
-            store
-                .stored
-                .borrow()
-                .get(&agent_keyring_name("pubkey-agent-alpha"))
-                .map(String::as_str),
-            Some("nsec1key_a"),
-        );
-        assert_eq!(
-            store
-                .stored
-                .borrow()
-                .get(&agent_keyring_name("pubkey-agent-beta"))
-                .map(String::as_str),
-            Some("nsec1key_b"),
-        );
-        // After persist the inline copies are cleared — next save is zero-write.
-        assert!(records[0].private_key_nsec.is_empty());
-        assert!(records[1].private_key_nsec.is_empty());
-    }
-
-    fn write_log(content: &str) -> NamedTempFile {
-        let mut file = NamedTempFile::new().expect("temp log");
-        file.write_all(content.as_bytes()).expect("write log");
-        file
-    }
-
-    /// The keyringless fallback write must land `0o600` from the write itself —
-    /// not a post-write `chmod` — so a crash in the umask window can never leave
-    /// plaintext agent nsecs world-readable (Wes storage.rs:239, SECURITY.md:90).
-    #[cfg(unix)]
-    #[test]
-    fn restricted_write_lands_owner_only_without_post_write_chmod() {
-        use std::os::unix::fs::PermissionsExt;
-
-        let dir = tempfile::tempdir().expect("temp dir");
-        let path = dir.path().join("managed-agents.json");
-
-        super::atomic_write_json_restricted(&path, br#"[{"private_key_nsec":"nsec1secret"}]"#)
-            .expect("restricted write");
-
-        let mode = std::fs::metadata(&path)
-            .expect("metadata")
-            .permissions()
-            .mode()
-            & 0o777;
-        assert_eq!(mode, 0o600, "secret-bearing write must be owner-only");
-        assert_eq!(
-            std::fs::read_to_string(&path).expect("read back"),
-            r#"[{"private_key_nsec":"nsec1secret"}]"#
-        );
-    }
-
-    #[test]
-    fn meaningful_agent_error_from_log_promotes_wrapped_llm_auth() {
-        let file = write_log(
-            "noise\nAgent reported error (code -32001): llm auth: 401 unauthorized: ...\n",
-        );
-        let result = super::meaningful_agent_error_from_log(file.path()).unwrap();
-        assert!(result.message.contains("llm auth"));
-        assert_eq!(result.code, Some(-32001));
-    }
-
-    #[test]
-    fn meaningful_agent_error_from_log_promotes_unwrapped_llm_auth() {
-        let file = write_log("noise\nllm auth: denied\n");
-        let result = super::meaningful_agent_error_from_log(file.path()).unwrap();
-        assert_eq!(result.message, "Agent reported error: llm auth: denied");
-        assert_eq!(result.code, Some(-32001));
-    }
-
-    #[test]
-    fn meaningful_agent_error_from_log_promotes_bare_model_not_found() {
-        let file = write_log("noise\nllm model not found: (some-model) 404\n");
-        let result = super::meaningful_agent_error_from_log(file.path()).unwrap();
-        assert_eq!(
-            result.message,
-            "Agent reported error: llm model not found: (some-model) 404"
-        );
-        assert_eq!(result.code, Some(-32002));
-    }
-
-    #[test]
-    fn meaningful_agent_error_from_log_promotes_legacy_format() {
-        let file = write_log("noise\nAgent reported error: llm: 500 internal\n");
-        let result = super::meaningful_agent_error_from_log(file.path()).unwrap();
-        assert_eq!(result.message, "Agent reported error: llm: 500 internal");
-        assert_eq!(result.code, None);
-    }
-
-    #[test]
-    fn meaningful_agent_error_from_log_does_not_promote_midline_auth_text() {
-        let file = write_log("noise before llm auth: denied\n");
-        assert!(super::meaningful_agent_error_from_log(file.path()).is_none());
-    }
-
-    #[test]
-    fn strips_ansi_from_typical_tracing_line() {
-        let input = "\x1b[2m2026-05-27T15:16:32\x1b[0m \x1b[32m INFO\x1b[0m \x1b[2mbuzz_acp\x1b[0m\x1b[2m:\x1b[0m starting";
-        assert_eq!(
-            strip_ansi_escapes::strip_str(input),
-            "2026-05-27T15:16:32  INFO buzz_acp: starting"
-        );
-    }
-
-    // ── keyring-dev-migration tests ────────────────────────────────────────
-
-    #[test]
-    fn copy_agent_keys_copies_keys_present_in_src_to_dst() {
-        // Keys in src but not in dst must be copied in a single bulk write,
-        // and the migration-complete marker must be set.
-        let src = FakeKeyStore::reachable()
-            .with_key(&agent_keyring_name("agent-alpha"), "nsec1alpha")
-            .with_key(&agent_keyring_name("agent-beta"), "nsec1beta");
-        let dst = FakeKeyStore::reachable();
-
-        super::copy_agent_keys_between_stores(
-            &["agent-alpha".to_string(), "agent-beta".to_string()],
-            &src,
-            &dst,
-        );
-
-        assert_eq!(
-            dst.stored
-                .borrow()
-                .get(&agent_keyring_name("agent-alpha"))
-                .map(String::as_str),
-            Some("nsec1alpha"),
-            "agent-alpha must be copied from src to dst"
-        );
-        assert_eq!(
-            dst.stored
-                .borrow()
-                .get(&agent_keyring_name("agent-beta"))
-                .map(String::as_str),
-            Some("nsec1beta"),
-            "agent-beta must be copied from src to dst"
-        );
-        assert_eq!(
-            dst.stored
-                .borrow()
-                .get(super::DEV_MIGRATION_MARKER)
-                .map(String::as_str),
-            Some("done"),
-            "migration-complete marker must be set after first migration"
-        );
-        // Bulk write: exactly 1 store_all call.
-        assert_eq!(
-            *dst.write_count.borrow(),
-            1,
-            "must perform exactly one bulk write"
-        );
-        // Src accessed exactly once (bulk blob read).
-        assert_eq!(
-            *src.read_count.borrow(),
-            1,
-            "src must be read exactly once (bulk)"
-        );
-    }
-
-    #[test]
-    fn copy_agent_keys_skips_keys_already_in_dst() {
-        // Idempotency: a key already present in dst must NOT be overwritten
-        // — the agent may have rotated their key in the dev service.
-        let src =
-            FakeKeyStore::reachable().with_key(&agent_keyring_name("agent-alpha"), "nsec1old");
-        let dst =
-            FakeKeyStore::reachable().with_key(&agent_keyring_name("agent-alpha"), "nsec1new");
-
-        super::copy_agent_keys_between_stores(&["agent-alpha".to_string()], &src, &dst);
-
-        // dst value must remain unchanged — src must not overwrite it.
-        assert_eq!(
-            dst.stored
-                .borrow()
-                .get(&agent_keyring_name("agent-alpha"))
-                .map(String::as_str),
-            Some("nsec1new"),
-            "key already in dst must not be overwritten by migration"
-        );
-        // Marker must still be written even though no new keys were copied.
-        assert_eq!(
-            dst.stored
-                .borrow()
-                .get(super::DEV_MIGRATION_MARKER)
-                .map(String::as_str),
-            Some("done"),
-            "marker must be set even when all keys are already present"
-        );
-        assert_eq!(*src.read_count.borrow(), 0);
-    }
-
-    #[test]
-    fn copy_agent_keys_skips_keys_absent_from_src() {
-        // A pubkey with no entry in src (new agent that will mint a fresh key)
-        // must be silently skipped — no agent key written to dst.
-        let src = FakeKeyStore::reachable(); // empty
-        let dst = FakeKeyStore::reachable();
-
-        super::copy_agent_keys_between_stores(&["new-agent".to_string()], &src, &dst);
-
-        assert!(
-            dst.stored
-                .borrow()
-                .get(&agent_keyring_name("new-agent"))
-                .is_none(),
-            "absent src key must produce no agent key write to dst"
-        );
-        // Marker must still be written.
-        assert_eq!(
-            dst.stored
-                .borrow()
-                .get(super::DEV_MIGRATION_MARKER)
-                .map(String::as_str),
-            Some("done"),
-            "marker must be set even when no keys were present in src"
-        );
-    }
-
-    #[test]
-    fn copy_agent_keys_skips_all_when_dst_unreachable() {
-        // When dst keyring is unreachable the migration must be a no-op — never
-        // data-loss (failing to write is fine; the agent will re-mint on next
-        // onboarding run).
-        let src =
-            FakeKeyStore::reachable().with_key(&agent_keyring_name("agent-alpha"), "nsec1alpha");
-        let dst = FakeKeyStore::unreachable();
-
-        super::copy_agent_keys_between_stores(&["agent-alpha".to_string()], &src, &dst);
-
-        // No writes attempted to an unreachable dst.
-        assert_eq!(*dst.write_count.borrow(), 0);
-        // Src must not have been accessed (failed on dst read, returned early).
-        assert_eq!(
-            *src.read_count.borrow(),
-            0,
-            "src must not be accessed when dst is unreachable"
-        );
-    }
-
-    #[test]
-    fn copy_agent_keys_skips_entirely_when_marker_present() {
-        // After the first migration, the marker is in dst. Subsequent calls
-        // must return immediately — the prod keyring (src) must never be read.
-        let src =
-            FakeKeyStore::reachable().with_key(&agent_keyring_name("agent-alpha"), "nsec1alpha");
-        let dst = FakeKeyStore::reachable()
-            .with_key(super::DEV_MIGRATION_MARKER, "done")
-            .with_key(&agent_keyring_name("agent-alpha"), "nsec1dev");
-
-        super::copy_agent_keys_between_stores(&["agent-alpha".to_string()], &src, &dst);
-
-        // Src must not have been accessed at all.
-        assert_eq!(
-            *src.read_count.borrow(),
-            0,
-            "src must not be read when migration-complete marker is present"
-        );
-        // Dst must not have been written.
-        assert_eq!(
-            *dst.write_count.borrow(),
-            0,
-            "dst must not be written when migration-complete marker is present"
-        );
-        // Dev key must remain unchanged.
-        assert_eq!(
-            dst.stored
-                .borrow()
-                .get(&agent_keyring_name("agent-alpha"))
-                .map(String::as_str),
-            Some("nsec1dev"),
-            "dev key must not be overwritten on subsequent boots"
-        );
-    }
-
-    #[test]
-    fn copy_agent_keys_writes_marker_even_with_empty_agent_list() {
-        // An empty pubkey list (no agents yet) must still write the marker so
-        // future boots skip the prod read.
-        let src = FakeKeyStore::reachable();
-        let dst = FakeKeyStore::reachable();
-
-        super::copy_agent_keys_between_stores(&[], &src, &dst);
-
-        assert_eq!(
-            dst.stored
-                .borrow()
-                .get(super::DEV_MIGRATION_MARKER)
-                .map(String::as_str),
-            Some("done"),
-            "marker must be set even when pubkey list is empty"
-        );
-        assert_eq!(*src.read_count.borrow(), 0);
-    }
-
-    #[test]
-    fn try_delete_agent_key_returns_result() {
-        // Verify the result-returning seam exists and has the correct signature.
-        // We cannot call it in default builds (system-keyring feature is on,
-        // which accesses the real OS keychain and blocks in headless/CI). The
-        // real keychain paths are integration-tested through the #[ignore]
-        // tests in secret_store.rs; the rollback aggregation is tested in
-        // team_snapshot::tests::rollback_aggregates_multiple_errors.
-        let _: fn(&str) -> Result<(), String> = super::try_delete_agent_key;
-    }
-}
+#[path = "storage_tests.rs"]
+mod tests;
diff --git a/desktop/src-tauri/src/managed_agents/storage_tests.rs b/desktop/src-tauri/src/managed_agents/storage_tests.rs
new file mode 100644
index 00000000000..73567bb915c
--- /dev/null
+++ b/desktop/src-tauri/src/managed_agents/storage_tests.rs
@@ -0,0 +1,700 @@
+//! Unit tests for `managed_agents/storage.rs`.
+//!
+//! Kept in a sibling file so `storage.rs` stays closer to the 1000-line gate;
+//! `#[path]`-included from there.
+
+use std::cell::RefCell;
+use std::collections::HashMap;
+use std::fs::File;
+use std::io::Write as _;
+use std::path::Path;
+
+use tempfile::NamedTempFile;
+
+use super::{
+    agent_keyring_name, hydrate_keys_with, migrate_inline_key, persist_agent_keys_with,
+    KeyMigration, KeyStore, KeyringProbe, ManagedAgentRecord,
+};
+
+/// In-memory [`KeyStore`] for testing the migrate decision without the OS
+/// keyring. `reachable=false` simulates a backend outage; `fail_verify`
+/// simulates a write whose read-back does not confirm.
+struct FakeKeyStore {
+    reachable: bool,
+    fail_verify: bool,
+    stored: RefCell<HashMap<String, String>>,
+    write_count: RefCell<usize>,
+    read_count: RefCell<usize>,
+}
+
+impl FakeKeyStore {
+    fn reachable() -> Self {
+        Self {
+            reachable: true,
+            fail_verify: false,
+            stored: RefCell::new(HashMap::new()),
+            write_count: RefCell::new(0),
+            read_count: RefCell::new(0),
+        }
+    }
+    fn unreachable() -> Self {
+        Self {
+            reachable: false,
+            fail_verify: false,
+            stored: RefCell::new(HashMap::new()),
+            write_count: RefCell::new(0),
+            read_count: RefCell::new(0),
+        }
+    }
+    fn verify_fails() -> Self {
+        Self {
+            reachable: true,
+            fail_verify: true,
+            stored: RefCell::new(HashMap::new()),
+            write_count: RefCell::new(0),
+            read_count: RefCell::new(0),
+        }
+    }
+    /// Seed a key as already present in the keyring.
+    fn with_key(self, name: &str, value: &str) -> Self {
+        self.stored
+            .borrow_mut()
+            .insert(name.to_string(), value.to_string());
+        self
+    }
+}
+
+impl KeyStore for FakeKeyStore {
+    fn probe(&self, _name: &str) -> KeyringProbe {
+        if self.reachable {
+            KeyringProbe::ReachableButEmpty
+        } else {
+            KeyringProbe::Unreachable
+        }
+    }
+    fn load(&self, name: &str) -> Result<Option<String>, String> {
+        // An unreachable backend errors on read (outage), distinct from a
+        // reachable backend returning `Ok(None)` for an absent entry.
+        if !self.reachable {
+            return Err("keyring backend unreachable".to_string());
+        }
+        *self.read_count.borrow_mut() += 1;
+        Ok(self.stored.borrow().get(name).cloned())
+    }
+    fn load_all_readonly(&self) -> Result<Option<HashMap<String, String>>, String> {
+        if !self.reachable {
+            return Err("keyring backend unreachable".to_string());
+        }
+        *self.read_count.borrow_mut() += 1;
+        let map = self.stored.borrow().clone();
+        // Return None when completely empty (simulates no blob written yet).
+        if map.is_empty() {
+            Ok(None)
+        } else {
+            Ok(Some(map))
+        }
+    }
+    fn write_and_verify(&self, name: &str, value: &str) -> Result<(), String> {
+        if self.fail_verify {
+            return Err("read-back verify failed".to_string());
+        }
+        *self.write_count.borrow_mut() += 1;
+        self.stored
+            .borrow_mut()
+            .insert(name.to_string(), value.to_string());
+        Ok(())
+    }
+    fn store_all(&self, entries: &HashMap<String, String>) -> Result<(), String> {
+        if !self.reachable {
+            return Err("keyring backend unreachable".to_string());
+        }
+        if self.fail_verify {
+            return Err("read-back verify failed".to_string());
+        }
+        *self.write_count.borrow_mut() += 1;
+        let mut stored = self.stored.borrow_mut();
+        for (k, v) in entries {
+            stored.insert(k.clone(), v.clone());
+        }
+        Ok(())
+    }
+}
+
+fn record_with_key(nsec: &str) -> ManagedAgentRecord {
+    record_with_pubkey_and_key("agent-pubkey", nsec)
+}
+
+fn record_with_pubkey_and_key(pubkey: &str, nsec: &str) -> ManagedAgentRecord {
+    serde_json::from_str(&format!(
+        r#"{{
+            "pubkey": "{pubkey}",
+            "name": "test-agent",
+            "private_key_nsec": "{nsec}",
+            "relay_url": "wss://localhost:3000",
+            "acp_command": "buzz-acp",
+            "agent_command": "goose",
+            "agent_args": [],
+            "mcp_command": "",
+            "turn_timeout_seconds": 320,
+            "created_at": "2026-01-01T00:00:00Z",
+            "updated_at": "2026-01-01T00:00:00Z"
+        }}"#
+    ))
+    .expect("sample record")
+}
+
+#[test]
+fn migrate_persists_and_signals_stripping_when_keyring_reachable() {
+    // Item 2: an inline key (residue from a prior keyring-unreachable save)
+    // is written to the keyring and verified when the backend is reachable,
+    // so the next save can drop it from JSON.
+    let store = FakeKeyStore::reachable();
+    let record = record_with_key("nsec1realkey");
+
+    let outcome = migrate_inline_key(&store, &record);
+
+    assert_eq!(outcome, KeyMigration::Persisted);
+    assert_eq!(
+        store
+            .stored
+            .borrow()
+            .get(&agent_keyring_name("agent-pubkey"))
+            .map(String::as_str),
+        Some("nsec1realkey")
+    );
+}
+
+#[test]
+fn migrate_keeps_inline_when_keyring_unreachable() {
+    // No-resurrection guard: a transient outage must NOT migrate; the key
+    // stays inline (file fallback) so it is not lost.
+    let store = FakeKeyStore::unreachable();
+    let record = record_with_key("nsec1realkey");
+
+    let outcome = migrate_inline_key(&store, &record);
+
+    assert_eq!(outcome, KeyMigration::KeptInline);
+    assert!(store.stored.borrow().is_empty());
+}
+
+#[test]
+fn migrate_keeps_inline_when_verify_fails() {
+    // A write whose read-back does not confirm must keep the key inline —
+    // never drop plaintext on an unverified write.
+    let store = FakeKeyStore::verify_fails();
+    let record = record_with_key("nsec1realkey");
+
+    assert_eq!(
+        migrate_inline_key(&store, &record),
+        KeyMigration::KeptInline
+    );
+}
+
+#[test]
+fn migrate_reports_nothing_for_empty_key() {
+    // A record whose key already lives in the keyring (empty inline) has
+    // nothing to migrate. It must NOT be reported as `Persisted` — an
+    // empty key after a keyring outage means the secret is unavailable,
+    // not verified present (Wes storage.rs:158).
+    let store = FakeKeyStore::reachable();
+    let record = record_with_key("");
+
+    assert_eq!(migrate_inline_key(&store, &record), KeyMigration::Nothing);
+    assert!(store.stored.borrow().is_empty());
+}
+
+#[test]
+fn hydrate_fills_key_from_keyring_when_reachable() {
+    // The normal keyring-backed case: an empty inline key is filled from
+    // the keyring on load.
+    let store =
+        FakeKeyStore::reachable().with_key(&agent_keyring_name("agent-pubkey"), "nsec1stored");
+    let mut records = vec![record_with_key("")];
+
+    hydrate_keys_with(&store, &mut records);
+
+    assert_eq!(records[0].private_key_nsec, "nsec1stored");
+}
+
+#[test]
+fn hydrate_leaves_key_empty_on_keyring_outage() {
+    // Outage edge (Wes storage.rs:158): when the keyring read ERRORS, the
+    // key must be left empty — never silently treated as resolved — so the
+    // spawn path refuses rather than launching the agent with no identity.
+    let store = FakeKeyStore::unreachable();
+    let mut records = vec![record_with_key("")];
+
+    hydrate_keys_with(&store, &mut records);
+
+    assert!(
+        records[0].private_key_nsec.is_empty(),
+        "an unreadable key must stay empty, not be fabricated"
+    );
+}
+
+#[test]
+fn spawn_refused_when_private_key_empty() {
+    // The spawn path MUST refuse a record left empty by an outage/absence
+    // before injecting an empty BUZZ_PRIVATE_KEY / NOSTR_PRIVATE_KEY — never
+    // launch an agent with no identity (Wes storage.rs:158).
+    let record = record_with_key("");
+    assert!(
+        super::spawn_key_refusal(&record).is_some(),
+        "an agent with no private key must be refused"
+    );
+}
+
+#[test]
+fn spawn_allowed_when_private_key_present() {
+    // A record carrying a key must not be blocked by the refusal guard.
+    let record = record_with_key("nsec1realkey");
+    assert!(super::spawn_key_refusal(&record).is_none());
+}
+
+#[test]
+fn persist_agent_keys_issues_zero_writes_when_inline_keys_already_cleared() {
+    // This is the dominant prompt-storm scenario: after the first successful
+    // persist all inline copies are cleared, so subsequent saves (e.g. a
+    // model change) must issue zero keychain writes. `migrate_inline_key`
+    // returns `Nothing` for empty-key records, and `persist_agent_keys_with`
+    // must propagate that guarantee — write_count stays at 0.
+    let store = FakeKeyStore::reachable();
+    // Records whose inline key is already blank (key lives in the keyring).
+    let mut records = vec![record_with_key(""), record_with_key("")];
+
+    persist_agent_keys_with(&store, &mut records);
+
+    assert_eq!(
+        *store.write_count.borrow(),
+        0,
+        "a save with no inline keys must issue zero keychain writes"
+    );
+}
+
+#[test]
+fn persist_agent_keys_writes_once_per_record_with_inline_key() {
+    // A record carrying an inline key (e.g. first save, or keyring-outage
+    // residue) must trigger exactly one write_and_verify per record — and
+    // once persisted the inline copy is cleared so the next save is free.
+    // Records use distinct pubkeys so each maps to a distinct keyring name,
+    // verifying the "per record" behaviour rather than a single-key overwrite.
+    let store = FakeKeyStore::reachable();
+    let mut records = vec![
+        record_with_pubkey_and_key("pubkey-agent-alpha", "nsec1key_a"),
+        record_with_pubkey_and_key("pubkey-agent-beta", "nsec1key_b"),
+    ];
+
+    persist_agent_keys_with(&store, &mut records);
+
+    assert_eq!(
+        *store.write_count.borrow(),
+        2,
+        "each record with an inline key must trigger exactly one write"
+    );
+    // Verify the correct keyring name was used for each agent.
+    assert_eq!(
+        store
+            .stored
+            .borrow()
+            .get(&agent_keyring_name("pubkey-agent-alpha"))
+            .map(String::as_str),
+        Some("nsec1key_a"),
+    );
+    assert_eq!(
+        store
+            .stored
+            .borrow()
+            .get(&agent_keyring_name("pubkey-agent-beta"))
+            .map(String::as_str),
+        Some("nsec1key_b"),
+    );
+    // After persist the inline copies are cleared — next save is zero-write.
+    assert!(records[0].private_key_nsec.is_empty());
+    assert!(records[1].private_key_nsec.is_empty());
+}
+
+fn write_log(content: &str) -> NamedTempFile {
+    let mut file = NamedTempFile::new().expect("temp log");
+    file.write_all(content.as_bytes()).expect("write log");
+    file
+}
+
+/// The keyringless fallback write must land `0o600` from the write itself —
+/// not a post-write `chmod` — so a crash in the umask window can never leave
+/// plaintext agent nsecs world-readable (Wes storage.rs:239, SECURITY.md:90).
+#[cfg(unix)]
+#[test]
+fn restricted_write_lands_owner_only_without_post_write_chmod() {
+    use std::os::unix::fs::PermissionsExt;
+
+    let dir = tempfile::tempdir().expect("temp dir");
+    let path = dir.path().join("managed-agents.json");
+
+    super::atomic_write_json_restricted(&path, br#"[{"private_key_nsec":"nsec1secret"}]"#)
+        .expect("restricted write");
+
+    let mode = std::fs::metadata(&path)
+        .expect("metadata")
+        .permissions()
+        .mode()
+        & 0o777;
+    assert_eq!(mode, 0o600, "secret-bearing write must be owner-only");
+    assert_eq!(
+        std::fs::read_to_string(&path).expect("read back"),
+        r#"[{"private_key_nsec":"nsec1secret"}]"#
+    );
+}
+
+#[test]
+fn meaningful_agent_error_from_log_promotes_wrapped_llm_auth() {
+    let file =
+        write_log("noise\nAgent reported error (code -32001): llm auth: 401 unauthorized: ...\n");
+    let result = super::meaningful_agent_error_from_log(file.path()).unwrap();
+    assert!(result.message.contains("llm auth"));
+    assert_eq!(result.code, Some(-32001));
+}
+
+#[test]
+fn meaningful_agent_error_from_log_promotes_unwrapped_llm_auth() {
+    let file = write_log("noise\nllm auth: denied\n");
+    let result = super::meaningful_agent_error_from_log(file.path()).unwrap();
+    assert_eq!(result.message, "Agent reported error: llm auth: denied");
+    assert_eq!(result.code, Some(-32001));
+}
+
+#[test]
+fn meaningful_agent_error_from_log_promotes_bare_model_not_found() {
+    let file = write_log("noise\nllm model not found: (some-model) 404\n");
+    let result = super::meaningful_agent_error_from_log(file.path()).unwrap();
+    assert_eq!(
+        result.message,
+        "Agent reported error: llm model not found: (some-model) 404"
+    );
+    assert_eq!(result.code, Some(-32002));
+}
+
+#[test]
+fn meaningful_agent_error_from_log_promotes_legacy_format() {
+    let file = write_log("noise\nAgent reported error: llm: 500 internal\n");
+    let result = super::meaningful_agent_error_from_log(file.path()).unwrap();
+    assert_eq!(result.message, "Agent reported error: llm: 500 internal");
+    assert_eq!(result.code, None);
+}
+
+#[test]
+fn meaningful_agent_error_from_log_does_not_promote_midline_auth_text() {
+    let file = write_log("noise before llm auth: denied\n");
+    assert!(super::meaningful_agent_error_from_log(file.path()).is_none());
+}
+
+#[test]
+fn strips_ansi_from_typical_tracing_line() {
+    let input = "\x1b[2m2026-05-27T15:16:32\x1b[0m \x1b[32m INFO\x1b[0m \x1b[2mbuzz_acp\x1b[0m\x1b[2m:\x1b[0m starting";
+    assert_eq!(
+        strip_ansi_escapes::strip_str(input),
+        "2026-05-27T15:16:32  INFO buzz_acp: starting"
+    );
+}
+
+// ── harness-log selection tests ────────────────────────────────────────
+
+const PUBKEY_A: &str = "aa11223344556677889900aabbccddeeff00112233445566778899aabbccddee";
+const PUBKEY_B: &str = "bb11223344556677889900aabbccddeeff00112233445566778899aabbccddee";
+
+/// Write `name` into `dir` and stamp it `age_secs` before now, so selection
+/// order is asserted against explicit mtimes rather than write order.
+fn write_log_in(dir: &Path, name: &str, age_secs: u64) {
+    let path = dir.join(name);
+    let file = File::create(&path).expect("create log");
+    file.set_modified(std::time::SystemTime::now() - std::time::Duration::from_secs(age_secs))
+        .expect("stamp mtime");
+}
+
+#[test]
+fn newest_agent_log_prefers_pair_scoped_when_it_is_freshest() {
+    let dir = tempfile::tempdir().expect("temp dir");
+    write_log_in(dir.path(), &format!("{PUBKEY_A}.log"), 600);
+    write_log_in(dir.path(), &format!("{PUBKEY_A}__cafe.log"), 5);
+
+    assert_eq!(
+        super::newest_agent_log_in_dir(dir.path(), PUBKEY_A),
+        Some(dir.path().join(format!("{PUBKEY_A}__cafe.log")))
+    );
+}
+
+#[test]
+fn newest_agent_log_prefers_legacy_when_it_is_freshest() {
+    let dir = tempfile::tempdir().expect("temp dir");
+    write_log_in(dir.path(), &format!("{PUBKEY_A}.log"), 5);
+    write_log_in(dir.path(), &format!("{PUBKEY_A}__cafe.log"), 600);
+
+    assert_eq!(
+        super::newest_agent_log_in_dir(dir.path(), PUBKEY_A),
+        Some(dir.path().join(format!("{PUBKEY_A}.log"))),
+        "mtime decides, not the filename shape"
+    );
+}
+
+#[test]
+fn newest_agent_log_finds_sole_pair_scoped_log() {
+    let dir = tempfile::tempdir().expect("temp dir");
+    write_log_in(dir.path(), &format!("{PUBKEY_A}__cafe.log"), 5);
+
+    assert_eq!(
+        super::newest_agent_log_in_dir(dir.path(), PUBKEY_A),
+        Some(dir.path().join(format!("{PUBKEY_A}__cafe.log")))
+    );
+}
+
+#[test]
+fn newest_agent_log_picks_freshest_of_several_relays() {
+    let dir = tempfile::tempdir().expect("temp dir");
+    write_log_in(dir.path(), &format!("{PUBKEY_A}__aaa.log"), 900);
+    write_log_in(dir.path(), &format!("{PUBKEY_A}__bbb.log"), 5);
+    write_log_in(dir.path(), &format!("{PUBKEY_A}__ccc.log"), 300);
+
+    assert_eq!(
+        super::newest_agent_log_in_dir(dir.path(), PUBKEY_A),
+        Some(dir.path().join(format!("{PUBKEY_A}__bbb.log")))
+    );
+}
+
+#[test]
+fn newest_agent_log_ignores_other_agents_and_non_log_files() {
+    let dir = tempfile::tempdir().expect("temp dir");
+    write_log_in(dir.path(), &format!("{PUBKEY_B}__cafe.log"), 1);
+    write_log_in(dir.path(), &format!("{PUBKEY_A}__cafe.log.gz"), 2);
+    write_log_in(dir.path(), &format!("{PUBKEY_A}__cafe.log"), 600);
+
+    assert_eq!(
+        super::newest_agent_log_in_dir(dir.path(), PUBKEY_A),
+        Some(dir.path().join(format!("{PUBKEY_A}__cafe.log"))),
+        "a fresher log belonging to another agent must never be selected"
+    );
+}
+
+#[test]
+fn newest_agent_log_is_none_when_agent_has_no_logs() {
+    let dir = tempfile::tempdir().expect("temp dir");
+    write_log_in(dir.path(), &format!("{PUBKEY_B}.log"), 1);
+
+    assert_eq!(super::newest_agent_log_in_dir(dir.path(), PUBKEY_A), None);
+}
+
+#[test]
+fn newest_agent_log_is_none_when_dir_is_missing() {
+    let dir = tempfile::tempdir().expect("temp dir");
+    let missing = dir.path().join("absent");
+
+    assert_eq!(super::newest_agent_log_in_dir(&missing, PUBKEY_A), None);
+}
+
+#[test]
+fn newest_agent_log_breaks_mtime_ties_deterministically() {
+    let dir = tempfile::tempdir().expect("temp dir");
+    write_log_in(dir.path(), &format!("{PUBKEY_A}__aaa.log"), 60);
+    write_log_in(dir.path(), &format!("{PUBKEY_A}__bbb.log"), 60);
+
+    assert_eq!(
+        super::newest_agent_log_in_dir(dir.path(), PUBKEY_A),
+        Some(dir.path().join(format!("{PUBKEY_A}__bbb.log"))),
+        "equal mtimes must resolve to the same file on every read_dir order"
+    );
+}
+
+// ── keyring-dev-migration tests ────────────────────────────────────────
+
+#[test]
+fn copy_agent_keys_copies_keys_present_in_src_to_dst() {
+    // Keys in src but not in dst must be copied in a single bulk write,
+    // and the migration-complete marker must be set.
+    let src = FakeKeyStore::reachable()
+        .with_key(&agent_keyring_name("agent-alpha"), "nsec1alpha")
+        .with_key(&agent_keyring_name("agent-beta"), "nsec1beta");
+    let dst = FakeKeyStore::reachable();
+
+    super::copy_agent_keys_between_stores(
+        &["agent-alpha".to_string(), "agent-beta".to_string()],
+        &src,
+        &dst,
+    );
+
+    assert_eq!(
+        dst.stored
+            .borrow()
+            .get(&agent_keyring_name("agent-alpha"))
+            .map(String::as_str),
+        Some("nsec1alpha"),
+        "agent-alpha must be copied from src to dst"
+    );
+    assert_eq!(
+        dst.stored
+            .borrow()
+            .get(&agent_keyring_name("agent-beta"))
+            .map(String::as_str),
+        Some("nsec1beta"),
+        "agent-beta must be copied from src to dst"
+    );
+    assert_eq!(
+        dst.stored
+            .borrow()
+            .get(super::DEV_MIGRATION_MARKER)
+            .map(String::as_str),
+        Some("done"),
+        "migration-complete marker must be set after first migration"
+    );
+    // Bulk write: exactly 1 store_all call.
+    assert_eq!(
+        *dst.write_count.borrow(),
+        1,
+        "must perform exactly one bulk write"
+    );
+    // Src accessed exactly once (bulk blob read).
+    assert_eq!(
+        *src.read_count.borrow(),
+        1,
+        "src must be read exactly once (bulk)"
+    );
+}
+
+#[test]
+fn copy_agent_keys_skips_keys_already_in_dst() {
+    // Idempotency: a key already present in dst must NOT be overwritten
+    // — the agent may have rotated their key in the dev service.
+    let src = FakeKeyStore::reachable().with_key(&agent_keyring_name("agent-alpha"), "nsec1old");
+    let dst = FakeKeyStore::reachable().with_key(&agent_keyring_name("agent-alpha"), "nsec1new");
+
+    super::copy_agent_keys_between_stores(&["agent-alpha".to_string()], &src, &dst);
+
+    // dst value must remain unchanged — src must not overwrite it.
+    assert_eq!(
+        dst.stored
+            .borrow()
+            .get(&agent_keyring_name("agent-alpha"))
+            .map(String::as_str),
+        Some("nsec1new"),
+        "key already in dst must not be overwritten by migration"
+    );
+    // Marker must still be written even though no new keys were copied.
+    assert_eq!(
+        dst.stored
+            .borrow()
+            .get(super::DEV_MIGRATION_MARKER)
+            .map(String::as_str),
+        Some("done"),
+        "marker must be set even when all keys are already present"
+    );
+    assert_eq!(*src.read_count.borrow(), 0);
+}
+
+#[test]
+fn copy_agent_keys_skips_keys_absent_from_src() {
+    // A pubkey with no entry in src (new agent that will mint a fresh key)
+    // must be silently skipped — no agent key written to dst.
+    let src = FakeKeyStore::reachable(); // empty
+    let dst = FakeKeyStore::reachable();
+
+    super::copy_agent_keys_between_stores(&["new-agent".to_string()], &src, &dst);
+
+    assert!(
+        dst.stored
+            .borrow()
+            .get(&agent_keyring_name("new-agent"))
+            .is_none(),
+        "absent src key must produce no agent key write to dst"
+    );
+    // Marker must still be written.
+    assert_eq!(
+        dst.stored
+            .borrow()
+            .get(super::DEV_MIGRATION_MARKER)
+            .map(String::as_str),
+        Some("done"),
+        "marker must be set even when no keys were present in src"
+    );
+}
+
+#[test]
+fn copy_agent_keys_skips_all_when_dst_unreachable() {
+    // When dst keyring is unreachable the migration must be a no-op — never
+    // data-loss (failing to write is fine; the agent will re-mint on next
+    // onboarding run).
+    let src = FakeKeyStore::reachable().with_key(&agent_keyring_name("agent-alpha"), "nsec1alpha");
+    let dst = FakeKeyStore::unreachable();
+
+    super::copy_agent_keys_between_stores(&["agent-alpha".to_string()], &src, &dst);
+
+    // No writes attempted to an unreachable dst.
+    assert_eq!(*dst.write_count.borrow(), 0);
+    // Src must not have been accessed (failed on dst read, returned early).
+    assert_eq!(
+        *src.read_count.borrow(),
+        0,
+        "src must not be accessed when dst is unreachable"
+    );
+}
+
+#[test]
+fn copy_agent_keys_skips_entirely_when_marker_present() {
+    // After the first migration, the marker is in dst. Subsequent calls
+    // must return immediately — the prod keyring (src) must never be read.
+    let src = FakeKeyStore::reachable().with_key(&agent_keyring_name("agent-alpha"), "nsec1alpha");
+    let dst = FakeKeyStore::reachable()
+        .with_key(super::DEV_MIGRATION_MARKER, "done")
+        .with_key(&agent_keyring_name("agent-alpha"), "nsec1dev");
+
+    super::copy_agent_keys_between_stores(&["agent-alpha".to_string()], &src, &dst);
+
+    // Src must not have been accessed at all.
+    assert_eq!(
+        *src.read_count.borrow(),
+        0,
+        "src must not be read when migration-complete marker is present"
+    );
+    // Dst must not have been written.
+    assert_eq!(
+        *dst.write_count.borrow(),
+        0,
+        "dst must not be written when migration-complete marker is present"
+    );
+    // Dev key must remain unchanged.
+    assert_eq!(
+        dst.stored
+            .borrow()
+            .get(&agent_keyring_name("agent-alpha"))
+            .map(String::as_str),
+        Some("nsec1dev"),
+        "dev key must not be overwritten on subsequent boots"
+    );
+}
+
+#[test]
+fn copy_agent_keys_writes_marker_even_with_empty_agent_list() {
+    // An empty pubkey list (no agents yet) must still write the marker so
+    // future boots skip the prod read.
+    let src = FakeKeyStore::reachable();
+    let dst = FakeKeyStore::reachable();
+
+    super::copy_agent_keys_between_stores(&[], &src, &dst);
+
+    assert_eq!(
+        dst.stored
+            .borrow()
+            .get(super::DEV_MIGRATION_MARKER)
+            .map(String::as_str),
+        Some("done"),
+        "marker must be set even when pubkey list is empty"
+    );
+    assert_eq!(*src.read_count.borrow(), 0);
+}
+
+#[test]
+fn try_delete_agent_key_returns_result() {
+    // Verify the result-returning seam exists and has the correct signature.
+    // We cannot call it in default builds (system-keyring feature is on,
+    // which accesses the real OS keychain and blocks in headless/CI). The
+    // real keychain paths are integration-tested through the #[ignore]
+    // tests in secret_store.rs; the rollback aggregation is tested in
+    // team_snapshot::tests::rollback_aggregates_multiple_errors.
+    let _: fn(&str) -> Result<(), String> = super::try_delete_agent_key;
+}
diff --git a/desktop/src-tauri/src/managed_agents/team_snapshot.rs b/desktop/src-tauri/src/managed_agents/team_snapshot.rs
index d88a362723b..96082acc76d 100644
--- a/desktop/src-tauri/src/managed_agents/team_snapshot.rs
+++ b/desktop/src-tauri/src/managed_agents/team_snapshot.rs
@@ -301,9 +301,11 @@ mod tests {
             name_pool: vec![],
             is_builtin: false,
             is_active: true,
+            shared: false,
             source_team: Some("SENTINEL_SOURCE_TEAM".to_string()), // MUST NOT appear
             source_team_persona_slug: Some("SENTINEL_SLUG".to_string()), // MUST NOT appear
             definition_respond_to: None,
+            catalog_source: None,
             definition_respond_to_allowlist: vec![],
             definition_parallelism: None,
             relay_mesh: None,
diff --git a/desktop/src-tauri/src/managed_agents/teams_tests.rs b/desktop/src-tauri/src/managed_agents/teams_tests.rs
index 140ac3cab96..1ffa60eda97 100644
--- a/desktop/src-tauri/src/managed_agents/teams_tests.rs
+++ b/desktop/src-tauri/src/managed_agents/teams_tests.rs
@@ -208,8 +208,10 @@ fn managed_agent(name: &str) -> ManagedAgentRecord {
         name_pool: vec![],
         is_builtin: false,
         is_active: true,
+        shared: false,
         source_team: None,
         source_team_persona_slug: None,
+        catalog_source: None,
         relay_mesh: None,
         definition_respond_to: None,
         definition_respond_to_allowlist: vec![],
diff --git a/desktop/src-tauri/src/managed_agents/types.rs b/desktop/src-tauri/src/managed_agents/types.rs
index dcb8095a7cf..3d8e0ed02ba 100644
--- a/desktop/src-tauri/src/managed_agents/types.rs
+++ b/desktop/src-tauri/src/managed_agents/types.rs
@@ -40,6 +40,13 @@ pub struct AgentDefinition {
     pub is_builtin: bool,
     #[serde(default = "default_record_active")]
     pub is_active: bool,
+    /// Whether this persona is discoverable in the currently active community.
+    ///
+    /// This is a command/view projection only. Durable share state lives in
+    /// the relay+owner-scoped retention head so one workspace's choice cannot
+    /// leak into another workspace's definition record.
+    #[serde(default)]
+    pub shared: bool,
     /// Team ID if this persona was imported from a team directory.
     /// Team personas are non-editable (system_prompt, model locked).
     #[serde(
@@ -57,6 +64,13 @@ pub struct AgentDefinition {
         alias = "source_pack_persona_slug"
     )]
     pub source_team_persona_slug: Option<String>,
+    /// Provenance of a persona copied from another owner's shared catalog.
+    ///
+    /// Set only on the copy, never on the original. It is what makes
+    /// "already added" answerable for a foreign catalog entry: the copy carries
+    /// a new local id, so the only link back to the publication is this pair.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub catalog_source: Option<CatalogSource>,
     /// Harness-level configuration passed to the agent subprocess as environment variables.
     /// Opaque to Buzz — keys and values are runtime-specific.
     ///
@@ -130,8 +144,11 @@ impl AgentDefinition {
             name_pool: self.name_pool,
             is_builtin: self.is_builtin,
             is_active: self.is_active,
+            // Catalog visibility is relay+owner scoped, not definition-global.
+            shared: false,
             source_team: self.source_team,
             source_team_persona_slug: self.source_team_persona_slug,
+            catalog_source: self.catalog_source,
             definition_respond_to: self.respond_to,
             definition_respond_to_allowlist: self.respond_to_allowlist,
             definition_parallelism: self.parallelism,
@@ -161,8 +178,11 @@ impl ManagedAgentRecord {
             name_pool: self.name_pool.clone(),
             is_builtin: self.is_builtin,
             is_active: self.is_active,
+            // Projected by `list_personas` from the active retention scope.
+            shared: false,
             source_team: self.source_team.clone(),
             source_team_persona_slug: self.source_team_persona_slug.clone(),
+            catalog_source: self.catalog_source.clone(),
             env_vars: self.env_vars.clone(),
             respond_to: self.definition_respond_to.clone(),
             respond_to_allowlist: self.definition_respond_to_allowlist.clone(),
@@ -368,6 +388,13 @@ pub struct ManagedAgentRecord {
     /// definition hidden from pickers. Defaults `true` for existing records.
     #[serde(default = "default_record_active")]
     pub is_active: bool,
+    /// Legacy process-global catalog visibility field.
+    ///
+    /// New writes omit it and definition views ignore it. It remains
+    /// deserializable for branch-era stores, but active visibility is projected
+    /// from the relay+owner-scoped retention database instead.
+    #[serde(default, skip_serializing)]
+    pub shared: bool,
     /// Absorbed from `AgentDefinition.source_team` — team ID when this
     /// definition was imported from a team directory (team definitions are
     /// non-editable). Distinct from `persona_team_dir`/`persona_name_in_team`,
@@ -378,6 +405,10 @@ pub struct ManagedAgentRecord {
     /// definition's slug within its source team.
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub source_team_persona_slug: Option<String>,
+    /// Absorbed from `AgentDefinition.catalog_source` — the publication this
+    /// definition was copied from, when it came from another owner's catalog.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub catalog_source: Option<CatalogSource>,
     /// NIP-AP definition-level behavioral defaults, absorbed from
     /// `AgentDefinition` in WIRE shape (kebab-case string / optional u32),
     /// distinct from the instance-side `respond_to`/`respond_to_allowlist`/
@@ -954,6 +985,8 @@ pub fn resolve_mint_behavioral_defaults(
     })
 }
 
+mod catalog_source;
+pub use catalog_source::CatalogSource;
 mod requests;
 pub use requests::*;
 
diff --git a/desktop/src-tauri/src/managed_agents/types/catalog_source.rs b/desktop/src-tauri/src/managed_agents/types/catalog_source.rs
new file mode 100644
index 00000000000..237ffbbfe9b
--- /dev/null
+++ b/desktop/src-tauri/src/managed_agents/types/catalog_source.rs
@@ -0,0 +1,52 @@
+//! The catalog-provenance coordinate carried on a copied persona
+//! definition, split from `types.rs` (file-size cap).
+
+use serde::{Deserialize, Serialize};
+
+/// Where a persona copy came from in another owner's shared catalog.
+///
+/// The pair is the publication's NIP-AP coordinate minus the kind: the owner
+/// who published it and the `d`-tag identifying the persona within that
+/// owner's catalog. A copy carries a fresh local `id`, so this pair is the
+/// only thing that can answer "is this catalog entry already added".
+///
+/// Field casing follows [`super::RelayMeshConfig`]: persisted records use snake_case
+/// and the camelCase `alias`es accept the create payload the frontend sends
+/// (`rename_all` on the request does not recurse into nested structs).
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+pub struct CatalogSource {
+    #[serde(alias = "ownerPubkey")]
+    pub owner_pubkey: String,
+    #[serde(alias = "personaId")]
+    pub persona_id: String,
+}
+
+impl CatalogSource {
+    /// Normalize a coordinate arriving from the frontend.
+    ///
+    /// "Already added" is decided by comparing this pair against a
+    /// publication's author and `d`-tag, so an un-normalized value silently
+    /// fails to match and mints another copy — the exact duplicate the field
+    /// exists to prevent. Owner pubkey: 64 hex, any case in, lowercase out
+    /// (same contract as [`super::validate_respond_to_allowlist`]). Persona id: the
+    /// publication's `d`-tag, trimmed and required.
+    pub fn normalized(self) -> Result<Self, String> {
+        let owner_pubkey = self.owner_pubkey.trim().to_ascii_lowercase();
+        if owner_pubkey.len() != 64 || !owner_pubkey.chars().all(|c| c.is_ascii_hexdigit()) {
+            return Err(format!(
+                "invalid catalog source owner pubkey: '{owner_pubkey}' (must be 64 hex chars)"
+            ));
+        }
+        let persona_id = self.persona_id.trim().to_string();
+        if persona_id.is_empty() {
+            return Err("catalog source persona id is required".to_string());
+        }
+        Ok(Self {
+            owner_pubkey,
+            persona_id,
+        })
+    }
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/desktop/src-tauri/src/managed_agents/types/catalog_source/tests.rs b/desktop/src-tauri/src/managed_agents/types/catalog_source/tests.rs
new file mode 100644
index 00000000000..1cdb891c0ab
--- /dev/null
+++ b/desktop/src-tauri/src/managed_agents/types/catalog_source/tests.rs
@@ -0,0 +1,62 @@
+use super::CatalogSource;
+
+fn source(owner_pubkey: &str, persona_id: &str) -> CatalogSource {
+    CatalogSource {
+        owner_pubkey: owner_pubkey.to_string(),
+        persona_id: persona_id.to_string(),
+    }
+}
+
+#[test]
+fn normalized_lowercases_and_trims_the_owner_pubkey() {
+    // "Already added" compares this against a publication's author hex, which
+    // is always lowercase — a mixed-case value from the UI must not miss.
+    let normalized = source(&format!("  {}  ", "A".repeat(64)), " helper ")
+        .normalized()
+        .expect("64 hex chars with surrounding space is valid");
+    assert_eq!(normalized.owner_pubkey, "a".repeat(64));
+    assert_eq!(normalized.persona_id, "helper");
+}
+
+#[test]
+fn normalized_rejects_a_short_owner_pubkey() {
+    let err = source("abc123", "helper").normalized().unwrap_err();
+    assert!(err.contains("64 hex"), "error must name the rule: {err}");
+}
+
+#[test]
+fn normalized_rejects_a_non_hex_owner_pubkey() {
+    let err = source(&"z".repeat(64), "helper").normalized().unwrap_err();
+    assert!(err.contains("64 hex"), "error must name the rule: {err}");
+}
+
+#[test]
+fn normalized_rejects_a_blank_persona_id() {
+    let err = source(&"a".repeat(64), "   ").normalized().unwrap_err();
+    assert!(
+        err.contains("persona id"),
+        "error must name the field: {err}"
+    );
+}
+
+#[test]
+fn deserializes_the_camel_case_payload_the_frontend_sends() {
+    // `rename_all` on CreatePersonaRequest does not recurse into this struct,
+    // so without the aliases the copy request fails at the Tauri boundary.
+    let parsed: CatalogSource =
+        serde_json::from_str(r#"{"ownerPubkey":"abc","personaId":"helper"}"#)
+            .expect("camelCase payload from TS should deserialize");
+    assert_eq!(parsed, source("abc", "helper"));
+}
+
+#[test]
+fn round_trips_persisted_snake_case() {
+    let value = source(&"a".repeat(64), "helper");
+    let json = serde_json::to_string(&value).unwrap();
+    assert!(json.contains("owner_pubkey"), "persisted shape: {json}");
+    assert_eq!(
+        serde_json::from_str::<CatalogSource>(&json).unwrap(),
+        value,
+        "the camelCase alias must not break the stored-record round trip"
+    );
+}
diff --git a/desktop/src-tauri/src/managed_agents/types/requests.rs b/desktop/src-tauri/src/managed_agents/types/requests.rs
index 58d60218a13..e28b0bd461a 100644
--- a/desktop/src-tauri/src/managed_agents/types/requests.rs
+++ b/desktop/src-tauri/src/managed_agents/types/requests.rs
@@ -7,7 +7,7 @@ use serde::Deserialize;
 
 use super::{
     default_start_on_app_launch, validate_respond_to_allowlist, AgentDefinition, BackendKind,
-    RelayMeshConfig, RespondTo,
+    CatalogSource, RelayMeshConfig, RespondTo,
 };
 
 /// The NIP-AP behavioral group as one grouped request field.
@@ -91,6 +91,10 @@ pub struct CreatePersonaRequest {
     /// NIP-AP behavioral group. Absent = behavior group stays unset.
     #[serde(default)]
     pub behavior: Option<PersonaBehaviorRequest>,
+    /// Set when this persona is a copy of another owner's shared catalog entry,
+    /// so the catalog can tell an already-added foreign persona from a new one.
+    #[serde(default)]
+    pub catalog_source: Option<CatalogSource>,
 }
 
 #[derive(Debug, Deserialize)]
@@ -275,8 +279,10 @@ mod tests {
             name_pool: Vec::new(),
             is_builtin: false,
             is_active: true,
+            shared: false,
             source_team: None,
             source_team_persona_slug: None,
+            catalog_source: None,
             env_vars: BTreeMap::new(),
             respond_to: None,
             respond_to_allowlist: Vec::new(),
@@ -428,4 +434,37 @@ mod tests {
         .unwrap();
         assert_eq!(record.parallelism, Some(8));
     }
+
+    /// The catalog copy path is the only caller that sends this field, and it
+    /// sends camelCase from TS. Without it deserializing, the copy silently
+    /// lands with no provenance and duplicate-add returns.
+    #[test]
+    fn create_request_deserializes_camel_case_catalog_source() {
+        let request: CreatePersonaRequest = serde_json::from_str(
+            r#"{
+                "displayName": "Copy",
+                "avatarUrl": null,
+                "systemPrompt": "Prompt",
+                "catalogSource": { "ownerPubkey": "abc", "personaId": "helper" }
+            }"#,
+        )
+        .expect("camelCase catalogSource payload from TS should deserialize");
+        assert_eq!(
+            request.catalog_source,
+            Some(CatalogSource {
+                owner_pubkey: "abc".to_string(),
+                persona_id: "helper".to_string(),
+            })
+        );
+    }
+
+    /// Ordinary agent creation never sends the field.
+    #[test]
+    fn create_request_without_catalog_source_is_not_a_catalog_copy() {
+        let request: CreatePersonaRequest = serde_json::from_str(
+            r#"{ "displayName": "Fresh", "avatarUrl": null, "systemPrompt": "Prompt" }"#,
+        )
+        .expect("a create payload without provenance should deserialize");
+        assert_eq!(request.catalog_source, None);
+    }
 }
diff --git a/desktop/src-tauri/src/managed_agents/types/tests.rs b/desktop/src-tauri/src/managed_agents/types/tests.rs
index 667a41a538a..96ed5560689 100644
--- a/desktop/src-tauri/src/managed_agents/types/tests.rs
+++ b/desktop/src-tauri/src/managed_agents/types/tests.rs
@@ -1,4 +1,4 @@
-use super::{AgentDefinition, ManagedAgentRecord};
+use super::{AgentDefinition, CatalogSource, ManagedAgentRecord};
 use std::path::PathBuf;
 
 #[test]
@@ -482,8 +482,10 @@ fn sample_persona() -> AgentDefinition {
         name_pool: vec!["Nimble".to_string()],
         is_builtin: false,
         is_active: true,
+        shared: false,
         source_team: Some("team-1".to_string()),
         source_team_persona_slug: Some("helper".to_string()),
+        catalog_source: None,
         env_vars: [("K".to_string(), "v".to_string())].into_iter().collect(),
         respond_to: None,
         respond_to_allowlist: Vec::new(),
@@ -493,6 +495,49 @@ fn sample_persona() -> AgentDefinition {
     }
 }
 
+#[test]
+fn persona_record_without_catalog_source_deserializes_and_omits_it() {
+    // Every persona already on disk predates the field — an old record must
+    // load as "not a catalog copy" and must not gain a null key on save.
+    let record: AgentDefinition = serde_json::from_str(
+        r#"{
+            "id": "persona-1",
+            "display_name": "Test",
+            "avatar_url": null,
+            "system_prompt": "Prompt",
+            "created_at": "2026-01-01T00:00:00Z",
+            "updated_at": "2026-01-01T00:00:00Z"
+        }"#,
+    )
+    .expect("pre-catalog-source persona should deserialize");
+
+    assert_eq!(record.catalog_source, None);
+    let json = serde_json::to_string(&record).unwrap();
+    assert!(
+        !json.contains("catalog_source"),
+        "absent provenance must stay absent on disk: {json}"
+    );
+}
+
+#[test]
+fn persona_catalog_source_survives_the_agent_store_fold() {
+    // Provenance is only useful if it is still there on the next launch, and
+    // `save_personas` funnels every definition through `into_agent_record`.
+    let mut persona = sample_persona();
+    persona.catalog_source = Some(CatalogSource {
+        owner_pubkey: "a".repeat(64),
+        persona_id: "helper".to_string(),
+    });
+
+    let view = persona
+        .clone()
+        .into_agent_record()
+        .to_definition_view()
+        .expect("slugged record must present a persona view");
+
+    assert_eq!(view.catalog_source, persona.catalog_source);
+}
+
 #[test]
 fn persona_into_agent_record_is_keyless_and_slugged() {
     let record = sample_persona().into_agent_record();
diff --git a/desktop/src-tauri/src/mesh_llm/recovery.rs b/desktop/src-tauri/src/mesh_llm/recovery.rs
index ce6d495a472..809fab89933 100644
--- a/desktop/src-tauri/src/mesh_llm/recovery.rs
+++ b/desktop/src-tauri/src/mesh_llm/recovery.rs
@@ -412,6 +412,7 @@ mod tests {
             is_active: true,
             source_team: None,
             source_team_persona_slug: None,
+            catalog_source: None,
             env_vars: std::collections::BTreeMap::from([
                 ("BUZZ_AGENT_PROVIDER".to_string(), "openai".to_string()),
                 (
diff --git a/desktop/src-tauri/src/migration_avatar_tests.rs b/desktop/src-tauri/src/migration_avatar_tests.rs
index 2a93c00185b..39dfc988ddf 100644
--- a/desktop/src-tauri/src/migration_avatar_tests.rs
+++ b/desktop/src-tauri/src/migration_avatar_tests.rs
@@ -35,8 +35,10 @@ fn refresh_builtin_agent_avatars_updates_seeded_values_and_preserves_customizati
         name_pool: vec!["Fizzy".to_string()],
         is_builtin: true,
         is_active: true,
+        shared: false,
         source_team: None,
         source_team_persona_slug: None,
+        catalog_source: None,
         env_vars: Default::default(),
         respond_to: None,
         respond_to_allowlist: Vec::new(),
diff --git a/desktop/src-tauri/src/relay.rs b/desktop/src-tauri/src/relay.rs
index 1c9ba0095af..f8966956241 100644
--- a/desktop/src-tauri/src/relay.rs
+++ b/desktop/src-tauri/src/relay.rs
@@ -532,49 +532,9 @@ pub struct AgentProfileInfo {
 // ── Signed-event submission ─────────────────────────────────────────────────
 
 mod submit;
-pub use submit::{submit_event, submit_event_at_with_keys, SubmitEventResponse};
-
-/// POST an already-signed event to `/events` with NIP-98 auth.
-///
-/// The persona flush loop drains pre-signed events from the retention store,
-/// so it must publish them verbatim — re-signing through `submit_event` would
-/// mint a new `created_at`/signature and break the compare-and-clear that
-/// `mark_synced` relies on. Only the NIP-98 request auth is signed here (with
-/// the owner keys), and that lock is dropped before the `.await`.
-pub async fn submit_signed_event(
-    event: &nostr::Event,
-    state: &AppState,
-) -> Result<SubmitEventResponse, String> {
-    crate::relay_admission::wait_for_rate_limit().await;
-    let url = format!("{}/events", relay_api_base_url_with_override(state));
-    let body_bytes = event.as_json().into_bytes();
-    let auth_header = {
-        let keys = state.signing_keys()?;
-        build_nip98_auth_header_for_keys(&keys, &Method::POST, &url, &body_bytes)?
-    }; // keys dropped here
-
-    let response = state
-        .http_client
-        .post(&url)
-        .header("Authorization", auth_header)
-        .header("Content-Type", "application/json")
-        .body(body_bytes)
-        .send()
-        .await
-        .map_err(|e| classify_request_error(&e))?;
-
-    if !response.status().is_success() {
-        return Err(relay_error_message(response).await);
-    }
-
-    let result: SubmitEventResponse = parse_json_response(response).await?;
-
-    if !result.accepted {
-        return Err(format!("relay rejected event: {}", result.message));
-    }
-
-    Ok(result)
-}
+pub use submit::{
+    submit_event, submit_event_at_with_keys, submit_signed_event_at_with_keys, SubmitEventResponse,
+};
 
 /// Sign an event with explicit keys and POST it to `/events` with NIP-98 auth.
 ///
diff --git a/desktop/src-tauri/src/relay/submit.rs b/desktop/src-tauri/src/relay/submit.rs
index 7fb3f94041d..2a42d86c2b1 100644
--- a/desktop/src-tauri/src/relay/submit.rs
+++ b/desktop/src-tauri/src/relay/submit.rs
@@ -8,22 +8,22 @@ pub struct SubmitEventResponse {
     pub message: String,
 }
 
-/// Sign with an explicit identity and POST the event to an explicit relay.
+/// POST an already-signed event to an explicit relay with an explicit owner.
 ///
-/// The caller owns the signer lifetime. This is important for deferred work:
-/// an in-process identity swap cannot retarget the event or its NIP-98 auth
-/// after the caller has validated which identity the operation belongs to.
-pub async fn submit_event_at_with_keys(
-    builder: nostr::EventBuilder,
+/// Deferred/scoped publication uses this form so a workspace or identity
+/// switch cannot retarget either the event or its NIP-98 authentication after
+/// the operation captured its `(relay, owner)` scope.
+pub async fn submit_signed_event_at_with_keys(
+    event: &nostr::Event,
     state: &AppState,
     api_base_url: &str,
     keys: &nostr::Keys,
 ) -> Result<SubmitEventResponse, String> {
+    if event.pubkey != keys.public_key() {
+        return Err("signed event does not match the publishing identity".to_string());
+    }
     crate::relay_admission::wait_for_rate_limit().await;
     let url = format!("{}/events", api_base_url.trim_end_matches('/'));
-    let event = builder
-        .sign_with_keys(keys)
-        .map_err(|e| format!("failed to sign event: {e}"))?;
     let body_bytes = event.as_json().into_bytes();
     let auth_header = build_nip98_auth_header_for_keys(keys, &Method::POST, &url, &body_bytes)?;
 
@@ -49,6 +49,23 @@ pub async fn submit_event_at_with_keys(
     Ok(result)
 }
 
+/// Sign with an explicit identity and POST the event to an explicit relay.
+///
+/// The caller owns the signer lifetime. This is important for deferred work:
+/// an in-process identity swap cannot retarget the event or its NIP-98 auth
+/// after the caller has validated which identity the operation belongs to.
+pub async fn submit_event_at_with_keys(
+    builder: nostr::EventBuilder,
+    state: &AppState,
+    api_base_url: &str,
+    keys: &nostr::Keys,
+) -> Result<SubmitEventResponse, String> {
+    let event = builder
+        .sign_with_keys(keys)
+        .map_err(|e| format!("failed to sign event: {e}"))?;
+    submit_signed_event_at_with_keys(&event, state, api_base_url, keys).await
+}
+
 /// Build and submit an event to the currently active workspace relay.
 pub async fn submit_event(
     builder: nostr::EventBuilder,
diff --git a/desktop/src-tauri/src/webkit_rendering.rs b/desktop/src-tauri/src/webkit_rendering.rs
new file mode 100644
index 00000000000..905da5eeed8
--- /dev/null
+++ b/desktop/src-tauri/src/webkit_rendering.rs
@@ -0,0 +1,208 @@
+//! WebKit rendering workarounds for Linux, applied before WebKit initializes.
+//!
+//! WebKitGTK's dmabuf renderer aborts the web process during startup on some
+//! GPU/driver/compositor combinations, so Buzz comes up with no window at all
+//! and the user has no way to fix it (#2338, upstream tauri#9394). Setting
+//! `WEBKIT_DISABLE_DMABUF_RENDERER=1` avoids the abort by falling back to the
+//! shared-memory buffer path.
+//!
+//! WebKit reads each of these variables exactly once per process, so the choice
+//! has to be made before anything initializes — there is no runtime toggle and
+//! no second chance later in the same process. This module therefore decides
+//! from cheap preflight signals instead of reacting to a crash:
+//!
+//! * an NVIDIA GPU, the driver family behind most upstream reports; and
+//! * AppImage packaging, where linuxdeploy's AppRun hook pins `GDK_BACKEND=x11`
+//!   and the dmabuf renderer buys nothing on that XWayland path (#2338).
+//!
+//! `--safe-rendering` is the manual escape hatch for a machine neither signal
+//! recognises; it also disables accelerated compositing, for that launch only.
+//!
+//! This is the shape the Tauri ecosystem converged on: clash-verge-rev's
+//! `utils/linux/workarounds.rs` and screenpipe's `linux_webkit_env.rs` both set
+//! the same variable from the same signals at the same point in startup.
+
+use std::ffi::{OsStr, OsString};
+use std::path::Path;
+
+/// Force the safest rendering configuration for this launch.
+const SAFE_RENDERING: &str = "--safe-rendering";
+
+/// PCI vendor ID reported by NVIDIA devices under `/sys/class/drm`.
+const NVIDIA_PCI_VENDOR: &str = "0x10de";
+
+/// Where DRM devices advertise their PCI vendor.
+const DRM_ROOT: &str = "/sys/class/drm";
+
+/// Drops the zero-copy dmabuf buffer path. The workaround for #2338.
+const DISABLE_DMABUF: &str = "WEBKIT_DISABLE_DMABUF_RENDERER";
+/// Drops accelerated compositing as well. `--safe-rendering` only.
+const DISABLE_COMPOSITING: &str = "WEBKIT_DISABLE_COMPOSITING_MODE";
+
+/// What the heuristic applies: the #2338 workaround alone, matching the
+/// ecosystem precedents. `DISABLE_COMPOSITING` is deliberately not here — no
+/// report has isolated it as necessary, and it costs more rendering than this.
+const HEURISTIC: [&str; 1] = [DISABLE_DMABUF];
+
+/// What `--safe-rendering` applies, which is also every variable this module may
+/// set and therefore every variable a user assignment takes away from it. Being
+/// the same list is the invariant: nothing outside it is ever written, so a user
+/// value for any other WebKit variable is not a conflict.
+const OWNED: [&str; 2] = [DISABLE_DMABUF, DISABLE_COMPOSITING];
+
+/// Reads one environment variable. Injected so the decision is testable without
+/// mutating the process environment. `OsString` rather than `String` because
+/// presence is the test — a non-UTF-8 assignment is still the user's.
+type EnvLookup<'a> = &'a dyn Fn(&str) -> Option<OsString>;
+
+/// What this launch should do about its rendering environment.
+#[derive(Debug, PartialEq, Eq)]
+enum Plan {
+    /// Set each of these to `1`, then report `why`.
+    Apply {
+        vars: &'static [&'static str],
+        why: String,
+    },
+    /// Change nothing, and report `why`.
+    Leave { why: String },
+    /// The request cannot be delivered. Report it and exit non-zero rather than
+    /// starting an app that silently ignores what the user asked for.
+    Fatal { diagnostic: String },
+}
+
+/// Applies the workaround for this launch.
+///
+/// Must be called from `main()` before `crate::run()`: WebKit memoizes these
+/// variables at process start, and `std::env::set_var` is only sound while the
+/// process is still single threaded, which it is nowhere else in Buzz.
+///
+/// `Err` carries a user-facing diagnostic; the caller reports it and exits.
+pub fn apply() -> Result<(), String> {
+    match plan(
+        std::env::args_os(),
+        &|key| std::env::var_os(key),
+        Path::new(DRM_ROOT),
+    ) {
+        Plan::Apply { vars, why } => {
+            for var in vars {
+                // Safe here and only here — see the doc comment above.
+                std::env::set_var(var, "1");
+            }
+            let applied: Vec<String> = vars.iter().map(|var| format!("{var}=1")).collect();
+            eprintln!("buzz-desktop: {} — {why}", applied.join(" "));
+            Ok(())
+        }
+        Plan::Leave { why } => {
+            eprintln!("buzz-desktop: WebKit rendering left as-is — {why}");
+            Ok(())
+        }
+        Plan::Fatal { diagnostic } => Err(diagnostic),
+    }
+}
+
+/// The whole decision, as a pure function of argv, the environment, and the DRM
+/// device tree.
+fn plan(
+    args: impl IntoIterator<Item = impl AsRef<OsStr>>,
+    env: EnvLookup<'_>,
+    drm_root: &Path,
+) -> Plan {
+    let safe_rendering = args
+        .into_iter()
+        .any(|arg| arg.as_ref() == OsStr::new(SAFE_RENDERING));
+    let user_set = user_set(env);
+
+    if !user_set.is_empty() {
+        // A user who has assigned one of these has taken over the decision, so
+        // the heuristic stands down wholesale — writing the *other* variable
+        // behind their back would be exactly the surprise they opted out of.
+        return match safe_rendering {
+            // Two incompatible answers to one question, and no basis for
+            // picking: honouring the flag would overwrite configuration the
+            // user typed, honouring the environment would silently ignore a
+            // rescue flag from a user whose app does not start.
+            true => Plan::Fatal {
+                diagnostic: conflict(&user_set),
+            },
+            false => Plan::Leave {
+                why: format!("{} set in the environment", describe(&user_set)),
+            },
+        };
+    }
+
+    if safe_rendering {
+        return Plan::Apply {
+            vars: &OWNED,
+            why: format!("{SAFE_RENDERING} requested, this launch only"),
+        };
+    }
+
+    let signals = [
+        (nvidia_gpu(drm_root), "NVIDIA GPU"),
+        (env("APPIMAGE").is_some(), "AppImage"),
+    ];
+    let hits: Vec<&str> = signals
+        .iter()
+        .filter_map(|(hit, label)| hit.then_some(*label))
+        .collect();
+
+    match hits.is_empty() {
+        true => Plan::Leave {
+            why: "no NVIDIA GPU and not an AppImage".to_string(),
+        },
+        false => Plan::Apply {
+            vars: &HEURISTIC,
+            why: hits.join(", "),
+        },
+    }
+}
+
+/// Owned variables the environment already carries, keyed by name.
+///
+/// Presence is the test, not truthiness: `VAR=0` and `VAR=` are both genuine
+/// user assignments, and both take the decision away from this module.
+fn user_set(env: EnvLookup<'_>) -> Vec<(&'static str, OsString)> {
+    OWNED
+        .iter()
+        .filter_map(|key| env(key).map(|value| (*key, value)))
+        .collect()
+}
+
+/// User assignments rendered as `KEY=value`, for a log line or a diagnostic.
+fn describe(user_set: &[(&str, OsString)]) -> String {
+    let shown: Vec<String> = user_set
+        .iter()
+        .map(|(key, value)| format!("{key}={}", value.to_string_lossy()))
+        .collect();
+    shown.join(", ")
+}
+
+/// Whether any DRM device reports NVIDIA's PCI vendor ID. An unreadable device
+/// tree is not a hit — the workaround has a real cost, so it needs evidence.
+fn nvidia_gpu(drm_root: &Path) -> bool {
+    let Ok(entries) = std::fs::read_dir(drm_root) else {
+        return false;
+    };
+    entries.flatten().any(|entry| {
+        std::fs::read_to_string(entry.path().join("device/vendor"))
+            .is_ok_and(|vendor| vendor.trim().eq_ignore_ascii_case(NVIDIA_PCI_VENDOR))
+    })
+}
+
+/// The diagnostic for `--safe-rendering` against a user-set owned variable.
+///
+/// The message both shows what is set and names the keys to unset — the two
+/// things a user whose app will not start needs in order to act on it.
+fn conflict(user_set: &[(&str, OsString)]) -> String {
+    let keys: Vec<&str> = user_set.iter().map(|(key, _)| *key).collect();
+    format!(
+        "{SAFE_RENDERING} cannot be applied: {} already set in the environment. \
+         Either unset {} and run {SAFE_RENDERING} again, or keep that \
+         environment and drop the flag.",
+        describe(user_set),
+        keys.join(", "),
+    )
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/desktop/src-tauri/src/webkit_rendering/tests.rs b/desktop/src-tauri/src/webkit_rendering/tests.rs
new file mode 100644
index 00000000000..5be1612b216
--- /dev/null
+++ b/desktop/src-tauri/src/webkit_rendering/tests.rs
@@ -0,0 +1,250 @@
+//! Behaviour of the preflight decision.
+//!
+//! Every case goes through `plan`, which takes argv, the environment, and the
+//! DRM root as arguments — so nothing here mutates the process environment and
+//! the tests are order-independent.
+
+use super::*;
+
+const NO_ARGS: [&str; 0] = [];
+
+/// A `/sys/class/drm` stand-in. `vendors` are written as `card<n>/device/vendor`
+/// with the trailing newline the kernel emits.
+fn drm(vendors: &[&str]) -> tempfile::TempDir {
+    let root = tempfile::tempdir().expect("tempdir");
+    for (index, vendor) in vendors.iter().enumerate() {
+        let device = root.path().join(format!("card{index}")).join("device");
+        std::fs::create_dir_all(&device).expect("device dir");
+        std::fs::write(device.join("vendor"), format!("{vendor}\n")).expect("vendor");
+    }
+    root
+}
+
+fn env_from(pairs: &[(&str, &str)]) -> impl Fn(&str) -> Option<OsString> {
+    let owned: Vec<(String, OsString)> = pairs
+        .iter()
+        .map(|(key, value)| (key.to_string(), OsString::from(value)))
+        .collect();
+    move |key| {
+        owned
+            .iter()
+            .find(|(candidate, _)| candidate == key)
+            .map(|(_, value)| value.clone())
+    }
+}
+
+/// The variables a plan would set, or `None` for a plan that sets nothing.
+fn applied(plan: &Plan) -> Option<&[&str]> {
+    match plan {
+        Plan::Apply { vars, .. } => Some(vars),
+        _ => None,
+    }
+}
+
+// ── Detection ───────────────────────────────────────────────────────────────
+
+#[test]
+fn test_nvidia_gpu_disables_the_dmabuf_renderer() {
+    let drm = drm(&["0x10de"]);
+    let plan = plan(NO_ARGS, &env_from(&[]), drm.path());
+
+    assert_eq!(
+        applied(&plan),
+        Some(&["WEBKIT_DISABLE_DMABUF_RENDERER"][..])
+    );
+    let Plan::Apply { why, .. } = &plan else {
+        unreachable!()
+    };
+    assert!(why.contains("NVIDIA"), "{why}");
+}
+
+#[test]
+fn test_an_nvidia_gpu_alongside_another_vendor_still_counts() {
+    // Hybrid graphics: the integrated GPU enumerates first, and WebKit may
+    // still land on the discrete one.
+    let drm = drm(&["0x8086", "0x10de"]);
+
+    assert_eq!(
+        applied(&plan(NO_ARGS, &env_from(&[]), drm.path())),
+        Some(&["WEBKIT_DISABLE_DMABUF_RENDERER"][..])
+    );
+}
+
+#[test]
+fn test_the_vendor_id_match_ignores_case() {
+    let drm = drm(&["0x10DE"]);
+
+    assert_eq!(
+        applied(&plan(NO_ARGS, &env_from(&[]), drm.path())),
+        Some(&["WEBKIT_DISABLE_DMABUF_RENDERER"][..])
+    );
+}
+
+#[test]
+fn test_an_appimage_launch_disables_the_dmabuf_renderer() {
+    // No NVIDIA GPU: the AppImage signal has to carry this on its own, which is
+    // #2338's reporter (Intel Mesa under the AppRun's pinned XWayland backend).
+    let drm = drm(&["0x8086"]);
+    let env = env_from(&[("APPIMAGE", "/home/u/Buzz.AppImage")]);
+    let plan = plan(NO_ARGS, &env, drm.path());
+
+    assert_eq!(
+        applied(&plan),
+        Some(&["WEBKIT_DISABLE_DMABUF_RENDERER"][..])
+    );
+    let Plan::Apply { why, .. } = &plan else {
+        unreachable!()
+    };
+    assert!(why.contains("AppImage"), "{why}");
+}
+
+#[test]
+fn test_a_plain_non_nvidia_launch_changes_nothing() {
+    let drm = drm(&["0x8086", "0x1002"]);
+
+    assert!(matches!(
+        plan(NO_ARGS, &env_from(&[]), drm.path()),
+        Plan::Leave { .. }
+    ));
+}
+
+#[test]
+fn test_an_unreadable_drm_tree_is_not_treated_as_a_hit() {
+    // Containers and hardened kernels can hide `/sys/class/drm` entirely. The
+    // workaround costs real rendering performance, so absent evidence is not
+    // evidence — this must not become an unconditional export.
+    let missing = std::path::Path::new("/nonexistent/class/drm");
+
+    assert!(matches!(
+        plan(NO_ARGS, &env_from(&[]), missing),
+        Plan::Leave { .. }
+    ));
+}
+
+#[test]
+fn test_a_device_without_a_vendor_file_is_skipped_not_fatal() {
+    // `/sys/class/drm` also contains connector entries (`card0-HDMI-A-1`) and
+    // `renderD*` nodes, which have no `device/vendor` under them.
+    let root = tempfile::tempdir().expect("tempdir");
+    std::fs::create_dir_all(root.path().join("card0-HDMI-A-1")).expect("connector");
+    let device = root.path().join("card1").join("device");
+    std::fs::create_dir_all(&device).expect("device dir");
+    std::fs::write(device.join("vendor"), "0x10de\n").expect("vendor");
+
+    assert_eq!(
+        applied(&plan(NO_ARGS, &env_from(&[]), root.path())),
+        Some(&["WEBKIT_DISABLE_DMABUF_RENDERER"][..])
+    );
+}
+
+// ── User environment ────────────────────────────────────────────────────────
+
+#[test]
+fn test_a_user_set_variable_disables_the_heuristic_wholesale() {
+    // `0` is the value a truthiness check would drop: the user is asking for the
+    // dmabuf renderer *on*, on a machine the heuristic would have opted out.
+    let drm = drm(&["0x10de"]);
+    let env = env_from(&[(DISABLE_DMABUF, "0")]);
+    let plan = plan(NO_ARGS, &env, drm.path());
+
+    let Plan::Leave { why } = &plan else {
+        panic!("a user assignment must not be overwritten: {plan:?}");
+    };
+    assert!(why.contains("WEBKIT_DISABLE_DMABUF_RENDERER=0"), "{why}");
+}
+
+#[test]
+fn test_an_empty_assignment_is_still_a_user_assignment() {
+    let drm = drm(&["0x10de"]);
+    let env = env_from(&[(DISABLE_DMABUF, "")]);
+
+    assert!(matches!(
+        plan(NO_ARGS, &env, drm.path()),
+        Plan::Leave { .. }
+    ));
+}
+
+#[test]
+fn test_a_user_set_compositing_variable_also_stands_the_heuristic_down() {
+    // The heuristic never sets this one, but it is still ours to set under
+    // `--safe-rendering`, so a user value takes the whole decision away rather
+    // than leaving us free to write the sibling variable.
+    let drm = drm(&["0x10de"]);
+    let env = env_from(&[(DISABLE_COMPOSITING, "1")]);
+
+    assert!(matches!(
+        plan(NO_ARGS, &env, drm.path()),
+        Plan::Leave { .. }
+    ));
+}
+
+// ── --safe-rendering ────────────────────────────────────────────────────────
+
+#[test]
+fn test_safe_rendering_applies_the_safest_set_without_any_hardware_signal() {
+    // The escape hatch exists for the machine neither signal recognises, so it
+    // must not depend on either one.
+    let drm = drm(&["0x8086"]);
+    let args = ["buzz://channel/1", SAFE_RENDERING];
+    let plan = plan(args, &env_from(&[]), drm.path());
+
+    assert_eq!(
+        applied(&plan),
+        Some(
+            &[
+                "WEBKIT_DISABLE_DMABUF_RENDERER",
+                "WEBKIT_DISABLE_COMPOSITING_MODE"
+            ][..]
+        )
+    );
+}
+
+#[test]
+fn test_an_unrelated_flag_is_not_mistaken_for_safe_rendering() {
+    let drm = drm(&["0x8086"]);
+
+    assert!(matches!(
+        plan(["--safe-renderingX"], &env_from(&[]), drm.path()),
+        Plan::Leave { .. }
+    ));
+}
+
+#[test]
+fn test_safe_rendering_against_a_user_set_variable_is_fatal_not_guessed() {
+    let drm = drm(&["0x8086"]);
+    let env = env_from(&[(DISABLE_DMABUF, "0")]);
+    let plan = plan([SAFE_RENDERING], &env, drm.path());
+
+    let Plan::Fatal { diagnostic } = &plan else {
+        panic!("the flag and the environment disagree; neither may be guessed: {plan:?}");
+    };
+    // The message has to name what is set and what to unset, or the user whose
+    // app will not start cannot act on it.
+    assert!(diagnostic.contains(SAFE_RENDERING), "{diagnostic}");
+    assert!(
+        diagnostic.contains("WEBKIT_DISABLE_DMABUF_RENDERER=0"),
+        "{diagnostic}"
+    );
+}
+
+#[test]
+fn test_a_non_utf8_user_assignment_is_reported_not_ignored() {
+    // Presence is the test, so this still stands the heuristic down; the
+    // diagnostic must name the key rather than dropping the whole entry.
+    #[cfg(unix)]
+    {
+        use std::os::unix::ffi::OsStringExt;
+
+        let drm = drm(&["0x10de"]);
+        let invalid = OsString::from_vec(vec![0xff, 0xfe]);
+        let env = |key: &str| match key == DISABLE_DMABUF {
+            true => Some(invalid.clone()),
+            false => None,
+        };
+
+        let Plan::Fatal { diagnostic } = plan([SAFE_RENDERING], &env, drm.path()) else {
+            panic!("a non-UTF-8 assignment is still a user assignment");
+        };
+        assert!(diagnostic.contains(DISABLE_DMABUF), "{diagnostic}");
+    }
+}
diff --git a/desktop/src-tauri/tauri.conf.json b/desktop/src-tauri/tauri.conf.json
index 07b7216346f..85ad5c0b2d7 100644
--- a/desktop/src-tauri/tauri.conf.json
+++ b/desktop/src-tauri/tauri.conf.json
@@ -1,7 +1,7 @@
 {
   "$schema": "https://schema.tauri.app/config/2",
   "productName": "Buzz",
-  "version": "0.4.26",
+  "version": "0.5.1",
   "identifier": "xyz.block.buzz.app",
   "build": {
     "beforeDevCommand": {
diff --git a/desktop/src/app/AppShell.tsx b/desktop/src/app/AppShell.tsx
index 7ed9fa9348c..75f57257ccc 100644
--- a/desktop/src/app/AppShell.tsx
+++ b/desktop/src/app/AppShell.tsx
@@ -96,6 +96,7 @@ import { useMessageDeepLinks } from "@/shared/useMessageDeepLinks";
 import { SidebarInset, SidebarProvider } from "@/shared/ui/sidebar";
 import { RelayConnectionOverlay } from "@/app/RelayConnectionOverlay";
 import { useSidebarRelayConnectionCard } from "@/features/sidebar/ui/useSidebarRelayConnectionCard";
+
 const LazySettingsScreen = React.lazy(async () => {
   const module = await import("@/features/settings/ui/SettingsScreen");
   return { default: module.SettingsScreen };
@@ -105,7 +106,6 @@ export function AppShell() {
   useWebviewZoomShortcuts();
   useTauriWindowDrag();
   useWebviewScrollBoundaryLock();
-
   const communitiesHook = useCommunities();
   const hasCommunityRail = communitiesHook.communities.length > 1;
   const addCommunityDialog = useAddCommunityDialogState();
@@ -167,7 +167,10 @@ export function AppShell() {
   const { starredChannelIds, starChannel, unstarChannel } = useChannelStars(
     identityQuery.data?.pubkey,
   );
-  usePersonaSync(identityQuery.data?.pubkey);
+  usePersonaSync(
+    identityQuery.data?.pubkey,
+    communitiesHook.activeCommunity?.relayUrl,
+  );
   useAgentsDataRefresh();
   // Chunk F: auto-restart drifted idle agents (per-agent opt-out, default ON).
   useAutoRestartPolicy();
diff --git a/desktop/src/app/useThreadActivityFeedItems.test.mjs b/desktop/src/app/useThreadActivityFeedItems.test.mjs
index 6c017028ca4..54d36dc1e88 100644
--- a/desktop/src/app/useThreadActivityFeedItems.test.mjs
+++ b/desktop/src/app/useThreadActivityFeedItems.test.mjs
@@ -113,3 +113,18 @@ test("channel-presence fence applies before mute filter — unknown channel + mu
 
   assert.deepEqual(items, []);
 });
+
+test("top-level DM activity is included in Activity", () => {
+  const dmItem = threadActivityItem({
+    id: "agent-dm-reply",
+    tags: [["h", CHANNEL_ID]],
+  });
+  const channels = [{ id: CHANNEL_ID, name: "Agent DM", channelType: "dm" }];
+
+  assert.deepEqual(
+    buildThreadActivityFeedItems([dmItem], new Set(), channels).map(
+      (item) => item.id,
+    ),
+    ["agent-dm-reply"],
+  );
+});
diff --git a/desktop/src/app/useThreadActivityFeedItems.ts b/desktop/src/app/useThreadActivityFeedItems.ts
index af0c50ce48a..b14eb51327f 100644
--- a/desktop/src/app/useThreadActivityFeedItems.ts
+++ b/desktop/src/app/useThreadActivityFeedItems.ts
@@ -17,7 +17,8 @@ export function buildThreadActivityFeedItems(
       // is present in the active community's channel set. Rows persisted under
       // a different relay's scope key should never reach this function, but
       // this filter is the last line of defense against cross-community leaks.
-      if (channelById.get(item.channelId) === undefined) return false;
+      const channel = channelById.get(item.channelId);
+      if (channel === undefined) return false;
       const rootId = getThreadReference(item.tags).rootId;
       return !rootId || !mutedRootIds.has(rootId);
     })
diff --git a/desktop/src/features/agents/AGENTS.md b/desktop/src/features/agents/AGENTS.md
index 06e6c02acbb..35ad4a63af5 100644
--- a/desktop/src/features/agents/AGENTS.md
+++ b/desktop/src/features/agents/AGENTS.md
@@ -106,6 +106,14 @@ with a TypeScript lookup table or an id comparison in a component.
    Edit. In Edit,
    selecting Custom command keeps its required command field beside the harness
    picker rather than hiding it in Advanced.
+10. **Catalog visibility is community-scoped relay state, never a global
+    definition field.** `AgentDefinition.shared` is only the active
+    relay+owner projection returned to the UI. Durable heads and pending
+    publications live in the scoped retention database, and explicit share
+    toggles await relay acceptance before the UI claims that an agent was
+    published or removed. A queued update must stay visibly queued, and the
+    catalog itself must render only relay-confirmed publications — never an
+    optimistic local persona.
 
 ## The tests that enforce this
 
@@ -124,6 +132,8 @@ with a TypeScript lookup table or an id comparison in a component.
   acceptance coverage for readiness, failure states, defaults, navigation,
   successful-empty vs failed optional-model discovery, and persistence races.
 - Rust: `runtime_metadata_env_vars` tests pin spawn-time key application.
+- Rust: persona sharing/retention tests pin relay+owner scoping, durable
+  enqueue errors, relay rejection/unavailability, and accepted publication.
 
 ## Keep this file true
 
diff --git a/desktop/src/features/agents/assets/agent-outline.svg b/desktop/src/features/agents/assets/agent-outline.svg
new file mode 100644
index 00000000000..b89f4c61c93
--- /dev/null
+++ b/desktop/src/features/agents/assets/agent-outline.svg
@@ -0,0 +1,15 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 360 360">
+  <defs>
+    <filter id="white-to-mask" color-interpolation-filters="sRGB">
+      <feComponentTransfer>
+        <feFuncR type="linear" slope="-6.7" intercept="6.7"/>
+        <feFuncG type="linear" slope="-6.7" intercept="6.7"/>
+        <feFuncB type="linear" slope="-6.7" intercept="6.7"/>
+      </feComponentTransfer>
+    </filter>
+    <mask id="agent-shape" maskUnits="userSpaceOnUse" x="0" y="0" width="360" height="360" style="mask-type:luminance">
+      <image width="360" height="360" filter="url(#white-to-mask)" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAWgAAAFoCAYAAAB65WHVAAAABGdBTUEAALGPC/xhBQAAACBjSFJNAAB6JgAAgIQAAPoAAACA6AAAdTAAAOpgAAA6mAAAF3CculE8AAAARGVYSWZNTQAqAAAACAABh2kABAAAAAEAAAAaAAAAAAADoAEAAwAAAAEAAQAAoAIABAAAAAEAAAFooAMABAAAAAEAAAFoAAAAAFtdPlUAAAGdaVRYdFhNTDpjb20uYWRvYmUueG1wAAAAAAA8eDp4bXBtZXRhIHhtbG5zOng9ImFkb2JlOm5zOm1ldGEvIiB4OnhtcHRrPSJYTVAgQ29yZSA2LjAuMCI+CiAgIDxyZGY6UkRGIHhtbG5zOnJkZj0iaHR0cDovL3d3dy53My5vcmcvMTk5OS8wMi8yMi1yZGYtc3ludGF4LW5zIyI+CiAgICAgIDxyZGY6RGVzY3JpcHRpb24gcmRmOmFib3V0PSIiCiAgICAgICAgICAgIHhtbG5zOmV4aWY9Imh0dHA6Ly9ucy5hZG9iZS5jb20vZXhpZi8xLjAvIj4KICAgICAgICAgPGV4aWY6UGl4ZWxYRGltZW5zaW9uPjUxMjwvZXhpZjpQaXhlbFhEaW1lbnNpb24+CiAgICAgICAgIDxleGlmOlBpeGVsWURpbWVuc2lvbj41MTI8L2V4aWY6UGl4ZWxZRGltZW5zaW9uPgogICAgICA8L3JkZjpEZXNjcmlwdGlvbj4KICAgPC9yZGY6UkRGPgo8L3g6eG1wbWV0YT4KuC9IVwAAMDdJREFUeAHtnQvXmzYWRb88mlc7//9/TtLm1Xam2zMnUYiNsS1AEltrEYEA6WpfcbgIPufZf/5JTyYJSEACEmiOwPPmLNIgCUhAAhI4EVCgHQgSkIAEGiWgQDfqGM2SgAQkoEA7BiQgAQk0SuBlo3Zp1gMEpu99nz179kBtnnorgfAnz3rqwBdZUmYugUsEFOhLZDosjyD8/fffTyzPnz8/LemKQh0S6+b4Af5fvnw5LaxThj9evXp1Wl6+fHkS6nUtsfbeCSjQvXvw//ZHnL9+/fr08ePHpz///PPpxYsXTwjB69evT7kCvb6z8QPs8QELIo1Ak+CPL969e/f09u1bfbK+O7pvQYHu3oX/6wDC8Pnz56c//vjj6cOHD09//fXXSRAQaASBBXHw8Xo9h0ec4f/777//IM5pFfFmwQ/4hKjaG2fomE8JKNBTIh1uIwwI8qdPn04CTRRNGYly1hEBxJrFVJ9AfJCbZCLn+CEtZuoDH7GOQJskcImAo+MSmY7Kc9HnkRpRyJJ9RNYsKe+oe92Yiji/f//+9CSTG+PUePjjE6JocpME5ggYTs3R6WQfFz0R2aWLHiFAPPKSiqkOko/WdRwMf55emNbgJok4X0v4hPNMEpgjYAQ9R6ejfVzsueCTl+YjCDx2E0UvEZDyXNcvE4B1boCINOtLkjfHJZQ8RoEeZAxcu+AREiJsRCTzo4N0fdduwJWnF7hmXnmJQTzNOP+8hNSxj1GgB/A/4rzkgkdMEGcewxFrtk33E4BfmC4VZ3zFi9pffvlFgb4f/WHOVKAHcTXfPCPSc5E0YpKpDgW6juPhmfn/JTXiI/5YJQI9568l9XnM2AQU6AH8y0WfP0q5dsFHoHkkv/SlwQBINukCNzxudJkyYnsu4RuEme+fEelrvpqry33HIKBAD+LnPDYjAHMXfkSl/CRvEASbd4Mb3C1zz/jmt99+Owk0/prz0+adscEmCSjQTbrlNqO40FkQgCV/iBKRJvJzquM21jkahgh0GKb8Up6pDT5x5GnHJIElBBToJZQ6OCYCzaMzYjCXIi58G838qel2ArnJ5eUg25dSfMPvb8Q/lJkkcI3A/JV87Wz3N0OAC57oGQFY8vjMXDQCnfnTZjrSgSGIcebylzyBEDETOSPQrCvOHTi5ERMV6EYc8agZXPREzojz0mkOHtFv+QLhURtHOj9fb5BfS0w9IdBLbpzX6nL/sQgo0AP5G5HO1xxLupUomhddc4/oS+o60jGwyvwz+Rw7bppEziysGz0faaQ83lcF+nGGTdWACFz7kiMG5zHdT+5CZFnOtMYSZogxU05Ez/gE35gkcAsBR8wttDo4FhEgil4arRH9ITgspusEptHztTMQaMX5GiX3XyKgQF8i02E5ERsLgrB0vjOCw1z03KN6hzhWMTk3tCUvV/NycMk7gVWMtdLuCSjQ3bvwxw4g0AjC0jnPCDSCw7oi/SPP6RZPGvn2eY4VTzBEzyxLn2ambbktAQV6wDFA5IYwLI2imYtGeJZ8kTAgrpu6BKd8+3zpxDzJ3OKDS3VZfmwCCvRg/kcciNh4McWCWF9LCDOis+Sx/VpdI+8nYubbcZa5mxk+QJzzad3ITOzbugQU6HX57lY789C//vrrSSgQjGsJgc7/BjL36H6tnlH3wyQ3smuf1vHkwg8ivXnzxumNUQfERv1SoDcCvWUzecRGpJd8QRDxcZpj3kvcxJZMb2SKacnTy3yL7j06AQV60BGASCMQecy+FkUnOsw0h1H094EBC5bMP8+x8eXgd26uPU5AgX6cYZM1IMilWFwTaDqBAPEHGOSmHwks+cvB3BSZ2lj6gvbHVtySwI8EFOgfeQy1FcFALBDruURUiAjxCE9u+k5gafQMb1gzrcQ6i0kCjxCYv2ofqdlzdycQgeaLgojGnFGZ5rg2zzpXx4j7lgp05p6XsB6Rk32qT0CBrs+0qRoRaQRjqWgg0nxGxjTH3FxrU51c0Zg8WTA3z41rjgnRs19urOiMA1atQA/u9ETRRHfXpjlAgUAv+Uu5wbF9614E+toNK5yde/6GzpUKBBToChBbr+KWR28EGjFCpI8+F404s8CCBTaXEsLsXw5eomP5vQQU6HvJdXIekR2Rc/6ykO1rCWHO/7Zy7djR98MCcZ6b3oApU0gINDfDJYxH52b/6hBQoOtwbLoWBAPhQESWTnMgSBGluXnXpjv+oHHl9AbR8xwH+CrODwL39J8IKNA/IRmvIAK99GsOhAhxJnI86jfREWe+C+dpYk6c4csUh/PP4107e/dIgd7bAxu1HxFhqmNpFI1AR5zmBGqjLmzaDBEzNyl+nyRPEucMyM2PpxMiaJMEahJQoGvSbLwuhDnTHAjLXEKQ87Jw7uXYXB297kv0vPRzw3J64xrXXplo9z4EFOh9uO/SagSaqY5rUXREiiiaF2VHiaDpJwtRM9Mb5HMJQeam5/TGHCX33UtAgb6XXGfnISQRaKY5ljyOI1RE0XOP+J1hWGRu2e9rTw9h6gvCRWg96EYCCvSNwHo/HEEh2rsWQdNPhAqBOlIETb/T52vinJue4gw10xoEXq5RqXW2SyARXx7JEeG5hDgTQSNW146dq+favhbmbukfS54arvUZm+FY3vBSx9L+ttDva7a6fz8CCvR+7G9u+dzFTxlp6YXOcXmphVgjwJcSdbOfl2UsnLu0nXM2xdayvVvqK897ZJ02z9lCGeL8xx9/nOaf59ik/TDiJgZPtllKcWeblL5yXLlQniX1mksAAgp0B+OgvOgRkFzwKT/XhfKCjzCQc84tL/5y/IcPH07nRYRS57TtaXm5HbvLc7I/efZNt1NOnnrKY1KW49hX7i/Xc8z0HEQVNkt/E5vzEebff//92w2MMpYIdLZpMzaQE3Xn5SJ5+XVNjoud5scl8OyfATT/jHtcNk30PBc7ooF4RFwxrrz42ebCpiwX+KU8j/Cl2HP+pUQ9CPOSF4tp81Jdl8qvncf+W4dqWWe5Hhum9bFN1MzC+nR/zitz6i0X9uXcufMTQcMUcc6f4ucF7jl7y3ZdPwYBBbphP3OBI6JEaESwmQsmOku6JALnLvCURUBSh/m+BPBLImr+o18WRDv+2tc6W9+TgFMce9KfaRsRJZIjYs6c6C3Cek64z5XNmOCujQjgF27E+BtRRpyJrImyFemNnNBoMwp0g47hguVi5c+M379/fxLoMmpu0GRNepAAPmfhZhxh9sf/H4Q6wOl+B92gE7lQiZyZ2mDuWXFu0EkrmYTv8Tk3Z6Jq07EJKNCN+T+RFPPNmXNuzETNWZkAN+RMeTAeTMcloEA36HumNyLQXqANOmhlkxBoxgAirf9Xht149Qp0Yw7iguTizOd0XqCNOWgjcxgDLPjfMbAR9AabUaAbdAoXpvPODTpmI5Miysk3atZmGiSgQDfkFC7IzD/6eNuQY3Yyxch5J/ANNatAN+QMTIlAE0WbjkuAcWAEfVz/p+d+Bx0SC/K5iKbWHxRwYebiXGCShwxKIE9Tc2Nu0K7brYLAoQX63OA/VwYvyrMvOeUIc8R5mrM/KfuyfSlPO2Ubl461fGwC5VhYOn4gcm3sXNu/pK0lx4ztnW16N7RAnxuIKSNPtJoc5KyT2F8uiWqTs49BypK//Cp/AId1/lx3eky2T41M/inbm+xy82AEGAtLXxZzLCnjh/WM6XK8lvuzTs6YTMpYZjtjdZrnmPK8cj11nSvLPvNlBLoXaAbYNJWDL+scw2AlUZbBT1nWKc8xHFcO7nK9rJNBmAEbUSbPj7izniW/r5CcNqaDOLawz3RcAoy3LBlvGStsJ2XM5tgyz1jKMTmPvFxSL3m50Ea5nXGcvNx3aT11lDnrpmUEuhDoDKyyS+UAK9cZoAzMDM7k5cAt13MudZ9rZ668tIcBmpT1ctAyqBFt/sNWfmOBPEKd42nfvyALxWPnjIWM44xL8iwZ5+T8Zwp8N5+xk/GdYyGZOqbr5yhnPGZftpMzllkvhTrreWokL5fsTx3TPG2Z/0igWYHOgGKwZaCVAy+Dl7JyYLJenpN6kqf70+2U35uX9ZXr1JfByF8H8jsL/CAOv/sbsUa4GczYnj9QudcOzxuHQMY2OQJHzhhijCDKjJcsGfP0fjr+biUyPX+6zbVHyrgu608Z9rJOzq/zsTDOs0Swc1zOS17WeeT1pgQ6AyGDjW0GIIMyA5Gc8jIyxoGcQ0od0/XTzp3+iU3kDMCIMBcZfUtETd9y4e1kqs02RCCCzBjJuOFHlLjJU8Y1UI6trU1P22W7KUvOPmyNEBOIINIR7TxJUk4fy6Ws96jru/9gfxxJzoA7J8ilGHPcVIxTR09OzEBkYGaQ0i8uvvLC66lP2lqXAGOEJ613796dBI2xkZs6Y6W3cZ8xPxVrthFtroNE2jmGc0jJ6xJuv7bdBJrBxRJRZvBlHg2RjihnECZvH+ntFjL4GJCkHi+823vsGUsJMC64iZNzTYx28y5Fmz4i1PQ3Qh3RZl+OPZJYbyrQEWVEiAUhZkGYW3lsW3rh1D4ug27kG1FtZkepL2OD/o48PkoBzlw1Ap3/pxHhprwU69HHwOoCHVEm5+7PfBRLRBmBTtQ48uAbfSDZPwnUJpAbE4KcqcC3b9+epkIi4Owj5djaNuxd32oCHWEuRZkomYWyiDIAFOa9h4HtS6BtAhHgRNFMgfCf606nQNruxe3WrSLQCG6mMHipwWdlmV+OMCvKtzvLMyRwdAKZBiFyRqSJqPkKqvz/GyPmI7Cq/pldxDn/EzXCzJKXGwrzCMPGPkhgHwLoRxaCPXQFfWHaFLFGtDNHvY+FdVutFkFHmAHGf3b64cOHEzQj5roOszYJSOA7gUTUzEnzMpFIOp8lZt/3o/tbqxJBR5z5iL6c0og494dFiyUggR4IJJomgkZv8tFBXiYyZ93zlMfDAh1xRpiJmnkJGEg9OFgbJSCB/gmgQ9GdTH0QSSPUPU95PCTQQGFKA3H+97///UQEnbnm/l1uDyQggd4IIM5550VOYtqj10j6of/yCoEmYmbOWXHubShrrwTGJFAGju/fv/8m2JT3lu6OoHOn4msNxJntHgH05jDtlYAErhNAi9AkAkimODLd0VskfZdA03Em5ZnWIHpmWoMykwQkIIFWCCDSzEujUeQkhLqnOembpzjS6UTOinMrw1E7JCCBKQH0Ku/JEOr8JTPlPaSbI2g6RvTMtAZ3pV462oMztFECEqhPICKNZhE9k/i6o4fP724S6LKjvCF13rn+YLJGCUigPgG0i4CSJ38iaoSaP2yJYNdvsU6NNwk0TdJJPqujk0bPdZxgLRKQwPoEItK0hFDz14eklkX6pjloIub83bsvBU++9R8JSKAjAuhWImnmo1ufBVgs0JneyEfgHflEUyUgAQl8I4Aol3/53HKwuVig6R3TGgg0Yu30xjd/uyIBCXRGAP1CpFufrl0s0HSIRwMWxbmz0ai5EpDADwTQsAScLWvaYoGOOPty8Ac/uyEBCXRKIFMdRNGtzkUvFmiEOT/p16k/NFsCEpDANwJE0QgzwWer89CLBDqPA0bP33zrigQkMACBCHSr0xyLBTpTHM4/DzAq7YIEJHAigJ4xM9Bq8HlVoOkACwJNJ0wSkIAERiJAFB2Bbi0AvSrQOCIdaHWeZqTBYl8kIIHtCCDIiHOrAegigaYTiLMCvd3AsSUJSGAbAuga0xwsraVFAq04t+Y27ZGABGoSIIpGoLud4kCkWzO+poOsSwISOC6BVoPQqxE0osz8DB0wSUACEhiNQDmF21oQOivQMZbw3wh6tGFpfyQggRCISGe7lXxWoDESw/MJSitGa4cEJCCBmgTQuQSkNet9tK5FAm30/Chmz5eABFomkEC0Na1bJNAt3lladra2SUACfRFA4xBnlpbSVYGOsYp0SJhLQAKjEYhAM53bUroq0DG8JaO1RQISkEBtAkTPrX0LfVWgWwz7azvG+iQggWMTIBBtMRidFegYnfzYLrT3EpDA6ARa+2JtVqBHd4b9k4AEJBAC3UXQGG70HPeZS0ACIxOIQLekeRcjaIwktWTsyIPDvklAAvsSQOvyV9P7WvK99YsCzSEYzEvCiPX301yTgAQkMBaBZ8+enTrUUlA6K9Bj4bc3EpCABOYJvHjx4un58+dPEev5o9ffe1GgMbAVI9fHYAsSkMDRCaB3L1++PAl0KywuCnQMVKhDwlwCEhiZAFqX6LmV4PSqQGOwSQISkMARCLQizGF9VX1zV8kJ5hKQgARGJJCvOHxJOKJ37ZMEJNA9gda+WrsaQXdP3A5IQAISWECgjKAXHL7JIVcFmimO1uZlNiFjIxKQwKEIIND8/6st/R7HVYE+lIfsrAQkcGgCiHNLPzk6K9CJnpMf2nN2XgISGJpAXg4yD01ie+80K9B7G2f7EpCABLYkgCi39KJwkUA7B73lELEtCUhgLwIIdFdz0IrzXkPFdiUgga0JGEFvTdz2JCABCdxAIFMcXcxBG0Hf4FkPlYAEuieAMLcgzoBcPAetUHc/7uyABCTQGYGrAo0wK86deVVzJSCBuwkYQd+NzhMlIAEJrEcg4px8vZaW1bwogvYnR5fB9CgJSEACNQlcFWgac5qjJnLrkoAEJLCMwFWBVpyXgfQoCUhgHAKtvHe7KtAgV6THGXj2RAISuE6gq8/srnfHIyQgAQlIoDYBI+jaRK1PAhLomgB/SZjf49g7kl4s0BBvZV6ma+9rvAQk0DQBRDl/7r23obMCrSDv7R7bl4AEtiQQce5CoBPe+5JwyyFiWxKQwN4EWhHol3MgjKDn6LhPAhKQwLoEZqc40rRCHRLmEpCABLYjsFigFentnGJLEpCABCCwSKA5UIGGgkkCEjgCgVb0bpFAx9jkR3CQfZSABI5HIBpHnvU9KSwSaH7NjqUFg/eEZdsSkMD4BNC6Fy9eNKF3CvT4480eSkACNxCIQJPvnRZZgKEvX7483VX2Ntj2JSABCaxFgFmCaF0L0xw3C7TTHGsNDeuVgAT2JoC+Mb1BUNqC1l0V6BiJ0SwmCUhAAhLYhsBVgcaM1u4q26CxFQlIQAL7Elgk0JgYkU5Eva/Zti4BCUhgHQL5DaJ1ar+t1kUCHXFuaW7mtm56tAQkIIHlBBDpFoR6kUDTLUSaifMWPj1ZjtkjJSABCSwnEGFuQZyxerFAI8yJoJd31yMlIAEJ9EMgU7jJ97Z8sUBjcKLoVozfG57tS0ACYxFA2/gOupvP7Er8TnGUNFyXgARGIpAgNALdQt9uiqAzzWEE3YLrtEECEqhNAHH+5ZdfTrMFLejcYoEGBAYn9G/B+NrOsT4JSOC4BNC2V69eNfUHeYsFOuLM3cW/KDzuILbnEhiRQPTt9evXpznoVgLQxQKNU7jD8AjQ0hzNiIPFPklAAvsQaG2G4CaBBlk+tWvlDrOPG21VAhKQwPoEbhJoRDmPAgr0+s6xBQlIYFsCrfyBSnp9k0BzUinQinQwmktAAhKoT+AmgUaQWTLNUd8ca5SABCSwDwHmn1laSjdbQwf4koMXhUbQLblSWyQggXsJoGsEnvkG+t56ap93t0C39jlKbTDWJwEJHIMAgSYBJ5rWvUDjMjrDB91G0ccYwPZSAqMTaDF6hvnNETR3Gx4HEOj81Y1THaMPX/sngXEJlHrWmpbdLNC4qXwk4M7TWqfGHUr2TAISqEkA7cp7NaY3Wkt3CzQd82Vha+7UHglI4FYCCHSW1oLNuwQaABFo56JvHQ4eLwEJtEQg4tySTbHlboGmAqY3ePPJ0tqdJx00l4AEJDBHAO3KMnfcHvvuFuh0iGkOFuei93CfbUpAAiMTuFugA6X85C5l5hKQgAR6IJBAk7zF9JBA06m8AWWag/VWO9oifG2SgAT2JzDsHDRoEWSmN3xZuP9A0wIJSOB2AgksWwwuH4qgQRGBzstC56JvHyCeIQEJbE8A7Ur0TN5iqmIVHSWCfvfu3dPbt2/9E/AWPa1NEpDADwQi0LxHa1WgX/5g8Z0b6ShR9N9///309evXp7/++uuptR+/vrN7niYBCQxIAN3KV2hDC3R8l++iEeg///zzJNCKdOiYS0ACrRBAnKfvzihrLVWJoOlUOkzONMeXL19OAm0k3ZrLtUcCEkCniJ7fvHlzylsUZ7xUZQ66dDePCsxH03FyXxqWdFyXgAT2JoAYR6cQ6VanN+BULYKmMjrOlAaT7rwwZJvl8+fPp7lp5qdNEpCABPYiEE1K9IxWtZyqWxcA+cOVRNBMeTgv3fJQ0DYJjE0AbUKPEOfffvvtNBUbfWq159UFOh0FBiCSAPHp06fTFx6U+fIwZMwlIIEtCKBJTLvyjown/JanNsJjVYGmER4hEk0D5OPHj6dImukOpzziBnMJSGAtAghz5pwR5vLFIPtaTs/+iWT/s6aBVM+S76MRaCJppzzWpG7dEpAABBBggsRMayDQbPcQPWP/ahE0lZMANF2Aw4JQ8xke4r3yfeJ/xvivBCRwGAIRZ6Y0iJojzpT3klYX6IAACqLMnSzr5Imk8720Qh1i5hKQwD0E0JVoDMLMC0HmnnuKnNPv1ac40lDyCDBRM5/fIdDJ+cqDchZSjs255hKQgATmCESYEWTeff3rX//69j8+sa+3tFkEHTCBRDQNQO5qWRBqIukINQKdJeebS0ACEpgSQFdKcc7LQIQ6+6bn9LC9uUAHSmAGHp/hIdQINFF1fnAp89OlUBtZh6K5BI5NIPpBwJdAjzlnFqZTKeeYXtPmUxznQEV8M71BBJ0fXCqFunyhGJFOTr3l+rl2LJOABMYgEGEmsGPJT0sgykTNlOWYnnvchEADMOJKzoJYI8iZ8sh68oh5jp/mcQrlJglIoH8CiYQjvETMTJOyINBsEzH3HjWXnmpGoEujSlEthTjinDz7knMe61OxLrfTTtlGypLP7csx5hKQwPoEIsbkCC+RcUSYSBlhRqATMWNRhHx969ZvoUmBLrs9FcuILUJMYrsU6GwnR8yzP+LNeeV66kx92U5OeRJlW6UMtC3b3KpvtiOBSwRKUUZ4mbYgOk5OWbnk+Ev19VzevECXcC8JVcqTcw7rWSLGyVNOPi1jOwvinmOnx1Gedk4rFf/JgMujGvPwJgmMSiCBSMY9eV74JUpmG1HONQGL8rxR2ez2Fcc9QOOQS+ee2z8V0rntUowj0snZl6mVfAYY0caeS/VesnVaHtvJGYQZoBxHe6l/ep7bEuiBQMY3tmadPEumLRIZEy1n4Vo4J8w99PtRG7sS6EudjcPP7Z/bd070UkY+XUeQEWkEkyXTJxwXIS+j7px/zi7KStsyUBmgDMy89CB65vdLqNckgV4IZGxnXJNHhJMnIi63I9DlvtTVS99r2jmEQN8L5JzjKUNYz+2jvBTjRNApQ0TLJcdj37Q+BmXKWWc/OQOTiAGRzjmUK9AnXIf+J+MBCIyt1lLsIy8FNmOaPOXlMayX1wD9KutqrZ9b2nNogb4EOoNjup9yLgwGU5lysZRRNIJ6SaCpp1wyOCnLeuovB3TayT7zYxHgps34YBxkmm2PMcE4LVPGMrZFhDNFx3bW2V+O79STPHVOt1N+xFyBvtHr5wZPysgZkFxIj6TUh+CTGNSmYxNgTORX2RgXTHvlpxHKQKAGpYy/1MV2FsqyTh7RJWfc81IvT4ARY46bpnNl02Pc3uDnRo8EuRx0XDRz20u5lHUsPcfjxiPAOEAAeTfBeiJVRJr3FBHpeyLqjLEIauhRnrZKIT63HnsQ55xX1pN189sIGEHfxmvx0Rn0OWG6nfK5POcknzvWfeMTYBwgjoghQp2nNUQ6Ux6ZZotQJ4dOOY5Yz3YEF3FlPfvI2aactlI+PSblZT6+N7bpoQK9Dee7W8mgv7sCTxyGQMYCOdE0wsmUAlMf+aqIPGKNOCPYEWnOixgjuCTKWKeuCHTK014E+XTC/885t54y83oEFOh6LK1JApsRQDxJEdaIcb4iijCnnGMjtBHp1JHt7OfYSynnXNpveV0CCnRdntVr84KojrTLChkH07Ew3SYSTmRMJxM5J6fsXD2Uk6b1/a/Uf/ckoEDvSX9h2144C0Ed4LBLY+Fcecoi0Nk+AKZhuqhAN+5KLioePU3HJsA4uFdg7z3v2MTb6L1Xfht+mLXCC2wWjzslMCwBBXpY19qxkQg8EkGPxOFofVGgO/C4F2cHTlrRxPjfJ6kVITdatQLdqGNiVi7ObJsfk0DE2fFwLP8r0B34OxdnB6Zq4ooEHAcrwm20agW6UceUZnlhljSOue4YOKbfFehj+t1ed0YAgVakO3NaBXMV6AoQ167CC3Ntwu3Xnz82ad9SLaxJQIGuSdO6JLASAQRakV4JbsPVKtANOwfTfLRt3EGaJ4EVCSjQK8K1agnUIuA0Vy2SfdWjQHfgLy/ODpy0gYmOgw0gN9aEAt2YQ0pzvCBLGq5L4HgEFOgOfK5Qd+CklU10DKwMuNHqFehGHVOa5cVZ0jjmOmMgyzEJHLPXCvQx/W6vOyKgMHfkrMqmKtCVga5VnVH0WmT7qFeR7sNPta1UoGsTtT4JSEAClQgo0JVArlmN0fOadPuo2zHQh59qW6lA1yZqfRKQgAQqEVCgK4Fcqxojp7XIWq8E2iegQLfvIy2UgJ/YHXQMKNAdON4ougMnaaIEViCgQK8AtXaVCHSW2nVbnwQk0C4BBbpd3/xgmVH0DzjckMAhCCjQHbjZ6LkDJ61soj/WvzLgRqtXoBt1TGnW8+fPneIogbgugYMQUKAbd3SiZ0TaJAEJHIuAV/2x/G1vOybgNEfHzrvTdAX6TnBbnuYLwi1p25YE2iGgQLfji4uWGDldRHOYHY6Bw7j6h44q0D/gaHfDC7Rd32xhGf53DGxBuq02FOi2/HHWmr///tuL8yyZYxSW4qxIH8Pn6aUCHRKN5lyQCLQi3aiDNjIrY2Cj5mymEQIKdCOOuGRGBNrI6RKhY5Tj/4yB5Mfo+bF7qUB34P9Ez16YHThrJRPj++QrNWO1jRFQoBtzSGlOLsbk5T7Xj0fAcXA8nyvQx/O5Pe6QAOKsQHfouAdNVqAfBLjF6V6YW1C2DQm0R0CBbs8nP1nkXxL+hMQCCRyCgALdgZsV6A6ctKKJ5fSGT1Mrgm6wagW6QafEpAizPzcaIuYSOBYBBbpxfyPSL168ePLnRht31IrmMQbKZcWmrLoxAgp0Yw6ZmhOBfvnypSI9hXOg7dykGQ+m4xBQoDvwNdGzAt2Bo1YyEVHG/4h0IumVmrLaxggo0I05ZGoOFyQC/fr1628X6PQYt8clgP8R5vh/3J7as3MEFOhzVBor4yLlAn316pUi3Zhv1jYH3xM943vfQ6xNu736Fej2fPKTRVykv/zyy9ObN2++XaiUmcYmEHHm5oz/2dbvY/t82ruX0wK32yPARclj7tu3b0/Gsf3ly5enP//80z//bc9dVSyKz7kpv3v37hRFK85V0HZViQLdibt4vC2jqE+fPj2xfP369STS/gFDJ468YmaEmWkNIudff/319OSUF4RXTnf3YASe/XNh/2ewPg3dHX569K+//jpF0Aj0x48fTyJNGa7UnW25H8EtI9+sT/2U47gR86SUdw6+d2jLn1tbYwS9NfEH2+MC5mImoiLKIqpmuiNTHhFqhJy0pmhHbJI/2LVvQlbWFyEry8r1JW1eOz5t5H8tyfaSuueOwVf4CR/Fbzl+2gY25tjMOSdqvmZ/6jQfj4ARdMc+5SJHVJiLZqqDBYFmoazMp4LwaLcRjblvc2nvnLBM7eCYHBcRy3Z5bI5Lfsn+8hyOSV3JL50HR25ynz9/PnGb1nPpvEvltIcwEw2zRGzL48s2OJ7+l0zLY10/JgEj6I79nosaIcicJUJTijRTICyU1Uq0S3u8vCo//6I8aSo+lKcsOWWcUy6I1LmUunPsuWMoK+vOMeW5KStzzoEbU0asJy+PuXWdfuAXGPGiD4Fekq71b0kdHjMOAQW6c1/mgkZYEAVyhIE8X3kQGdYWaISZF1g8jseGEiXtkyKO2ZfybE+PmR5fHvfo+rm6Yw95RPrccfe0jSgnIr5047mnXs85DgEFehBfR1SSIziIA0vKanWV+qgXkb63fuyrbdc9/YsNiHPW76lneg79YzFJ4BEC558nH6nRc5sjUFN46Bz1Zbm3s7VtuteO6Xk17VKkp3TdvpWAAn0rsc6Oj+Akr2E+dfnIfp2kEfR1Rh4xT0CBnufT/V7EtLY4R6AV6cvDI9GzIn2ZkXuuE1CgrzPq8ojawlxCyMuvmsJf1r/XekS1VvupT5GuRfR49SjQg/ucKPfcN7j3dpv6+EqEZc2bwL32PXIeQsrLwlqprE+RrkX1WPUo0AP7GwFNtEv+aCrrQ6BHS7VFFLGnztr1jsbd/lwmoEBfZjPEHiJePoWrFUVTH8to0xu1nR1hrhmR17bR+tonoEC376OHLERIEWhEtUZCcLLUqK+lOmBV88ZjBN2Sd/u0pc5V22ffD2F1RKeG8BAV5vc9+CvF0VJNVrCBV0R6NFb2ZxsCCvQ2nIdpBcHJDzEN06n/dyTTN7X6lWmOWvVZz/EIKNCD+3yNKA6RJpIeSYASPWd+vcYTB0NrJEaDXypNdk+BbtIt9YyKQNd81C4Fup6l+9eUCLrWfD09ivDv3zst6JGAAt2j126wGYGuOSWRiLCm4N/QndUPrRU5Y6jivLq7hm9AgR7exU/VX1QhzqMKdM3hEIGuKfo17bOu9gko0O37qIqFRL61UjltUqvOluqpySoi3VL/tKUfAgp0P766y9KaYlMaQL1r1V22s+V6It3kNdquWVcNe6yjLwIKdF/+utlaRJTpiJqJl2j8ZWLNl2k17XukrpqCWrOuR/rkuf0SUKD79d1VyxPlJr96woIDEJ38byqjCnQtYc3NsfYNcoGbPGQQAgr0II681I3aL/MQL6JnfiwJga4lZpfs37KcvpTLo20j0Ple/NG6PP+YBBToQf2eqBmBri3SCPNo4swwqCnO1BcfkJskcA8BBfoeah2dE5GoZXIi5uS16m2lHvpVc+qm9s2xFU7asQ0BBXobzru1Ujt6S33Jd+tY5YZzw5nmtZoZjVctLtYzT0CBnufT/d4ITs2OZNqkZp171xUBJc+yt022LwEFeuAxEKGJ+NToKnXlJ0dHe3znT+K/fPny9PXr1yrfeGe6hHyNG2UNf1pH2wQU6Lb987B1a4g0wjzS1wlhRJ8Q55o3nhFfpj48KK1gMQEFejGqvg5EdNYQ0rXq3ZsurBI9s14jjfq1Sw021rGMgAK9jFNXRyGiJCJCllqCEwgR6bST8p5z+gIrpjlq9CvTGkbQPY+K/W1XoPf3wSoWREQRnRqCs4qRB6g0Qn2ArtrFFQgo0CtAbaFKRDm/A11ToBEc/pKw5n9E2wKvCGmtiDecav1v6i0w0obtCSjQ2zPfpEWmNbLUFmj+zPv169fD/TUholoz5QelIv4167auYxBQoAf2MwJdU5xBRYSZCLq2oO3tippCmrpGY7S3j47WvgI9qMcR5triHNFBoFlGSvSt1lcX4ZR8JE72ZVsCCvS2vDdrDXHOFMdmjXbaUIS0fDKgzCSBvQko0Ht7YMX2a0fQmLpGZL4igpuqzpMBkbRJAi0QcCS24IUObVhD/PfEkCi61lcc8DEK39OjY7StQI/hx596gTjUEptUPpoop19lvsa0kEJdEnb9FgIK9C20Oju2tkAnykzeGY6L5mbaJn91me2LJ9ywQ3G+AZaH/kRAgf4JyRgFCENtgYYMdTJXSz5SQpT5oaT8WFKtvtUU+1o2WU8/BMa6yvrhvrqliXJrR3AI82jijDOY2iCCrvmn8YizSQKPEFCgH6HX8LllBF1bpBvu9t2mJdKtIaqpI3XebZQnHp6AAn34IXAbACJMfuODiHO0VFNQqauMyCPaozGzP+sSUKDX5btb7UTNteeKIzr53eSagrYbqP83TF+46dQU0tzMMm1Ss+69edn+NgQU6G0479IKIp2llgGIGC/SPn/+PEwUnRtNTQGlLljlZhaRruUH6zkGgZfH6OYxe1lTcEKQOpni+PTp09ObN2++vTDsdZ47jMjLJf19JEeg4QQbBJpfAOSXAGvfNB+x0XPbJqBAt+2fJq1LZIj4MI2C6PSeIs70AwGNcN/br9SXz/bIubFxU3v16tXpxjbi1zD38vK88wQU6PNchihdK1JDfIgIeXwnKuTH+2mr10R/uOlEVMlrpdRLzpKpDrit5Z9atlvP/gQU6P19sIoFXPxEaGuJAGLDPDTinCg6Ip18lY5VrDSCTF8S4Vas/ltVuQHAC4Gmrbdv3z69e/fOKY9vlFw5R0CBPkel8zIEsmYUeA5HRO33338/tYXgMNUx/XKkdbFGMD9+/HiaK2YKYi1uuRkgzrRJW+SINFMecGud1blxYNm6BBTodfnuUnvEAAFASNcSnYj0H3/8cWoHgc6S/7OQtlsUnjBCMIlsma6B11qsMhCoH260lxspZaVIt8gr9ptvS0CB3pb36q1FABAdIkMEaC3Rod6IGhEhUSDCjNiwINbka0613AMUu1lgw4tOFuzfKqX9THnQNk8g4WY0vZUn2m/n2T+Dpd4bkfb7O6yFuJHIDMGMOEegKV87JeojR2BYEOhff/319OVCXiTmuLXtuVR/hjuciPzfv39/4pUbzaXz1ioPr9zYfvvtt5NY56a2VrvW2wcBI+g+/DRrZcQ5ESHzwjxCE5lFkGYrqLAz7ZCz0Hai0ojQ3uKcbmJfpjbIuYHF/hyzVU673Bxyc4VRxLoVXluxsJ2fCSjQPzPpqiRiSLRMRIgwtyA6QER4mD4gGmThhdieCVYsPGHAKlMblO2Z0n6iegSalOmhPW2z7X0JKND78n+odS5sxJiIOVHzXo/q5zqCfRHpRIXke0aGRPW5mcEOGyOQ5/qwVVnsIOfmAafMRe/Ja6v+2855Av4Wx3kuzZdyISM2Eee8cGpBbEp42INIJ7Jnew8b0y6iDKu9nzJKRuU6duJXbCTfg1Vpj+v7ElCg9+V/V+tctIgekeCHDx9OF/Oe86jXOoFtiE0i1mvHr7UfZggfS8u8ckNr3c61/GS93wko0N9ZdLXGRZw555bFJpErNmIz+R4JO2ibG0V4tRqdYlduaHvx2sNHtvkzAQX6ZybNl3ABI3Z7R6RLQDF/yoLNWZact8Yxab8H0cNGfMyC3aZjElCgO/N7LlbyHoQmeCPU2d46p/18TcJ66yn+Lf3dus3aV5+AAl2f6eo1ctEiMvwhSKtiUwoidvIzm/yCG18m7JVoO19H7GXD0nbjV3wdkV56rseNQ8DP7DrzJRcuC0LDnwdz8TLVUc7v7nVBxzbyRKvYyfe85e8g74E8tmELNwzmeEl7sbrEIHbCjxsKOWWmYxJQoDv0OxcswsefUZPnE7Z8OhaxPic+58puRVAKBusRkVKUE60ihizYmei5PP/Wth85nnYRaP5gBg5wgxWpBpdHbOPcsIQXTxvcgOFG+V7MHu2T5z9GwN/ieIzfrmcjKggMCxHhdGE/89TkWWIw22WabrOvFIWsRyzII8yJ9CLKydnPenlO2eYe6/BAmPmEjb8kZB1ulGdO/xyLNWwtueTmhjgjzAg062G7RvvW2T4BBbp9H81aGOFNjshEtLMe8SHPcak0YpRyRCMp66WQsB4xiXgkT3l5PHWlntS7Z55+wognDoQ6TyCUhVW4xNbpNuXnynL8pT6X5eFFlJynDISZKD9My+NTt/lxCCjQg/i6FAvWs531Mk+Xy2NSNs0RiIjEufVpWXl+zivLWlgv+52bWJ5CcnOLWIcbxyWljO3UVe5Lv8+xoQxhRoATISePYJOTUk/qNj8eAQV6YJ9PxWPa1Wv7c/w1obi2P/W0mIcBOUv5lBFRzr7k9KNcT78oK1MptGFEzhKRznq5v6zD9WMTUKCP7f9vvZ+KCzsiGt8OGnjlXP/pblme9eTT/dkuubE+3ea4c2WUmyRQElCgSxquS+ACgVKULxyyqLgU5kUneNChCfiZ3aHdb+eXElBYl5LyuJoE/EvCmjStSwISkEBFAgp0RZhWJQEJSKAmAQW6Jk3rkoAEJFCRgAJdEaZVSUACEqhJQIGuSdO6JCABCVQkoEBXhGlVEpCABGoSUKBr0rQuCUhAAhUJKNAVYVqVBCQggZoEFOiaNK1LAhKQQEUCCnRFmFYlAQlIoCYBBbomTeuSgAQkUJGAAl0RplVJQAISqElAga5J07okIAEJVCSgQFeEaVUSkIAEahJQoGvStC4JSEACFQko0BVhWpUEJCCBmgQU6Jo0rUsCEpBARQIKdEWYViUBCUigJgEFuiZN65KABCRQkYACXRGmVUlAAhKoSUCBrknTuiQgAQlUJKBAV4RpVRKQgARqElCga9K0LglIQAIVCSjQFWFalQQkIIGaBBTomjStSwISkEBFAgp0RZhWJQEJSKAmAQW6Jk3rkoAEJFCRwH8B9uC5+Ly6DkQAAAAASUVORK5CYII="/>
+    </mask>
+  </defs>
+  <rect width="360" height="360" fill="#D9D9D9" mask="url(#agent-shape)"/>
+</svg>
diff --git a/desktop/src/features/agents/knownAgentPubkeys.test.mjs b/desktop/src/features/agents/knownAgentPubkeys.test.mjs
index 2b7b3e18afc..d58b7f5dabc 100644
--- a/desktop/src/features/agents/knownAgentPubkeys.test.mjs
+++ b/desktop/src/features/agents/knownAgentPubkeys.test.mjs
@@ -1,7 +1,10 @@
 import assert from "node:assert/strict";
 import test from "node:test";
 
-import { mergeKnownAgentPubkeys } from "./knownAgentPubkeys.ts";
+import {
+  mergeKnownAgentPubkeys,
+  mergeOwnedAgentPubkeys,
+} from "./knownAgentPubkeys.ts";
 
 const MANAGED =
   "1111111111111111111111111111111111111111111111111111111111111111";
@@ -34,3 +37,26 @@ test("normalisesCaseAndWhitespace_dedupingAcrossSources", () => {
 
   assert.deepEqual([...merged], [MANAGED]);
 });
+
+test("owned agents include managed and profile-declared agents", () => {
+  const merged = mergeOwnedAgentPubkeys(
+    [{ pubkey: MANAGED }],
+    {
+      [RELAY]: { ownerPubkey: " owner " },
+      other: { ownerPubkey: "somebody-else" },
+    },
+    "OWNER",
+  );
+
+  assert.deepEqual([...merged].sort(), [MANAGED, RELAY].sort());
+});
+
+test("owned agents exclude agents controlled by somebody else", () => {
+  const merged = mergeOwnedAgentPubkeys(
+    undefined,
+    { [RELAY]: { ownerPubkey: "somebody-else" } },
+    "owner",
+  );
+
+  assert.equal(merged.size, 0);
+});
diff --git a/desktop/src/features/agents/knownAgentPubkeys.ts b/desktop/src/features/agents/knownAgentPubkeys.ts
index 978509af096..70cbac68fdb 100644
--- a/desktop/src/features/agents/knownAgentPubkeys.ts
+++ b/desktop/src/features/agents/knownAgentPubkeys.ts
@@ -22,6 +22,34 @@ export function mergeKnownAgentPubkeys(
   return pubkeys;
 }
 
+/** Agent identities controlled by the current user. */
+export function mergeOwnedAgentPubkeys(
+  managedAgents: readonly { pubkey: string }[] | undefined,
+  profiles:
+    | Readonly<Record<string, { ownerPubkey?: string | null }>>
+    | undefined,
+  currentPubkey: string | null | undefined,
+): ReadonlySet<string> {
+  const pubkeys = new Set<string>();
+  for (const agent of managedAgents ?? []) {
+    pubkeys.add(normalizePubkey(agent.pubkey));
+  }
+
+  if (!currentPubkey) return pubkeys;
+
+  const ownerPubkey = normalizePubkey(currentPubkey);
+  for (const [pubkey, profile] of Object.entries(profiles ?? {})) {
+    if (
+      profile.ownerPubkey &&
+      normalizePubkey(profile.ownerPubkey) === ownerPubkey
+    ) {
+      pubkeys.add(normalizePubkey(pubkey));
+    }
+  }
+
+  return pubkeys;
+}
+
 /**
  * Channel-scoped variant: the managed ∪ relay baseline plus this channel's
  * bot members (role `bot` or `isAgent`), so member-only agents are included.
diff --git a/desktop/src/features/agents/lib/catalog.test.mjs b/desktop/src/features/agents/lib/catalog.test.mjs
index 7fa72f4f3ee..62e809bdb5c 100644
--- a/desktop/src/features/agents/lib/catalog.test.mjs
+++ b/desktop/src/features/agents/lib/catalog.test.mjs
@@ -2,11 +2,8 @@ import assert from "node:assert/strict";
 import test from "node:test";
 
 import {
-  getCatalogPersonas,
-  getCatalogSelectionState,
   getLibraryPersonas,
   getPersonaLabelsById,
-  getPersonaLibraryState,
   isCatalogPersonaSelected,
 } from "./catalog.ts";
 
@@ -25,62 +22,6 @@ function createPersona(id, displayName, overrides = {}) {
   };
 }
 
-test("getCatalogPersonas keeps built-ins visible whether selected or not", () => {
-  const personas = [
-    createPersona("builtin:fizz", "Fizz", { isBuiltIn: true, isActive: false }),
-    createPersona("custom:builder", "Builder"),
-  ];
-
-  assert.deepEqual(
-    getCatalogPersonas(personas).map((persona) => persona.id),
-    ["builtin:fizz"],
-  );
-});
-
-test("getCatalogSelectionState keeps built-in selection rules in one place", () => {
-  const personas = [
-    createPersona("builtin:fizz", "Fizz", { isBuiltIn: true, isActive: true }),
-    createPersona("custom:builder", "Builder"),
-  ];
-
-  const state = getCatalogSelectionState(personas);
-
-  assert.deepEqual(
-    state.catalogPersonas.map((persona) => persona.id),
-    ["builtin:fizz"],
-  );
-  assert.deepEqual(
-    state.selectedCatalogPersonas.map((persona) => persona.id),
-    ["builtin:fizz"],
-  );
-  assert.deepEqual(
-    state.unselectedCatalogPersonas.map((persona) => persona.id),
-    [],
-  );
-});
-
-test("getCatalogPersonas keeps chooser order stable when selection changes", () => {
-  const inactive = [
-    createPersona("builtin:fizz", "Fizz", { isBuiltIn: true, isActive: false }),
-    createPersona("builtin:reviewer", "Reviewer", {
-      isBuiltIn: true,
-      isActive: true,
-    }),
-  ];
-  const active = [
-    createPersona("builtin:fizz", "Fizz", { isBuiltIn: true, isActive: true }),
-    createPersona("builtin:reviewer", "Reviewer", {
-      isBuiltIn: true,
-      isActive: false,
-    }),
-  ];
-
-  assert.deepEqual(
-    getCatalogPersonas(inactive).map((persona) => persona.id),
-    getCatalogPersonas(active).map((persona) => persona.id),
-  );
-});
-
 test("isCatalogPersonaSelected treats active catalog personas as selected", () => {
   assert.equal(
     isCatalogPersonaSelected(
@@ -118,25 +59,6 @@ test("getPersonaLabelsById keeps every returned persona addressable", () => {
   });
 });
 
-test("getPersonaLibraryState keeps the working library and full catalog in one place", () => {
-  const personas = [
-    createPersona("builtin:fizz", "Fizz", { isBuiltIn: true, isActive: true }),
-    createPersona("custom:builder", "Builder"),
-  ];
-
-  const state = getPersonaLibraryState(personas);
-
-  assert.deepEqual(
-    state.libraryPersonas.map((persona) => persona.id),
-    ["builtin:fizz", "custom:builder"],
-  );
-  assert.deepEqual(
-    state.catalogPersonas.map((persona) => persona.id),
-    ["builtin:fizz"],
-  );
-  assert.equal(state.personaLabelsById["builtin:fizz"], "Fizz");
-});
-
 test("getLibraryPersonas keeps active custom personas even when catalog entries are similar", () => {
   const avatarUrl = "https://example.test/coordinator.png";
   const personas = [
diff --git a/desktop/src/features/agents/lib/catalog.ts b/desktop/src/features/agents/lib/catalog.ts
index 226aafca5e3..fabc0af87ec 100644
--- a/desktop/src/features/agents/lib/catalog.ts
+++ b/desktop/src/features/agents/lib/catalog.ts
@@ -1,17 +1,5 @@
 import type { AgentPersona } from "@/shared/api/types";
 
-export type CatalogSelectionState = {
-  catalogPersonas: AgentPersona[];
-  selectedCatalogPersonas: AgentPersona[];
-  unselectedCatalogPersonas: AgentPersona[];
-};
-
-export type PersonaLibraryState = {
-  catalogPersonas: AgentPersona[];
-  libraryPersonas: AgentPersona[];
-  personaLabelsById: Record<string, string>;
-};
-
 export function isPersonaActive(persona: AgentPersona) {
   return persona.isActive;
 }
@@ -24,62 +12,12 @@ export function getLibraryPersonas(personas: readonly AgentPersona[]) {
   return getActivePersonas(personas);
 }
 
-export function isPersonaVisibleInCatalog(
-  persona: AgentPersona,
-  sharedCatalogPersonaIds: ReadonlySet<string> = new Set(),
-) {
-  return persona.isBuiltIn || sharedCatalogPersonaIds.has(persona.id);
-}
-
-export function getCatalogPersonas(
-  personas: readonly AgentPersona[],
-  sharedCatalogPersonaIds: ReadonlySet<string> = new Set(),
-) {
-  return personas
-    .filter((persona) =>
-      isPersonaVisibleInCatalog(persona, sharedCatalogPersonaIds),
-    )
-    .sort((left, right) => left.displayName.localeCompare(right.displayName));
-}
-
 export function isCatalogPersonaSelected(persona: AgentPersona) {
   return persona.isActive;
 }
 
-export function getCatalogSelectionState(
-  personas: readonly AgentPersona[],
-  sharedCatalogPersonaIds: ReadonlySet<string> = new Set(),
-): CatalogSelectionState {
-  const catalogPersonas = getCatalogPersonas(personas, sharedCatalogPersonaIds);
-
-  return {
-    catalogPersonas,
-    selectedCatalogPersonas: catalogPersonas.filter(isCatalogPersonaSelected),
-    unselectedCatalogPersonas: catalogPersonas.filter(
-      (persona) => !isCatalogPersonaSelected(persona),
-    ),
-  };
-}
-
 export function getPersonaLabelsById(personas: readonly AgentPersona[]) {
   return Object.fromEntries(
     personas.map((persona) => [persona.id, persona.displayName]),
   );
 }
-
-export function getPersonaLibraryState(
-  personas: readonly AgentPersona[],
-  sharedCatalogPersonaIds: ReadonlySet<string> = new Set(),
-): PersonaLibraryState {
-  const libraryPersonas = getLibraryPersonas(personas);
-  const { catalogPersonas } = getCatalogSelectionState(
-    personas,
-    sharedCatalogPersonaIds,
-  );
-
-  return {
-    catalogPersonas,
-    libraryPersonas,
-    personaLabelsById: getPersonaLabelsById(personas),
-  };
-}
diff --git a/desktop/src/features/agents/lib/legacyPersonaCatalogVisibility.test.mjs b/desktop/src/features/agents/lib/legacyPersonaCatalogVisibility.test.mjs
deleted file mode 100644
index 9439d4a36e0..00000000000
--- a/desktop/src/features/agents/lib/legacyPersonaCatalogVisibility.test.mjs
+++ /dev/null
@@ -1,27 +0,0 @@
-import assert from "node:assert/strict";
-import test from "node:test";
-
-import { clearLegacyPersonaCatalogVisibility } from "./legacyPersonaCatalogVisibility.ts";
-
-test("clearLegacyPersonaCatalogVisibility removes the retired preference", () => {
-  const removedKeys = [];
-
-  clearLegacyPersonaCatalogVisibility({
-    removeItem(key) {
-      removedKeys.push(key);
-    },
-  });
-
-  assert.deepEqual(removedKeys, ["buzz-persona-catalog-visibility-v1"]);
-});
-
-test("clearLegacyPersonaCatalogVisibility ignores unavailable storage", () => {
-  assert.doesNotThrow(() => clearLegacyPersonaCatalogVisibility(null));
-  assert.doesNotThrow(() =>
-    clearLegacyPersonaCatalogVisibility({
-      removeItem() {
-        throw new Error("storage unavailable");
-      },
-    }),
-  );
-});
diff --git a/desktop/src/features/agents/lib/legacyPersonaCatalogVisibility.ts b/desktop/src/features/agents/lib/legacyPersonaCatalogVisibility.ts
deleted file mode 100644
index 38b2d5d9743..00000000000
--- a/desktop/src/features/agents/lib/legacyPersonaCatalogVisibility.ts
+++ /dev/null
@@ -1,28 +0,0 @@
-const LEGACY_PERSONA_CATALOG_VISIBILITY_STORAGE_KEY =
-  "buzz-persona-catalog-visibility-v1";
-
-/**
- * Removes the retired custom-persona catalog preference so it cannot resurface
- * agents after the visibility control has been removed.
- */
-export function clearLegacyPersonaCatalogVisibility(
-  storage?: Pick<Storage, "removeItem"> | null,
-) {
-  let targetStorage = storage;
-  if (targetStorage === undefined) {
-    if (typeof window === "undefined") return;
-
-    try {
-      targetStorage = window.localStorage;
-    } catch {
-      return;
-    }
-  }
-  if (!targetStorage) return;
-
-  try {
-    targetStorage.removeItem(LEGACY_PERSONA_CATALOG_VISIBILITY_STORAGE_KEY);
-  } catch {
-    // Catalog cleanup is best-effort and should not block the agents view.
-  }
-}
diff --git a/desktop/src/features/agents/lib/personaCatalogRelay.test.mjs b/desktop/src/features/agents/lib/personaCatalogRelay.test.mjs
new file mode 100644
index 00000000000..fbaf1f52742
--- /dev/null
+++ b/desktop/src/features/agents/lib/personaCatalogRelay.test.mjs
@@ -0,0 +1,484 @@
+import assert from "node:assert/strict";
+import test, { mock } from "node:test";
+
+import { relayClient } from "@/shared/api/relayClient";
+import { emojiAvatarDataUrl } from "@/features/profile/ui/ProfileAvatarEditor.utils.ts";
+import {
+  catalogPersonasFromPublications,
+  catalogPublicationsFromEvents,
+  fetchPersonaCatalogPublications,
+  personaEventIsShared,
+} from "./personaCatalogRelay.ts";
+
+const ALICE = "a".repeat(64);
+const BOB = "b".repeat(64);
+
+function personaEvent({
+  createdAt,
+  id,
+  owner = ALICE,
+  sourcePersonaId = "reviewer",
+  shared = true,
+  avatarUrl = null,
+  respondTo = null,
+  sharedTag,
+}) {
+  return {
+    id,
+    pubkey: owner,
+    created_at: createdAt,
+    kind: 30175,
+    tags: [
+      ["d", sourcePersonaId],
+      ...(shared
+        ? [sharedTag ?? ["shared", "true"]]
+        : sharedTag
+          ? [sharedTag]
+          : []),
+    ],
+    content: JSON.stringify({
+      display_name: "Relay Reviewer",
+      system_prompt: "Review changes.",
+      avatar_url: avatarUrl,
+      runtime: "goose",
+      model: "claude",
+      provider: null,
+      name_pool: ["Reviewer"],
+      respond_to: respondTo,
+      respond_to_allowlist: respondTo === "allowlist" ? [BOB] : undefined,
+      parallelism: 4,
+    }),
+    sig: "sig",
+  };
+}
+
+test("a shared kind 30175 persona from Alice is discoverable by Bob", () => {
+  const publications = catalogPublicationsFromEvents([
+    personaEvent({ createdAt: 1, id: "alice-reviewer" }),
+  ]);
+  const personas = catalogPersonasFromPublications(publications, [], BOB);
+
+  assert.equal(personas.length, 1);
+  assert.equal(personas[0].displayName, "Relay Reviewer");
+  assert.equal(personas[0].isActive, false);
+  assert.equal(personas[0].shared, true);
+  assert.equal(personas[0].catalogSource.ownerPubkey, ALICE);
+  assert.equal(personas[0].catalogSource.isOwn, false);
+});
+
+test("a newer unshared head hides the older shared head", () => {
+  const publications = catalogPublicationsFromEvents([
+    personaEvent({ createdAt: 1, id: "shared" }),
+    personaEvent({ createdAt: 2, id: "unshared", shared: false }),
+  ]);
+
+  assert.deepEqual(publications, []);
+});
+
+test("persona coordinates remain independent across authors", () => {
+  const publications = catalogPublicationsFromEvents([
+    personaEvent({ createdAt: 1, id: "alice", owner: ALICE }),
+    personaEvent({ createdAt: 1, id: "bob", owner: BOB }),
+  ]);
+
+  assert.equal(publications.length, 2);
+  assert.equal(
+    catalogPersonasFromPublications(publications, [], BOB).length,
+    2,
+  );
+});
+
+test("equal-second persona heads use the relay lowest-id tie-break", () => {
+  const publications = catalogPublicationsFromEvents([
+    personaEvent({
+      createdAt: 1,
+      id: "b".repeat(64),
+      shared: true,
+    }),
+    personaEvent({
+      createdAt: 1,
+      id: "a".repeat(64),
+      shared: false,
+    }),
+  ]);
+
+  assert.deepEqual(publications, []);
+});
+
+test("an invalid canonical head does not resurrect an older shared persona", () => {
+  const invalidHead = {
+    ...personaEvent({ createdAt: 2, id: "a".repeat(64) }),
+    content: "{}",
+  };
+  const publications = catalogPublicationsFromEvents([
+    personaEvent({ createdAt: 1, id: "older-valid" }),
+    invalidHead,
+  ]);
+
+  assert.deepEqual(publications, []);
+});
+
+test("only an exact shared true tag opts a persona into discovery", () => {
+  assert.equal(
+    personaEventIsShared(personaEvent({ createdAt: 1, id: "exact-shared" })),
+    true,
+  );
+  for (const [index, sharedTag] of [
+    ["shared"],
+    ["shared", "false"],
+    ["shared", "true", "extra"],
+  ].entries()) {
+    const event = personaEvent({
+      createdAt: index + 2,
+      id: `malformed-${index}`,
+      shared: false,
+      sharedTag,
+    });
+    assert.equal(personaEventIsShared(event), false);
+    assert.deepEqual(catalogPublicationsFromEvents([event]), []);
+  }
+  const duplicate = personaEvent({
+    createdAt: 5,
+    id: "duplicate",
+  });
+  duplicate.tags.push(["shared", "true"]);
+  assert.equal(personaEventIsShared(duplicate), false);
+});
+
+test("catalog avatars keep bounded http URLs and drop unsafe schemes", () => {
+  const safe = catalogPersonasFromPublications(
+    catalogPublicationsFromEvents([
+      personaEvent({
+        createdAt: 1,
+        id: "safe-avatar",
+        avatarUrl: "https://relay.example/avatar.png",
+      }),
+    ]),
+    [],
+    BOB,
+  );
+  assert.equal(safe[0].avatarUrl, "https://relay.example/avatar.png");
+
+  const unsafe = catalogPersonasFromPublications(
+    catalogPublicationsFromEvents([
+      personaEvent({
+        createdAt: 1,
+        id: "unsafe-avatar",
+        avatarUrl: "javascript:alert(1)",
+      }),
+    ]),
+    [],
+    BOB,
+  );
+  assert.equal(unsafe[0].avatarUrl, null);
+});
+
+/** The avatar a catalog entry projects for `avatarUrl`, or null if dropped. */
+function catalogAvatarUrl(avatarUrl) {
+  const personas = catalogPersonasFromPublications(
+    catalogPublicationsFromEvents([
+      personaEvent({ createdAt: 1, id: "avatar-vector", avatarUrl }),
+    ]),
+    [],
+    BOB,
+  );
+  return personas[0].avatarUrl;
+}
+
+// An emoji avatar is self-contained, so it is the one `data:` avatar that can
+// render on another member's machine. Dropping it left shared agents looking
+// avatar-less in the catalog.
+test("test_percent_encoded_emoji_svg_avatar_survives_the_catalog", () => {
+  const emojiAvatar = emojiAvatarDataUrl("🐝", "#FFCC00");
+
+  assert.equal(catalogAvatarUrl(emojiAvatar), emojiAvatar);
+});
+
+test("test_base64_svg_avatar_is_rejected", () => {
+  assert.equal(
+    catalogAvatarUrl(`data:image/svg+xml;base64,${btoa("<svg/>")}`),
+    null,
+  );
+});
+
+test("test_non_svg_data_avatar_is_rejected", () => {
+  assert.equal(catalogAvatarUrl("data:image/png,%89PNG"), null);
+});
+
+test("test_legacy_inline_raster_avatar_survives_the_catalog", () => {
+  for (const mime of ["png", "jpeg", "gif", "webp"]) {
+    const avatar = `data:image/${mime};base64,iVBORw0KGgo=`;
+    assert.equal(catalogAvatarUrl(avatar), avatar);
+  }
+});
+
+test("test_inline_raster_avatar_rejects_unbounded_or_malformed_payloads", () => {
+  const prefix = "data:image/png;base64,";
+  const payloadLength = 256 * 1_024 - prefix.length;
+  const validPayloadLength = payloadLength - (payloadLength % 4);
+  const withinCap = `${prefix}${"a".repeat(validPayloadLength - 2)}==`;
+  assert.ok(withinCap.length <= 256 * 1_024);
+  assert.equal(catalogAvatarUrl(withinCap), withinCap);
+  assert.equal(
+    catalogAvatarUrl(
+      `${withinCap}${"a".repeat(256 * 1_024 - withinCap.length + 1)}`,
+    ),
+    null,
+  );
+  assert.equal(catalogAvatarUrl("data:image/png;base64,not base64"), null);
+  assert.equal(catalogAvatarUrl("data:image/bmp;base64,aA=="), null);
+});
+
+test("test_oversized_inline_svg_avatar_is_rejected", () => {
+  const withinCap = `data:image/svg+xml,${"a".repeat(8_192 - "data:image/svg+xml,".length)}`;
+  assert.equal(withinCap.length, 8_192);
+  assert.equal(catalogAvatarUrl(withinCap), withinCap);
+  assert.equal(catalogAvatarUrl(`${withinCap}a`), null);
+});
+
+// Catalog avatars render through `<img src>` (ProfileAvatar → AvatarImage),
+// where an SVG document is never scripted, so a script-bearing avatar is
+// accepted and inert rather than filtered — the projection must not silently
+// start sanitizing markup it does not render.
+test("test_script_bearing_inline_svg_avatar_is_accepted_and_rendered_inert", () => {
+  const scripted = `data:image/svg+xml,${encodeURIComponent(
+    '<svg xmlns="http://www.w3.org/2000/svg"><script>alert(1)</script></svg>',
+  )}`;
+
+  assert.equal(catalogAvatarUrl(scripted), scripted);
+});
+
+test("foreign allowlist behavior imports as owner-only", () => {
+  const personas = catalogPersonasFromPublications(
+    catalogPublicationsFromEvents([
+      personaEvent({
+        createdAt: 1,
+        id: "allowlist",
+        respondTo: "allowlist",
+      }),
+    ]),
+    [],
+    BOB,
+  );
+
+  assert.equal(personas[0].respondTo, "owner-only");
+  assert.deepEqual(personas[0].respondToAllowlist, []);
+});
+
+test("a pending local share does not appear before relay confirmation", () => {
+  const localPersona = {
+    id: "local-reviewer",
+    displayName: "Local Reviewer",
+    avatarUrl: null,
+    systemPrompt: "Review local changes.",
+    runtime: null,
+    model: null,
+    provider: null,
+    namePool: [],
+    isBuiltIn: false,
+    isActive: true,
+    shared: true,
+    sourceTeam: null,
+    envVars: {},
+    respondTo: null,
+    respondToAllowlist: [],
+    parallelism: null,
+    createdAt: "2026-07-26T00:00:00.000Z",
+    updatedAt: "2026-07-26T00:00:00.000Z",
+  };
+
+  const personas = catalogPersonasFromPublications([], [localPersona], ALICE);
+  assert.deepEqual(personas, []);
+});
+
+function localPersona(overrides = {}) {
+  return {
+    id: "local-1",
+    displayName: "Relay Reviewer",
+    avatarUrl: null,
+    systemPrompt: "Review changes.",
+    runtime: null,
+    model: null,
+    provider: null,
+    namePool: [],
+    isBuiltIn: false,
+    isActive: true,
+    shared: false,
+    sourceTeam: null,
+    catalogSource: null,
+    envVars: {},
+    respondTo: null,
+    respondToAllowlist: [],
+    parallelism: null,
+    createdAt: "2026-07-26T00:00:00.000Z",
+    updatedAt: "2026-07-26T00:00:00.000Z",
+    ...overrides,
+  };
+}
+
+// The duplicate-add bug: a copy of Alice's entry carries a fresh local UUID, so
+// matching by id finds nothing and the catalog offers "Add" again. Only the
+// stored catalogSource coordinate links the copy back to the publication.
+test("test_added_foreign_catalog_entry_resolves_to_its_local_copy", () => {
+  const publications = catalogPublicationsFromEvents([
+    personaEvent({ createdAt: 1, id: "alice-reviewer" }),
+  ]);
+  const copy = localPersona({
+    id: "a-fresh-uuid",
+    catalogSource: { ownerPubkey: ALICE, personaId: "reviewer" },
+  });
+
+  const personas = catalogPersonasFromPublications(publications, [copy], BOB);
+
+  assert.equal(personas.length, 1);
+  assert.equal(
+    personas[0].id,
+    "a-fresh-uuid",
+    "the projection must resolve to the existing local copy, not a synthetic id",
+  );
+  assert.equal(
+    personas[0].isActive,
+    true,
+    "an added foreign entry must read as already selected",
+  );
+});
+
+test("test_foreign_entry_with_no_local_copy_stays_unselected", () => {
+  const publications = catalogPublicationsFromEvents([
+    personaEvent({ createdAt: 1, id: "alice-reviewer" }),
+  ]);
+  // A same-named local persona with no provenance is a different agent.
+  const unrelated = localPersona({ id: "unrelated" });
+
+  const personas = catalogPersonasFromPublications(
+    publications,
+    [unrelated],
+    BOB,
+  );
+
+  assert.equal(personas[0].id, "catalog:" + ALICE + ":reviewer");
+  assert.equal(personas[0].isActive, false);
+});
+
+// Provenance is per-owner: the same d-tag under a different publisher is a
+// different agent, so a copy of Alice's must not mask Bob's entry.
+test("test_catalog_source_match_is_scoped_to_the_publishing_owner", () => {
+  const publications = catalogPublicationsFromEvents([
+    personaEvent({ createdAt: 1, id: "bob-reviewer", owner: BOB }),
+  ]);
+  const copyOfAlices = localPersona({
+    id: "copy-of-alices",
+    catalogSource: { ownerPubkey: ALICE, personaId: "reviewer" },
+  });
+
+  const personas = catalogPersonasFromPublications(
+    publications,
+    [copyOfAlices],
+    ALICE,
+  );
+
+  assert.equal(personas[0].id, "catalog:" + BOB + ":reviewer");
+  assert.equal(personas[0].isActive, false);
+});
+
+test("test_own_publication_still_resolves_by_local_id", () => {
+  const publications = catalogPublicationsFromEvents([
+    personaEvent({ createdAt: 1, id: "alice-reviewer" }),
+  ]);
+  const own = localPersona({ id: "reviewer", shared: true });
+
+  const personas = catalogPersonasFromPublications(publications, [own], ALICE);
+
+  assert.equal(personas[0].id, "reviewer");
+  assert.equal(personas[0].catalogSource.isOwn, true);
+});
+
+function pageOfEvents(count, startId, createdAt) {
+  return Array.from({ length: count }, (_, index) =>
+    personaEvent({
+      createdAt: typeof createdAt === "function" ? createdAt(index) : createdAt,
+      id: `event-${startId + index}`,
+      sourcePersonaId: `persona-${startId + index}`,
+    }),
+  );
+}
+
+function stubPagedRelay(pages) {
+  const filters = [];
+  mock.method(relayClient, "fetchEvents", (filter) => {
+    filters.push(filter);
+    return Promise.resolve(pages[filters.length - 1] ?? []);
+  });
+  return filters;
+}
+
+// A single limit-capped fetch drops every entry past the relay's clamp, making
+// those agents undiscoverable. The walk must keep going while pages come back
+// full, and must carry an `until` cursor derived from the oldest event seen.
+test("test_full_page_is_followed_by_a_cursored_request_for_older_events", async (t) => {
+  t.after(() => mock.restoreAll());
+  const filters = stubPagedRelay([
+    pageOfEvents(500, 0, (index) => 10_000 - index),
+    pageOfEvents(3, 500, 9_000),
+  ]);
+
+  const publications = await fetchPersonaCatalogPublications();
+
+  assert.equal(filters.length, 2, "a full page must be followed by another");
+  assert.equal(filters[0].until, undefined, "the first page has no cursor");
+  assert.equal(
+    filters[1].until,
+    10_000 - 499,
+    "the cursor must be the oldest created_at from the previous page",
+  );
+  assert.equal(
+    publications.length,
+    503,
+    "entries past the first page must still be discoverable",
+  );
+});
+
+test("test_short_first_page_does_not_issue_a_second_request", async (t) => {
+  t.after(() => mock.restoreAll());
+  const filters = stubPagedRelay([pageOfEvents(2, 0, 10_000)]);
+
+  const publications = await fetchPersonaCatalogPublications();
+
+  assert.equal(filters.length, 1);
+  assert.equal(publications.length, 2);
+});
+
+// `until` is inclusive on the relay, so consecutive pages overlap on the
+// boundary timestamp. Without id dedupe the repeats would be counted twice.
+test("test_overlapping_pages_are_deduped_by_event_id", async (t) => {
+  t.after(() => mock.restoreAll());
+  const firstPage = pageOfEvents(500, 0, (index) => 10_000 - index);
+  const secondPage = [
+    // The boundary event repeats because `until` includes its timestamp.
+    firstPage[firstPage.length - 1],
+    ...pageOfEvents(2, 500, 9_000),
+  ];
+  stubPagedRelay([firstPage, secondPage]);
+
+  const publications = await fetchPersonaCatalogPublications();
+
+  assert.equal(publications.length, 502, "the repeated event must count once");
+});
+
+// The stop-on-no-progress guard: a full page whose events all share one
+// created_at cannot advance the cursor, so paging must terminate instead of
+// re-requesting the same page forever.
+test("test_full_page_of_tied_timestamps_terminates_the_walk", async (t) => {
+  t.after(() => mock.restoreAll());
+  const tiedPage = pageOfEvents(500, 0, 10_000);
+  const filters = stubPagedRelay([tiedPage, tiedPage, tiedPage, tiedPage]);
+
+  const publications = await fetchPersonaCatalogPublications();
+
+  assert.equal(
+    filters.length,
+    2,
+    "the walk must stop once a page contributes nothing new",
+  );
+  assert.equal(publications.length, 500);
+});
diff --git a/desktop/src/features/agents/lib/personaCatalogRelay.ts b/desktop/src/features/agents/lib/personaCatalogRelay.ts
new file mode 100644
index 00000000000..02c3f8e2023
--- /dev/null
+++ b/desktop/src/features/agents/lib/personaCatalogRelay.ts
@@ -0,0 +1,382 @@
+import { relayClient } from "@/shared/api/relayClient";
+import type {
+  AgentPersona,
+  CatalogSourceCoordinate,
+  RelayEvent,
+  RespondToMode,
+} from "@/shared/api/types";
+import { KIND_PERSONA } from "@/shared/constants/kinds";
+
+export type CatalogPersonaShareLevel = "not-shared" | "none";
+
+type CatalogAgentProjection = {
+  displayName: string;
+  avatarUrl: string | null;
+  systemPrompt: string;
+  runtime: string | null;
+  model: string | null;
+  provider: string | null;
+  namePool: string[];
+  respondTo: RespondToMode | null;
+  parallelism: number | null;
+};
+
+export type PersonaCatalogPublication = {
+  eventId: string;
+  ownerPubkey: string;
+  sourcePersonaId: string;
+  createdAt: number;
+  agent: CatalogAgentProjection;
+};
+
+export type CatalogPersona = AgentPersona & {
+  catalogSource: CatalogSourceCoordinate & {
+    /** The publication event this projection was built from. */
+    eventId: string;
+    /** Whether the current identity published it. */
+    isOwn: boolean;
+  };
+};
+
+type JsonObject = Record<string, unknown>;
+
+function isObject(value: unknown): value is JsonObject {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+function extractTag(event: RelayEvent, name: string): string | null {
+  const matches = event.tags.filter(
+    (tag) => tag.length >= 2 && tag[0] === name && typeof tag[1] === "string",
+  );
+  return matches.length === 1 ? (matches[0]?.[1] ?? null) : null;
+}
+
+export function personaEventIsShared(event: RelayEvent): boolean {
+  const sharedTags = event.tags.filter((tag) => tag[0] === "shared");
+  return (
+    sharedTags.length === 1 &&
+    sharedTags[0]?.length === 2 &&
+    sharedTags[0]?.[1] === "true"
+  );
+}
+
+function isSafeHttpUrl(value: unknown): value is string {
+  if (
+    typeof value !== "string" ||
+    value.length === 0 ||
+    value.length > 2_048 ||
+    /[\s()]/u.test(value)
+  ) {
+    return false;
+  }
+  try {
+    const parsed = new URL(value);
+    return parsed.protocol === "https:" || parsed.protocol === "http:";
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Emoji avatars are the one `data:` avatar a catalog entry keeps.
+ *
+ * They persist as inline, percent-encoded SVG (`emojiAvatarDataUrl` in
+ * `ProfileAvatarEditor.utils.ts`), so they are self-contained and render on
+ * any member's machine — unlike a bundled runtime-default avatar, whose local
+ * asset path means nothing to another install. The accepted shape is exactly
+ * that prefix: the trailing comma is what rejects `;base64` payloads, and
+ * every other `data:` MIME stays rejected. Catalog avatars render through
+ * `<img src>` (`ProfileAvatar` → `AvatarImage`), where SVG script never
+ * executes, so bounding the length is the remaining concern — 8 KiB is an
+ * order of magnitude above the ~700 characters an emoji avatar encodes to.
+ */
+const INLINE_SVG_AVATAR_PREFIX = "data:image/svg+xml,";
+const MAX_INLINE_SVG_AVATAR_LENGTH = 8_192;
+
+/**
+ * Shared persona heads can carry an uploaded avatar as an inline raster. Keep
+ * those self-contained images renderable without accepting arbitrary `data:`
+ * URLs: only the raster MIME types browsers decode in `<img>`, strict base64
+ * shape, and a bound no larger than the relay's event-content ceiling.
+ */
+const MAX_INLINE_RASTER_AVATAR_LENGTH = 256 * 1_024;
+const INLINE_RASTER_AVATAR_RE =
+  /^data:image\/(?:png|jpeg|gif|webp);base64,([A-Za-z0-9+/]+={0,2})$/u;
+
+function isInlineSvgAvatar(value: unknown): value is string {
+  return (
+    typeof value === "string" &&
+    value.startsWith(INLINE_SVG_AVATAR_PREFIX) &&
+    value.length <= MAX_INLINE_SVG_AVATAR_LENGTH
+  );
+}
+
+function isInlineRasterAvatar(value: unknown): value is string {
+  if (
+    typeof value !== "string" ||
+    value.length > MAX_INLINE_RASTER_AVATAR_LENGTH
+  ) {
+    return false;
+  }
+  const match = INLINE_RASTER_AVATAR_RE.exec(value);
+  return match !== null && (match[1]?.length ?? 0) % 4 === 0;
+}
+
+function optionalString(value: unknown): string | null {
+  return typeof value === "string" && value.trim().length > 0 ? value : null;
+}
+
+function parsePersonaContent(event: RelayEvent): CatalogAgentProjection | null {
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(event.content);
+  } catch {
+    return null;
+  }
+  if (
+    !isObject(parsed) ||
+    typeof parsed.display_name !== "string" ||
+    parsed.display_name.trim().length === 0
+  ) {
+    return null;
+  }
+
+  const avatarUrl =
+    isSafeHttpUrl(parsed.avatar_url) ||
+    isInlineSvgAvatar(parsed.avatar_url) ||
+    isInlineRasterAvatar(parsed.avatar_url)
+      ? parsed.avatar_url
+      : null;
+  const namePool = Array.isArray(parsed.name_pool)
+    ? parsed.name_pool.filter(
+        (candidate): candidate is string => typeof candidate === "string",
+      )
+    : [];
+  const respondTo =
+    parsed.respond_to === "allowlist"
+      ? "owner-only"
+      : parsed.respond_to === "owner-only" || parsed.respond_to === "anyone"
+        ? parsed.respond_to
+        : null;
+  const parallelism =
+    typeof parsed.parallelism === "number" &&
+    Number.isInteger(parsed.parallelism) &&
+    parsed.parallelism >= 1 &&
+    parsed.parallelism <= 32
+      ? parsed.parallelism
+      : null;
+
+  return {
+    displayName: parsed.display_name,
+    avatarUrl,
+    systemPrompt:
+      typeof parsed.system_prompt === "string" ? parsed.system_prompt : "",
+    runtime: optionalString(parsed.runtime),
+    model: optionalString(parsed.model),
+    provider: optionalString(parsed.provider),
+    namePool,
+    respondTo,
+    parallelism,
+  };
+}
+
+/**
+ * Collapse relay results to the canonical NIP-33 head for each persona
+ * coordinate, then keep only exact `["shared", "true"]` heads.
+ *
+ * The relay normally returns one replaceable head. The client-side collapse is
+ * defense in depth for older relays and fixtures, and deliberately claims the
+ * coordinate before parsing so an invalid or unshared newest head cannot
+ * resurrect an older shared definition.
+ */
+export function catalogPublicationsFromEvents(
+  events: readonly RelayEvent[],
+): PersonaCatalogPublication[] {
+  const sorted = [...events].sort(
+    (left, right) =>
+      right.created_at - left.created_at || left.id.localeCompare(right.id),
+  );
+  const seenCoordinates = new Set<string>();
+  const publications: PersonaCatalogPublication[] = [];
+
+  for (const event of sorted) {
+    if (event.kind !== KIND_PERSONA) continue;
+    const sourcePersonaId = extractTag(event, "d");
+    if (!sourcePersonaId) continue;
+    const ownerPubkey = event.pubkey.toLowerCase();
+    const coordinate = `${ownerPubkey}:${sourcePersonaId}`;
+    if (seenCoordinates.has(coordinate)) continue;
+    seenCoordinates.add(coordinate);
+
+    if (!personaEventIsShared(event)) continue;
+    const agent = parsePersonaContent(event);
+    if (!agent) continue;
+    publications.push({
+      eventId: event.id,
+      ownerPubkey,
+      sourcePersonaId,
+      createdAt: event.created_at,
+      agent,
+    });
+  }
+
+  return publications;
+}
+
+/**
+ * Events per catalog page.
+ *
+ * Kept well under the relay's 1,000-row `query_events` clamp so a page that
+ * comes back full is a reliable "there may be more" signal rather than a
+ * silently truncated result.
+ */
+const CATALOG_PAGE_SIZE = 500;
+
+/**
+ * Hard bound on pages walked, so a relay that keeps returning full pages can
+ * never spin this forever.
+ */
+const MAX_CATALOG_PAGES = 40;
+
+/**
+ * Read every shared persona event, page by page.
+ *
+ * A single `limit`-capped fetch silently truncates once a community publishes
+ * more agents than the relay's clamp, and the entries that fall off are simply
+ * undiscoverable. Paging walks backwards through `created_at` using the only
+ * cursor a WS `REQ` filter carries — `until` — which the relay treats as
+ * *inclusive*, so consecutive pages overlap on tied timestamps. Two things
+ * follow, and both are load-bearing:
+ *
+ * - dedupe by event id, because the boundary events repeat; and
+ * - stop when a page contributes nothing new, because a page whose events all
+ *   share one `created_at` would otherwise be requested forever.
+ */
+export async function fetchPersonaCatalogPublications(): Promise<
+  PersonaCatalogPublication[]
+> {
+  const byId = new Map<string, RelayEvent>();
+  let until: number | undefined;
+
+  for (let page = 0; page < MAX_CATALOG_PAGES; page += 1) {
+    const events = await relayClient.fetchEvents({
+      kinds: [KIND_PERSONA],
+      limit: CATALOG_PAGE_SIZE,
+      ...(until === undefined ? {} : { until }),
+    });
+
+    const sizeBefore = byId.size;
+    let oldestCreatedAt = Number.POSITIVE_INFINITY;
+    for (const event of events) {
+      byId.set(event.id, event);
+      oldestCreatedAt = Math.min(oldestCreatedAt, event.created_at);
+    }
+
+    // A short page is the end of the catalog; a page of only-repeats means the
+    // cursor cannot advance past a run of tied timestamps.
+    if (events.length < CATALOG_PAGE_SIZE || byId.size === sizeBefore) {
+      break;
+    }
+    until = oldestCreatedAt;
+  }
+
+  return catalogPublicationsFromEvents([...byId.values()]);
+}
+
+function publicationToPersona(
+  publication: PersonaCatalogPublication,
+  localPersona: AgentPersona | undefined,
+  isOwn: boolean,
+): CatalogPersona {
+  const timestamp = new Date(publication.createdAt * 1_000).toISOString();
+  const basePersona: AgentPersona = localPersona ?? {
+    id: `catalog:${publication.ownerPubkey}:${publication.sourcePersonaId}`,
+    displayName: publication.agent.displayName,
+    avatarUrl: publication.agent.avatarUrl,
+    systemPrompt: publication.agent.systemPrompt,
+    runtime: publication.agent.runtime,
+    model: publication.agent.model,
+    provider: publication.agent.provider,
+    namePool: publication.agent.namePool,
+    isBuiltIn: false,
+    isActive: false,
+    shared: true,
+    sourceTeam: null,
+    envVars: {},
+    respondTo: publication.agent.respondTo,
+    respondToAllowlist: [],
+    parallelism: publication.agent.parallelism,
+    createdAt: timestamp,
+    updatedAt: timestamp,
+  };
+
+  return {
+    ...basePersona,
+    // Catalog membership is relay-confirmed by the shared event itself. Do not
+    // let a local pending toggle override this projection.
+    shared: true,
+    catalogSource: {
+      eventId: publication.eventId,
+      ownerPubkey: publication.ownerPubkey,
+      isOwn,
+      personaId: publication.sourcePersonaId,
+    },
+  };
+}
+
+export function catalogPersonasFromPublications(
+  publications: readonly PersonaCatalogPublication[],
+  localPersonas: readonly AgentPersona[],
+  currentPubkey: string | null | undefined,
+): CatalogPersona[] {
+  const normalizedCurrentPubkey = currentPubkey?.toLowerCase() ?? null;
+  const personas: CatalogPersona[] = [];
+
+  for (const publication of publications) {
+    const isOwn = publication.ownerPubkey === normalizedCurrentPubkey;
+    personas.push(
+      publicationToPersona(
+        publication,
+        findLocalPersonaForCatalogEntry(localPersonas, {
+          ownerPubkey: publication.ownerPubkey,
+          personaId: publication.sourcePersonaId,
+          isOwn,
+        }),
+        isOwn,
+      ),
+    );
+  }
+
+  return personas.sort((left, right) =>
+    left.displayName.localeCompare(right.displayName),
+  );
+}
+
+/**
+ * The local persona backing a catalog entry, if the user already has it.
+ *
+ * An own publication is found by id — its `d`-tag *is* the local persona id. A
+ * copy of another owner's entry carries a fresh local id instead, so the only
+ * link back is the `catalogSource` coordinate stored on the copy. Matching on
+ * that coordinate is what stops the catalog from offering "Add" for an entry
+ * the user already added, which would mint a second copy.
+ */
+export function findLocalPersonaForCatalogEntry(
+  localPersonas: readonly AgentPersona[],
+  source: CatalogSourceCoordinate & { isOwn: boolean },
+): AgentPersona | undefined {
+  if (source.isOwn) {
+    return localPersonas.find((persona) => persona.id === source.personaId);
+  }
+  return localPersonas.find(
+    (persona) =>
+      persona.catalogSource?.ownerPubkey === source.ownerPubkey &&
+      persona.catalogSource?.personaId === source.personaId,
+  );
+}
+
+export function isCatalogPersona(
+  persona: AgentPersona,
+): persona is CatalogPersona {
+  return "catalogSource" in persona && isObject(persona.catalogSource);
+}
diff --git a/desktop/src/features/agents/lib/personaEditCaches.ts b/desktop/src/features/agents/lib/personaEditCaches.ts
new file mode 100644
index 00000000000..c5071d1246b
--- /dev/null
+++ b/desktop/src/features/agents/lib/personaEditCaches.ts
@@ -0,0 +1,42 @@
+import type { QueryClient } from "@tanstack/react-query";
+
+import { evictUsersBatchEntries } from "@/features/profile/hooks";
+import type { ManagedAgent } from "@/shared/api/types";
+
+/**
+ * Refresh every cache a saved persona edit can invalidate.
+ *
+ * Shared by the plain edit mutation and the publish-on-save edit mutation so
+ * the two cannot drift on what a saved edit refreshes.
+ */
+export async function invalidatePersonaEditCaches(
+  queryClient: QueryClient,
+  personaId: string,
+): Promise<void> {
+  // Evict per-pubkey users-batch-entry caches for agents linked to this
+  // persona so the batch invalidation below refetches fresh profiles instead
+  // of re-reading stale entries (mirrors useUpdateManagedAgentMutation).
+  const agents = queryClient.getQueryData<ManagedAgent[]>(["managed-agents"]);
+  if (agents) {
+    evictUsersBatchEntries(
+      queryClient,
+      agents
+        .filter((agent) => agent.personaId === personaId)
+        .map((agent) => agent.pubkey.toLowerCase()),
+    );
+  }
+
+  await Promise.all([
+    queryClient.invalidateQueries({ queryKey: ["personas"] }),
+    queryClient.invalidateQueries({ queryKey: ["managed-agents"] }),
+    // Persona avatar changes re-sync linked agents' relay profiles;
+    // invalidate cached user-profile and users-batch queries so the UI picks
+    // up the updated kind:0 picture without waiting for staleTime expiry —
+    // covers agent cards, message timelines, and member lists.
+    queryClient.invalidateQueries({
+      predicate: (query) =>
+        query.queryKey[0] === "user-profile" ||
+        query.queryKey[0] === "users-batch",
+    }),
+  ]);
+}
diff --git a/desktop/src/features/agents/lib/personaSaveNotice.test.mjs b/desktop/src/features/agents/lib/personaSaveNotice.test.mjs
new file mode 100644
index 00000000000..36f3fcdc8a0
--- /dev/null
+++ b/desktop/src/features/agents/lib/personaSaveNotice.test.mjs
@@ -0,0 +1,29 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+
+import { personaSaveNotice } from "./personaSaveNotice.ts";
+
+test("test_plain_save_notice_says_nothing_about_the_catalog", () => {
+  const notice = personaSaveNotice("Helper", null);
+  assert.equal(notice, "Updated Helper.");
+  assert.ok(!/catalog/i.test(notice));
+});
+
+test("test_accepted_publish_notice_claims_the_catalog_has_the_edit", () => {
+  assert.match(
+    personaSaveNotice("Helper", "published"),
+    /published it to the community catalog/,
+  );
+});
+
+// The whole point of routing "Save and publish" through the strict command is
+// that a queued edit must NOT be reported as published — the relay hasn't taken
+// it yet, so the catalog still shows the old definition.
+test("test_queued_publish_notice_does_not_claim_the_edit_is_published", () => {
+  const notice = personaSaveNotice("Helper", "queued");
+  assert.match(notice, /queued/);
+  assert.ok(
+    !/\bpublished\b/.test(notice),
+    "a queued edit must not be described as published",
+  );
+});
diff --git a/desktop/src/features/agents/lib/personaSaveNotice.ts b/desktop/src/features/agents/lib/personaSaveNotice.ts
new file mode 100644
index 00000000000..f75f0e1c68a
--- /dev/null
+++ b/desktop/src/features/agents/lib/personaSaveNotice.ts
@@ -0,0 +1,24 @@
+import type { PersonaSharePublicationResult } from "@/shared/api/tauriPersonas";
+
+/**
+ * The confirmation shown after a persona edit is saved.
+ *
+ * `publicationStatus` is null when the edit did not promise publication, so
+ * the copy stays silent about the catalog. When it did, the copy must
+ * distinguish a relay-accepted publish from a queued one — a "published"
+ * message for an edit still sitting in the outbox is the promise the
+ * "Save and publish" button was making falsely.
+ */
+export function personaSaveNotice(
+  displayName: string,
+  publicationStatus: PersonaSharePublicationResult["publicationStatus"] | null,
+): string {
+  switch (publicationStatus) {
+    case "published":
+      return `Updated ${displayName} and published it to the community catalog.`;
+    case "queued":
+      return `Updated ${displayName}. Publishing to the community catalog is queued and will appear after the relay accepts the update.`;
+    default:
+      return `Updated ${displayName}.`;
+  }
+}
diff --git a/desktop/src/features/agents/lib/usePersonaCatalogRelay.ts b/desktop/src/features/agents/lib/usePersonaCatalogRelay.ts
new file mode 100644
index 00000000000..c7835f93739
--- /dev/null
+++ b/desktop/src/features/agents/lib/usePersonaCatalogRelay.ts
@@ -0,0 +1,115 @@
+import * as React from "react";
+import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
+
+import {
+  fetchPersonaCatalogPublications,
+  type PersonaCatalogPublication,
+} from "@/features/agents/lib/personaCatalogRelay";
+import { invalidatePersonaEditCaches } from "@/features/agents/lib/personaEditCaches";
+import { relayClient } from "@/shared/api/relayClient";
+import {
+  setPersonaShared,
+  updatePersonaAndPublish,
+} from "@/shared/api/tauriPersonas";
+import type { AgentPersona, UpdatePersonaInput } from "@/shared/api/types";
+import { KIND_PERSONA } from "@/shared/constants/kinds";
+
+export function personaCatalogQueryKey(communityId: string | null) {
+  return ["persona-catalog", communityId] as const;
+}
+
+export function usePersonaCatalogQuery(communityId: string | null) {
+  return useQuery<PersonaCatalogPublication[]>({
+    enabled: communityId !== null,
+    queryKey: personaCatalogQueryKey(communityId),
+    queryFn: fetchPersonaCatalogPublications,
+    staleTime: 30_000,
+    refetchInterval: 120_000,
+  });
+}
+
+export function usePersonaCatalogLiveUpdates(communityId: string | null): void {
+  const queryClient = useQueryClient();
+
+  React.useEffect(() => {
+    if (!communityId) return;
+    let disposed = false;
+    let dispose: (() => Promise<void>) | null = null;
+
+    void relayClient
+      .subscribeLive({ kinds: [KIND_PERSONA], limit: 0 }, () => {
+        void queryClient.invalidateQueries({
+          queryKey: personaCatalogQueryKey(communityId),
+        });
+      })
+      .then((unsubscribe) => {
+        if (disposed) {
+          void unsubscribe();
+        } else {
+          dispose = unsubscribe;
+        }
+      })
+      .catch((error) => {
+        console.error(
+          "Couldn’t subscribe to the community agent catalog",
+          error,
+        );
+      });
+
+    const unsubscribeReconnect = relayClient.subscribeToReconnects(() => {
+      void queryClient.invalidateQueries({
+        queryKey: personaCatalogQueryKey(communityId),
+      });
+    });
+
+    return () => {
+      disposed = true;
+      unsubscribeReconnect();
+      if (dispose) void dispose();
+    };
+  }, [communityId, queryClient]);
+}
+
+export function useSetPersonaCatalogSharedMutation(communityId: string | null) {
+  const queryClient = useQueryClient();
+  return useMutation({
+    mutationFn: ({ id, shared }: { id: string; shared: boolean }) =>
+      setPersonaShared(id, shared),
+    onSuccess: (result) => {
+      queryClient.setQueryData<AgentPersona[]>(
+        ["personas"],
+        (current) =>
+          current?.map((persona) =>
+            persona.id === result.persona.id ? result.persona : persona,
+          ) ?? [result.persona],
+      );
+      void queryClient.invalidateQueries({
+        queryKey: personaCatalogQueryKey(communityId),
+      });
+    },
+  });
+}
+
+/**
+ * Save a persona edit and publish its catalog head, reporting the relay's
+ * verdict.
+ *
+ * The plain edit mutation only enqueues the head best-effort, so it cannot back
+ * the "Save and publish" promise. This awaits the relay and additionally
+ * refreshes the catalog query, since the published edit changes what the
+ * catalog shows.
+ */
+export function useUpdatePersonaAndPublishMutation(communityId: string | null) {
+  const queryClient = useQueryClient();
+  return useMutation({
+    mutationFn: (input: UpdatePersonaInput) => updatePersonaAndPublish(input),
+    onSettled: async (_data, _error, variables) => {
+      await Promise.all([
+        invalidatePersonaEditCaches(queryClient, variables.id),
+        queryClient.invalidateQueries({
+          queryKey: personaCatalogQueryKey(communityId),
+        }),
+      ]);
+    },
+  });
+}
diff --git a/desktop/src/features/agents/lib/usePersonaSync.test.mjs b/desktop/src/features/agents/lib/usePersonaSync.test.mjs
index a1cbbf93fe4..0dc12ddfd1e 100644
--- a/desktop/src/features/agents/lib/usePersonaSync.test.mjs
+++ b/desktop/src/features/agents/lib/usePersonaSync.test.mjs
@@ -35,7 +35,7 @@ test("startPersonaSync backfills history including the deletion kind", () => {
     return Promise.resolve(() => Promise.resolve());
   });
 
-  startPersonaSync("owner-pubkey", () => false);
+  startPersonaSync("owner-pubkey", "wss://relay.example", () => false);
 
   assert.equal(fetchCalls.length, 1, "must do exactly one backfill fetch");
   assert.deepEqual(
@@ -58,3 +58,53 @@ test("startPersonaSync backfills history including the deletion kind", () => {
 
   mock.reset();
 });
+
+// Regression guard for the arrival-scope fix (F6): the reconcile must carry the
+// relay this subscription was opened on, NOT whichever community happens to be
+// active when the reconcile runs. Without the forwarded URL the backend falls
+// back to the active workspace and an in-flight event lands in the wrong
+// community's scoped retention store on a mid-flight switch.
+test("startPersonaSync forwards its own relay as the event arrival relay", async () => {
+  const invokes = [];
+  // @tauri-apps/api/core reads `window.__TAURI_INTERNALS__.invoke`.
+  globalThis.window = {
+    __TAURI_INTERNALS__: {
+      invoke: (cmd, args) => {
+        invokes.push({ cmd, args });
+        return Promise.resolve();
+      },
+    },
+  };
+
+  const ownEvent = { id: "e1", pubkey: "owner-pubkey", kind: KIND_PERSONA };
+  const foreignEvent = { id: "e2", pubkey: "someone-else", kind: KIND_PERSONA };
+
+  mock.method(relayClient, "fetchEvents", () =>
+    Promise.resolve([ownEvent, foreignEvent]),
+  );
+  mock.method(relayClient, "subscribeLive", () =>
+    Promise.resolve(() => Promise.resolve()),
+  );
+
+  startPersonaSync("owner-pubkey", "wss://community-a.example", () => false);
+  // Let the backfill promise chain and the reconcile invoke settle.
+  await new Promise((resolve) => setImmediate(resolve));
+
+  const reconciles = invokes.filter(
+    (call) => call.cmd === "reconcile_inbound_persona_event",
+  );
+  assert.equal(
+    reconciles.length,
+    1,
+    "only the subscribed author's event reconciles",
+  );
+  assert.equal(
+    reconciles[0].args.arrivalRelayUrl,
+    "wss://community-a.example",
+    "reconcile must carry the subscription's relay as the arrival relay",
+  );
+  assert.equal(JSON.parse(reconciles[0].args.eventJson).id, "e1");
+
+  mock.reset();
+  delete globalThis.window;
+});
diff --git a/desktop/src/features/agents/lib/usePersonaSync.ts b/desktop/src/features/agents/lib/usePersonaSync.ts
index e713ed71d15..f18194c5c6e 100644
--- a/desktop/src/features/agents/lib/usePersonaSync.ts
+++ b/desktop/src/features/agents/lib/usePersonaSync.ts
@@ -20,19 +20,28 @@ const PERSONA_SYNC_KINDS = [
   KIND_DELETION,
 ];
 
-// Start the persona/team/agent/deletion sync for `pubkey`: one-shot backfill
-// of existing heads + tombstones, then a live subscription. Returns a disposer
-// that closes the live subscription. Extracted from the hook so the wiring is
-// unit-testable without a React renderer (see `usePersonaSync.test.mjs`).
+// Start the persona/team/agent/deletion sync for `pubkey` on `relayUrl`:
+// one-shot backfill of existing heads + tombstones, then a live subscription.
+// Returns a disposer that closes the live subscription. Extracted from the hook
+// so the wiring is unit-testable without a React renderer (see
+// `usePersonaSync.test.mjs`).
+//
+// `relayUrl` is the community this subscription is bound to, and every reconcile
+// carries it as the event's arrival relay. Capturing it here — rather than
+// letting the backend read whichever workspace is active when the reconcile runs
+// — is what keeps an in-flight event out of the next community's scoped store.
 export function startPersonaSync(
   pubkey: string,
+  relayUrl: string,
   onCancelled: () => boolean,
 ): () => Promise<void> {
   const reconcile = (event: RelayEvent) => {
     if (event.pubkey !== pubkey) return;
-    void reconcileInboundPersonaEvent(JSON.stringify(event)).catch((error) => {
-      console.warn("[usePersonaSync] reconcile failed:", error);
-    });
+    void reconcileInboundPersonaEvent(JSON.stringify(event), relayUrl).catch(
+      (error) => {
+        console.warn("[usePersonaSync] reconcile failed:", error);
+      },
+    );
   };
 
   // One-shot backfill of existing heads + tombstones (closes the fresh-start
@@ -68,23 +77,27 @@ export function startPersonaSync(
 
 // Subscribes to this device's own persona/team/agent projection + deletion
 // events and patches each into the local store. The subscription is keyed on
-// the active pubkey: an identity switch re-runs the effect, whose cleanup
-// closes the old subscription before a new one opens on the new pubkey's
-// filter — so no stale-coordinate subscription survives.
+// the active pubkey and relay: an identity or community switch re-runs the
+// effect, whose cleanup closes the old subscription before a new one opens on
+// the new filter — so no stale-coordinate subscription survives, and every
+// reconcile is attributed to the community it was subscribed to.
 //
 // A fresh device that comes online AFTER another already published gets no
 // history from a live-only subscription: relayClient's replayLiveSubscriptions
 // only replays from a since-cursor that is undefined until the first live
 // event arrives. So `startPersonaSync` does an explicit one-shot history fetch
 // up front and feeds each event through the same reconcile path.
-export function usePersonaSync(pubkey: string | undefined): void {
+export function usePersonaSync(
+  pubkey: string | undefined,
+  relayUrl: string | undefined,
+): void {
   React.useEffect(() => {
-    if (!pubkey) return;
+    if (!pubkey || !relayUrl) return;
     let cancelled = false;
-    const dispose = startPersonaSync(pubkey, () => cancelled);
+    const dispose = startPersonaSync(pubkey, relayUrl, () => cancelled);
     return () => {
       cancelled = true;
       void dispose();
     };
-  }, [pubkey]);
+  }, [pubkey, relayUrl]);
 }
diff --git a/desktop/src/features/agents/ui/AddCustomHarnessDialog.tsx b/desktop/src/features/agents/ui/AddCustomHarnessDialog.tsx
new file mode 100644
index 00000000000..0c84e99275a
--- /dev/null
+++ b/desktop/src/features/agents/ui/AddCustomHarnessDialog.tsx
@@ -0,0 +1,47 @@
+import { CustomHarnessForm } from "@/features/settings/ui/CustomHarnessForm";
+import { ChooserDialogContent } from "@/shared/ui/chooser-dialog-content";
+import { Dialog } from "@/shared/ui/dialog";
+
+/**
+ * Registers a custom ACP harness from inside an agent dialog, so "New agent"
+ * is a complete entry point and not a dead end that sends the user to
+ * Settings. Hosts the same `CustomHarnessForm` the harness catalog uses.
+ */
+export function AddCustomHarnessDialog({
+  onOpenChange,
+  onSaved,
+  open,
+}: {
+  onOpenChange: (open: boolean) => void;
+  /** Called with the id of the harness that was just registered. */
+  onSaved: (id: string) => void;
+  open: boolean;
+}) {
+  return (
+    <Dialog onOpenChange={onOpenChange} open={open}>
+      <ChooserDialogContent
+        className="h-[42rem] max-w-2xl"
+        contentClassName="flex min-h-0 flex-1 p-0"
+        data-testid="add-custom-harness-dialog"
+        scrollAreaClassName="flex min-h-0 overflow-hidden px-0"
+        title="Add custom harness"
+      >
+        <CustomHarnessForm
+          chromeless
+          header={
+            <p className="text-sm text-muted-foreground">
+              Register any ACP-speaking agent tool as a selectable harness.
+            </p>
+          }
+          onCancel={() => onOpenChange(false)}
+          onSaved={(id) => {
+            // Dismiss on save as well as cancel — both exits belong to this
+            // dialog, so callers only handle the resulting selection.
+            onOpenChange(false);
+            onSaved(id);
+          }}
+        />
+      </ChooserDialogContent>
+    </Dialog>
+  );
+}
diff --git a/desktop/src/features/agents/ui/AgentCreationPreview.tsx b/desktop/src/features/agents/ui/AgentCreationPreview.tsx
index 1bdd93673bf..e7a68211dcd 100644
--- a/desktop/src/features/agents/ui/AgentCreationPreview.tsx
+++ b/desktop/src/features/agents/ui/AgentCreationPreview.tsx
@@ -133,6 +133,32 @@ export function AgentCreationPreview({
     isAvatarMenuOpen && activeTab === "emoji",
   );
 
+  // Emoji Mart mounts its search input inside a shadow root. Wait for it
+  // before focusing so the surrounding Radix popover cannot win the race.
+  React.useEffect(() => {
+    if (!isAvatarMenuOpen || activeTab !== "emoji") {
+      return;
+    }
+
+    let animationFrame = 0;
+    const focusSearchInput = () => {
+      const searchInput =
+        emojiPickerContainerRef.current
+          ?.querySelector("em-emoji-picker")
+          ?.shadowRoot?.querySelector<HTMLInputElement>(
+            'input[type="search"]',
+          ) ?? null;
+      if (!searchInput) {
+        animationFrame = window.requestAnimationFrame(focusSearchInput);
+        return;
+      }
+      searchInput.focus();
+    };
+
+    animationFrame = window.requestAnimationFrame(focusSearchInput);
+    return () => window.cancelAnimationFrame(animationFrame);
+  }, [activeTab, isAvatarMenuOpen]);
+
   const customColorDraft = React.useMemo(
     () => hsvToHex(customHue, customSaturation, customValue),
     [customHue, customSaturation, customValue],
@@ -550,6 +576,7 @@ export function AgentCreationPreview({
               style={emojiMartThemeVars}
             >
               <Picker
+                autoFocus
                 categories={EMOJI_MART_CATEGORIES}
                 data={emojiData}
                 dynamicWidth
@@ -577,7 +604,7 @@ export function AgentCreationPreview({
                   applyEmojiAvatar(emoji.native, nextColor);
                 }}
                 previewPosition="none"
-                searchPosition="none"
+                searchPosition="sticky"
                 set="native"
                 skinTonePosition="none"
                 theme="auto"
diff --git a/desktop/src/features/agents/ui/AgentDefinitionDialog.tsx b/desktop/src/features/agents/ui/AgentDefinitionDialog.tsx
index 29cb48c6439..54251314481 100644
--- a/desktop/src/features/agents/ui/AgentDefinitionDialog.tsx
+++ b/desktop/src/features/agents/ui/AgentDefinitionDialog.tsx
@@ -8,7 +8,6 @@ import type {
   UpdatePersonaInput,
 } from "@/shared/api/types";
 import { cn } from "@/shared/lib/cn";
-import { Button } from "@/shared/ui/button";
 import { ChooserDialogContent } from "@/shared/ui/chooser-dialog-content";
 import { Dialog } from "@/shared/ui/dialog";
 import { Input } from "@/shared/ui/input";
@@ -36,6 +35,7 @@ import {
   AUTO_MODEL_DROPDOWN_VALUE,
   AUTO_PROVIDER_DROPDOWN_VALUE,
   BLOCK_BUILD_HIDDEN_PROVIDER_IDS,
+  buildPersonaRuntimeDropdownOptions,
   CUSTOM_PROVIDER_DROPDOWN_VALUE,
   computeLocalModeGate,
   formatRuntimeOptionLabel,
@@ -50,7 +50,6 @@ import {
   PERSONA_FIELD_SHELL_CLASS,
   PERSONA_LABEL_OPTIONAL_CLASS,
   shouldClearKnownModelForSelectionScope,
-  sortPersonaRuntimes,
 } from "./agentConfigOptions";
 import { RequiredFieldLabel } from "./agentConfigControls";
 import {
@@ -83,6 +82,13 @@ import {
 } from "./agentAiConfigurationPolicy";
 import { useProviderApiKeyFieldState } from "./providerApiKeyFieldState";
 import { buildRuntimeModelProviderPayload } from "./agentDefinitionSubmitPayload";
+import { AgentDefinitionDialogFooter } from "./AgentDefinitionDialogFooter";
+import { AddCustomHarnessDialog } from "./AddCustomHarnessDialog";
+import {
+  ADD_CUSTOM_HARNESS_OPTION,
+  runtimeDropdownAction,
+  usePendingHarnessSelection,
+} from "./addCustomHarness";
 
 type AgentDefinitionDialogProps = {
   open: boolean;
@@ -97,13 +103,20 @@ type AgentDefinitionDialogProps = {
   onOpenChange: (open: boolean) => void;
   onSubmit: (
     input: CreatePersonaInput | UpdatePersonaInput,
+    options: AgentDefinitionSubmitOptions,
   ) => Promise<unknown>;
+  /** Publishes saved changes when the edited agent is shared in the catalog. */
+  publishCatalogUpdatesOnSave?: boolean;
   /** Rendered below the form fields in create mode only ("Where to run"). */
   createRunSection?: React.ReactNode;
   /** Extra create-mode submit gate (e.g. incomplete provider config). */
   createSubmitBlocked?: boolean;
 };
 
+export type AgentDefinitionSubmitOptions = {
+  publishCatalogUpdates: boolean;
+};
+
 const ADVANCED_FIELDS_MOTION_TRANSITION = {
   duration: 0.18,
   ease: [0.23, 1, 0.32, 1],
@@ -121,6 +134,7 @@ export function AgentDefinitionDialog({
   runtimesLoading = false,
   onOpenChange,
   onSubmit,
+  publishCatalogUpdatesOnSave = false,
   createRunSection,
   createSubmitBlocked = false,
 }: AgentDefinitionDialogProps) {
@@ -158,6 +172,8 @@ export function AgentDefinitionDialog({
   const [showAdvancedFields, setShowAdvancedFields] = React.useState(false);
   const [isAvatarUploadPending, setIsAvatarUploadPending] =
     React.useState(false);
+  const [hasUserChanges, setHasUserChanges] = React.useState(false);
+  const [isAddHarnessOpen, setIsAddHarnessOpen] = React.useState(false);
   const {
     globalConfig,
     inheritedDefaults: {
@@ -212,6 +228,7 @@ export function AgentDefinitionDialog({
     // Advanced always starts collapsed and only changes from its toggle.
     setShowAdvancedFields(false);
     setIsAvatarUploadPending(false);
+    setHasUserChanges(false);
     isRuntimeAutoSeededRef.current = false;
     hasSeededForOpenRef.current = false;
   }, [initialValues, open]);
@@ -297,6 +314,8 @@ export function AgentDefinitionDialog({
       behaviorSeedRef.current = emptyPersonaBehaviorDraft;
       setShowAdvancedFields(false);
       setIsAvatarUploadPending(false);
+      setHasUserChanges(false);
+      setIsAddHarnessOpen(false);
       // isRuntimeAutoSeededRef and hasSeededForOpenRef are NOT reset here — the
       // [initialValues, open] effect resets both when the dialog re-opens.
     }
@@ -348,14 +367,19 @@ export function AgentDefinitionDialog({
     };
 
     if ("id" in initialValues) {
-      await onSubmit({
-        id: initialValues.id,
-        ...baseInput,
-      });
+      await onSubmit(
+        {
+          id: initialValues.id,
+          ...baseInput,
+        },
+        {
+          publishCatalogUpdates: publishCatalogUpdatesOnSave && hasUserChanges,
+        },
+      );
       return;
     }
 
-    await onSubmit(baseInput);
+    await onSubmit(baseInput, { publishCatalogUpdates: false });
   }
 
   function handleSubmitForm(event: React.FormEvent<HTMLFormElement>) {
@@ -382,6 +406,7 @@ export function AgentDefinitionDialog({
     enabled: open,
   });
   function handleAiConfigurationModeChange(nextMode: AgentAiConfigurationMode) {
+    setHasUserChanges(true);
     setAiConfigurationMode(nextMode);
     setIsCustomProviderEditing(false);
     setIsCustomModelEditing(false);
@@ -553,44 +578,15 @@ export function AgentDefinitionDialog({
   const showCustomProviderInput =
     llmProviderFieldVisible && isCustomProviderEditing;
   const runtimeDropdownValue = runtime.trim() || NO_RUNTIME_DROPDOWN_VALUE;
-  const sortedRuntimes = React.useMemo(
-    () => sortPersonaRuntimes(runtimes),
-    [runtimes],
-  );
-  const blankRuntimeOptionLabel = runtimesLoading
-    ? "Loading harnesses..."
-    : isCreateMode
-      ? "Choose a harness"
-      : "No preference (use app default)";
-  const runtimeDropdownOptions: PersonaDropdownOption[] = [
-    ...(!isCreateMode
-      ? [
-          {
-            label: blankRuntimeOptionLabel,
-            value: NO_RUNTIME_DROPDOWN_VALUE,
-          },
-        ]
-      : []),
-    ...sortedRuntimes.map((candidate) => ({
-      disabled:
-        isCreateMode &&
-        defaultRuntime !== null &&
-        candidate.availability !== "available",
-      label: `${formatRuntimeOptionLabel(candidate)}${
-        isCreateMode && candidate.id === defaultRuntime?.id ? " (default)" : ""
-      }`,
-      value: candidate.id,
-    })),
-  ];
-  if (
-    runtime.trim().length > 0 &&
-    !runtimeDropdownOptions.some((option) => option.value === runtime)
-  ) {
-    runtimeDropdownOptions.push({
-      label: `${runtime.trim()} (current)`,
-      value: runtime.trim(),
+  const { blankRuntimeOptionLabel, runtimeDropdownOptions } =
+    buildPersonaRuntimeDropdownOptions({
+      defaultRuntimeId: defaultRuntime?.id,
+      isCreateMode,
+      runtime,
+      runtimes,
+      runtimesLoading,
     });
-  }
+  runtimeDropdownOptions.push(ADD_CUSTOM_HARNESS_OPTION);
   const runtimeSummaryLabel = selectedRuntime
     ? formatRuntimeOptionLabel(selectedRuntime)
     : runtime.trim() || "Not configured";
@@ -675,8 +671,13 @@ export function AgentDefinitionDialog({
   }
 
   function handleRuntimeDropdownChange(nextValue: string) {
-    const nextRuntime =
-      nextValue === NO_RUNTIME_DROPDOWN_VALUE ? "" : nextValue;
+    const action = runtimeDropdownAction(nextValue);
+    if (action.kind === "add-custom-harness") {
+      setIsAddHarnessOpen(true);
+      return;
+    }
+    setHasUserChanges(true);
+    const nextRuntime = action.runtimeId;
     // The user made an explicit choice — no longer auto-seeded.
     isRuntimeAutoSeededRef.current = false;
     setRuntime(nextRuntime);
@@ -692,7 +693,17 @@ export function AgentDefinitionDialog({
     );
   }
 
+  // Routed through the normal change handler so a harness registered inline
+  // resets model/provider exactly as a hand-picked one would. Scoped to `open`
+  // so a pending id can't outlive the dialog that started the registration.
+  const selectSavedHarness = usePendingHarnessSelection(
+    runtimes,
+    handleRuntimeDropdownChange,
+    open,
+  );
+
   function handleProviderDropdownChange(nextValue: string) {
+    setHasUserChanges(true);
     const nextProvider =
       nextValue === AUTO_PROVIDER_DROPDOWN_VALUE ? "" : nextValue;
     if (nextProvider === "relay-mesh" && runtime !== "buzz-agent") {
@@ -710,6 +721,7 @@ export function AgentDefinitionDialog({
   }
 
   function handleModelDropdownChange(nextValue: string) {
+    setHasUserChanges(true);
     applySelection(
       selectionOnModelDropdownChange(selection, {
         nextValue,
@@ -736,42 +748,38 @@ export function AgentDefinitionDialog({
         headerClassName="pb-2"
         title={title}
         footer={
-          <div className="flex w-full items-center justify-end gap-2">
-            <Button
-              disabled={isPending || isAvatarUploadPending}
-              onClick={() => handleOpenChange(false)}
-              type="button"
-              variant="outline"
-            >
-              Cancel
-            </Button>
-            <Button
-              data-testid="persona-dialog-submit"
-              disabled={!canSubmit}
-              form="persona-dialog-form"
-              type="submit"
-            >
-              {isPending
-                ? "Saving..."
-                : isAvatarUploadPending
-                  ? "Uploading..."
-                  : submitLabel}
-            </Button>
-          </div>
+          <AgentDefinitionDialogFooter
+            canSubmit={canSubmit}
+            isAvatarUploadPending={isAvatarUploadPending}
+            isPending={isPending}
+            onCancel={() => handleOpenChange(false)}
+            publishesCatalogUpdates={
+              publishCatalogUpdatesOnSave && hasUserChanges
+            }
+            submitBlockReason={null}
+            submitLabel={submitLabel}
+          />
         }
       >
         <form
           className="grid gap-5 lg:grid-cols-[220px_minmax(0,1fr)]"
           id="persona-dialog-form"
+          onChangeCapture={() => setHasUserChanges(true)}
           onSubmit={handleSubmitForm}
         >
           <AgentCreationPreview
             avatarUrl={previewAvatarUrl}
             disabled={isPending || isAvatarUploadPending}
             label={previewLabel}
-            onClearAvatar={() => setAvatarUrl("")}
+            onClearAvatar={() => {
+              setHasUserChanges(true);
+              setAvatarUrl("");
+            }}
             onUploadPendingChange={setIsAvatarUploadPending}
-            onSelectAvatar={setAvatarUrl}
+            onSelectAvatar={(nextAvatarUrl) => {
+              setHasUserChanges(true);
+              setAvatarUrl(nextAvatarUrl);
+            }}
           />
 
           <div className="space-y-5">
@@ -958,6 +966,12 @@ export function AgentDefinitionDialog({
               returnFocusRef={aiDefaultsTriggerRef}
             />
 
+            <AddCustomHarnessDialog
+              onOpenChange={setIsAddHarnessOpen}
+              onSaved={selectSavedHarness}
+              open={isAddHarnessOpen}
+            />
+
             {isCreateMode ? createRunSection : null}
 
             <div className="space-y-3">
@@ -1008,7 +1022,10 @@ export function AgentDefinitionDialog({
                       model={model}
                       modelTuningRuntimeId={runtime}
                       namePoolText={namePoolText}
-                      onBehaviorDraftChange={setBehaviorDraft}
+                      onBehaviorDraftChange={(nextBehaviorDraft) => {
+                        setHasUserChanges(true);
+                        setBehaviorDraft(nextBehaviorDraft);
+                      }}
                       onEnvVarsChange={setEnvVars}
                       onNamePoolTextChange={setNamePoolText}
                       provider={effectiveProvider}
diff --git a/desktop/src/features/agents/ui/AgentDefinitionDialogFooter.tsx b/desktop/src/features/agents/ui/AgentDefinitionDialogFooter.tsx
new file mode 100644
index 00000000000..92428ad95cb
--- /dev/null
+++ b/desktop/src/features/agents/ui/AgentDefinitionDialogFooter.tsx
@@ -0,0 +1,70 @@
+import { Button } from "@/shared/ui/button";
+
+type AgentDefinitionDialogFooterProps = {
+  canSubmit: boolean;
+  isAvatarUploadPending: boolean;
+  isPending: boolean;
+  onCancel: () => void;
+  publishesCatalogUpdates: boolean;
+  submitBlockReason: string | null;
+  submitLabel: string;
+};
+
+export function AgentDefinitionDialogFooter({
+  canSubmit,
+  isAvatarUploadPending,
+  isPending,
+  onCancel,
+  publishesCatalogUpdates,
+  submitBlockReason,
+  submitLabel,
+}: AgentDefinitionDialogFooterProps) {
+  return (
+    <div className="flex w-full flex-wrap items-center justify-between gap-3">
+      <div className="flex min-h-9 min-w-0 flex-wrap items-center gap-3">
+        {submitBlockReason ? (
+          <p
+            className="text-2xs text-muted-foreground"
+            data-testid="persona-dialog-submit-reason"
+          >
+            {submitBlockReason}
+          </p>
+        ) : null}
+        {publishesCatalogUpdates ? (
+          <p
+            className="max-w-sm text-xs text-muted-foreground"
+            data-testid="persona-dialog-catalog-publish-notice"
+          >
+            This agent is in the community catalog. Your changes will be
+            published when you save.
+          </p>
+        ) : null}
+      </div>
+
+      <div className="flex items-center gap-2">
+        <Button
+          disabled={isPending || isAvatarUploadPending}
+          onClick={onCancel}
+          type="button"
+          variant="outline"
+        >
+          Cancel
+        </Button>
+        <Button
+          data-testid="persona-dialog-submit"
+          disabled={!canSubmit}
+          form="persona-dialog-form"
+          type="submit"
+        >
+          {isPending
+            ? "Saving..."
+            : isAvatarUploadPending
+              ? "Uploading..."
+              : publishesCatalogUpdates
+                ? "Save and publish"
+                : submitLabel}
+        </Button>
+      </div>
+    </div>
+  );
+}
diff --git a/desktop/src/features/agents/ui/AgentDefinitionMetadata.tsx b/desktop/src/features/agents/ui/AgentDefinitionMetadata.tsx
new file mode 100644
index 00000000000..50109143cdc
--- /dev/null
+++ b/desktop/src/features/agents/ui/AgentDefinitionMetadata.tsx
@@ -0,0 +1,55 @@
+import { cn } from "@/shared/lib/cn";
+
+export function AgentDefinitionMetadata({
+  className,
+  isBuiltIn,
+  model,
+  runtime,
+}: {
+  className?: string;
+  isBuiltIn: boolean;
+  model: string | null;
+  runtime: string | null;
+}) {
+  const items = [
+    {
+      label: "Type",
+      value: isBuiltIn ? "Built-in agent" : "Custom agent",
+    },
+    {
+      label: "Preferred model",
+      value: model ?? "Use app default",
+    },
+    {
+      label: "Preferred runtime",
+      value: runtime ?? "Use app default",
+    },
+  ];
+
+  return (
+    <div
+      className={cn("rounded-lg border border-border/70 bg-card/70", className)}
+      data-testid="agent-definition-metadata"
+    >
+      <div className="grid sm:grid-cols-3">
+        {items.map((item, index) => (
+          <div
+            className={cn(
+              "relative px-4 py-3",
+              index > 0 &&
+                "border-t border-border/60 sm:border-t-0 sm:before:absolute sm:before:bottom-3 sm:before:left-0 sm:before:top-3 sm:before:w-px sm:before:bg-border/70",
+            )}
+            key={item.label}
+          >
+            <p className="text-xs font-semibold text-muted-foreground">
+              {item.label}
+            </p>
+            <p className="mt-2 text-sm font-medium text-foreground">
+              {item.value}
+            </p>
+          </div>
+        ))}
+      </div>
+    </div>
+  );
+}
diff --git a/desktop/src/features/agents/ui/AgentDialog.tsx b/desktop/src/features/agents/ui/AgentDialog.tsx
index 02a6d0e64aa..f5be3cc7e87 100644
--- a/desktop/src/features/agents/ui/AgentDialog.tsx
+++ b/desktop/src/features/agents/ui/AgentDialog.tsx
@@ -11,7 +11,10 @@ import type { AgentCreateIntent } from "./agentCreateIntent";
 import type { EditAgentFocusTarget } from "@/features/agents/openEditAgentEvent";
 import { AgentInstanceEditDialog } from "./AgentInstanceEditDialog";
 import { createPersonaDialogState } from "./personaDialogState";
-import { AgentDefinitionDialog } from "./AgentDefinitionDialog";
+import {
+  AgentDefinitionDialog,
+  type AgentDefinitionSubmitOptions,
+} from "./AgentDefinitionDialog";
 import { WhereToRunSection } from "./WhereToRunSection";
 import {
   canSubmitWhereToRun,
@@ -64,7 +67,9 @@ type AgentDialogDefinitionEditProps = {
   onOpenChange: (open: boolean) => void;
   onSubmit: (
     input: CreatePersonaInput | UpdatePersonaInput,
+    options: AgentDefinitionSubmitOptions,
   ) => Promise<unknown>;
+  publishCatalogUpdatesOnSave?: boolean;
 };
 
 type AgentDialogProps =
diff --git a/desktop/src/features/agents/ui/AgentInstanceEditDialog.tsx b/desktop/src/features/agents/ui/AgentInstanceEditDialog.tsx
index 601d57f95d5..f3c410e2ff2 100644
--- a/desktop/src/features/agents/ui/AgentInstanceEditDialog.tsx
+++ b/desktop/src/features/agents/ui/AgentInstanceEditDialog.tsx
@@ -83,6 +83,12 @@ import { useProviderApiKeyFieldState } from "./providerApiKeyFieldState";
 import { resolveModelFieldStatusMessage } from "./agentConfigControls";
 import { AdvancedRequiredBadge } from "./AdvancedRequiredBadge";
 import { showAgentProfileSyncWarning } from "./agentProfileSyncWarning";
+import { AddCustomHarnessDialog } from "./AddCustomHarnessDialog";
+import {
+  ADD_CUSTOM_HARNESS_OPTION,
+  runtimeDropdownAction,
+  usePendingHarnessSelection,
+} from "./addCustomHarness";
 
 const ADVANCED_FIELDS_MOTION_TRANSITION = {
   duration: 0.18,
@@ -157,6 +163,7 @@ export function AgentInstanceEditDialog({
   const [avatarUrl, setAvatarUrl] = React.useState(agent.avatarUrl ?? "");
   const [isAvatarUploadPending, setIsAvatarUploadPending] =
     React.useState(false);
+  const [isAddHarnessOpen, setIsAddHarnessOpen] = React.useState(false);
   const shouldReduceMotion = useReducedMotion();
 
   // Runtime selector: defaults to "custom" until the dialog opens and the
@@ -191,6 +198,7 @@ export function AgentInstanceEditDialog({
       setAvatarUrl(agent.avatarUrl ?? "");
       setShowAdvancedFields(false);
       setIsAvatarUploadPending(false);
+      setIsAddHarnessOpen(false);
       runtimeTouched.current = false;
       const matched =
         runtimes.find((r) => r.command?.trim() === agent.agentCommand.trim()) ??
@@ -244,6 +252,7 @@ export function AgentInstanceEditDialog({
         value: selectedRuntimeId,
       });
     }
+    options.push(ADD_CUSTOM_HARNESS_OPTION);
     return options;
   }, [sortedRuntimes, selectedRuntimeId]);
 
@@ -484,8 +493,12 @@ export function AgentInstanceEditDialog({
   }
 
   function handleRuntimeDropdownChange(nextValue: string) {
-    const nextRuntimeId =
-      nextValue === NO_RUNTIME_DROPDOWN_VALUE ? "" : nextValue;
+    const action = runtimeDropdownAction(nextValue);
+    if (action.kind === "add-custom-harness") {
+      setIsAddHarnessOpen(true);
+      return;
+    }
+    const nextRuntimeId = action.runtimeId;
     const previousRuntimeId = selectedRuntimeId;
     const nextRuntime = runtimes.find((r) => r.id === nextRuntimeId);
 
@@ -532,6 +545,16 @@ export function AgentInstanceEditDialog({
     );
   }
 
+  // Routed through the normal change handler so a harness registered inline
+  // pins its command and resets model/provider like a hand-picked one. Scoped
+  // to `open` so a pending id can't outlive the dialog that started the
+  // registration.
+  const selectSavedHarness = usePendingHarnessSelection(
+    runtimes,
+    handleRuntimeDropdownChange,
+    open,
+  );
+
   function handleProviderDropdownChange(nextValue: string) {
     const nextProvider =
       nextValue === AUTO_PROVIDER_DROPDOWN_VALUE ? "" : nextValue;
@@ -949,6 +972,11 @@ export function AgentInstanceEditDialog({
                   </span>
                 </p>
               ) : null}
+              <AddCustomHarnessDialog
+                onOpenChange={setIsAddHarnessOpen}
+                onSaved={selectSavedHarness}
+                open={isAddHarnessOpen}
+              />
             </div>
             {selectedRuntimeId === "custom" && !inheritHarness ? (
               <div className="space-y-1.5">
diff --git a/desktop/src/features/agents/ui/AgentSnapshotImportDialog.tsx b/desktop/src/features/agents/ui/AgentSnapshotImportDialog.tsx
index ad1219310d7..4a9584dfb9a 100644
--- a/desktop/src/features/agents/ui/AgentSnapshotImportDialog.tsx
+++ b/desktop/src/features/agents/ui/AgentSnapshotImportDialog.tsx
@@ -15,6 +15,8 @@ import {
 } from "@/shared/ui/dialog";
 import { Separator } from "@/shared/ui/separator";
 
+import { AgentDefinitionMetadata } from "./AgentDefinitionMetadata";
+
 // ── Types ─────────────────────────────────────────────────────────────────────
 
 type ImportPhase = "preview" | "confirming" | "result";
@@ -164,6 +166,12 @@ function PreviewBody({
         ) : null}
       </div>
 
+      <AgentDefinitionMetadata
+        isBuiltIn={preview.isBuiltIn}
+        model={preview.model}
+        runtime={preview.runtime}
+      />
+
       <p className="text-sm text-muted-foreground">
         A new agent will be created with a fresh keypair. The imported agent is
         independent of the source — identity never travels.
diff --git a/desktop/src/features/agents/ui/AgentsView.tsx b/desktop/src/features/agents/ui/AgentsView.tsx
index 8e1c47c6157..f24a3c06d7f 100644
--- a/desktop/src/features/agents/ui/AgentsView.tsx
+++ b/desktop/src/features/agents/ui/AgentsView.tsx
@@ -1,5 +1,5 @@
 import * as React from "react";
-import { OctagonX } from "lucide-react";
+import { OctagonX, Settings2 } from "lucide-react";
 import {
   consumePendingSnapshotImport,
   subscribeSnapshotImport,
@@ -20,7 +20,10 @@ import { SecretRevealDialog } from "./SecretRevealDialog";
 import { TeamDeleteDialog } from "./TeamDeleteDialog";
 import { TeamDialog } from "./TeamDialog";
 import { TeamsSection } from "./TeamsSection";
-import { UnifiedAgentsSection } from "./UnifiedAgentsSection";
+import {
+  AGENT_CARD_GRID_COLUMNS_CLASS,
+  UnifiedAgentsSection,
+} from "./UnifiedAgentsSection";
 import { useManagedAgentActions } from "./useManagedAgentActions";
 import { usePersonaActions } from "./usePersonaActions";
 import { useTeamActions } from "./useTeamActions";
@@ -70,11 +73,14 @@ export function AgentsView() {
   const runningAgentCount = agents.managedAgents.filter((agent) =>
     isManagedAgentActive(agent),
   ).length;
-  // Show the resolved effective model, not just the structured `model` field:
-  // most providers persist the model as a provider env var (e.g. DATABRICKS_MODEL)
-  // or inherit a baked build default, leaving `globalConfig.model` null.
-  const configuredGlobalModel = inheritedDefaults.model.value;
-
+  const hasSavedAgentDefaults = Boolean(
+    globalConfig.preferred_runtime?.trim() ||
+      globalConfig.provider?.trim() ||
+      globalConfig.model?.trim() ||
+      Object.values(globalConfig.env_vars).some(
+        (value) => value.trim().length > 0,
+      ),
+  );
   // biome-ignore lint/correctness/useExhaustiveDependencies: mount-only; personas.handleImportSnapshotFile and teamActions.handleImportTeamSnapshotFile are stable
   React.useEffect(() => {
     // Consume a snapshot import that was enqueued before navigation (e.g. from
@@ -106,18 +112,23 @@ export function AgentsView() {
   return (
     <>
       <div className="flex-1 overflow-y-auto overflow-x-hidden overscroll-contain px-4 py-7 sm:px-6 sm:py-8">
-        <div className="mx-auto flex w-full max-w-6xl flex-col gap-8">
+        <div
+          className={`mx-auto grid w-full max-w-6xl ${AGENT_CARD_GRID_COLUMNS_CLASS} justify-start gap-x-3 gap-y-8`}
+        >
           <PageHeader
+            className="col-[1/-1]"
             action={
               <div className="flex flex-wrap justify-end gap-2">
                 <Button
-                  onClick={() => setIsAiDefaultsOpen(true)}
+                  data-testid="agent-defaults-button"
                   ref={aiDefaultsTriggerRef}
+                  onClick={() => setIsAiDefaultsOpen(true)}
                   size="sm"
                   variant="outline"
                 >
-                  {configuredGlobalModel
-                    ? `Default model: ${configuredGlobalModel}`
+                  <Settings2 />
+                  {hasSavedAgentDefaults
+                    ? "Agent defaults"
                     : "Set agent defaults"}
                 </Button>
                 {runningAgentCount > 0 ? (
@@ -135,11 +146,10 @@ export function AgentsView() {
                 ) : null}
               </div>
             }
-            className="mx-auto w-full max-w-[996px]"
             description="Set up and manage your agents."
             title="Agents"
           />
-          <div className="flex flex-col gap-8">
+          <div className="col-[1/-1] flex flex-col gap-8">
             <UnifiedAgentsSection
               defaultModel={inheritedDefaults.model.value}
               actionErrorMessage={agents.actionErrorMessage}
@@ -167,7 +177,6 @@ export function AgentsView() {
                 void agents.handleStartPersona(persona);
               }}
               // Persona props
-              canChooseCatalog={personas.catalogPersonas.length > 0}
               personas={personas.libraryPersonas}
               personasError={
                 personas.personasQuery.error instanceof Error
@@ -186,10 +195,8 @@ export function AgentsView() {
               }
               isPersonasLoading={personas.personasQuery.isLoading}
               isPersonasPending={personas.isPending}
-              onCreatePersona={() => {
-                openUnifiedCreate();
-              }}
-              onChooseCatalog={personas.openCatalog}
+              onCreatePersona={openUnifiedCreate}
+              onDiscoverPersonas={personas.openCatalog}
               onDuplicatePersona={personas.openDuplicate}
               onEditPersona={personas.openEdit}
               onSharePersona={personas.openShare}
@@ -289,9 +296,11 @@ export function AgentsView() {
           error={
             personas.updatePersonaMutation.error instanceof Error
               ? personas.updatePersonaMutation.error
-              : personas.createPersonaMutation.error instanceof Error
-                ? personas.createPersonaMutation.error
-                : null
+              : personas.updatePersonaAndPublishMutation.error instanceof Error
+                ? personas.updatePersonaAndPublishMutation.error
+                : personas.createPersonaMutation.error instanceof Error
+                  ? personas.createPersonaMutation.error
+                  : null
           }
           initialValues={personas.personaDialogState.initialValues}
           isPending={personas.isPending}
@@ -303,8 +312,22 @@ export function AgentsView() {
               personas.setPersonaDialogState(null);
             }
           }}
-          onSubmit={personas.handleSubmit}
+          onSubmit={(input, options) =>
+            personas.handleSubmit(
+              input,
+              undefined,
+              undefined,
+              undefined,
+              options,
+            )
+          }
           open={personas.personaDialogState !== null}
+          publishCatalogUpdatesOnSave={
+            "id" in personas.personaDialogState.initialValues &&
+            personas.sharedCatalogPersonaIdSet.has(
+              personas.personaDialogState.initialValues.id,
+            )
+          }
           submitLabel={personas.personaDialogState.submitLabel}
           title={personas.personaDialogState.title}
         />
@@ -330,8 +353,20 @@ export function AgentsView() {
       ) : null}
       {personas.personaToShare ? (
         <PersonaShareDialog
+          catalogShareLevel={personas.getPersonaCatalogShareLevel(
+            personas.personaToShare.persona,
+          )}
           isPending={personas.isPending}
           linkedAgentPubkey={personas.personaToShare.linkedAgentPubkey}
+          effectiveAvatarUrl={personas.personaToShare.effectiveAvatarUrl}
+          onCatalogShareLevelChange={(shareLevel) => {
+            const shareTarget = personas.personaToShare;
+            if (!shareTarget) return;
+            void personas.setPersonaCatalogShareLevel(
+              shareTarget.persona,
+              shareLevel,
+            );
+          }}
           onExport={() => {
             const shareTarget = personas.personaToShare;
             if (!shareTarget) return;
@@ -358,6 +393,7 @@ export function AgentsView() {
               personas.handleExportSnapshot(
                 personas.personaToExportSnapshot.persona,
                 personas.personaToExportSnapshot.linkedAgentPubkey,
+                personas.personaToExportSnapshot.effectiveAvatarUrl,
                 memoryLevel,
                 format,
               );
@@ -390,8 +426,8 @@ export function AgentsView() {
       {personas.isCatalogDialogOpen ? (
         <PersonaCatalogDialog
           error={
-            personas.personasQuery.error instanceof Error
-              ? personas.personasQuery.error
+            personas.catalogQuery.error instanceof Error
+              ? personas.catalogQuery.error
               : null
           }
           feedbackErrorMessage={
@@ -404,8 +440,8 @@ export function AgentsView() {
               ? personas.personaNoticeMessage
               : null
           }
-          isLoading={personas.personasQuery.isLoading}
-          isPending={personas.setPersonaActiveMutation.isPending}
+          isLoading={personas.catalogQuery.isLoading}
+          isPending={personas.isPending}
           onClearFeedback={() => {
             personas.clearFeedback("catalog");
           }}
diff --git a/desktop/src/features/agents/ui/CreateIdentityCard.tsx b/desktop/src/features/agents/ui/CreateIdentityCard.tsx
index 70d063098b7..4fdd6db26f3 100644
--- a/desktop/src/features/agents/ui/CreateIdentityCard.tsx
+++ b/desktop/src/features/agents/ui/CreateIdentityCard.tsx
@@ -6,7 +6,7 @@ import { cn } from "@/shared/lib/cn";
 type CreateIdentityCardProps = React.ButtonHTMLAttributes<HTMLButtonElement> & {
   ariaLabel: string;
   dataTestId: string;
-  label: string;
+  label?: string;
 };
 
 export const CreateIdentityCard = React.forwardRef<
@@ -30,7 +30,9 @@ export const CreateIdentityCard = React.forwardRef<
     >
       <span className="flex flex-col items-center justify-center gap-2 text-center">
         <Plus className="h-7 w-7 transition-colors" />
-        <span className="text-sm font-medium leading-5">{label}</span>
+        {label ? (
+          <span className="text-sm font-medium leading-5">{label}</span>
+        ) : null}
       </span>
     </button>
   );
diff --git a/desktop/src/features/agents/ui/PersonaAddedBy.tsx b/desktop/src/features/agents/ui/PersonaAddedBy.tsx
index 66e5ee31f9e..3cdec291046 100644
--- a/desktop/src/features/agents/ui/PersonaAddedBy.tsx
+++ b/desktop/src/features/agents/ui/PersonaAddedBy.tsx
@@ -2,13 +2,17 @@ import { cn } from "@/shared/lib/cn";
 
 type PersonaAddedByProps = {
   className?: string;
+  label?: string;
 };
 
-export function PersonaAddedBy({ className }: PersonaAddedByProps) {
+export function PersonaAddedBy({
+  className,
+  label = "You",
+}: PersonaAddedByProps) {
   return (
     <p className={cn("truncate text-xs leading-tight", className)}>
       <span className="text-muted-foreground/55">Added by</span>{" "}
-      <span className="text-muted-foreground">You</span>
+      <span className="text-muted-foreground">{label}</span>
     </p>
   );
 }
diff --git a/desktop/src/features/agents/ui/PersonaCatalogDialog.tsx b/desktop/src/features/agents/ui/PersonaCatalogDialog.tsx
index 0d6b5583ff8..ba76d6e4edb 100644
--- a/desktop/src/features/agents/ui/PersonaCatalogDialog.tsx
+++ b/desktop/src/features/agents/ui/PersonaCatalogDialog.tsx
@@ -1,6 +1,7 @@
 import * as React from "react";
 
 import { isCatalogPersonaSelected } from "@/features/agents/lib/catalog";
+import { isCatalogPersona } from "@/features/agents/lib/personaCatalogRelay";
 import { ProfileAvatar } from "@/features/profile/ui/ProfileAvatar";
 import type { AgentPersona } from "@/shared/api/types";
 import { useFeedbackToasts } from "@/shared/hooks/useToastEffect";
@@ -11,6 +12,8 @@ import { ChooserDialogContent } from "@/shared/ui/chooser-dialog-content";
 import { Markdown } from "@/shared/ui/markdown";
 import { Skeleton } from "@/shared/ui/skeleton";
 
+import agentOutlineUrl from "../assets/agent-outline.svg";
+import { AgentDefinitionMetadata } from "./AgentDefinitionMetadata";
 import { PersonaAddedBy } from "./PersonaAddedBy";
 import { personaCatalogCopy } from "./personaLibraryCopy";
 
@@ -28,7 +31,7 @@ type PersonaCatalogDialogProps = {
 };
 
 const agentInstructionMarkdownClassName = [
-  "mt-3 leading-6 text-muted-foreground [&_blockquote]:!text-muted-foreground [&_code]:!text-muted-foreground [&_li]:text-muted-foreground [&_ol]:text-muted-foreground [&_p]:text-muted-foreground [&_strong]:text-muted-foreground [&_td]:text-muted-foreground [&_ul]:text-muted-foreground",
+  "mt-3 w-full min-w-0 max-w-full overflow-x-hidden leading-6 text-muted-foreground [&>*]:min-w-0 [&>*]:max-w-full [&_.code-block-lines]:min-w-0 [&_.code-block-lines]:max-w-full [&_.code-block-lines]:whitespace-pre-wrap [&_.code-block-lines]:[overflow-wrap:anywhere] [&_.inline-code-chip]:max-w-full [&_.inline-code-chip]:whitespace-pre-wrap [&_.inline-code-chip]:[overflow-wrap:anywhere] [&_blockquote]:!text-muted-foreground [&_code]:!text-muted-foreground [&_li]:text-muted-foreground [&_ol]:text-muted-foreground [&_p]:text-muted-foreground [&_strong]:text-muted-foreground [&_td]:text-muted-foreground [&_ul]:text-muted-foreground",
   "[&>h1]:!text-sm [&>h1]:!font-semibold [&>h1]:!leading-6 [&>h1]:!tracking-normal [&>h1]:!text-foreground",
   "[&>h2]:!text-sm [&>h2]:!font-semibold [&>h2]:!leading-6 [&>h2]:!tracking-normal [&>h2]:!text-foreground",
   "[&>h3]:!text-sm [&>h3]:!font-semibold [&>h3]:!leading-6 [&>h3]:!tracking-normal [&>h3]:!text-foreground",
@@ -100,7 +103,7 @@ export function PersonaCatalogDialog({
     <Dialog onOpenChange={onOpenChange} open={open}>
       <ChooserDialogContent
         className="h-[42rem] max-w-4xl"
-        contentClassName="flex min-h-0 flex-1 p-0"
+        contentClassName="flex min-h-0 min-w-0 flex-1 p-0"
         data-testid="persona-catalog-dialog"
         description={personaCatalogCopy.dialogDescription}
         headerClassName="bg-sidebar pb-3 text-sidebar-foreground"
@@ -154,6 +157,31 @@ function PersonaCatalogChooser({
   selectedPersona,
   selectedPersonaId,
 }: PersonaCatalogChooserProps) {
+  if (!isLoading && personas.length === 0 && !error) {
+    return (
+      <div
+        className="flex min-h-0 flex-1 items-center justify-center bg-sidebar px-6 py-10 text-center"
+        data-testid="persona-catalog-empty-state"
+      >
+        <div className="flex max-w-sm flex-col items-center">
+          <img
+            alt=""
+            aria-hidden="true"
+            className="h-32 w-32 dark:opacity-60"
+            data-testid="persona-catalog-empty-agent-artwork"
+            src={agentOutlineUrl}
+          />
+          <p className="mt-4 text-sm font-semibold">
+            {personaCatalogCopy.emptyCatalogTitle}
+          </p>
+          <p className="mt-2 text-sm text-muted-foreground">
+            {personaCatalogCopy.emptyCatalogDescription}
+          </p>
+        </div>
+      </div>
+    );
+  }
+
   return (
     <div className="flex min-h-0 flex-1 flex-col overflow-hidden bg-sidebar sm:flex-row">
       <div className="flex max-h-56 min-h-0 flex-col sm:max-h-none sm:w-56">
@@ -200,9 +228,9 @@ function PersonaCatalogChooser({
         </div>
       </div>
 
-      <div className="relative z-10 ml-px flex min-h-0 flex-1 flex-col overflow-hidden rounded-tl-xl bg-background shadow-[-1px_0_0_0_hsl(var(--sidebar-border)/0.45)]">
+      <div className="relative z-10 mb-3 ml-px mr-3 flex min-h-0 min-w-0 flex-1 flex-col overflow-hidden rounded-xl bg-background shadow-[-1px_0_0_0_hsl(var(--sidebar-border)/0.45)]">
         <div
-          className="min-h-0 flex-1 overflow-y-auto px-5 pb-24 pt-5"
+          className="min-h-0 min-w-0 max-w-full flex-1 overflow-x-hidden overflow-y-auto px-5 pb-24 pt-5"
           data-testid="persona-catalog-detail-pane"
         >
           {isLoading ? <PersonaCatalogDetailSkeleton /> : null}
@@ -211,19 +239,6 @@ function PersonaCatalogChooser({
             <PersonaCatalogDetail persona={selectedPersona} />
           ) : null}
 
-          {!isLoading && personas.length === 0 && !error ? (
-            <div className="flex min-h-80 items-center justify-center rounded-lg border border-dashed border-border/70 px-6 text-center">
-              <div>
-                <p className="text-sm font-semibold">
-                  {personaCatalogCopy.emptyCatalogTitle}
-                </p>
-                <p className="mt-2 max-w-sm text-sm text-muted-foreground">
-                  {personaCatalogCopy.emptyCatalogDescription}
-                </p>
-              </div>
-            </div>
-          ) : null}
-
           {error ? (
             <p className="rounded-lg border border-destructive/30 bg-destructive/10 px-4 py-3 text-sm text-destructive">
               {error.message}
@@ -263,7 +278,7 @@ function PersonaCatalogChooser({
 
 function PersonaCatalogDetail({ persona }: { persona: AgentPersona }) {
   return (
-    <div className="space-y-6">
+    <div className="w-full min-w-0 max-w-full space-y-6 overflow-x-hidden">
       <div className="flex items-center gap-3">
         <ProfileAvatar
           avatarUrl={persona.avatarUrl}
@@ -274,28 +289,26 @@ function PersonaCatalogDetail({ persona }: { persona: AgentPersona }) {
           <h3 className="truncate text-xl font-semibold leading-snug">
             {persona.displayName}
           </h3>
-          {persona.isBuiltIn ? null : <PersonaAddedBy className="mt-0.5" />}
+          {persona.isBuiltIn ? null : (
+            <PersonaAddedBy
+              className="mt-0.5"
+              label={
+                isCatalogPersona(persona) && !persona.catalogSource.isOwn
+                  ? "Community member"
+                  : "You"
+              }
+            />
+          )}
         </div>
       </div>
 
-      <PersonaCatalogMetaGroup
-        items={[
-          {
-            label: "Type",
-            value: persona.isBuiltIn ? "Built-in agent" : "Custom agent",
-          },
-          {
-            label: "Preferred model",
-            value: persona.model ?? "Use app default",
-          },
-          {
-            label: "Preferred runtime",
-            value: persona.runtime ?? "Use app default",
-          },
-        ]}
+      <AgentDefinitionMetadata
+        isBuiltIn={persona.isBuiltIn}
+        model={persona.model}
+        runtime={persona.runtime}
       />
 
-      <div className="pt-3">
+      <div className="min-w-0 max-w-full pt-3">
         <p className="text-base font-semibold text-foreground">
           Agent instruction
         </p>
@@ -309,36 +322,6 @@ function PersonaCatalogDetail({ persona }: { persona: AgentPersona }) {
   );
 }
 
-function PersonaCatalogMetaGroup({
-  items,
-}: {
-  items: { label: string; value: string }[];
-}) {
-  return (
-    <div className="rounded-lg border border-border/70 bg-card/70">
-      <div className="grid sm:grid-cols-3">
-        {items.map((item, index) => (
-          <div
-            className={cn(
-              "relative px-4 py-3",
-              index > 0 &&
-                "border-t border-border/60 sm:border-t-0 sm:before:absolute sm:before:bottom-3 sm:before:left-0 sm:before:top-3 sm:before:w-px sm:before:bg-border/70",
-            )}
-            key={item.label}
-          >
-            <p className="text-xs font-semibold text-muted-foreground">
-              {item.label}
-            </p>
-            <p className="mt-2 text-sm font-medium text-foreground">
-              {item.value}
-            </p>
-          </div>
-        ))}
-      </div>
-    </div>
-  );
-}
-
 function PersonaCatalogListSkeleton() {
   return (
     <div className="space-y-2">
diff --git a/desktop/src/features/agents/ui/PersonaShareDialog.tsx b/desktop/src/features/agents/ui/PersonaShareDialog.tsx
index b6d3fafd3ce..c641de9c709 100644
--- a/desktop/src/features/agents/ui/PersonaShareDialog.tsx
+++ b/desktop/src/features/agents/ui/PersonaShareDialog.tsx
@@ -1,6 +1,7 @@
 import * as React from "react";
 import {
   AlertCircle,
+  BookUser,
   Check,
   ChevronRight,
   Download,
@@ -11,6 +12,7 @@ import { AnimatePresence, motion, useReducedMotion } from "motion/react";
 import { toast } from "sonner";
 
 import { useEncodeAgentSnapshotForSendMutation } from "@/features/agents/hooks";
+import type { CatalogPersonaShareLevel } from "@/features/agents/lib/personaCatalogRelay";
 import {
   useOpenDmMutation,
   useUpsertCachedChannel,
@@ -20,7 +22,6 @@ import { uploadMediaBytes, type BlobDescriptor } from "@/shared/api/tauri";
 import { copyTextToSystemClipboard } from "@/shared/api/tauriMedia";
 import type { SnapshotMemoryLevel } from "@/shared/api/tauriPersonas";
 import type { AgentPersona, UserSearchResult } from "@/shared/api/types";
-import { cn } from "@/shared/lib/cn";
 import {
   AlertDialog,
   AlertDialogAction,
@@ -39,7 +40,6 @@ import {
   DialogHeader,
   DialogTitle,
 } from "@/shared/ui/dialog";
-import { Separator } from "@/shared/ui/separator";
 import { Spinner } from "@/shared/ui/spinner";
 
 import {
@@ -51,8 +51,11 @@ import { resolveSnapshotAvatarPng } from "./snapshotAvatarPng";
 import { useSnapshotSendController } from "./useSnapshotSendController";
 
 type PersonaShareDialogProps = {
+  catalogShareLevel: CatalogPersonaShareLevel;
   isPending: boolean;
   linkedAgentPubkey: string | null;
+  effectiveAvatarUrl: string | null;
+  onCatalogShareLevelChange: (shareLevel: CatalogPersonaShareLevel) => void;
   onExport: () => void;
   onOpenChange: (open: boolean) => void;
   open: boolean;
@@ -60,6 +63,7 @@ type PersonaShareDialogProps = {
 };
 
 type SnapshotShareDialogProps = {
+  afterLink?: React.ReactNode;
   displayName: string;
   encodeSnapshot: (
     memoryLevel: SnapshotMemoryLevel,
@@ -109,6 +113,20 @@ type PendingMemoryShare = {
   recipientNames?: string[];
 };
 
+function buildSnapshotShareLevels(itemLabel: "Agent" | "Team") {
+  return [
+    { value: "none" as const, label: `${itemLabel} only` },
+    {
+      value: "core" as const,
+      label: `${itemLabel} + core memory`,
+    },
+    {
+      value: "everything" as const,
+      label: `${itemLabel} + all memories`,
+    },
+  ];
+}
+
 function formatRecipientAudience(names: readonly string[]): string {
   if (names.length === 0) return "The people you selected";
   if (names.length === 1) return names[0] ?? "The person you selected";
@@ -179,39 +197,32 @@ function MemoryShareConfirmation({
 
 function ShareLevelControl({
   ariaLabel,
-  className,
   disabled,
   hasMemoryOptions,
-  onOpenChange,
-  staticClassName,
-  staticLabel,
   testId,
   value,
   options,
   onChange,
 }: {
   ariaLabel: string;
-  className?: string;
   disabled: boolean;
   hasMemoryOptions: boolean;
-  onOpenChange?: (open: boolean) => void;
-  staticClassName?: string;
-  staticLabel: string;
   testId: string;
   value: SnapshotMemoryLevel;
   options: { value: SnapshotMemoryLevel; label: string }[];
   onChange: (level: SnapshotMemoryLevel) => void;
 }) {
   if (!hasMemoryOptions) {
+    // Nothing to choose from, so there is no dropdown to open. State the
+    // outcome rather than naming the sole option: the memory-level labels
+    // ("Agent only", "+ core memory", …) are comparative and only make sense
+    // when the alternatives are actually offered.
     return (
       <span
-        className={cn(
-          "inline-flex h-8 w-auto shrink-0 items-center justify-end px-2 text-sm text-muted-foreground",
-          staticClassName,
-        )}
+        className="inline-flex h-8 w-auto shrink-0 items-center justify-end px-2 text-sm text-muted-foreground"
         data-testid={testId}
       >
-        {staticLabel}
+        No memories included
       </span>
     );
   }
@@ -219,9 +230,7 @@ function ShareLevelControl({
   return (
     <SnapshotOptionMenu
       ariaLabel={ariaLabel}
-      className={className}
       disabled={disabled}
-      onOpenChange={onOpenChange}
       onValueChange={(nextValue) => onChange(nextValue as SnapshotMemoryLevel)}
       options={options}
       testId={testId}
@@ -231,6 +240,7 @@ function ShareLevelControl({
 }
 
 export function SnapshotShareDialog({
+  afterLink,
   displayName,
   encodeSnapshot,
   hasMemoryOptions,
@@ -252,9 +262,7 @@ export function SnapshotShareDialog({
   const [copyStatus, setCopyStatus] = React.useState<CopyStatus>("idle");
   const [pendingMemoryShare, setPendingMemoryShare] =
     React.useState<PendingMemoryShare | null>(null);
-  const [linkShareLevel, setLinkShareLevel] =
-    React.useState<SnapshotMemoryLevel>("none");
-  const [recipientShareLevel, setRecipientShareLevel] =
+  const [shareLevel, setShareLevel] =
     React.useState<SnapshotMemoryLevel>("none");
   const encodedSnapshotCacheRef = React.useRef(
     new Map<SnapshotMemoryLevel, Promise<EncodedSnapshot>>(),
@@ -273,9 +281,7 @@ export function SnapshotShareDialog({
   const isActionPending = isPending || isCopying || isSending;
   const isInterfacePending = isPending || isSending;
   const hasSelectedRecipients = selectedRecipients.length > 0;
-  const showMemoryWarning =
-    linkShareLevel !== "none" ||
-    (hasSelectedRecipients && recipientShareLevel !== "none");
+  const showMemoryWarning = shareLevel !== "none";
   const recipientActionTransition = shouldReduceMotion
     ? { duration: 0 }
     : RECIPIENT_ACTION_TRANSITION;
@@ -298,17 +304,7 @@ export function SnapshotShareDialog({
   const itemLabel = snapshotKind === "team" ? "team" : "agent";
   const itemLabelTitle = snapshotKind === "team" ? "Team" : "Agent";
   const shareLevels = React.useMemo(
-    () => [
-      { value: "none" as const, label: `${itemLabelTitle} only` },
-      {
-        value: "core" as const,
-        label: `${itemLabelTitle} + core memory`,
-      },
-      {
-        value: "everything" as const,
-        label: `${itemLabelTitle} + all memories`,
-      },
-    ],
+    () => buildSnapshotShareLevels(itemLabelTitle),
     [itemLabelTitle],
   );
   const getEncodedSnapshot = React.useCallback(
@@ -337,8 +333,7 @@ export function SnapshotShareDialog({
       setSelectedRecipients([]);
       setCopyStatus("idle");
       setPendingMemoryShare(null);
-      setLinkShareLevel("none");
-      setRecipientShareLevel("none");
+      setShareLevel("none");
       onReset?.();
       snapshotSendController.reset();
     }
@@ -495,21 +490,6 @@ export function SnapshotShareDialog({
                     excludedPubkeys={excludedRecipientPubkeys}
                     onSelectionChange={setSelectedRecipients}
                     open={open}
-                    renderEndControl={(handleAccessOpenChange) => (
-                      <ShareLevelControl
-                        ariaLabel="What to include"
-                        className="-mr-2 h-7"
-                        disabled={isInterfacePending}
-                        hasMemoryOptions={hasMemoryOptions}
-                        onChange={setRecipientShareLevel}
-                        onOpenChange={handleAccessOpenChange}
-                        options={shareLevels}
-                        staticLabel={`${itemLabelTitle} only`}
-                        staticClassName="-mr-2 h-7 w-auto"
-                        testId={`${testIdPrefix}-recipient-access`}
-                        value={recipientShareLevel}
-                      />
-                    )}
                     selectedUsers={selectedRecipients}
                     testIdPrefix={testIdPrefix}
                   />
@@ -532,9 +512,7 @@ export function SnapshotShareDialog({
                           isActionPending ||
                           !snapshotSendController.isDmSafetyReady
                         }
-                        onClick={() =>
-                          requestMemoryShare("send", recipientShareLevel)
-                        }
+                        onClick={() => requestMemoryShare("send", shareLevel)}
                         type="button"
                       >
                         {isSending ? "Sending…" : "Send"}
@@ -552,6 +530,116 @@ export function SnapshotShareDialog({
               </p>
             </div>
 
+            <div
+              className="flex items-center gap-3 pt-2"
+              data-testid={`${testIdPrefix}-link-row`}
+            >
+              <span
+                className="flex h-8 w-8 shrink-0 items-center justify-center rounded-full bg-muted text-muted-foreground"
+                data-testid={`${testIdPrefix}-link-icon`}
+              >
+                <Link2 className="h-4 w-4" />
+              </span>
+              <div
+                className="min-w-0 flex-1"
+                data-testid={`${testIdPrefix}-link-copy`}
+              >
+                <h3 className="text-sm font-medium">Share with a link</h3>
+                <p className="text-xs text-secondary-foreground/75">
+                  Anyone with the link can add and use a copy.
+                </p>
+              </div>
+              <Button
+                asChild
+                className="shrink-0 border-border shadow-none disabled:opacity-100"
+                data-copy-status={copyStatus}
+                data-testid={`${testIdPrefix}-copy-link`}
+                disabled={isActionPending}
+                onClick={() => requestMemoryShare("copy", shareLevel)}
+                size="sm"
+                type="button"
+                variant="outline"
+              >
+                <motion.button
+                  layout={!shouldReduceMotion}
+                  layoutDependency={copyStatus}
+                  style={{ transformOrigin: "100% 50%" }}
+                  transition={copyButtonLayoutTransition}
+                >
+                  <span aria-live="polite" className="sr-only">
+                    {copyStatusLabel}
+                  </span>
+                  <span
+                    aria-hidden="true"
+                    className="relative grid place-items-center"
+                    data-testid={`${testIdPrefix}-copy-link-stage`}
+                  >
+                    <AnimatePresence initial={false} mode="popLayout">
+                      <motion.span
+                        animate={{
+                          filter: "blur(0px)",
+                          opacity: 1,
+                          transform: "scale(1)",
+                        }}
+                        className="col-start-1 row-start-1 flex items-center justify-center gap-1.5 [transform-origin:50%_50%] will-change-[transform,opacity,filter]"
+                        data-testid={`${testIdPrefix}-copy-link-state`}
+                        exit={
+                          shouldReduceMotion
+                            ? { opacity: 0 }
+                            : {
+                                filter: "blur(2px)",
+                                opacity: 0,
+                                transform: "scale(0.97)",
+                              }
+                        }
+                        initial={
+                          shouldReduceMotion
+                            ? false
+                            : {
+                                filter: "blur(2px)",
+                                opacity: 0,
+                                transform: "scale(0.97)",
+                              }
+                        }
+                        key={copyStatus}
+                        transition={copyFeedbackTransition}
+                      >
+                        {copyStatus === "copying" ? (
+                          <Spinner
+                            aria-hidden="true"
+                            className="h-4 w-4 border-2"
+                          />
+                        ) : copyStatus === "copied" ? (
+                          <Check aria-hidden="true" className="h-4 w-4" />
+                        ) : (
+                          <Link2 aria-hidden="true" className="h-4 w-4" />
+                        )}
+                        <span>{copyStatusLabel}</span>
+                      </motion.span>
+                    </AnimatePresence>
+                  </span>
+                </motion.button>
+              </Button>
+            </div>
+
+            <div
+              className="flex items-center gap-3"
+              data-testid={`${testIdPrefix}-share-level-row`}
+            >
+              <h3 className="min-w-0 flex-1 text-sm font-medium">
+                What’s included
+              </h3>
+              <ShareLevelControl
+                ariaLabel="What to include"
+                disabled={isInterfacePending}
+                hasMemoryOptions={hasMemoryOptions}
+                onChange={setShareLevel}
+                options={shareLevels}
+                testId={`${testIdPrefix}-share-level`}
+                value={shareLevel}
+              />
+            </div>
+
             <AnimatePresence initial={false}>
               {showMemoryWarning ? (
                 <motion.div
@@ -577,118 +665,7 @@ export function SnapshotShareDialog({
               ) : null}
             </AnimatePresence>
 
-            <section
-              className="pt-6"
-              data-testid={`${testIdPrefix}-copy-link-footer`}
-            >
-              <div
-                className="flex items-center gap-3"
-                data-testid={`${testIdPrefix}-link-row`}
-              >
-                <span
-                  className="flex h-8 w-8 shrink-0 items-center justify-center rounded-full bg-muted text-muted-foreground"
-                  data-testid={`${testIdPrefix}-link-icon`}
-                >
-                  <Link2 className="h-4 w-4" />
-                </span>
-                <div
-                  className="min-w-0 flex-1"
-                  data-testid={`${testIdPrefix}-link-copy`}
-                >
-                  <h3 className="text-sm font-medium">Share with a link</h3>
-                  <p className="text-xs text-secondary-foreground/75">
-                    Anyone with the link can add and use a copy.
-                  </p>
-                </div>
-                <ShareLevelControl
-                  ariaLabel="What to include in the link"
-                  disabled={isInterfacePending}
-                  hasMemoryOptions={hasMemoryOptions}
-                  onChange={setLinkShareLevel}
-                  options={shareLevels}
-                  staticLabel={`${itemLabelTitle} only`}
-                  testId={`${testIdPrefix}-link-access`}
-                  value={linkShareLevel}
-                />
-              </div>
-              <Separator
-                className="my-4 bg-input/40"
-                data-testid={`${testIdPrefix}-link-divider`}
-              />
-              <div className="flex justify-end">
-                <Button
-                  asChild
-                  className="shrink-0 border-border shadow-none disabled:opacity-100"
-                  data-copy-status={copyStatus}
-                  data-testid={`${testIdPrefix}-copy-link`}
-                  disabled={isActionPending}
-                  onClick={() => requestMemoryShare("copy", linkShareLevel)}
-                  size="sm"
-                  type="button"
-                  variant="outline"
-                >
-                  <motion.button
-                    layout={!shouldReduceMotion}
-                    layoutDependency={copyStatus}
-                    style={{ transformOrigin: "100% 50%" }}
-                    transition={copyButtonLayoutTransition}
-                  >
-                    <span aria-live="polite" className="sr-only">
-                      {copyStatusLabel}
-                    </span>
-                    <span
-                      aria-hidden="true"
-                      className="relative grid place-items-center"
-                      data-testid={`${testIdPrefix}-copy-link-stage`}
-                    >
-                      <AnimatePresence initial={false} mode="popLayout">
-                        <motion.span
-                          animate={{
-                            filter: "blur(0px)",
-                            opacity: 1,
-                            transform: "scale(1)",
-                          }}
-                          className="col-start-1 row-start-1 flex items-center justify-center gap-1.5 [transform-origin:50%_50%] will-change-[transform,opacity,filter]"
-                          data-testid={`${testIdPrefix}-copy-link-state`}
-                          exit={
-                            shouldReduceMotion
-                              ? { opacity: 0 }
-                              : {
-                                  filter: "blur(2px)",
-                                  opacity: 0,
-                                  transform: "scale(0.97)",
-                                }
-                          }
-                          initial={
-                            shouldReduceMotion
-                              ? false
-                              : {
-                                  filter: "blur(2px)",
-                                  opacity: 0,
-                                  transform: "scale(0.97)",
-                                }
-                          }
-                          key={copyStatus}
-                          transition={copyFeedbackTransition}
-                        >
-                          {copyStatus === "copying" ? (
-                            <Spinner
-                              aria-hidden="true"
-                              className="h-4 w-4 border-2"
-                            />
-                          ) : copyStatus === "copied" ? (
-                            <Check aria-hidden="true" className="h-4 w-4" />
-                          ) : (
-                            <Link2 aria-hidden="true" className="h-4 w-4" />
-                          )}
-                          <span>{copyStatusLabel}</span>
-                        </motion.span>
-                      </AnimatePresence>
-                    </span>
-                  </motion.button>
-                </Button>
-              </div>
-            </section>
+            {afterLink}
           </div>
         </div>
         <button
@@ -715,14 +692,24 @@ export function SnapshotShareDialog({
 }
 
 export function PersonaShareDialog({
+  catalogShareLevel,
   isPending,
   linkedAgentPubkey,
+  effectiveAvatarUrl,
+  onCatalogShareLevelChange,
   onExport,
   onOpenChange,
   open,
   persona,
 }: PersonaShareDialogProps) {
   const encodeSnapshotMutation = useEncodeAgentSnapshotForSendMutation();
+  const catalogShareLevels = React.useMemo(
+    () => [
+      { value: "not-shared", label: "Not shared" },
+      { value: "none", label: "Shared" },
+    ],
+    [],
+  );
   const encodeSnapshot = React.useCallback(
     async (memoryLevel: SnapshotMemoryLevel) =>
       encodeSnapshotMutation.mutateAsync({
@@ -730,18 +717,52 @@ export function PersonaShareDialog({
         memoryLevel: linkedAgentPubkey ? memoryLevel : "none",
         format: "png",
         memorySourcePubkey: linkedAgentPubkey,
-        avatarPngDataUrl: await resolveSnapshotAvatarPng(persona.avatarUrl),
+        avatarPngDataUrl: await resolveSnapshotAvatarPng(effectiveAvatarUrl),
       }),
     [
       encodeSnapshotMutation.mutateAsync,
+      effectiveAvatarUrl,
       linkedAgentPubkey,
-      persona.avatarUrl,
       persona.id,
     ],
   );
 
   return (
     <SnapshotShareDialog
+      afterLink={
+        persona.isBuiltIn ? null : (
+          <section
+            className="flex min-h-16 w-full items-center gap-3"
+            data-testid="persona-share-catalog"
+          >
+            <span className="flex h-8 w-8 shrink-0 items-center justify-center rounded-full bg-muted text-muted-foreground">
+              <BookUser className="h-4 w-4" />
+            </span>
+            <div className="min-w-0 flex-1">
+              <h3 className="text-sm font-medium">Share to catalog</h3>
+              <p className="text-xs text-secondary-foreground/75">
+                Anyone in this community can find and use a copy. Your agent
+                instruction is shared as plaintext. Memories and secrets aren’t
+                included.
+              </p>
+            </div>
+            <div className="flex shrink-0 items-center">
+              <SnapshotOptionMenu
+                ariaLabel="What to share in the catalog"
+                disabled={isPending}
+                onValueChange={(nextValue) =>
+                  onCatalogShareLevelChange(
+                    nextValue as CatalogPersonaShareLevel,
+                  )
+                }
+                options={catalogShareLevels}
+                testId="persona-share-catalog-access"
+                value={catalogShareLevel}
+              />
+            </div>
+          </section>
+        )
+      }
       displayName={persona.displayName}
       encodeSnapshot={encodeSnapshot}
       hasMemoryOptions={linkedAgentPubkey !== null}
diff --git a/desktop/src/features/agents/ui/PersonaShareRecipients.tsx b/desktop/src/features/agents/ui/PersonaShareRecipients.tsx
index 4f8874914d4..7db7c32bfa5 100644
--- a/desktop/src/features/agents/ui/PersonaShareRecipients.tsx
+++ b/desktop/src/features/agents/ui/PersonaShareRecipients.tsx
@@ -34,7 +34,6 @@ export function PersonaShareRecipients({
   excludedPubkeys = [],
   onSelectionChange,
   open,
-  renderEndControl,
   selectedUsers,
   testIdPrefix = "persona-share",
 }: {
@@ -42,7 +41,6 @@ export function PersonaShareRecipients({
   excludedPubkeys?: readonly string[];
   onSelectionChange: (users: UserSearchResult[]) => void;
   open: boolean;
-  renderEndControl?: (onOpenChange: (open: boolean) => void) => React.ReactNode;
   selectedUsers: UserSearchResult[];
   testIdPrefix?: string;
 }) {
@@ -228,11 +226,6 @@ export function PersonaShareRecipients({
                 value={searchQuery}
               />
             </div>
-            {selectedUsers.length > 0 && renderEndControl
-              ? renderEndControl((controlOpen) => {
-                  if (controlOpen) setIsPickerOpen(false);
-                })
-              : null}
           </div>
         </PopoverAnchor>
         <PopoverContent
diff --git a/desktop/src/features/agents/ui/TeamIdentityCard.tsx b/desktop/src/features/agents/ui/TeamIdentityCard.tsx
index 824b2066047..19596b76d6c 100644
--- a/desktop/src/features/agents/ui/TeamIdentityCard.tsx
+++ b/desktop/src/features/agents/ui/TeamIdentityCard.tsx
@@ -115,6 +115,7 @@ function TeamAvatarRow({
 }) {
   const visiblePersonas = personas.slice(0, MAX_VISIBLE_MEMBER_AVATARS);
   const overflowCount = Math.max(0, memberCount - visiblePersonas.length);
+  const stackItemCount = visiblePersonas.length + (overflowCount > 0 ? 1 : 0);
 
   if (visiblePersonas.length === 0 && overflowCount === 0) {
     return (
@@ -130,16 +131,26 @@ function TeamAvatarRow({
     <div className="absolute inset-x-0 top-0 bottom-12 flex items-center justify-center">
       <div
         aria-label={`${teamName} member avatars`}
-        className="flex max-w-full items-center justify-center gap-2 px-4"
+        className="flex max-w-full items-center justify-center px-4"
         role="img"
       >
         {visiblePersonas.map((persona, index) => (
-          <TeamAvatarItem index={index} key={persona.id} persona={persona} />
+          <TeamAvatarItem
+            index={index}
+            isFollowedByAnother={index < stackItemCount - 1}
+            key={persona.id}
+            persona={persona}
+          />
         ))}
         {overflowCount > 0 ? (
-          <span className="flex h-14 w-14 items-center justify-center rounded-full border-[3px] border-background bg-card text-sm font-semibold text-muted-foreground shadow-sm">
-            +{overflowCount}
-          </span>
+          <div
+            className={visiblePersonas.length > 0 ? "-ml-5" : ""}
+            style={{ zIndex: stackItemCount }}
+          >
+            <span className="flex h-14 w-14 items-center justify-center rounded-full bg-card text-sm font-semibold text-muted-foreground">
+              +{overflowCount}
+            </span>
+          </div>
         ) : null}
       </div>
     </div>
@@ -148,25 +159,39 @@ function TeamAvatarRow({
 
 function TeamAvatarItem({
   index,
+  isFollowedByAnother,
   persona,
 }: {
   index: number;
+  isFollowedByAnother: boolean;
   persona: AgentPersona;
 }) {
   const avatarUrl = persona.avatarUrl?.trim() ?? null;
 
   return (
-    <div className="h-14 w-14" data-team-member-avatar="avatar">
+    <div
+      className={`h-14 w-14 ${index > 0 ? "-ml-5" : ""}`}
+      data-team-member-avatar="avatar"
+      style={{
+        zIndex: index + 1,
+        ...(isFollowedByAnother && {
+          mask: "radial-gradient(circle 32px at calc(100% + 8px) 50%, transparent 99%, #fff 100%)",
+          WebkitMask:
+            "radial-gradient(circle 32px at calc(100% + 8px) 50%, transparent 99%, #fff 100%)",
+        }),
+      }}
+    >
       {avatarUrl ? (
         <ProfileAvatar
           avatarUrl={avatarUrl}
-          className="h-full w-full border-[3px] border-background bg-muted shadow-sm"
+          className="h-full w-full bg-muted shadow-none"
           iconClassName="h-6 w-6"
           label={persona.displayName}
           testId={`team-member-avatar-${persona.id}`}
         />
       ) : (
         <IdentityInitialsAvatar
+          className="border-0 shadow-none"
           colorIndex={index}
           label={persona.displayName}
           size={56}
diff --git a/desktop/src/features/agents/ui/TeamsSection.tsx b/desktop/src/features/agents/ui/TeamsSection.tsx
index daf44195925..f974081b7db 100644
--- a/desktop/src/features/agents/ui/TeamsSection.tsx
+++ b/desktop/src/features/agents/ui/TeamsSection.tsx
@@ -5,7 +5,6 @@ import {
   Rocket,
   Share2,
   Trash2,
-  Upload,
 } from "lucide-react";
 
 import { resolveTeamPersonas } from "@/features/agents/lib/teamPersonas";
@@ -201,11 +200,7 @@ function NewTeamCard({
   return (
     <DropdownMenu modal={false}>
       <DropdownMenuTrigger asChild>
-        <CreateIdentityCard
-          ariaLabel="New team"
-          dataTestId="new-team-card"
-          label="New team"
-        />
+        <CreateIdentityCard ariaLabel="New team" dataTestId="new-team-card" />
       </DropdownMenuTrigger>
       <DropdownMenuContent
         align="start"
@@ -215,8 +210,7 @@ function NewTeamCard({
           Create team
         </DropdownMenuItem>
         <DropdownMenuItem disabled={isPending} onClick={onImport}>
-          <Upload className="h-4 w-4" />
-          Import team snapshot
+          Import
         </DropdownMenuItem>
       </DropdownMenuContent>
     </DropdownMenu>
diff --git a/desktop/src/features/agents/ui/UnifiedAgentsSection.tsx b/desktop/src/features/agents/ui/UnifiedAgentsSection.tsx
index f24d6a41ffc..9bbe3feef79 100644
--- a/desktop/src/features/agents/ui/UnifiedAgentsSection.tsx
+++ b/desktop/src/features/agents/ui/UnifiedAgentsSection.tsx
@@ -45,7 +45,6 @@ type UnifiedAgentsSectionProps = {
   onOpenPersonaProfile: (persona: AgentPersona) => void;
   onStartAgent: (pubkey: string) => void;
   onStartPersona: (persona: AgentPersona) => void;
-  canChooseCatalog: boolean;
   personas: AgentPersona[];
   personasError: Error | null;
   personaFeedbackErrorMessage: string | null;
@@ -53,12 +52,13 @@ type UnifiedAgentsSectionProps = {
   isPersonasLoading: boolean;
   isPersonasPending: boolean;
   onCreatePersona: () => void;
-  onChooseCatalog: () => void;
+  onDiscoverPersonas: () => void;
   onDuplicatePersona: (persona: AgentPersona) => void;
   onEditPersona: (persona: AgentPersona) => void;
   onSharePersona: (
     persona: AgentPersona,
     linkedAgent: ManagedAgent | undefined,
+    effectiveAvatarUrl: string | null,
   ) => void;
   onDeactivatePersona: (persona: AgentPersona) => void;
   onDeletePersona: (persona: AgentPersona) => void;
@@ -66,7 +66,9 @@ type UnifiedAgentsSectionProps = {
 };
 
 const AGENT_CARD_COLUMN_CLASS = "w-full";
-const AGENT_CARD_GRID_CLASS = `${AGENT_CARD_COLUMN_CLASS} mx-auto grid max-w-[996px] grid-cols-[repeat(auto-fill,minmax(220px,240px))] justify-center gap-3`;
+export const AGENT_CARD_GRID_COLUMNS_CLASS =
+  "grid-cols-[repeat(auto-fill,minmax(220px,240px))]";
+const AGENT_CARD_GRID_CLASS = `${AGENT_CARD_COLUMN_CLASS} ${AGENT_CARD_GRID_COLUMNS_CLASS} grid justify-start gap-3`;
 
 export function UnifiedAgentsSection(props: UnifiedAgentsSectionProps) {
   const {
@@ -83,7 +85,6 @@ export function UnifiedAgentsSection(props: UnifiedAgentsSectionProps) {
     onOpenPersonaProfile,
     onStartAgent,
     onStartPersona,
-    canChooseCatalog,
     personas,
     personasError,
     personaFeedbackErrorMessage,
@@ -91,7 +92,7 @@ export function UnifiedAgentsSection(props: UnifiedAgentsSectionProps) {
     isPersonasLoading,
     isPersonasPending,
     onCreatePersona,
-    onChooseCatalog,
+    onDiscoverPersonas,
     onDuplicatePersona,
     onEditPersona,
     onSharePersona,
@@ -157,9 +158,11 @@ export function UnifiedAgentsSection(props: UnifiedAgentsSectionProps) {
               const profileAgent = pickProfileAgent(group.agents);
               return (
                 <AgentPersonaCard
-                  actions={
+                  actions={(effectiveAvatarUrl, isEffectiveAvatarLoading) => (
                     <PersonaActionsMenu
-                      isActionPending={isActionPending}
+                      isActionPending={
+                        isActionPending || isEffectiveAvatarLoading
+                      }
                       isPending={isPersonasPending}
                       persona={group.persona}
                       linkedAgent={profileAgent}
@@ -167,9 +170,11 @@ export function UnifiedAgentsSection(props: UnifiedAgentsSectionProps) {
                       onDelete={onDeletePersona}
                       onDuplicate={onDuplicatePersona}
                       onEdit={onEditPersona}
-                      onShare={onSharePersona}
+                      onShare={(persona, linkedAgent) =>
+                        onSharePersona(persona, linkedAgent, effectiveAvatarUrl)
+                      }
                     />
-                  }
+                  )}
                   agent={profileAgent}
                   defaultModel={defaultModel}
                   key={group.persona.id}
@@ -184,11 +189,10 @@ export function UnifiedAgentsSection(props: UnifiedAgentsSectionProps) {
               );
             })}
             <NewAgentCard
-              canChooseCatalog={canChooseCatalog}
-              isPersonasPending={isPersonasPending}
-              openFilePicker={openFilePicker}
-              onChooseCatalog={onChooseCatalog}
-              onCreatePersona={onCreatePersona}
+              isPending={isPersonasPending}
+              onCreate={onCreatePersona}
+              onDiscover={onDiscoverPersonas}
+              onImport={openFilePicker}
             />
           </div>
 
@@ -251,7 +255,10 @@ function AgentPersonaCard({
   onStartAgent,
   onStartPersona,
 }: {
-  actions?: React.ReactNode;
+  actions?: (
+    effectiveAvatarUrl: string | null,
+    isEffectiveAvatarLoading: boolean,
+  ) => React.ReactNode;
   agent: ManagedAgent | undefined;
   defaultModel: string;
   persona: AgentPersona;
@@ -283,7 +290,10 @@ function AgentPersonaCard({
 
   return (
     <AgentIdentityCard
-      actions={actions}
+      actions={actions?.(
+        avatarUrl,
+        Boolean(agent && !persona.avatarUrl && profileQuery.isPending),
+      )}
       ariaLabel={`${title} agent profile`}
       avatar={
         agent ? (
@@ -430,50 +440,37 @@ function firstAvatarUrl(
 }
 
 function NewAgentCard({
-  canChooseCatalog,
-  isPersonasPending,
-  openFilePicker,
-  onChooseCatalog,
-  onCreatePersona,
+  isPending,
+  onCreate,
+  onDiscover,
+  onImport,
 }: {
-  canChooseCatalog: boolean;
-  isPersonasPending: boolean;
-  openFilePicker: () => void;
-  onChooseCatalog: () => void;
-  onCreatePersona: () => void;
+  isPending: boolean;
+  onCreate: () => void;
+  onDiscover: () => void;
+  onImport: () => void;
 }) {
   return (
     <DropdownMenu modal={false}>
       <DropdownMenuTrigger asChild>
-        <CreateIdentityCard
-          ariaLabel="New agent"
-          dataTestId="new-agent-card"
-          label="New agent"
-        />
+        <CreateIdentityCard ariaLabel="New agent" dataTestId="new-agent-card" />
       </DropdownMenuTrigger>
       <DropdownMenuContent
         align="start"
         onCloseAutoFocus={(event) => event.preventDefault()}
       >
-        <DropdownMenuItem
-          disabled={isPersonasPending}
-          onClick={onCreatePersona}
-        >
-          Create from scratch
+        <DropdownMenuItem disabled={isPending} onClick={onCreate}>
+          Create agent
+        </DropdownMenuItem>
+        <DropdownMenuItem disabled={isPending} onClick={onDiscover}>
+          Discover agents
         </DropdownMenuItem>
-        {canChooseCatalog ? (
-          <DropdownMenuItem
-            disabled={isPersonasPending}
-            onClick={onChooseCatalog}
-          >
-            Choose from catalog
-          </DropdownMenuItem>
-        ) : null}
         <DropdownMenuItem
           data-testid="import-agent-snapshot-menu-item"
-          onClick={openFilePicker}
+          disabled={isPending}
+          onClick={onImport}
         >
-          Import agent snapshot
+          Import
         </DropdownMenuItem>
       </DropdownMenuContent>
     </DropdownMenu>
diff --git a/desktop/src/features/agents/ui/addCustomHarness.test.mjs b/desktop/src/features/agents/ui/addCustomHarness.test.mjs
new file mode 100644
index 00000000000..6c0aa32daf6
--- /dev/null
+++ b/desktop/src/features/agents/ui/addCustomHarness.test.mjs
@@ -0,0 +1,344 @@
+/**
+ * Behavior tests for the inline "Add custom harness…" dropdown entry shared by
+ * AgentDefinitionDialog and AgentInstanceEditDialog.
+ *
+ * Two seams carry the feature, and both are pinned here:
+ *
+ *   1. ROUTING (`runtimeDropdownAction`) — the sentinel must resolve to "open
+ *      the form", never to a selection. If it ever resolved to a selection the
+ *      dialogs would write "\u0000add-custom-harness" into `runtime` and try to
+ *      spawn an agent on a harness that does not exist.
+ *   2. DEFERRED SELECTION (`usePendingHarnessSelection`) — saving only writes
+ *      the definition file; the harness becomes a catalog entry when the
+ *      invalidated discovery query refetches. Selecting on save would pick an
+ *      id no entry backs. The hook must wait for the catalog, fire exactly
+ *      once, stay silent when the user cancels, and drop the pending id when
+ *      its dialog closes — the host dialogs stay mounted, so a stale id would
+ *      otherwise select into reset form state on a later publish.
+ *
+ * The hook is mounted for real (react-dom/client + act) rather than simulated,
+ * so its effect wiring — including the guard that survives the dialogs'
+ * non-memoized change handlers — is what gets tested.
+ */
+
+import assert from "node:assert/strict";
+import test from "node:test";
+
+// ── Minimal DOM shim ─────────────────────────────────────────────────────────
+// react-dom/client needs a container element and a document; node has neither.
+// The harness renders null, so no real node operations are exercised.
+
+class ElementShim {
+  constructor() {
+    this.children = [];
+    this.childNodes = [];
+    this.nodeType = 1;
+    this.nodeName = "DIV";
+    this.tagName = "DIV";
+    this.namespaceURI = "http://www.w3.org/1999/xhtml";
+  }
+  get ownerDocument() {
+    return globalThis.document;
+  }
+  addEventListener() {}
+  removeEventListener() {}
+  appendChild(child) {
+    this.children.push(child);
+    this.childNodes.push(child);
+    return child;
+  }
+  removeChild(child) {
+    this.children = this.children.filter((current) => current !== child);
+    this.childNodes = this.childNodes.filter((current) => current !== child);
+    return child;
+  }
+  insertBefore(child) {
+    return this.appendChild(child);
+  }
+  contains(target) {
+    return this === target;
+  }
+}
+
+globalThis.document = {
+  activeElement: null,
+  addEventListener() {},
+  createElement: () => new ElementShim(),
+  get defaultView() {
+    return globalThis.window;
+  },
+  nodeType: 9,
+  removeEventListener() {},
+};
+// react-dom derives update priority from window.event and walks iframe
+// boundaries via window.HTMLIFrameElement during commit.
+Object.defineProperty(globalThis, "window", {
+  configurable: true,
+  value: {
+    addEventListener() {},
+    document: globalThis.document,
+    event: undefined,
+    HTMLIFrameElement: ElementShim,
+    removeEventListener() {},
+  },
+});
+globalThis.HTMLElement = ElementShim;
+globalThis.Node = ElementShim;
+globalThis.IS_REACT_ACT_ENVIRONMENT = true;
+
+import React from "react";
+import { act } from "react";
+import { createRoot } from "react-dom/client";
+
+import { NO_RUNTIME_DROPDOWN_VALUE } from "./agentConfigOptions.tsx";
+import {
+  ADD_CUSTOM_HARNESS_OPTION,
+  ADD_CUSTOM_HARNESS_VALUE,
+  readyHarnessId,
+  runtimeDropdownAction,
+  usePendingHarnessSelection,
+} from "./addCustomHarness.ts";
+
+// ── Routing: the sentinel opens the form, it is never a selection ────────────
+
+test("selecting the add-custom entry requests the form and yields no runtime id", () => {
+  const action = runtimeDropdownAction(ADD_CUSTOM_HARNESS_VALUE);
+  assert.equal(action.kind, "add-custom-harness");
+  // The dialogs read `action.runtimeId` on the select branch; the sentinel
+  // must not carry one, or it could leak into form state.
+  assert.equal("runtimeId" in action, false);
+});
+
+test("selecting a harness yields that harness id", () => {
+  assert.deepEqual(runtimeDropdownAction("my-harness"), {
+    kind: "select",
+    runtimeId: "my-harness",
+  });
+});
+
+test("selecting the no-runtime entry yields the empty id", () => {
+  assert.deepEqual(runtimeDropdownAction(NO_RUNTIME_DROPDOWN_VALUE), {
+    kind: "select",
+    runtimeId: "",
+  });
+});
+
+test("the add-custom sentinel cannot collide with a backend-valid harness id", () => {
+  // Backend ids match [a-z0-9_][a-z0-9_-]* (custom_harnesses.rs), so a
+  // NUL-prefixed value is unreachable as a real id.
+  assert.equal(ADD_CUSTOM_HARNESS_VALUE.startsWith("\u0000"), true);
+  assert.equal(ADD_CUSTOM_HARNESS_OPTION.value, ADD_CUSTOM_HARNESS_VALUE);
+  assert.equal(ADD_CUSTOM_HARNESS_OPTION.label, "Add custom harness…");
+});
+
+// ── Readiness: an id is selectable only once the catalog publishes it ────────
+
+test("a pending id absent from the catalog is not ready", () => {
+  assert.equal(readyHarnessId([{ id: "claude" }], "my-harness"), null);
+});
+
+test("a pending id present in the catalog is ready", () => {
+  assert.equal(
+    readyHarnessId([{ id: "claude" }, { id: "my-harness" }], "my-harness"),
+    "my-harness",
+  );
+});
+
+test("no pending id is never ready even against a populated catalog", () => {
+  assert.equal(readyHarnessId([{ id: "claude" }], null), null);
+});
+
+// ── Deferred selection: mounted hook ─────────────────────────────────────────
+
+/**
+ * Mount the real hook over a mutable catalog. Returns the setter the dialogs
+ * call on save, a `setRuntimes` to simulate the discovery refetch, a `setOpen`
+ * to simulate the owning dialog closing and reopening, and the log of ids the
+ * hook handed back for selection.
+ */
+async function mountPendingSelection(initialRuntimes = []) {
+  const selected = [];
+  const control = {};
+
+  function Harness() {
+    const [runtimes, setRuntimes] = React.useState(initialRuntimes);
+    const [open, setOpen] = React.useState(true);
+    // Deliberately NOT memoized: both dialogs pass a plain function
+    // declaration, so `onReady` has a fresh identity on every render.
+    const onReady = (id) => selected.push(id);
+    control.save = usePendingHarnessSelection(runtimes, onReady, open);
+    control.setRuntimes = setRuntimes;
+    control.setOpen = setOpen;
+    return null;
+  }
+
+  const root = createRoot(new ElementShim());
+  await act(async () => {
+    root.render(React.createElement(Harness));
+  });
+  return { control, root, selected };
+}
+
+test("saving a harness selects it only once the catalog publishes it", async () => {
+  const { control, root, selected } = await mountPendingSelection([
+    { id: "claude" },
+  ]);
+
+  // Save returns before discovery refetches — nothing to select yet.
+  await act(async () => control.save("my-harness"));
+  assert.deepEqual(selected, []);
+
+  // The invalidated discovery query resolves with the new entry.
+  await act(async () =>
+    control.setRuntimes([{ id: "claude" }, { id: "my-harness" }]),
+  );
+  assert.deepEqual(selected, ["my-harness"]);
+
+  await act(async () => root.unmount());
+});
+
+test("a published harness is selected exactly once across later catalog updates", async () => {
+  const { control, root, selected } = await mountPendingSelection([
+    { id: "claude" },
+  ]);
+
+  await act(async () => control.save("my-harness"));
+  await act(async () =>
+    control.setRuntimes([{ id: "claude" }, { id: "my-harness" }]),
+  );
+  assert.deepEqual(selected, ["my-harness"]);
+
+  // Any later refetch re-renders with a new array identity and a new onReady
+  // identity. Re-firing here would clobber a selection the user made in
+  // between, so the pending id must have been cleared.
+  await act(async () =>
+    control.setRuntimes([
+      { id: "claude" },
+      { id: "my-harness" },
+      { id: "codex" },
+    ]),
+  );
+  assert.deepEqual(selected, ["my-harness"]);
+
+  await act(async () => root.unmount());
+});
+
+test("cancelling the form leaves the current selection untouched", async () => {
+  const { control, root, selected } = await mountPendingSelection([
+    { id: "claude" },
+  ]);
+
+  // Cancel never reports a saved id, so no selection is ever requested — even
+  // as the catalog keeps refreshing underneath.
+  await act(async () =>
+    control.setRuntimes([{ id: "claude" }, { id: "codex" }]),
+  );
+  assert.deepEqual(selected, []);
+
+  await act(async () => root.unmount());
+});
+
+test("a saved harness discovery never publishes is never selected", async () => {
+  const { control, root, selected } = await mountPendingSelection([
+    { id: "claude" },
+  ]);
+
+  // e.g. the definition file was written but the entry failed to load. The
+  // hook must stall rather than select an id no catalog entry backs.
+  await act(async () => control.save("ghost-harness"));
+  await act(async () =>
+    control.setRuntimes([{ id: "claude" }, { id: "codex" }]),
+  );
+  assert.deepEqual(selected, []);
+
+  await act(async () => root.unmount());
+});
+
+test("two harnesses registered in a row are each selected when published", async () => {
+  const { control, root, selected } = await mountPendingSelection([
+    { id: "claude" },
+  ]);
+
+  await act(async () => control.save("first"));
+  await act(async () =>
+    control.setRuntimes([{ id: "claude" }, { id: "first" }]),
+  );
+  await act(async () => control.save("second"));
+  await act(async () =>
+    control.setRuntimes([{ id: "claude" }, { id: "first" }, { id: "second" }]),
+  );
+  assert.deepEqual(selected, ["first", "second"]);
+
+  await act(async () => root.unmount());
+});
+
+test("a second save before the first publishes selects only the later harness", async () => {
+  const { control, root, selected } = await mountPendingSelection([
+    { id: "claude" },
+  ]);
+
+  // The dropdown holds one harness, so the latest registration wins: the
+  // first id is dropped rather than queued behind the second.
+  await act(async () => control.save("first"));
+  await act(async () => control.save("second"));
+  await act(async () =>
+    control.setRuntimes([{ id: "claude" }, { id: "first" }, { id: "second" }]),
+  );
+  assert.deepEqual(selected, ["second"]);
+
+  await act(async () => root.unmount());
+});
+
+// ── Lifecycle: a pending id never outlives the dialog that created it ────────
+
+test("a harness published after its dialog closed is never selected", async () => {
+  const { control, root, selected } = await mountPendingSelection([
+    { id: "claude" },
+  ]);
+
+  // Both host dialogs stay mounted when closed, so the hook keeps running.
+  await act(async () => control.save("my-harness"));
+  await act(async () => control.setOpen(false));
+  await act(async () =>
+    control.setRuntimes([{ id: "claude" }, { id: "my-harness" }]),
+  );
+
+  // Selecting here would write into form state the close already reset.
+  assert.deepEqual(selected, []);
+
+  await act(async () => root.unmount());
+});
+
+test("reopening after closing mid-registration does not select the abandoned harness", async () => {
+  const { control, root, selected } = await mountPendingSelection([
+    { id: "claude" },
+  ]);
+
+  await act(async () => control.save("my-harness"));
+  await act(async () => control.setOpen(false));
+  await act(async () =>
+    control.setRuntimes([{ id: "claude" }, { id: "my-harness" }]),
+  );
+  // The reopened dialog seeds from its own initial values; a stale pending id
+  // must not overwrite them.
+  await act(async () => control.setOpen(true));
+  assert.deepEqual(selected, []);
+
+  await act(async () => root.unmount());
+});
+
+test("a harness saved after reopening is still selected when published", async () => {
+  const { control, root, selected } = await mountPendingSelection([
+    { id: "claude" },
+  ]);
+
+  await act(async () => control.setOpen(false));
+  await act(async () => control.setOpen(true));
+  await act(async () => control.save("my-harness"));
+  await act(async () =>
+    control.setRuntimes([{ id: "claude" }, { id: "my-harness" }]),
+  );
+  assert.deepEqual(selected, ["my-harness"]);
+
+  await act(async () => root.unmount());
+});
diff --git a/desktop/src/features/agents/ui/addCustomHarness.ts b/desktop/src/features/agents/ui/addCustomHarness.ts
new file mode 100644
index 00000000000..f9c21435300
--- /dev/null
+++ b/desktop/src/features/agents/ui/addCustomHarness.ts
@@ -0,0 +1,104 @@
+/**
+ * Shared pieces of the inline "Add custom harness…" entry the agent dialogs
+ * append to their harness dropdown.
+ *
+ * Registering a custom harness used to be reachable only from Settings, so
+ * anyone whose first stop was "New agent" never learned the path existed.
+ * These helpers keep the entry identical across the dropdowns, keep its
+ * sentinel value out of form state, and defer selecting a freshly registered
+ * harness until discovery has actually published it.
+ */
+
+import * as React from "react";
+
+import {
+  NO_RUNTIME_DROPDOWN_VALUE,
+  type PersonaDropdownOption,
+} from "./agentConfigOptions";
+
+/**
+ * Dropdown value for the add-custom-harness entry. NUL-prefixed so it can
+ * never collide with a harness id (`[a-z0-9_][a-z0-9_-]*`) — same trick as the
+ * harness catalog's `CUSTOM_ENTRY_ID`.
+ */
+export const ADD_CUSTOM_HARNESS_VALUE = "\u0000add-custom-harness";
+
+export const ADD_CUSTOM_HARNESS_OPTION: PersonaDropdownOption = {
+  label: "Add custom harness…",
+  value: ADD_CUSTOM_HARNESS_VALUE,
+};
+
+export type RuntimeDropdownAction =
+  | { kind: "add-custom-harness" }
+  | { kind: "select"; runtimeId: string };
+
+/**
+ * Route a harness-dropdown change. The add-custom entry only opens the
+ * registration form — it is never a selection, so its sentinel can't reach
+ * form state. Every other value selects, with the no-runtime sentinel
+ * normalized to the empty id.
+ */
+export function runtimeDropdownAction(value: string): RuntimeDropdownAction {
+  if (value === ADD_CUSTOM_HARNESS_VALUE) {
+    return { kind: "add-custom-harness" };
+  }
+  return {
+    kind: "select",
+    runtimeId: value === NO_RUNTIME_DROPDOWN_VALUE ? "" : value,
+  };
+}
+
+/**
+ * The pending harness id once discovery has published it, else `null`.
+ *
+ * Saving only writes the definition file — the harness becomes a catalog entry
+ * when the invalidated discovery query refetches. Selecting before then would
+ * pick an id no entry backs: the create dialog would block Save on an unknown
+ * availability, and the instance dialog could not read the command to pin.
+ */
+export function readyHarnessId(
+  runtimes: ReadonlyArray<{ id: string }>,
+  pendingId: string | null,
+): string | null {
+  return runtimes.some((runtime) => runtime.id === pendingId)
+    ? pendingId
+    : null;
+}
+
+/**
+ * Selects a newly registered custom harness once discovery publishes it.
+ *
+ * Returns the setter to hand the saved id; `onReady` then fires with it, so
+ * callers reuse their normal dropdown-change path instead of growing a second
+ * selection code path.
+ *
+ * `active` is the owning dialog's open state. The wait is only meaningful
+ * while that dialog is open: both host dialogs stay mounted across closes, so
+ * a pending id would otherwise survive the close and select into reset — or
+ * hidden — form state whenever discovery caught up. Going inactive both blocks
+ * `onReady` and drops the pending id, so a later publish is a no-op and
+ * reopening starts clean. A second save before the first publishes replaces
+ * it: the field holds one harness, so the latest save wins.
+ */
+export function usePendingHarnessSelection(
+  runtimes: ReadonlyArray<{ id: string }>,
+  onReady: (id: string) => void,
+  active: boolean,
+): (id: string) => void {
+  const [pendingId, setPendingId] = React.useState<string | null>(null);
+  // Gated at render, not just in the effect, so a catalog update landing in
+  // the same commit as the close cannot slip a selection through.
+  const readyId = active ? readyHarnessId(runtimes, pendingId) : null;
+
+  React.useEffect(() => {
+    if (!active) {
+      setPendingId(null);
+      return;
+    }
+    if (readyId === null) return;
+    setPendingId(null);
+    onReady(readyId);
+  }, [active, onReady, readyId]);
+
+  return setPendingId;
+}
diff --git a/desktop/src/features/agents/ui/agentConfigOptions.tsx b/desktop/src/features/agents/ui/agentConfigOptions.tsx
index 6ae81ff6cba..1313d2cec41 100644
--- a/desktop/src/features/agents/ui/agentConfigOptions.tsx
+++ b/desktop/src/features/agents/ui/agentConfigOptions.tsx
@@ -426,6 +426,60 @@ export function formatRuntimeOptionLabel(runtime: AcpRuntimeCatalogEntry) {
   return `${runtime.label}${suffix}`;
 }
 
+export function buildPersonaRuntimeDropdownOptions({
+  defaultRuntimeId,
+  isCreateMode,
+  runtime,
+  runtimes,
+  runtimesLoading,
+}: {
+  defaultRuntimeId?: string;
+  isCreateMode: boolean;
+  runtime: string;
+  runtimes: AcpRuntimeCatalogEntry[];
+  runtimesLoading: boolean;
+}): {
+  blankRuntimeOptionLabel: string;
+  runtimeDropdownOptions: PersonaDropdownOption[];
+} {
+  const blankRuntimeOptionLabel = runtimesLoading
+    ? "Loading harnesses..."
+    : isCreateMode
+      ? "Choose a harness"
+      : "No preference (use app default)";
+  const runtimeDropdownOptions: PersonaDropdownOption[] = [
+    ...(!isCreateMode
+      ? [
+          {
+            label: blankRuntimeOptionLabel,
+            value: NO_RUNTIME_DROPDOWN_VALUE,
+          },
+        ]
+      : []),
+    ...sortPersonaRuntimes(runtimes).map((candidate) => ({
+      disabled:
+        isCreateMode &&
+        defaultRuntimeId !== undefined &&
+        candidate.availability !== "available",
+      label: `${formatRuntimeOptionLabel(candidate)}${
+        isCreateMode && candidate.id === defaultRuntimeId ? " (default)" : ""
+      }`,
+      value: candidate.id,
+    })),
+  ];
+  const currentRuntime = runtime.trim();
+  if (
+    currentRuntime.length > 0 &&
+    !runtimeDropdownOptions.some((option) => option.value === currentRuntime)
+  ) {
+    runtimeDropdownOptions.push({
+      label: `${currentRuntime} (current)`,
+      value: currentRuntime,
+    });
+  }
+  return { blankRuntimeOptionLabel, runtimeDropdownOptions };
+}
+
 function runtimeAvailabilitySortRank(
   availability: AcpRuntimeCatalogEntry["availability"],
 ) {
diff --git a/desktop/src/features/agents/ui/effortTable.fixture.json b/desktop/src/features/agents/ui/effortTable.fixture.json
index ed44c7581bb..defb1f86de2 100644
--- a/desktop/src/features/agents/ui/effortTable.fixture.json
+++ b/desktop/src/features/agents/ui/effortTable.fixture.json
@@ -41,6 +41,13 @@
     "validValues": ["low", "medium", "high", "xhigh", "max"],
     "defaultValue": "high"
   },
+  {
+    "note": "Anthropic adaptive xhigh-capable: claude-opus-5",
+    "provider": "anthropic",
+    "model": "claude-opus-5",
+    "validValues": ["low", "medium", "high", "xhigh", "max"],
+    "defaultValue": "high"
+  },
   {
     "note": "Anthropic adaptive xhigh-capable: claude-mythos-5",
     "provider": "anthropic",
diff --git a/desktop/src/features/agents/ui/personaLibraryCopy.ts b/desktop/src/features/agents/ui/personaLibraryCopy.ts
index 53c5e7a16f4..79ddad1c3ce 100644
--- a/desktop/src/features/agents/ui/personaLibraryCopy.ts
+++ b/desktop/src/features/agents/ui/personaLibraryCopy.ts
@@ -14,14 +14,13 @@ export const personaLibraryCopy = {
 
 export const personaCatalogCopy = {
   title: "Agent Catalog",
-  description: "Browse built-in agents and add them to My Agents.",
+  description: "Browse agents shared to this relay.",
   dialogTitle: "Agent Catalog",
-  dialogDescription: "Browse built-in agents and add them to My Agents.",
+  dialogDescription: "Browse agents shared to this relay.",
   emptyTitle: "You're all set",
   emptyDescription: "Everything in Agent Catalog is already in My Agents.",
-  emptyCatalogDescription:
-    "New agents will show up here when the app ships more options.",
-  emptyCatalogTitle: "No agents in the catalog yet",
+  emptyCatalogDescription: "Shared agents will appear here.",
+  emptyCatalogTitle: "No agents are being shared",
   detailsAction: "View details",
   selectAction: "Choose",
   deselectAction: "Deselect",
diff --git a/desktop/src/features/agents/ui/runtimeAvailabilityWarning.test.mjs b/desktop/src/features/agents/ui/runtimeAvailabilityWarning.test.mjs
index 611d5ff4c86..35067143092 100644
--- a/desktop/src/features/agents/ui/runtimeAvailabilityWarning.test.mjs
+++ b/desktop/src/features/agents/ui/runtimeAvailabilityWarning.test.mjs
@@ -16,7 +16,8 @@ function entry(overrides) {
     modelEnvVar: null,
     providerEnvVar: null,
     thinkingEnvVar: null,
-    installHint: "Install the amp-acp npm adapter: npm install -g amp-acp.",
+    installHint:
+      "Buzz talks to the Amp CLI through the amp-acp adapter. Follow the setup guide to install the adapter so the amp-acp command is on your PATH.",
     installInstructionsUrl: "https://example.com",
     canAutoInstall: false,
     requiresExternalCli: false,
@@ -43,7 +44,7 @@ test("not-installed warning includes the install hint", () => {
   const warning = runtimeAvailabilityWarning(entry({}));
   assert.equal(
     warning,
-    "Amp is not installed. Install the amp-acp npm adapter: npm install -g amp-acp.",
+    "Amp is not installed. Buzz talks to the Amp CLI through the amp-acp adapter. Follow the setup guide to install the adapter so the amp-acp command is on your PATH.",
   );
 });
 
@@ -62,7 +63,7 @@ test("adapter-missing warning names the adapter and includes the hint", () => {
     warning ?? "",
     /CLI is installed but the ACP adapter is missing/,
   );
-  assert.match(warning ?? "", /npm install -g amp-acp/);
+  assert.match(warning ?? "", /amp-acp command is on your PATH/);
 });
 
 test("cli-missing external-CLI warning keeps the hint", () => {
diff --git a/desktop/src/features/agents/ui/usePersonaActions.ts b/desktop/src/features/agents/ui/usePersonaActions.ts
index 54535d121c9..2c7668969a1 100644
--- a/desktop/src/features/agents/ui/usePersonaActions.ts
+++ b/desktop/src/features/agents/ui/usePersonaActions.ts
@@ -17,9 +17,26 @@ import {
   type AgentSnapshotImportPreview,
   type AgentSnapshotImportResult,
 } from "@/features/agents/hooks";
-import { getPersonaLibraryState } from "@/features/agents/lib/catalog";
-import { clearLegacyPersonaCatalogVisibility } from "@/features/agents/lib/legacyPersonaCatalogVisibility";
+import {
+  getLibraryPersonas,
+  getPersonaLabelsById,
+} from "@/features/agents/lib/catalog";
+import {
+  type CatalogPersonaShareLevel,
+  catalogPersonasFromPublications,
+  findLocalPersonaForCatalogEntry,
+  isCatalogPersona,
+} from "@/features/agents/lib/personaCatalogRelay";
+import {
+  usePersonaCatalogLiveUpdates,
+  usePersonaCatalogQuery,
+  useSetPersonaCatalogSharedMutation,
+  useUpdatePersonaAndPublishMutation,
+} from "@/features/agents/lib/usePersonaCatalogRelay";
+import { personaSaveNotice } from "@/features/agents/lib/personaSaveNotice";
 import { useCreatedAgentChannelAttachment } from "@/features/agents/useCreatedAgentChannelAttachment";
+import { useCommunities } from "@/features/communities/useCommunities";
+import { useIdentityQuery } from "@/shared/api/hooks";
 import type {
   SnapshotFormat,
   SnapshotMemoryLevel,
@@ -51,7 +68,14 @@ type PersonaFeedbackSurface = "catalog" | "library";
 
 export function usePersonaActions() {
   const queryClient = useQueryClient();
+  const { activeCommunity } = useCommunities();
+  const identityQuery = useIdentityQuery();
+  const communityId = activeCommunity?.id ?? null;
   const personasQuery = usePersonasQuery();
+  const catalogQuery = usePersonaCatalogQuery(communityId);
+  usePersonaCatalogLiveUpdates(communityId);
+  const setCatalogSharedMutation =
+    useSetPersonaCatalogSharedMutation(communityId);
   const [shouldLoadAcpRuntimes, setShouldLoadAcpRuntimes] =
     React.useState(false);
   const acpRuntimesQuery = useAcpRuntimesQuery({
@@ -60,6 +84,8 @@ export function usePersonaActions() {
   const createAgentMutation = useCreateManagedAgentMutation();
   const createPersonaMutation = useCreatePersonaMutation();
   const updatePersonaMutation = useUpdatePersonaMutation();
+  const updatePersonaAndPublishMutation =
+    useUpdatePersonaAndPublishMutation(communityId);
   const deletePersonaMutation = useDeletePersonaMutation();
   const setPersonaActiveMutation = useSetPersonaActiveMutation();
   const exportAgentSnapshotMutation = useExportAgentSnapshotMutation();
@@ -73,10 +99,12 @@ export function usePersonaActions() {
   const [personaToShare, setPersonaToShare] = React.useState<{
     persona: AgentPersona;
     linkedAgentPubkey: string | null;
+    effectiveAvatarUrl: string | null;
   } | null>(null);
   const [personaToExportSnapshot, setPersonaToExportSnapshot] = React.useState<{
     persona: AgentPersona;
     linkedAgentPubkey: string | null;
+    effectiveAvatarUrl: string | null;
   } | null>(null);
   const [snapshotImportState, setSnapshotImportState] = React.useState<{
     fileBytes: number[];
@@ -101,9 +129,15 @@ export function usePersonaActions() {
     React.useState(false);
 
   const personas = personasQuery.data ?? [];
-  React.useEffect(() => {
-    clearLegacyPersonaCatalogVisibility();
-  }, []);
+  const publications = catalogQuery.data ?? [];
+  const sharedCatalogPersonaIdSet = React.useMemo(() => {
+    const currentPubkey = identityQuery.data?.pubkey.toLowerCase();
+    return new Set(
+      publications
+        .filter((publication) => publication.ownerPubkey === currentPubkey)
+        .map((publication) => publication.sourcePersonaId),
+    );
+  }, [identityQuery.data?.pubkey, publications]);
   const availableRuntimes = React.useMemo(
     () =>
       (acpRuntimesQuery.data ?? []).filter(
@@ -112,8 +146,21 @@ export function usePersonaActions() {
       ),
     [acpRuntimesQuery.data],
   );
-  const { catalogPersonas, libraryPersonas, personaLabelsById } = React.useMemo(
-    () => getPersonaLibraryState(personas),
+  const catalogPersonas = React.useMemo(
+    () =>
+      catalogPersonasFromPublications(
+        publications,
+        personas,
+        identityQuery.data?.pubkey,
+      ),
+    [identityQuery.data?.pubkey, personas, publications],
+  );
+  const libraryPersonas = React.useMemo(
+    () => getLibraryPersonas(personas),
+    [personas],
+  );
+  const personaLabelsById = React.useMemo(
+    () => getPersonaLabelsById(personas),
     [personas],
   );
 
@@ -130,6 +177,7 @@ export function usePersonaActions() {
     intent?: AgentCreateIntent,
     backendIntent?: BackendIntent | null,
     targetChannel?: Pick<Channel, "id" | "name"> | null,
+    options?: { publishCatalogUpdates?: boolean },
   ): Promise<boolean> {
     if (isPersonaSubmitPending) {
       return false;
@@ -139,8 +187,24 @@ export function usePersonaActions() {
     setIsPersonaSubmitPending(true);
     try {
       if ("id" in input) {
-        await updatePersonaMutation.mutateAsync(input);
-        setPersonaNoticeMessage(`Updated ${input.displayName}.`);
+        // "Save and publish" promises the community catalog sees this edit, so
+        // it must use the command that awaits the relay. A plain save only
+        // enqueues the head and cannot report the outcome.
+        if (options?.publishCatalogUpdates) {
+          const result =
+            await updatePersonaAndPublishMutation.mutateAsync(input);
+          if (result.publicationStatus === "queued" && result.relayMessage) {
+            console.warn(
+              `[updatePersonaAndPublish] relay publication queued: ${result.relayMessage}`,
+            );
+          }
+          setPersonaNoticeMessage(
+            personaSaveNotice(input.displayName, result.publicationStatus),
+          );
+        } else {
+          await updatePersonaMutation.mutateAsync(input);
+          setPersonaNoticeMessage(personaSaveNotice(input.displayName, null));
+        }
       } else {
         const runtime = availableRuntimes.find(
           (candidate) => candidate.id === input.runtime,
@@ -240,7 +304,46 @@ export function usePersonaActions() {
   ) {
     clearFeedback(surface);
     try {
-      await setPersonaActiveMutation.mutateAsync({ id: persona.id, active });
+      if (active && isCatalogPersona(persona)) {
+        const localPersona = findLocalPersonaForCatalogEntry(
+          personas,
+          persona.catalogSource,
+        );
+
+        if (localPersona) {
+          if (!localPersona.isActive) {
+            await setPersonaActiveMutation.mutateAsync({
+              id: localPersona.id,
+              active: true,
+            });
+          }
+        } else {
+          await createPersonaMutation.mutateAsync({
+            displayName: persona.displayName,
+            avatarUrl: persona.avatarUrl ?? undefined,
+            systemPrompt: persona.systemPrompt,
+            runtime: persona.runtime ?? undefined,
+            model: persona.model ?? undefined,
+            provider: persona.provider ?? undefined,
+            namePool: persona.namePool,
+            behavior: {
+              respondTo:
+                persona.respondTo === "anyone" ? "anyone" : "owner-only",
+              parallelism: persona.parallelism ?? undefined,
+            },
+            // Provenance on the copy: without it the copy's fresh local id is
+            // the only identifier, and the catalog offers "Add" again.
+            catalogSource: persona.catalogSource.isOwn
+              ? undefined
+              : {
+                  ownerPubkey: persona.catalogSource.ownerPubkey,
+                  personaId: persona.catalogSource.personaId,
+                },
+          });
+        }
+      } else {
+        await setPersonaActiveMutation.mutateAsync({ id: persona.id, active });
+      }
       setPersonaNoticeMessage(
         active
           ? `Selected ${persona.displayName} for My Agents.`
@@ -334,6 +437,7 @@ export function usePersonaActions() {
 
   function openCatalog() {
     clearFeedback("catalog");
+    void catalogQuery.refetch();
     setIsCatalogDialogOpen(true);
   }
 
@@ -345,17 +449,20 @@ export function usePersonaActions() {
   function openShare(
     persona: AgentPersona,
     linkedAgent: ManagedAgent | undefined,
+    effectiveAvatarUrl: string | null,
   ) {
     clearFeedback("library");
     setPersonaToShare({
       persona,
       linkedAgentPubkey: linkedAgent?.pubkey ?? null,
+      effectiveAvatarUrl,
     });
   }
 
   function handleExportSnapshot(
     persona: AgentPersona,
     linkedAgentPubkey: string | null,
+    effectiveAvatarUrl: string | null,
     memoryLevel: SnapshotMemoryLevel,
     format: SnapshotFormat,
   ) {
@@ -367,7 +474,7 @@ export function usePersonaActions() {
         memoryLevel,
         format,
         memorySourcePubkey: linkedAgentPubkey,
-        avatarUrl: persona.avatarUrl,
+        avatarUrl: effectiveAvatarUrl,
       },
       {
         onSuccess: (saved) => {
@@ -386,22 +493,83 @@ export function usePersonaActions() {
     );
   }
 
+  function getPersonaCatalogShareLevel(
+    persona: AgentPersona,
+  ): CatalogPersonaShareLevel {
+    return persona.shared ? "none" : "not-shared";
+  }
+
+  async function setPersonaCatalogShareLevel(
+    persona: AgentPersona,
+    shareLevel: CatalogPersonaShareLevel,
+  ): Promise<void> {
+    if (persona.isBuiltIn) return;
+
+    clearFeedback("library");
+    try {
+      const shared = shareLevel !== "not-shared";
+      const result = await setCatalogSharedMutation.mutateAsync({
+        id: persona.id,
+        shared,
+      });
+      setPersonaToShare((current) =>
+        current?.persona.id === result.persona.id
+          ? { ...current, persona: result.persona }
+          : current,
+      );
+      if (result.publicationStatus === "queued") {
+        if (shared) {
+          setPersonaNoticeMessage(
+            `Sharing ${persona.displayName} is queued. It will appear after the relay accepts the update.`,
+          );
+        } else {
+          setPersonaNoticeMessage(
+            `Removing ${persona.displayName} is queued. It may remain discoverable until the relay accepts the update.`,
+          );
+        }
+        if (result.relayMessage) {
+          console.warn(
+            `[setPersonaShared] relay publication queued: ${result.relayMessage}`,
+          );
+        }
+      } else if (!shared) {
+        setPersonaNoticeMessage(
+          `${persona.displayName} is no longer discoverable in the community catalog.`,
+        );
+      } else {
+        setPersonaNoticeMessage(
+          `Published ${persona.displayName} to the community catalog.`,
+        );
+      }
+    } catch (error) {
+      setPersonaErrorMessage(
+        error instanceof Error
+          ? error.message
+          : "Failed to update catalog sharing.",
+      );
+    }
+  }
+
   const isPending =
     isPersonaSubmitPending ||
     createPersonaMutation.isPending ||
     createAgentMutation.isPending ||
     updatePersonaMutation.isPending ||
+    updatePersonaAndPublishMutation.isPending ||
     deletePersonaMutation.isPending ||
     setPersonaActiveMutation.isPending ||
     exportAgentSnapshotMutation.isPending ||
     previewSnapshotImportMutation.isPending ||
-    confirmSnapshotImportMutation.isPending;
+    confirmSnapshotImportMutation.isPending ||
+    setCatalogSharedMutation.isPending;
 
   return {
     personasQuery,
+    catalogQuery,
     acpRuntimesQuery,
     createPersonaMutation,
     updatePersonaMutation,
+    updatePersonaAndPublishMutation,
     setPersonaActiveMutation,
     catalogPersonas,
     libraryPersonas,
@@ -431,6 +599,9 @@ export function usePersonaActions() {
     personaToExportSnapshot,
     setPersonaToExportSnapshot,
     handleExportSnapshot,
+    getPersonaCatalogShareLevel,
+    setPersonaCatalogShareLevel,
+    sharedCatalogPersonaIdSet,
     clearFeedback,
     snapshotImportState,
     snapshotImportResult,
diff --git a/desktop/src/features/channels/channelSnapshot.test.mjs b/desktop/src/features/channels/channelSnapshot.test.mjs
index 37b69f1eb21..5355bfe6f17 100644
--- a/desktop/src/features/channels/channelSnapshot.test.mjs
+++ b/desktop/src/features/channels/channelSnapshot.test.mjs
@@ -87,6 +87,36 @@ test("remove clears the snapshot for that relay", () => {
   assert.equal(readChannelSnapshot(RELAY), null);
 });
 
+test("cache write evicts disposable entries and retries at quota", () => {
+  const original = window.localStorage;
+  const storage = new Map([
+    ["buzz-channel-messages.v1:relay:old", "big"],
+    ["buzz-timeline-skeleton-shape.v1:old", "small"],
+  ]);
+  window.localStorage = {
+    get length() {
+      return storage.size;
+    },
+    key: (index) => [...storage.keys()][index] ?? null,
+    getItem: (key) => storage.get(key) ?? null,
+    setItem(key, value) {
+      if (!storage.has(key) && storage.size >= 2) {
+        throw new Error("quota exceeded");
+      }
+      storage.set(key, value);
+    },
+    removeItem: (key) => storage.delete(key),
+  };
+  try {
+    writeChannelSnapshot(RELAY, [makeChannel()]);
+    assert.deepEqual(readChannelSnapshot(RELAY), [makeChannel()]);
+    assert.equal(storage.has("buzz-channel-messages.v1:relay:old"), false);
+    assert.equal(storage.has("buzz-timeline-skeleton-shape.v1:old"), false);
+  } finally {
+    window.localStorage = original;
+  }
+});
+
 test("write is tolerant of storage failures", () => {
   const original = window.localStorage.setItem;
   window.localStorage.setItem = () => {
diff --git a/desktop/src/features/channels/channelSnapshot.ts b/desktop/src/features/channels/channelSnapshot.ts
index 404377eee3c..265b675790e 100644
--- a/desktop/src/features/channels/channelSnapshot.ts
+++ b/desktop/src/features/channels/channelSnapshot.ts
@@ -13,6 +13,7 @@
 
 import type { Channel } from "@/shared/api/types";
 import { normalizeRelayUrl } from "@/features/profile/lib/selfProfileStorage";
+import { setLocalStorageItemWithRecovery } from "@/shared/lib/localStorageQuota";
 
 const STORAGE_KEY_PREFIX = "buzz-channels.v1";
 
@@ -51,9 +52,22 @@ export function writeChannelSnapshot(
 ): void {
   try {
     const key = channelSnapshotKey(relayUrl);
-    const serialized = JSON.stringify({ version: 1, channels });
-    if (window.localStorage.getItem(key) === serialized) return;
-    window.localStorage.setItem(key, serialized);
+    const previous = window.localStorage.getItem(key);
+    if (previous) {
+      try {
+        const parsed = parseChannelSnapshot(JSON.parse(previous));
+        if (parsed && JSON.stringify(parsed) === JSON.stringify(channels))
+          return;
+      } catch {
+        // Malformed snapshots are replaced below.
+      }
+    }
+    const serialized = JSON.stringify({
+      version: 1,
+      updatedAt: Date.now(),
+      channels,
+    });
+    setLocalStorageItemWithRecovery(key, serialized);
   } catch {
     // Storage access failures are non-fatal.
   }
diff --git a/desktop/src/features/channels/ui/BotActivityBar.tsx b/desktop/src/features/channels/ui/BotActivityBar.tsx
index 21ab04f8d6b..d685a961030 100644
--- a/desktop/src/features/channels/ui/BotActivityBar.tsx
+++ b/desktop/src/features/channels/ui/BotActivityBar.tsx
@@ -164,7 +164,7 @@ export function BotActivityComposerAction({
           className={cn(
             "inline-flex items-center justify-center rounded-full border border-border/60 bg-background font-medium text-muted-foreground transition-colors hover:border-primary/30 hover:bg-primary/5 hover:text-foreground focus-visible:outline-hidden focus-visible:ring-1 focus-visible:ring-ring data-[state=open]:border-primary/40 data-[state=open]:bg-primary/10 data-[state=open]:text-primary",
             isInline
-              ? "h-7 min-w-0 gap-2 overflow-visible border-transparent bg-transparent px-0 text-xs font-semibold leading-none shadow-none hover:border-transparent hover:bg-transparent data-[state=open]:border-transparent data-[state=open]:bg-transparent"
+              ? "min-w-0 gap-1.5 overflow-visible border-transparent bg-transparent px-0 text-xs font-normal leading-normal shadow-none hover:border-transparent hover:bg-transparent data-[state=open]:border-transparent data-[state=open]:bg-transparent"
               : "h-9 min-w-9 gap-1.5 px-2 text-xs",
           )}
           data-testid="bot-activity-composer-trigger"
@@ -178,17 +178,16 @@ export function BotActivityComposerAction({
           onMouseLeave={closeWithDelay}
           type="button"
         >
-          <span className="flex items-center overflow-visible py-px -space-x-1">
+          <span className="flex h-4.5 items-center overflow-visible -space-x-1">
             {workingAgents.slice(0, 2).map((agent) => (
               <UserAvatar
                 avatarUrl={agentAvatarUrl(agent)}
                 className={cn(
                   "border border-background",
-                  isInline
-                    ? "!h-[18px] !w-[18px] shadow-xs ring-1 ring-primary/25 text-3xs"
-                    : "shrink-0",
+                  isInline ? "!h-4.5 !w-4.5 text-3xs" : "shrink-0",
                 )}
                 displayName={agent.name}
+                fallbackDelayMs={isInline ? 0 : undefined}
                 key={agent.pubkey}
                 size="xs"
               />
@@ -201,11 +200,15 @@ export function BotActivityComposerAction({
           ) : null}
           <span
             className={cn(
-              isInline ? "min-w-0 flex-1 overflow-hidden" : "sr-only",
+              isInline
+                ? "flex h-4.5 min-w-0 flex-1 items-center overflow-visible leading-none"
+                : "sr-only",
             )}
           >
             {isInline ? (
-              <Shimmer className="block truncate">{visibleStatusLabel}</Shimmer>
+              <Shimmer className="-my-px truncate py-px">
+                {visibleStatusLabel}
+              </Shimmer>
             ) : (
               "working"
             )}
diff --git a/desktop/src/features/channels/ui/ChannelComposerActivityAccessory.tsx b/desktop/src/features/channels/ui/ChannelComposerActivityAccessory.tsx
new file mode 100644
index 00000000000..216b205fcc6
--- /dev/null
+++ b/desktop/src/features/channels/ui/ChannelComposerActivityAccessory.tsx
@@ -0,0 +1,66 @@
+import type { ComponentProps } from "react";
+
+import { BotActivityComposerAction } from "@/features/channels/ui/BotActivityBar";
+import { ComposerActivityAccessory } from "@/features/messages/ui/ComposerActivityAccessory";
+import { TypingIndicatorRow } from "@/features/messages/ui/TypingIndicatorRow";
+
+type ChannelComposerActivityAccessoryProps = {
+  agents: ComponentProps<typeof BotActivityComposerAction>["agents"];
+  channel: ComponentProps<typeof TypingIndicatorRow>["channel"];
+  currentPubkey: ComponentProps<typeof TypingIndicatorRow>["currentPubkey"];
+  onOpenAgentSession: ComponentProps<
+    typeof BotActivityComposerAction
+  >["onOpenAgentSession"];
+  openAgentSessionPubkey: ComponentProps<
+    typeof BotActivityComposerAction
+  >["openAgentSessionPubkey"];
+  profiles: ComponentProps<typeof BotActivityComposerAction>["profiles"];
+  typingPubkeys: string[];
+  visible: boolean;
+  workingBotPubkeys: string[];
+};
+
+export function ChannelComposerActivityAccessory({
+  agents,
+  channel,
+  currentPubkey,
+  onOpenAgentSession,
+  openAgentSessionPubkey,
+  profiles,
+  typingPubkeys,
+  visible,
+  workingBotPubkeys,
+}: ChannelComposerActivityAccessoryProps) {
+  return (
+    <ComposerActivityAccessory
+      className="px-5"
+      testId="channel-composer-activity-row"
+      visible={visible}
+    >
+      <div className="flex w-full items-center gap-2 overflow-visible pl-2">
+        {workingBotPubkeys.length > 0 ? (
+          <div className="flex min-w-0 flex-1 overflow-visible">
+            <BotActivityComposerAction
+              agents={agents}
+              channelId={channel?.id ?? null}
+              onOpenAgentSession={onOpenAgentSession}
+              openAgentSessionPubkey={openAgentSessionPubkey}
+              profiles={profiles}
+              workingBotPubkeys={workingBotPubkeys}
+              variant="inline"
+            />
+          </div>
+        ) : null}
+        {typingPubkeys.length > 0 ? (
+          <TypingIndicatorRow
+            channel={channel}
+            className="min-w-0 flex-1 py-0 pl-[calc(0.75rem+1px)] pr-0 sm:pl-[calc(1rem+1px)]"
+            currentPubkey={currentPubkey}
+            profiles={profiles}
+            typingPubkeys={typingPubkeys}
+          />
+        ) : null}
+      </div>
+    </ComposerActivityAccessory>
+  );
+}
diff --git a/desktop/src/features/channels/ui/ChannelPane.tsx b/desktop/src/features/channels/ui/ChannelPane.tsx
index dbce0b6f5ea..92fa172ff5a 100644
--- a/desktop/src/features/channels/ui/ChannelPane.tsx
+++ b/desktop/src/features/channels/ui/ChannelPane.tsx
@@ -3,6 +3,7 @@ import { Hash, LogIn } from "lucide-react";
 import { AnimatePresence } from "motion/react";
 import { useAppNavigation } from "@/app/navigation/useAppNavigation";
 import { useMediaUpload } from "@/features/messages/lib/useMediaUpload";
+import { ComposerDockBackdrop } from "@/features/messages/ui/ComposerDockBackdrop";
 import { MessageComposer } from "@/features/messages/ui/MessageComposer";
 import { ComposerTimeoutBanner } from "@/features/moderation/ui/ComposerTimeoutBanner";
 import { useTimeoutState } from "@/features/moderation/lib/timeoutStore";
@@ -25,7 +26,6 @@ import {
   buildVideoReviewContextForMessage,
 } from "@/features/messages/lib/videoReviewContext";
 import { useComposerHeightPadding } from "@/features/messages/ui/useComposerHeightPadding";
-import { TypingIndicatorRow } from "@/features/messages/ui/TypingIndicatorRow";
 import { UserProfilePanel } from "@/features/profile/ui/UserProfilePanel";
 import { ChannelFindBar } from "@/features/search/ui/ChannelFindBar";
 import { AgentSessionThreadPanel } from "@/features/channels/ui/AgentSessionThreadPanel";
@@ -40,6 +40,7 @@ import { useThreadViewModeSwitch } from "@/features/channels/ui/useThreadViewMod
 import { useFocusDrawerPresence } from "@/features/channels/ui/useFocusDrawerPresence";
 import { useChannelWorkingAgentPubkeys } from "@/features/agents/agentWorkingSignal";
 import { BotActivityComposerAction } from "@/features/channels/ui/BotActivityBar";
+import { ChannelComposerActivityAccessory } from "@/features/channels/ui/ChannelComposerActivityAccessory";
 import {
   containsWelcomePersonaMention,
   WelcomeComposerBanner,
@@ -218,6 +219,7 @@ export const ChannelPane = React.memo(function ChannelPane({
     composerWrapperRef,
     `${activeChannelId}:${isSinglePanelView}:${hasMainComposerOverlay}`,
     "css-variable",
+    () => messageTimelineRef.current?.settleAtBottom() ?? false,
   );
   const clearWelcomeComposerDismissTimer = React.useCallback(() => {
     if (welcomeComposerDismissTimerRef.current !== null) {
@@ -408,26 +410,18 @@ export const ChannelPane = React.memo(function ChannelPane({
     activeChannel?.id ?? null,
   );
   const hasComposerBotActivity = composerWorkingBotPubkeys.length > 0;
+  const hasComposerBottomActivity = hasComposerBotActivity || hasTypingActivity;
   const threadComposerBotTypingPubkeys = React.useMemo(() => {
-    if (!openThreadHeadId) {
-      return [];
-    }
-
-    const pubkeys: string[] = [];
-    for (const entry of botTypingEntries) {
-      if (entry.threadHeadId !== openThreadHeadId) {
-        continue;
-      }
-
-      if (
-        !pubkeys.some(
-          (pubkey) => pubkey.toLowerCase() === entry.pubkey.toLowerCase(),
-        )
-      ) {
-        pubkeys.push(entry.pubkey);
-      }
-    }
-    return pubkeys;
+    if (!openThreadHeadId) return [];
+    return botTypingEntries
+      .filter((entry) => entry.threadHeadId === openThreadHeadId)
+      .map((entry) => entry.pubkey)
+      .filter(
+        (pubkey, index, all) =>
+          all.findIndex(
+            (candidate) => candidate.toLowerCase() === pubkey.toLowerCase(),
+          ) === index,
+      );
   }, [botTypingEntries, openThreadHeadId]);
   const hasThreadComposerBotActivity =
     threadComposerBotTypingPubkeys.length > 0;
@@ -514,8 +508,6 @@ export const ChannelPane = React.memo(function ChannelPane({
   const isOverlay = useIsThreadPanelOverlay();
   const useSplitAuxiliaryPane = !isSinglePanelView && !isOverlay;
   const threadViewMode = useThreadViewMode();
-  // Focus mode only replaces the wide split thread pane; narrow threads and
-  // other auxiliary panels keep their existing presentation.
   const useFocusThreadDrawer =
     threadViewMode === "focus" &&
     useSplitAuxiliaryPane &&
@@ -526,6 +518,7 @@ export const ChannelPane = React.memo(function ChannelPane({
   );
   const { changeThreadViewMode, layoutScrollTargetId, resolveScrollTarget } =
     useThreadViewModeSwitch({
+      activeThreadHeadId: threadHeadMessage?.id ?? null,
       externalScrollTargetId: threadScrollTargetId,
       onExternalTargetResolved: onThreadScrollTargetResolved,
       onModeChange: markExitComplete,
@@ -734,7 +727,12 @@ export const ChannelPane = React.memo(function ChannelPane({
               data-testid="channel-composer-overlay"
               ref={composerWrapperRef}
             >
-              <div className="composer-overlay-corner-masks pointer-events-auto">
+              <div
+                className={cn(
+                  "composer-dock composer-overlay-corner-masks relative pointer-events-auto",
+                  hasComposerBottomActivity && "composer-dock--with-activity",
+                )}
+              >
                 {timeoutState.active ? (
                   <ComposerTimeoutBanner
                     expiresAtMs={timeoutState.expiresAtMs}
@@ -748,11 +746,13 @@ export const ChannelPane = React.memo(function ChannelPane({
                     />
                   </div>
                 ) : null}
+                <ComposerDockBackdrop gutterClassName="inset-x-5" />
                 <MessageComposer
                   channelId={activeChannel?.id ?? null}
                   channelName={activeChannel?.name ?? "channel"}
                   channelType={activeChannel?.channelType ?? null}
-                  containerClassName="px-5"
+                  containerClassName="px-5 pb-0"
+                  layoutMode="dock"
                   disabled={isComposerDisabled}
                   editTarget={mainEditTarget}
                   autoSubmitDraftKey={autoSendDraftKey}
@@ -787,40 +787,26 @@ export const ChannelPane = React.memo(function ChannelPane({
                   }
                   showTopBorder={false}
                 />
-                <div
-                  className="min-h-8 overflow-visible bg-background px-5 pb-1.5 pt-0"
-                  data-testid="channel-composer-activity-row"
-                >
-                  <div className="flex h-full w-full items-center gap-2 overflow-visible">
-                    {hasComposerBotActivity ? (
-                      <div className="flex min-w-0 flex-1 overflow-visible">
-                        <BotActivityComposerAction
-                          agents={activityAgents}
-                          channelId={activeChannel?.id ?? null}
-                          onOpenAgentSession={onOpenAgentSession}
-                          openAgentSessionPubkey={openAgentSessionPubkey}
-                          profiles={profiles}
-                          workingBotPubkeys={composerWorkingBotPubkeys}
-                          variant="inline"
-                        />
-                      </div>
-                    ) : null}
-                    {hasTypingActivity ? (
-                      <TypingIndicatorRow
-                        channel={activeChannel}
-                        className="min-w-0 flex-1 py-0 pl-[calc(0.75rem+1px)] pr-0 sm:pl-[calc(1rem+1px)]"
-                        currentPubkey={currentPubkey}
-                        profiles={profiles}
-                        typingPubkeys={typingPubkeys}
-                      />
-                    ) : null}
-                  </div>
-                </div>
+                {/* The activity accessory is anchored in the dock's reserved
+                    bottom rail, so fading it cannot change the observed
+                    overlay height or move the conversation. Its natural
+                    content height remains responsive. */}
+                <ChannelComposerActivityAccessory
+                  agents={activityAgents}
+                  channel={activeChannel}
+                  currentPubkey={currentPubkey}
+                  onOpenAgentSession={onOpenAgentSession}
+                  openAgentSessionPubkey={openAgentSessionPubkey}
+                  profiles={profiles}
+                  typingPubkeys={typingPubkeys}
+                  visible={hasComposerBottomActivity}
+                  workingBotPubkeys={composerWorkingBotPubkeys}
+                />
               </div>
             </div>
           )}
           {canDropInMainColumn && mainComposerMedia.isDragOver ? (
-            <DropZoneOverlay className="z-30 rounded-none" />
+            <DropZoneOverlay className="z-50 rounded-2xl bg-primary/20 backdrop-blur-sm" />
           ) : null}
         </section>
       ) : null}
@@ -881,7 +867,8 @@ export const ChannelPane = React.memo(function ChannelPane({
                 onExpandReplies={onExpandThreadReplies}
                 onSelectReplyTarget={onSelectThreadReplyTarget}
                 onSend={onSendThreadReply}
-                onScrollTargetResolved={resolveScrollTarget}
+                onScrollTargetResolved={() => resolveScrollTarget()}
+                onScrollTargetSettled={resolveScrollTarget}
                 onToggleReaction={onToggleReaction}
                 onUnfollowThread={onUnfollowThread}
                 profiles={profiles}
@@ -898,7 +885,8 @@ export const ChannelPane = React.memo(function ChannelPane({
                 )}
                 threadReplyUnreadCounts={threadReplyUnreadCounts}
                 threadTypingPubkeys={threadTypingPubkeys}
-                toolbarExtraActions={
+                activityAccessoryVisible={hasThreadComposerBotActivity}
+                activityAccessoryContent={
                   hasThreadComposerBotActivity ? (
                     <BotActivityComposerAction
                       agents={activityAgents}
diff --git a/desktop/src/features/channels/ui/useThreadViewModeSwitch.test.mjs b/desktop/src/features/channels/ui/useThreadViewModeSwitch.test.mjs
index 255492bf49a..9f40a00fbc2 100644
--- a/desktop/src/features/channels/ui/useThreadViewModeSwitch.test.mjs
+++ b/desktop/src/features/channels/ui/useThreadViewModeSwitch.test.mjs
@@ -4,6 +4,7 @@ import test from "node:test";
 import {
   findTopVisibleThreadMessageId,
   getResolvedThreadTargets,
+  getScopedLayoutScrollTargetId,
 } from "./useThreadViewModeSwitch.ts";
 
 function row(id, top, bottom) {
@@ -44,6 +45,55 @@ test("resolves both sources when a layout anchor matches the external target", (
   );
 });
 
+test("does not resolve a layout target that was never captured", () => {
+  assert.deepEqual(
+    getResolvedThreadTargets({
+      externalTargetId: "reply-b",
+      layoutTargetId: null,
+    }),
+    { resolveExternal: true, resolveLayout: false },
+  );
+  assert.deepEqual(
+    getResolvedThreadTargets({
+      externalTargetId: null,
+      layoutTargetId: null,
+    }),
+    { resolveExternal: true, resolveLayout: false },
+  );
+});
+
+test("drops a captured layout target when the active thread closes or changes", () => {
+  const captured = { messageId: "reply-a", threadHeadId: "thread-a" };
+
+  assert.equal(
+    getScopedLayoutScrollTargetId({
+      activeThreadHeadId: "thread-a",
+      layoutTarget: captured,
+    }),
+    "reply-a",
+  );
+  assert.equal(
+    getScopedLayoutScrollTargetId({
+      activeThreadHeadId: null,
+      layoutTarget: captured,
+    }),
+    null,
+  );
+  const replacementLayoutTargetId = getScopedLayoutScrollTargetId({
+    activeThreadHeadId: "thread-b",
+    layoutTarget: captured,
+  });
+  assert.equal(replacementLayoutTargetId, null);
+  assert.deepEqual(
+    getResolvedThreadTargets({
+      externalTargetId: "reply-b",
+      layoutTargetId: replacementLayoutTargetId,
+    }),
+    { resolveExternal: true, resolveLayout: false },
+    "the stale anchor does not mask the replacement thread target",
+  );
+});
+
 test("returns null without a mounted thread body or visible message", () => {
   assert.equal(findTopVisibleThreadMessageId(null), null);
   assert.equal(
diff --git a/desktop/src/features/channels/ui/useThreadViewModeSwitch.ts b/desktop/src/features/channels/ui/useThreadViewModeSwitch.ts
index 5493eada508..8dd41cfc51e 100644
--- a/desktop/src/features/channels/ui/useThreadViewModeSwitch.ts
+++ b/desktop/src/features/channels/ui/useThreadViewModeSwitch.ts
@@ -31,7 +31,25 @@ export function getResolvedThreadTargets({
   };
 }
 
+type LayoutScrollTarget = {
+  messageId: string;
+  threadHeadId: string;
+};
+
+export function getScopedLayoutScrollTargetId({
+  activeThreadHeadId,
+  layoutTarget,
+}: {
+  activeThreadHeadId: string | null;
+  layoutTarget: LayoutScrollTarget | null;
+}): string | null {
+  return layoutTarget?.threadHeadId === activeThreadHeadId
+    ? layoutTarget.messageId
+    : null;
+}
+
 type ThreadViewModeSwitchOptions = {
+  activeThreadHeadId: string | null;
   externalScrollTargetId: string | null;
   onExternalTargetResolved: () => void;
   onModeChange?: (mode: ThreadViewMode) => void;
@@ -39,13 +57,23 @@ type ThreadViewModeSwitchOptions = {
 
 /** Preserves the reply being read while the thread changes presentation. */
 export function useThreadViewModeSwitch({
+  activeThreadHeadId,
   externalScrollTargetId,
   onExternalTargetResolved,
   onModeChange,
 }: ThreadViewModeSwitchOptions) {
-  const [layoutScrollTargetId, setLayoutScrollTargetId] = React.useState<
-    string | null
-  >(null);
+  const [layoutScrollTarget, setLayoutScrollTarget] =
+    React.useState<LayoutScrollTarget | null>(null);
+  const layoutScrollTargetId = getScopedLayoutScrollTargetId({
+    activeThreadHeadId,
+    layoutTarget: layoutScrollTarget,
+  });
+
+  React.useEffect(() => {
+    setLayoutScrollTarget((current) =>
+      current?.threadHeadId === activeThreadHeadId ? current : null,
+    );
+  }, [activeThreadHeadId]);
 
   const changeThreadViewMode = React.useCallback(
     (mode: ThreadViewMode, restoreFocus: boolean) => {
@@ -54,7 +82,11 @@ export function useThreadViewModeSwitch({
       );
       const anchorId = findTopVisibleThreadMessageId(body);
 
-      setLayoutScrollTargetId(anchorId);
+      setLayoutScrollTarget(
+        anchorId && activeThreadHeadId
+          ? { messageId: anchorId, threadHeadId: activeThreadHeadId }
+          : null,
+      );
       onModeChange?.(mode);
       setThreadViewMode(mode);
       requestAnimationFrame(() => {
@@ -69,17 +101,32 @@ export function useThreadViewModeSwitch({
         });
       });
     },
-    [onModeChange],
+    [activeThreadHeadId, onModeChange],
   );
 
-  const resolveScrollTarget = React.useCallback(() => {
-    const resolution = getResolvedThreadTargets({
-      externalTargetId: externalScrollTargetId,
-      layoutTargetId: layoutScrollTargetId,
-    });
-    if (resolution.resolveLayout) setLayoutScrollTargetId(null);
-    if (resolution.resolveExternal) onExternalTargetResolved();
-  }, [externalScrollTargetId, layoutScrollTargetId, onExternalTargetResolved]);
+  const resolveScrollTarget = React.useCallback(
+    (settledMessageId?: string) => {
+      const resolution = getResolvedThreadTargets({
+        externalTargetId: externalScrollTargetId,
+        layoutTargetId: layoutScrollTargetId,
+      });
+      if (resolution.resolveExternal) onExternalTargetResolved();
+      if (settledMessageId) {
+        setLayoutScrollTarget((current) =>
+          current?.threadHeadId === activeThreadHeadId &&
+          current.messageId === settledMessageId
+            ? null
+            : current,
+        );
+      }
+    },
+    [
+      activeThreadHeadId,
+      externalScrollTargetId,
+      layoutScrollTargetId,
+      onExternalTargetResolved,
+    ],
+  );
 
   return {
     changeThreadViewMode,
diff --git a/desktop/src/features/channels/useLiveChannelUpdates.ts b/desktop/src/features/channels/useLiveChannelUpdates.ts
index f8db0af5e29..aeb3abb9059 100644
--- a/desktop/src/features/channels/useLiveChannelUpdates.ts
+++ b/desktop/src/features/channels/useLiveChannelUpdates.ts
@@ -88,6 +88,13 @@ export function isChannelUnreadTriggerKind(kind: number, isDmChannel: boolean) {
     : UNREAD_TRIGGER_KINDS.has(kind);
 }
 
+export function isHomeActivityEvent(
+  isDmChannel: boolean,
+  isThreadedReply: boolean,
+) {
+  return isThreadedReply || isDmChannel;
+}
+
 export function withChannelTagFallback(
   event: RelayEvent,
   channelId: string,
@@ -278,7 +285,7 @@ export function useLiveChannelUpdates(
         }
       } else {
         options.onChannelMessage?.(channelId, event);
-        if (isThreadedReply) {
+        if (isHomeActivityEvent(isDmChannel, isThreadedReply)) {
           options.onThreadReplyNotification?.(channelId, event);
         }
       }
diff --git a/desktop/src/features/communities/ui/CommunityEditForm.tsx b/desktop/src/features/communities/ui/CommunityEditForm.tsx
index 4c94acf102a..76837b65aac 100644
--- a/desktop/src/features/communities/ui/CommunityEditForm.tsx
+++ b/desktop/src/features/communities/ui/CommunityEditForm.tsx
@@ -68,7 +68,7 @@ export function CommunityEditForm({
 
     let cancelled = false;
     const timeoutId = window.setTimeout(() => {
-      void getJoinPolicy(normalizedUrl)
+      void getJoinPolicy(normalizedUrl, "native")
         .then((policy) => {
           if (cancelled || !policy) return;
           setJoinPolicy(policy);
@@ -105,7 +105,7 @@ export function CommunityEditForm({
 
       if (joinPolicyRequired) {
         try {
-          const policy = await getJoinPolicy(normalizedUrl);
+          const policy = await getJoinPolicy(normalizedUrl, "native");
           if (!policy) {
             onSubmit(trimmedName, normalizedUrl);
             return;
diff --git a/desktop/src/features/community-members/ui/CommunityInviteDialog.tsx b/desktop/src/features/community-members/ui/CommunityInviteDialog.tsx
index bd23e2bbecb..9daca590f47 100644
--- a/desktop/src/features/community-members/ui/CommunityInviteDialog.tsx
+++ b/desktop/src/features/community-members/ui/CommunityInviteDialog.tsx
@@ -3,6 +3,7 @@ import * as React from "react";
 import {
   Dialog,
   DialogContent,
+  DialogDescription,
   DialogHeader,
   DialogTitle,
 } from "@/shared/ui/dialog";
@@ -29,12 +30,14 @@ export function CommunityInviteDialog({
   return (
     <Dialog onOpenChange={onOpenChange} open={open}>
       <DialogContent
-        aria-describedby={undefined}
         className="max-h-[85vh] max-w-xl overflow-y-auto"
         data-testid="community-invite-dialog"
       >
-        <DialogHeader className="space-y-0">
+        <DialogHeader>
           <DialogTitle>Invite to community</DialogTitle>
+          <DialogDescription>
+            Anyone with this link can join this community.
+          </DialogDescription>
         </DialogHeader>
 
         <InviteLinkSection onTtlSecsChange={setTtlSecs} ttlSecs={ttlSecs} />
diff --git a/desktop/src/features/community-members/ui/InviteLinkSection.tsx b/desktop/src/features/community-members/ui/InviteLinkSection.tsx
index 76c0262ea5c..dc0735c85e0 100644
--- a/desktop/src/features/community-members/ui/InviteLinkSection.tsx
+++ b/desktop/src/features/community-members/ui/InviteLinkSection.tsx
@@ -8,10 +8,8 @@ import { Button } from "@/shared/ui/button";
 import {
   DropdownMenu,
   DropdownMenuContent,
-  DropdownMenuLabel,
   DropdownMenuRadioGroup,
   DropdownMenuRadioItem,
-  DropdownMenuSeparator,
   DropdownMenuTrigger,
 } from "@/shared/ui/dropdown-menu";
 import { Separator } from "@/shared/ui/separator";
@@ -24,6 +22,15 @@ const TTL_OPTIONS: { label: string; value: number }[] = [
   { label: "30 days", value: 30 * 24 * 60 * 60 },
 ];
 
+const MAX_USE_OPTIONS: { label: string; value: number | null }[] = [
+  { label: "No limit", value: null },
+  { label: "1 use", value: 1 },
+  { label: "3 uses", value: 3 },
+  { label: "5 uses", value: 5 },
+  { label: "10 uses", value: 10 },
+  { label: "25 uses", value: 25 },
+];
+
 export const DEFAULT_INVITE_TTL_SECS = TTL_OPTIONS[1].value;
 
 type CopyStatus = "idle" | "copying" | "copied";
@@ -31,8 +38,9 @@ type CopyStatus = "idle" | "copying" | "copied";
 /**
  * Share-with-link footer for the community invite dialog.
  *
- * Each copy action mints a fresh stateless invite code and places its
- * shareable landing-page URL on the clipboard.
+ * Each copy action mints a fresh database-backed invite code and places its
+ * shareable landing-page URL on the clipboard. Invites may be unlimited or
+ * capped to a caller-selected number of successful joins.
  */
 export function InviteLinkSection({
   onTtlSecsChange,
@@ -42,8 +50,12 @@ export function InviteLinkSection({
   ttlSecs: number;
 }) {
   const [copyStatus, setCopyStatus] = React.useState<CopyStatus>("idle");
+  const [maxUses, setMaxUses] = React.useState<number | null>(null);
   const ttlLabel =
     TTL_OPTIONS.find((option) => option.value === ttlSecs)?.label ?? "3 days";
+  const maxUsesLabel =
+    MAX_USE_OPTIONS.find((option) => option.value === maxUses)?.label ??
+    "No limit";
   const copyLabel =
     copyStatus === "copying"
       ? "Copying…"
@@ -61,7 +73,7 @@ export function InviteLinkSection({
     if (copyStatus === "copying") return;
     setCopyStatus("copying");
     try {
-      const invite = await mintInvite(ttlSecs);
+      const invite = await mintInvite({ ttlSecs, maxUses });
       await writeTextToClipboard(invite.url);
       setCopyStatus("copied");
       toast.success("Invite link copied");
@@ -73,50 +85,79 @@ export function InviteLinkSection({
 
   return (
     <section className="pt-2" data-testid="community-invite-link-section">
-      <div className="flex items-center gap-3">
-        <span className="flex h-8 w-8 shrink-0 items-center justify-center rounded-full bg-muted text-muted-foreground">
-          <Link2 aria-hidden="true" className="h-4 w-4" />
-        </span>
-        <div className="min-w-0 flex-1">
-          <h3 className="text-sm font-medium">Share with a link</h3>
-          <p className="text-xs text-secondary-foreground/75">
-            Anyone with the link can join this community.
-          </p>
+      <div className="space-y-5">
+        <div className="flex items-center justify-between gap-4">
+          <span className="text-sm font-medium">Expires after</span>
+          <DropdownMenu>
+            <DropdownMenuTrigger asChild>
+              <Button
+                aria-label="Choose invite expiry"
+                className="h-8 shrink-0 gap-1.5 px-2 text-sm text-muted-foreground"
+                data-testid="invite-link-ttl-trigger"
+                disabled={copyStatus === "copying"}
+                size="sm"
+                type="button"
+                variant="ghost"
+              >
+                {ttlLabel}
+                <ChevronDown aria-hidden="true" className="h-3.5 w-3.5" />
+              </Button>
+            </DropdownMenuTrigger>
+            <DropdownMenuContent align="end" className="w-40">
+              <DropdownMenuRadioGroup
+                onValueChange={(value) => onTtlSecsChange(Number(value))}
+                value={String(ttlSecs)}
+              >
+                {TTL_OPTIONS.map((option) => (
+                  <DropdownMenuRadioItem
+                    data-testid={`invite-link-ttl-${option.value}`}
+                    key={option.value}
+                    value={String(option.value)}
+                  >
+                    {option.label}
+                  </DropdownMenuRadioItem>
+                ))}
+              </DropdownMenuRadioGroup>
+            </DropdownMenuContent>
+          </DropdownMenu>
+        </div>
+        <div className="flex items-center justify-between gap-4">
+          <span className="text-sm font-medium">Limit number of uses</span>
+          <DropdownMenu>
+            <DropdownMenuTrigger asChild>
+              <Button
+                aria-label="Choose maximum invite uses"
+                className="h-8 shrink-0 gap-1.5 px-2 text-sm text-muted-foreground"
+                data-testid="invite-link-max-uses-trigger"
+                disabled={copyStatus === "copying"}
+                size="sm"
+                type="button"
+                variant="ghost"
+              >
+                {maxUsesLabel}
+                <ChevronDown aria-hidden="true" className="h-3.5 w-3.5" />
+              </Button>
+            </DropdownMenuTrigger>
+            <DropdownMenuContent align="end" className="w-40">
+              <DropdownMenuRadioGroup
+                onValueChange={(value) =>
+                  setMaxUses(value === "no-limit" ? null : Number(value))
+                }
+                value={String(maxUses ?? "no-limit")}
+              >
+                {MAX_USE_OPTIONS.map((option) => (
+                  <DropdownMenuRadioItem
+                    data-testid={`invite-link-max-uses-${option.value ?? "no-limit"}`}
+                    key={option.value ?? "no-limit"}
+                    value={String(option.value ?? "no-limit")}
+                  >
+                    {option.label}
+                  </DropdownMenuRadioItem>
+                ))}
+              </DropdownMenuRadioGroup>
+            </DropdownMenuContent>
+          </DropdownMenu>
         </div>
-        <DropdownMenu>
-          <DropdownMenuTrigger asChild>
-            <Button
-              aria-label="Choose invite expiry"
-              className="h-8 shrink-0 gap-1.5 px-2 text-muted-foreground"
-              data-testid="invite-link-ttl-trigger"
-              disabled={copyStatus === "copying"}
-              size="sm"
-              type="button"
-              variant="ghost"
-            >
-              {ttlLabel}
-              <ChevronDown aria-hidden="true" className="h-3.5 w-3.5" />
-            </Button>
-          </DropdownMenuTrigger>
-          <DropdownMenuContent align="end" className="w-40">
-            <DropdownMenuLabel>Expires after</DropdownMenuLabel>
-            <DropdownMenuSeparator />
-            <DropdownMenuRadioGroup
-              onValueChange={(value) => onTtlSecsChange(Number(value))}
-              value={String(ttlSecs)}
-            >
-              {TTL_OPTIONS.map((option) => (
-                <DropdownMenuRadioItem
-                  data-testid={`invite-link-ttl-${option.value}`}
-                  key={option.value}
-                  value={String(option.value)}
-                >
-                  {option.label}
-                </DropdownMenuRadioItem>
-              ))}
-            </DropdownMenuRadioGroup>
-          </DropdownMenuContent>
-        </DropdownMenu>
       </div>
       <Separator className="my-4 bg-input/40" />
       <div className="flex justify-end">
diff --git a/desktop/src/features/home/lib/homeMessageCapabilities.ts b/desktop/src/features/home/lib/homeMessageCapabilities.ts
new file mode 100644
index 00000000000..effd96e9346
--- /dev/null
+++ b/desktop/src/features/home/lib/homeMessageCapabilities.ts
@@ -0,0 +1,31 @@
+import type { InboxItem } from "@/features/home/lib/inbox";
+
+export function getHomeMessageCapabilities(
+  item: InboxItem | null,
+  currentPubkey: string | undefined,
+  availableChannelIds: ReadonlySet<string>,
+) {
+  const canReact = Boolean(
+    item?.item.channelId && availableChannelIds.has(item.item.channelId),
+  );
+  const canReply =
+    canReact && item?.item.kind !== 45001 && item?.item.kind !== 45003;
+  const disabledReplyReason =
+    canReply || !item
+      ? null
+      : item.item.channelId
+        ? availableChannelIds.has(item.item.channelId)
+          ? "This item does not support inline replies yet."
+          : "Open the linked channel to reply."
+        : "This inbox item does not have a reply target.";
+
+  return {
+    canDelete:
+      item !== null &&
+      currentPubkey?.trim().toLowerCase() ===
+        item.item.pubkey.trim().toLowerCase(),
+    canReact,
+    canReply,
+    disabledReplyReason,
+  };
+}
diff --git a/desktop/src/features/home/lib/homePaneLayout.ts b/desktop/src/features/home/lib/homePaneLayout.ts
new file mode 100644
index 00000000000..dd4871c888f
--- /dev/null
+++ b/desktop/src/features/home/lib/homePaneLayout.ts
@@ -0,0 +1,72 @@
+import { INBOX_COLUMN_MIN_WIDTH_PX } from "@/features/home/useResizableInboxListWidth";
+
+type HomePaneLayoutOptions = {
+  hasAuxiliaryPane: boolean;
+  homeWidthPx: number;
+  inboxListWidthPx: number;
+  isDrafts: boolean;
+  isMessagesMode: boolean;
+  isNarrow: boolean;
+  isReminders: boolean;
+  isSinglePanelAuxiliaryView: boolean;
+  selectedDraft: boolean;
+  selectedEvent: boolean;
+  selectedReminder: boolean;
+  threadPanelWidthPx: number;
+};
+
+export function getHomePaneLayout(options: HomePaneLayoutOptions) {
+  const singleMessage =
+    options.isMessagesMode &&
+    options.isNarrow &&
+    options.selectedEvent &&
+    !options.isSinglePanelAuxiliaryView;
+  const singleDraft =
+    options.isDrafts &&
+    options.isNarrow &&
+    options.selectedDraft &&
+    !options.isSinglePanelAuxiliaryView;
+  const singleReminder =
+    options.isReminders &&
+    options.isNarrow &&
+    options.selectedReminder &&
+    !options.isSinglePanelAuxiliaryView;
+  const showList =
+    !singleMessage &&
+    !singleDraft &&
+    !singleReminder &&
+    !options.isSinglePanelAuxiliaryView;
+  const showDetail =
+    !options.isSinglePanelAuxiliaryView &&
+    ((options.isMessagesMode && (!options.isNarrow || singleMessage)) ||
+      (options.isDrafts && (!options.isNarrow || singleDraft)) ||
+      (options.isReminders && (!options.isNarrow || singleReminder)));
+  const auxiliaryWidth = options.isSinglePanelAuxiliaryView
+    ? options.homeWidthPx
+    : options.threadPanelWidthPx;
+  const maxListWidth =
+    options.homeWidthPx > 0
+      ? Math.max(
+          INBOX_COLUMN_MIN_WIDTH_PX,
+          options.homeWidthPx -
+            INBOX_COLUMN_MIN_WIDTH_PX -
+            (options.hasAuxiliaryPane ? auxiliaryWidth : 0),
+        )
+      : undefined;
+
+  return {
+    auxiliaryPaneWidthPx: auxiliaryWidth,
+    effectiveInboxListWidthPx:
+      options.homeWidthPx > 0
+        ? Math.min(
+            options.inboxListWidthPx,
+            maxListWidth ?? options.inboxListWidthPx,
+          )
+        : options.inboxListWidthPx,
+    isSinglePanelDetailView: singleMessage,
+    isSinglePanelDraftDetailView: singleDraft,
+    isSinglePanelReminderDetailView: singleReminder,
+    showDetailPane: showDetail,
+    showListPane: showList,
+  };
+}
diff --git a/desktop/src/features/home/lib/inbox.test.mjs b/desktop/src/features/home/lib/inbox.test.mjs
index 457e8ecdec5..cd2f78c80cf 100644
--- a/desktop/src/features/home/lib/inbox.test.mjs
+++ b/desktop/src/features/home/lib/inbox.test.mjs
@@ -3,11 +3,13 @@ import test from "node:test";
 
 import {
   buildInboxItems,
+  findInboxItemByEventId,
   getInboxConversationId,
   getInboxTypeLabel,
 } from "./inbox.ts";
 
 const CHANNEL_ID = "9a1657ac-f7aa-5db0-b632-d8bbeb6dfb50";
+const DM_CHANNEL_ID = "8ad375a7-6990-4b22-985f-e3fd34f634d7";
 
 const channels = [
   {
@@ -15,6 +17,11 @@ const channels = [
     name: "buzz-bugs",
     channelType: "stream",
   },
+  {
+    id: DM_CHANNEL_ID,
+    name: "dm-alice",
+    channelType: "dm",
+  },
 ];
 
 function feedWith(overrides) {
@@ -161,6 +168,197 @@ test("thread groups use the latest row label even when the root was a mention",
   });
 });
 
+test("thread groups resume at the oldest unread reply", () => {
+  const [inboxItem] = buildInboxItems({
+    channels,
+    feed: feedWith({
+      activity: [
+        item({
+          id: "reply-1",
+          category: "activity",
+          content: "Already read reply",
+          createdAt: 1,
+          tags: [
+            ["h", CHANNEL_ID],
+            ["e", "root-event", "", "root"],
+            ["e", "root-event", "", "reply"],
+          ],
+        }),
+        item({
+          id: "reply-2",
+          category: "activity",
+          content: "First unread reply",
+          createdAt: 2,
+          tags: [
+            ["h", CHANNEL_ID],
+            ["e", "root-event", "", "root"],
+            ["e", "reply-1", "", "reply"],
+          ],
+        }),
+        item({
+          id: "reply-3",
+          category: "activity",
+          content: "Newest unread reply",
+          createdAt: 3,
+          tags: [
+            ["h", CHANNEL_ID],
+            ["e", "root-event", "", "root"],
+            ["e", "reply-2", "", "reply"],
+          ],
+        }),
+      ],
+    }),
+    getThreadReadAt: (rootId) => (rootId === "root-event" ? 1 : null),
+  });
+
+  assert.equal(inboxItem.id, "reply-2");
+  assert.equal(inboxItem.preview, "First unread reply");
+  assert.equal(inboxItem.latestActivityAt, 3);
+  assert.equal(inboxItem.unreadCount, 2);
+});
+
+test("thread groups skip an individually read reply when choosing the resume point", () => {
+  const [inboxItem] = buildInboxItems({
+    channels,
+    feed: feedWith({
+      activity: [
+        item({
+          id: "reply-1",
+          createdAt: 1,
+          tags: [
+            ["h", CHANNEL_ID],
+            ["e", "root-event", "", "root"],
+            ["e", "root-event", "", "reply"],
+          ],
+        }),
+        item({
+          id: "reply-2",
+          createdAt: 2,
+          tags: [
+            ["h", CHANNEL_ID],
+            ["e", "root-event", "", "root"],
+            ["e", "reply-1", "", "reply"],
+          ],
+        }),
+      ],
+    }),
+    getMessageReadAt: (messageId) => (messageId === "reply-1" ? 1 : null),
+    getThreadReadAt: () => null,
+  });
+
+  assert.equal(inboxItem.id, "reply-2");
+  assert.equal(inboxItem.unreadCount, 1);
+});
+
+test("thread groups follow per-message unread state when the aggregate thread marker is newer", () => {
+  const [inboxItem] = buildInboxItems({
+    channels,
+    feed: feedWith({
+      activity: [
+        item({
+          id: "reply-1",
+          createdAt: 1,
+          tags: [
+            ["h", CHANNEL_ID],
+            ["e", "root-event", "", "root"],
+            ["e", "root-event", "", "reply"],
+          ],
+        }),
+        item({
+          id: "reply-2",
+          createdAt: 2,
+          tags: [
+            ["h", CHANNEL_ID],
+            ["e", "root-event", "", "root"],
+            ["e", "reply-1", "", "reply"],
+          ],
+        }),
+      ],
+    }),
+    getMessageReadAt: (messageId) => (messageId === "reply-1" ? 1 : null),
+    getThreadReadAt: () => 2,
+  });
+
+  assert.equal(inboxItem.id, "reply-2");
+  assert.equal(inboxItem.unreadCount, 1);
+});
+
+test("DMs are grouped by channel and represented by the first unread message", () => {
+  const inboxItems = buildInboxItems({
+    channels,
+    feed: feedWith({
+      activity: [
+        item({
+          id: "dm-1",
+          channelId: DM_CHANNEL_ID,
+          channelType: undefined,
+          content: "Already read",
+          createdAt: 1,
+          tags: [["h", DM_CHANNEL_ID]],
+        }),
+        item({
+          id: "dm-2",
+          channelId: DM_CHANNEL_ID,
+          channelType: undefined,
+          content: "First unread",
+          createdAt: 2,
+          tags: [["h", DM_CHANNEL_ID]],
+        }),
+        item({
+          id: "dm-3",
+          channelId: DM_CHANNEL_ID,
+          channelType: undefined,
+          content: "Newest unread",
+          createdAt: 3,
+          tags: [["h", DM_CHANNEL_ID]],
+        }),
+      ],
+    }),
+    getChannelReadAt: (channelId) => (channelId === DM_CHANNEL_ID ? 1 : null),
+  });
+
+  assert.equal(inboxItems.length, 1);
+  assert.equal(inboxItems[0].conversationId, `dm:${DM_CHANNEL_ID}`);
+  assert.equal(inboxItems[0].id, "dm-2");
+  assert.equal(inboxItems[0].preview, "First unread");
+  assert.equal(inboxItems[0].latestActivityAt, 3);
+  assert.equal(inboxItems[0].unreadCount, 2);
+  assert.deepEqual(
+    inboxItems[0].groupItems.map((groupItem) => groupItem.id),
+    ["dm-1", "dm-2", "dm-3"],
+  );
+  assert.equal(findInboxItemByEventId(inboxItems, "dm-3"), inboxItems[0]);
+});
+
+test("a fully read DM conversation falls back to its latest message", () => {
+  const [inboxItem] = buildInboxItems({
+    channels,
+    feed: feedWith({
+      activity: [
+        item({
+          id: "dm-1",
+          channelId: DM_CHANNEL_ID,
+          content: "Older",
+          createdAt: 1,
+          tags: [["h", DM_CHANNEL_ID]],
+        }),
+        item({
+          id: "dm-2",
+          channelId: DM_CHANNEL_ID,
+          content: "Latest",
+          createdAt: 2,
+          tags: [["h", DM_CHANNEL_ID]],
+        }),
+      ],
+    }),
+    getChannelReadAt: () => 2,
+  });
+
+  assert.equal(inboxItem.id, "dm-2");
+  assert.equal(inboxItem.preview, "Latest");
+  assert.equal(inboxItem.unreadCount, 0);
+});
+
 // ── conversationId stability tests ──────────────────────────────────────────
 
 test("conversationId is stable when a live reply advances the representative", () => {
@@ -272,6 +470,18 @@ test("getInboxConversationId falls back to eventId when no root tag", () => {
   );
 });
 
+test("getInboxConversationId groups direct messages by channel", () => {
+  assert.equal(
+    getInboxConversationId(
+      [["h", DM_CHANNEL_ID]],
+      "dm-event",
+      DM_CHANNEL_ID,
+      "dm",
+    ),
+    `dm:${DM_CHANNEL_ID}`,
+  );
+});
+
 test("old event still resolves to its conversation row via groupItems", () => {
   // Demonstrates that findItemByEventId searching groupItems works: the old
   // root event id is still present in groupItems even when a newer reply
diff --git a/desktop/src/features/home/lib/inbox.ts b/desktop/src/features/home/lib/inbox.ts
index a34ea1b66f9..e34fa0c200f 100644
--- a/desktop/src/features/home/lib/inbox.ts
+++ b/desktop/src/features/home/lib/inbox.ts
@@ -26,7 +26,6 @@ export type InboxFilter =
   | "mention"
   | "thread"
   | "needs_action"
-  | "activity"
   | "agent_activity"
   | "reminders"
   | "drafts";
@@ -55,6 +54,7 @@ export type InboxItem = {
   senderLabel: string;
   subject: string;
   timestampLabel: string;
+  unreadCount: number;
 };
 
 export type InboxTypeLabel = {
@@ -238,6 +238,29 @@ export function isThreadActivityItem(item: FeedItem) {
   return thread.parentId !== null && !isBroadcastReply(item.tags);
 }
 
+function isThreadReplyItem(item: FeedItem) {
+  const thread = getThreadReference(item.tags);
+  return thread.parentId !== null && !isBroadcastReply(item.tags);
+}
+
+function uniqueItemsById(items: readonly FeedItem[]) {
+  const seen = new Set<string>();
+  return items.filter((item) => {
+    if (seen.has(item.id)) return false;
+    seen.add(item.id);
+    return true;
+  });
+}
+
+function isItemUnread(
+  item: FeedItem,
+  readAt: number | null,
+  getMessageReadAt?: (messageId: string) => number | null,
+) {
+  const messageReadAt = getMessageReadAt?.(item.id) ?? null;
+  return item.createdAt > Math.max(readAt ?? 0, messageReadAt ?? 0);
+}
+
 function activityHeadline(item: FeedItem) {
   return feedHeadline(item);
 }
@@ -338,18 +361,30 @@ function categoryPriority(category: FeedItemCategory) {
   }
 }
 
-function getInboxThreadKey(item: FeedItem) {
+function getInboxThreadKey(
+  item: FeedItem,
+  channelById: ReadonlyMap<string, InboxChannel>,
+) {
   const projectReference = getProjectInboxReference(item);
   if (projectReference) {
     return `project:${projectReference.repoAddress}:${projectReference.rootId}`;
   }
 
-  const thread = getThreadReference(item.tags);
-  return thread.rootId ?? thread.parentId ?? item.id;
+  const channelType = resolveItemChannel(item, channelById).type;
+  return getInboxConversationId(
+    item.tags,
+    item.id,
+    item.channelId,
+    channelType,
+    item.kind,
+  );
 }
 
-function getStableConversationId(item: FeedItem) {
-  return getInboxItemConversationId(item);
+function getStableConversationId(
+  item: FeedItem,
+  channelById: ReadonlyMap<string, InboxChannel>,
+) {
+  return getInboxThreadKey(item, channelById);
 }
 
 /**
@@ -361,6 +396,8 @@ function getStableConversationId(item: FeedItem) {
 export function getInboxConversationId(
   tags: string[][],
   eventId: string,
+  channelId?: string | null,
+  channelType?: string,
   kind?: number,
 ): string {
   if (kind !== undefined) {
@@ -374,13 +411,37 @@ export function getInboxConversationId(
     }
   }
 
+  if (channelType === "dm" && channelId) {
+    return `dm:${channelId}`;
+  }
+
   const thread = getThreadReference(tags);
   return thread.rootId ?? thread.parentId ?? eventId;
 }
 
 /** Returns the stable conversation identity for a complete Inbox feed item. */
 export function getInboxItemConversationId(item: FeedItem) {
-  return getInboxConversationId(item.tags, item.id, item.kind);
+  return getInboxConversationId(
+    item.tags,
+    item.id,
+    item.channelId,
+    item.channelType,
+    item.kind,
+  );
+}
+
+/** Finds the Inbox row containing an event, including grouped events. */
+export function findInboxItemByEventId(
+  items: readonly InboxItem[],
+  eventId: string,
+): InboxItem | null {
+  return (
+    items.find((item) => item.id === eventId) ??
+    items.find((item) =>
+      item.groupItems.some((groupItem) => groupItem.id === eventId),
+    ) ??
+    null
+  );
 }
 
 function formatInboxTimestamp(unixSeconds: number) {
@@ -450,11 +511,20 @@ export function buildInboxItems({
   channels,
   currentPubkey,
   feed,
+  getChannelReadAt,
+  getMessageReadAt,
+  getThreadReadAt,
   profiles,
 }: {
   channels?: InboxChannel[];
   currentPubkey?: string;
   feed?: HomeFeedResponse;
+  getChannelReadAt?: (channelId: string) => number | null;
+  getMessageReadAt?: (messageId: string) => number | null;
+  getThreadReadAt?: (
+    rootId: string,
+    channelId?: string | null,
+  ) => number | null;
   profiles?: UserProfileLookup;
 }): InboxItem[] {
   if (!feed) {
@@ -493,7 +563,7 @@ export function buildInboxItems({
   >();
 
   for (const item of feedItems) {
-    const threadKey = getInboxThreadKey(item);
+    const threadKey = getInboxThreadKey(item, channelById);
     const group = threadGroups.get(threadKey) ?? {
       items: [],
       latestActivityAt: 0,
@@ -502,7 +572,7 @@ export function buildInboxItems({
 
     group.items.push(item);
     group.latestActivityAt = Math.max(group.latestActivityAt, item.createdAt);
-    if (item.id === getStableConversationId(item)) {
+    if (item.id === getStableConversationId(item, channelById)) {
       group.rootItem = item;
     }
 
@@ -514,11 +584,49 @@ export function buildInboxItems({
       ([, left], [, right]) => right.latestActivityAt - left.latestActivityAt,
     )
     .map(([, group]) => {
-      const conversationId = getStableConversationId(group.items[0]);
+      const conversationId = getStableConversationId(
+        group.items[0],
+        channelById,
+      );
       const latestItem = group.items.reduce((latest, current) =>
         current.createdAt > latest.createdAt ? current : latest,
       );
-      const item = latestItem;
+      const groupChannel = resolveGroupChannel(
+        latestItem,
+        group.items,
+        channelById,
+      );
+      const groupChannelId = group.items.find(
+        (candidate) => candidate.channelId,
+      )?.channelId;
+      const channelReadAt =
+        groupChannel.type === "dm" && groupChannelId && getChannelReadAt
+          ? getChannelReadAt(groupChannelId)
+          : undefined;
+      const uniqueGroupItems = uniqueItemsById(group.items);
+      const threadReplyItems = uniqueGroupItems.filter(isThreadReplyItem);
+      const threadReadAt =
+        groupChannel.type !== "dm" &&
+        threadReplyItems.length > 0 &&
+        getThreadReadAt
+          ? getThreadReadAt(conversationId, groupChannelId)
+          : undefined;
+      const unreadItems = (
+        channelReadAt !== undefined
+          ? uniqueGroupItems.filter((candidate) =>
+              isItemUnread(candidate, channelReadAt),
+            )
+          : threadReplyItems.length > 0 && getMessageReadAt
+            ? threadReplyItems.filter((candidate) =>
+                isItemUnread(candidate, null, getMessageReadAt),
+              )
+            : threadReadAt !== undefined
+              ? threadReplyItems.filter((candidate) =>
+                  isItemUnread(candidate, threadReadAt),
+                )
+              : []
+      ).sort((left, right) => left.createdAt - right.createdAt);
+      const item = unreadItems[0] ?? latestItem;
       const categories = [
         ...new Set(group.items.map((groupItem) => groupItem.category)),
       ].sort((left, right) => categoryPriority(left) - categoryPriority(right));
@@ -534,7 +642,6 @@ export function buildInboxItems({
         item.tags,
         profiles,
       );
-      const groupChannel = resolveGroupChannel(item, group.items, channelById);
       const channelLabel = groupChannel.name;
       const displayItem: FeedItem = {
         ...item,
@@ -561,6 +668,7 @@ export function buildInboxItems({
         senderLabel,
         subject,
         timestampLabel: formatInboxTimestamp(group.latestActivityAt),
+        unreadCount: unreadItems.length,
       };
     });
 }
diff --git a/desktop/src/features/home/lib/inboxListRows.test.mjs b/desktop/src/features/home/lib/inboxListRows.test.mjs
new file mode 100644
index 00000000000..b0a093de1b6
--- /dev/null
+++ b/desktop/src/features/home/lib/inboxListRows.test.mjs
@@ -0,0 +1,106 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+
+import { buildInboxListRows } from "./inboxListRows.ts";
+
+function inboxItem(
+  id,
+  latestActivityAt,
+  conversationId = `conversation:${id}`,
+) {
+  return {
+    conversationId,
+    groupItems: [],
+    id,
+    item: { id },
+    latestActivityAt,
+  };
+}
+
+function reminder(
+  id,
+  createdAt,
+  status = "pending",
+  { eventId, notBefore } = {},
+) {
+  return {
+    id,
+    createdAt,
+    notBefore,
+    content: {
+      status,
+      target: eventId ? { eventId } : undefined,
+    },
+  };
+}
+
+test("Inbox All combines rows in latest-first order", () => {
+  const rows = buildInboxListRows({
+    items: [inboxItem("message", 1_753_099_300)],
+    reminders: [reminder("reminder", 1_753_099_100)],
+  });
+
+  assert.deepEqual(
+    rows.map((row) => row.kind),
+    ["inbox", "reminder"],
+  );
+});
+
+test("Inbox All excludes completed reminders", () => {
+  const rows = buildInboxListRows({
+    items: [],
+    reminders: [reminder("done", 1_753_099_100, "done")],
+  });
+
+  assert.deepEqual(rows, []);
+});
+
+test("Inbox conversation keys stay stable when the representative changes", () => {
+  const first = buildInboxListRows({
+    items: [inboxItem("reply-1", 1, "thread-root")],
+    reminders: [],
+  });
+  const second = buildInboxListRows({
+    items: [inboxItem("reply-2", 2, "thread-root")],
+    reminders: [],
+  });
+
+  assert.equal(first[0].key, "inbox:thread-root");
+  assert.equal(second[0].key, first[0].key);
+});
+
+test("due reminder enriches its existing conversation instead of duplicating it", () => {
+  const item = inboxItem("message", 100);
+  item.groupItems = [{ id: "reminded-reply" }];
+  const rows = buildInboxListRows({
+    items: [item],
+    reminders: [
+      reminder("reminder", 50, "pending", {
+        eventId: "reminded-reply",
+        notBefore: 200,
+      }),
+    ],
+  });
+
+  assert.equal(rows.length, 1);
+  assert.equal(rows[0].kind, "inbox");
+  assert.equal(rows[0].dueReminder?.id, "reminder");
+  assert.equal(rows[0].sortAt, 200);
+});
+
+test("due reminder without a represented conversation sorts at trigger time", () => {
+  const rows = buildInboxListRows({
+    items: [inboxItem("newer-than-creation", 150)],
+    reminders: [
+      reminder("reminder", 50, "pending", {
+        eventId: "not-in-feed",
+        notBefore: 200,
+      }),
+    ],
+  });
+
+  assert.deepEqual(
+    rows.map((row) => row.kind),
+    ["reminder", "inbox"],
+  );
+});
diff --git a/desktop/src/features/home/lib/inboxListRows.ts b/desktop/src/features/home/lib/inboxListRows.ts
new file mode 100644
index 00000000000..70311a0d13c
--- /dev/null
+++ b/desktop/src/features/home/lib/inboxListRows.ts
@@ -0,0 +1,82 @@
+import type { InboxItem } from "@/features/home/lib/inbox";
+import type { Reminder } from "@/features/reminders/lib/reminderTypes";
+
+export type InboxListRow =
+  | {
+      key: string;
+      kind: "inbox";
+      item: InboxItem;
+      dueReminder?: Reminder;
+      sortAt: number;
+    }
+  | {
+      key: string;
+      kind: "reminder";
+      reminder: Reminder;
+      sortAt: number;
+    };
+
+export function buildInboxListRows({
+  items,
+  reminders,
+}: {
+  items: readonly InboxItem[];
+  reminders: readonly Reminder[];
+}): InboxListRow[] {
+  const consumedReminderIds = new Set<string>();
+  const inboxRows = items.map((item): InboxListRow => {
+    const eventIds = new Set([
+      item.id,
+      item.item.id,
+      ...item.groupItems.map((groupItem) => groupItem.id),
+    ]);
+    const matchingReminders = reminders
+      .filter(
+        (reminder) =>
+          reminder.content.status === "pending" &&
+          Boolean(
+            reminder.content.target?.eventId &&
+              eventIds.has(reminder.content.target.eventId),
+          ),
+      )
+      .sort(
+        (left, right) =>
+          (right.notBefore ?? right.createdAt) -
+          (left.notBefore ?? left.createdAt),
+      );
+    const dueReminder = matchingReminders[0];
+
+    for (const reminder of matchingReminders) {
+      consumedReminderIds.add(reminder.id);
+    }
+
+    return {
+      key: `inbox:${item.conversationId}`,
+      kind: "inbox",
+      item,
+      dueReminder,
+      sortAt: Math.max(
+        item.latestActivityAt,
+        dueReminder?.notBefore ?? dueReminder?.createdAt ?? 0,
+      ),
+    };
+  });
+
+  return [
+    ...inboxRows,
+    ...reminders
+      .filter(
+        (reminder) =>
+          reminder.content.status === "pending" &&
+          !consumedReminderIds.has(reminder.id),
+      )
+      .map(
+        (reminder): InboxListRow => ({
+          key: `reminder:${reminder.id}`,
+          kind: "reminder",
+          reminder,
+          sortAt: reminder.notBefore ?? reminder.createdAt,
+        }),
+      ),
+  ].sort((left, right) => right.sortAt - left.sortAt);
+}
diff --git a/desktop/src/features/home/lib/inboxSelection.test.mjs b/desktop/src/features/home/lib/inboxSelection.test.mjs
new file mode 100644
index 00000000000..84088f743ae
--- /dev/null
+++ b/desktop/src/features/home/lib/inboxSelection.test.mjs
@@ -0,0 +1,53 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+
+import { resolveInboxFilterSelection } from "./inboxSelection.ts";
+
+const items = [
+  { conversationId: "first-conversation", id: "first-event" },
+  { conversationId: "second-conversation", id: "second-event" },
+];
+
+test("filter selection preserves a conversation that remains visible", () => {
+  assert.deepEqual(
+    resolveInboxFilterSelection({
+      isNarrow: false,
+      items,
+      selectedConversationId: "second-conversation",
+    }),
+    { autoSelectedEventId: null, preserveSelection: true },
+  );
+});
+
+test("wide filter selection immediately selects the first valid row", () => {
+  assert.deepEqual(
+    resolveInboxFilterSelection({
+      isNarrow: false,
+      items,
+      selectedConversationId: "filtered-out-conversation",
+    }),
+    { autoSelectedEventId: "first-event", preserveSelection: false },
+  );
+});
+
+test("narrow filter selection returns to the list when selection is invalid", () => {
+  assert.deepEqual(
+    resolveInboxFilterSelection({
+      isNarrow: true,
+      items,
+      selectedConversationId: "filtered-out-conversation",
+    }),
+    { autoSelectedEventId: null, preserveSelection: false },
+  );
+});
+
+test("empty filter selection clears detail at every width", () => {
+  assert.deepEqual(
+    resolveInboxFilterSelection({
+      isNarrow: false,
+      items: [],
+      selectedConversationId: "filtered-out-conversation",
+    }),
+    { autoSelectedEventId: null, preserveSelection: false },
+  );
+});
diff --git a/desktop/src/features/home/lib/inboxSelection.ts b/desktop/src/features/home/lib/inboxSelection.ts
new file mode 100644
index 00000000000..c7c6217a2fb
--- /dev/null
+++ b/desktop/src/features/home/lib/inboxSelection.ts
@@ -0,0 +1,21 @@
+import type { InboxItem } from "@/features/home/lib/inbox";
+
+export function resolveInboxFilterSelection({
+  isNarrow,
+  items,
+  selectedConversationId,
+}: {
+  isNarrow: boolean;
+  items: readonly Pick<InboxItem, "conversationId" | "id">[];
+  selectedConversationId: string | null;
+}) {
+  const preserveSelection =
+    selectedConversationId !== null &&
+    items.some((item) => item.conversationId === selectedConversationId);
+
+  return {
+    autoSelectedEventId:
+      preserveSelection || isNarrow ? null : (items[0]?.id ?? null),
+    preserveSelection,
+  };
+}
diff --git a/desktop/src/features/home/lib/inboxViewHelpers.test.mjs b/desktop/src/features/home/lib/inboxViewHelpers.test.mjs
index e76b5512392..2cd6424ab5a 100644
--- a/desktop/src/features/home/lib/inboxViewHelpers.test.mjs
+++ b/desktop/src/features/home/lib/inboxViewHelpers.test.mjs
@@ -4,14 +4,67 @@ import test from "node:test";
 import { formatTimelineMessages } from "../../messages/lib/formatTimelineMessages.ts";
 import { getConfigNudgeAuthorPubkey } from "../../messages/ui/configNudgeAuthPubkey.ts";
 import {
+  filterInboxItems,
   getContextMessageDepth,
   getReactionTargetId,
+  hasInboxThreadContext,
   isInboxThreadContextEvent,
+  matchesInboxAllView,
   matchesInboxFilter,
   toInboxContextMessage,
   toTimelineMessage,
 } from "./inboxViewHelpers.ts";
 
+test("Inbox uses the dedicated reminder list instead of feed reminder rows", () => {
+  const message = { item: { kind: 9 } };
+  const reminder = { item: { kind: 40007 } };
+  const items = [message, reminder];
+
+  assert.deepEqual(filterInboxItems(items), [message]);
+});
+
+test("hasInboxThreadContext finds replies in the grouped row or loaded context", () => {
+  const root = { tags: [["h", "channel"]] };
+  const reply = {
+    tags: [
+      ["h", "channel"],
+      ["e", "root", "", "reply"],
+    ],
+  };
+
+  assert.equal(
+    hasInboxThreadContext({ item: root, groupItems: [root, reply] }),
+    true,
+  );
+  assert.equal(
+    hasInboxThreadContext({ item: root, groupItems: [root] }, [reply]),
+    true,
+  );
+});
+
+test("hasInboxThreadContext keeps standalone and broadcast activity unthreaded", () => {
+  const root = { tags: [["h", "channel"]] };
+  const broadcastReply = {
+    tags: [
+      ["h", "channel"],
+      ["e", "root", "", "reply"],
+      ["broadcast", "1"],
+    ],
+  };
+
+  assert.equal(
+    hasInboxThreadContext({ item: root, groupItems: [root] }),
+    false,
+  );
+  assert.equal(
+    hasInboxThreadContext({
+      item: broadcastReply,
+      groupItems: [broadcastReply],
+    }),
+    false,
+  );
+});
+
 // --- matchesInboxFilter ---
 
 test("matchesInboxFilter returns true for the 'all' filter regardless of categories", () => {
@@ -19,6 +72,85 @@ test("matchesInboxFilter returns true for the 'all' filter regardless of categor
   assert.equal(matchesInboxFilter({ categories: ["mentions"] }, "all"), true);
 });
 
+test("Inbox All excludes generic top-level channel traffic", () => {
+  const owned = new Set(["owned-agent"]);
+  assert.equal(
+    matchesInboxAllView(
+      {
+        categories: ["activity"],
+        item: {
+          channelType: "stream",
+          pubkey: "human",
+          tags: [["h", "channel"]],
+        },
+      },
+      owned,
+    ),
+    false,
+  );
+});
+
+test("Inbox All includes each personally relevant message source", () => {
+  const owned = new Set(["owned-agent"]);
+  const cases = [
+    {
+      categories: ["activity"],
+      item: { channelType: "dm", pubkey: "human", tags: [] },
+    },
+    {
+      categories: ["mention"],
+      item: { channelType: "stream", pubkey: "human", tags: [] },
+    },
+    {
+      categories: ["needs_action"],
+      item: { channelType: "stream", pubkey: "human", tags: [] },
+    },
+    {
+      categories: ["activity"],
+      item: {
+        channelType: "stream",
+        pubkey: "human",
+        tags: [["e", "root", "", "reply"]],
+      },
+    },
+    {
+      categories: ["activity"],
+      item: { channelType: "stream", pubkey: "OWNED-AGENT", tags: [] },
+    },
+    {
+      categories: ["activity"],
+      item: {
+        channelType: null,
+        id: "project-pull-request",
+        kind: 1618,
+        pubkey: "human",
+        tags: [["a", `30617:${"a".repeat(64)}:buzz`]],
+      },
+    },
+  ];
+
+  for (const item of cases) {
+    assert.equal(matchesInboxAllView(item, owned), true);
+  }
+});
+
+test("Inbox All excludes generic updates from agents the user does not own", () => {
+  assert.equal(
+    matchesInboxAllView(
+      {
+        categories: ["agent_activity"],
+        item: {
+          channelType: "stream",
+          pubkey: "somebody-elses-agent",
+          tags: [],
+        },
+      },
+      new Set(["owned-agent"]),
+    ),
+    false,
+  );
+});
+
 test("matchesInboxFilter matches when the category is present", () => {
   assert.equal(
     matchesInboxFilter({ categories: ["mentions", "activity"] }, "mentions"),
@@ -34,6 +166,32 @@ test("matchesInboxFilter is false when the category is absent", () => {
   assert.equal(matchesInboxFilter({ categories: [] }, "mentions"), false);
 });
 
+test("owned-agent filtering uses the representative event author", () => {
+  const owned = new Set(["owned-agent"]);
+  assert.equal(
+    matchesInboxFilter(
+      {
+        categories: ["activity"],
+        item: { pubkey: "OWNED-AGENT" },
+      },
+      "agent_activity",
+      owned,
+    ),
+    true,
+  );
+  assert.equal(
+    matchesInboxFilter(
+      {
+        categories: ["agent_activity"],
+        item: { pubkey: "somebody-elses-agent" },
+      },
+      "agent_activity",
+      owned,
+    ),
+    false,
+  );
+});
+
 test("matchesInboxFilter matches thread rows by thread tags", () => {
   const replyItem = {
     id: "reply",
diff --git a/desktop/src/features/home/lib/inboxViewHelpers.ts b/desktop/src/features/home/lib/inboxViewHelpers.ts
index 869dbf18181..42ed8e1a5a6 100644
--- a/desktop/src/features/home/lib/inboxViewHelpers.ts
+++ b/desktop/src/features/home/lib/inboxViewHelpers.ts
@@ -2,6 +2,7 @@ import {
   formatInboxFullTimestamp,
   type InboxContextMessage,
   type InboxFilter,
+  type InboxItem,
 } from "@/features/home/lib/inbox";
 import { isProjectInboxItem } from "@/features/home/lib/projectInbox";
 import {
@@ -15,6 +16,8 @@ import type {
   RelayEvent,
   UserProfileSummary,
 } from "@/shared/api/types";
+import { KIND_REMINDER } from "@/shared/constants/kinds";
+import { normalizePubkey } from "@/shared/lib/pubkey";
 import { resolveMentionProps } from "@/shared/lib/resolveMentionNames";
 
 function hasThreadReplyTags(tags: string[][]) {
@@ -22,6 +25,19 @@ function hasThreadReplyTags(tags: string[][]) {
   return thread.parentId !== null && !isBroadcastReply(tags);
 }
 
+export function filterInboxItems(items: InboxItem[]) {
+  return items.filter((item) => item.item.kind !== KIND_REMINDER);
+}
+
+export function hasInboxThreadContext(
+  item: Pick<InboxItem, "groupItems" | "item">,
+  contextMessages: readonly Pick<InboxContextMessage, "tags">[] = [],
+) {
+  return [item.item, ...item.groupItems, ...contextMessages].some((event) =>
+    hasThreadReplyTags(event.tags ?? []),
+  );
+}
+
 export function matchesInboxFilter(
   item: {
     categories: readonly string[];
@@ -29,9 +45,12 @@ export function matchesInboxFilter(
     item?: FeedItem;
   },
   filter: InboxFilter,
+  ownedAgentPubkeys?: ReadonlySet<string>,
 ) {
   if (filter === "all") {
-    return true;
+    return ownedAgentPubkeys
+      ? matchesInboxAllView(item, ownedAgentPubkeys)
+      : true;
   }
 
   if (filter === "thread") {
@@ -46,9 +65,42 @@ export function matchesInboxFilter(
     );
   }
 
+  if (filter === "agent_activity" && ownedAgentPubkeys) {
+    const representative = item.item ?? item.groupItems?.at(-1);
+    return representative
+      ? ownedAgentPubkeys.has(normalizePubkey(representative.pubkey))
+      : false;
+  }
+
   return item.categories.includes(filter);
 }
 
+export function matchesInboxAllView(
+  item: {
+    categories: readonly string[];
+    groupItems?: readonly FeedItem[];
+    item?: FeedItem;
+  },
+  ownedAgentPubkeys: ReadonlySet<string>,
+): boolean {
+  const representative = item.item ?? item.groupItems?.at(-1);
+  return (
+    representative?.channelType === "dm" ||
+    item.categories.includes("mention") ||
+    [item.item, ...(item.groupItems ?? [])].some((groupItem) =>
+      groupItem ? hasThreadReplyTags(groupItem.tags) : false,
+    ) ||
+    [item.item, ...(item.groupItems ?? [])].some(
+      (groupItem) => groupItem && isProjectInboxItem(groupItem),
+    ) ||
+    item.categories.includes("needs_action") ||
+    Boolean(
+      representative &&
+        ownedAgentPubkeys.has(normalizePubkey(representative.pubkey)),
+    )
+  );
+}
+
 export function getContextMessageDepth(
   event: RelayEvent,
   eventById: ReadonlyMap<string, RelayEvent>,
diff --git a/desktop/src/features/home/ui/HomePersonalInboxDetail.tsx b/desktop/src/features/home/ui/HomePersonalInboxDetail.tsx
new file mode 100644
index 00000000000..044c7689619
--- /dev/null
+++ b/desktop/src/features/home/ui/HomePersonalInboxDetail.tsx
@@ -0,0 +1,45 @@
+import type { DraftViewItem } from "@/features/messages/ui/DraftsPanel";
+import { DraftDetailPane } from "@/features/messages/ui/DraftDetailPane";
+import type { Reminder } from "@/features/reminders/lib/reminderTypes";
+import { ReminderDetailPane } from "@/features/reminders/ui/RemindersPanel";
+
+type HomePersonalInboxDetailProps = {
+  currentPubkey?: string;
+  draftItem: DraftViewItem | null;
+  mode: "drafts" | "reminders";
+  onBack?: () => void;
+  onDeleteDraft: (draftKey: string) => void;
+  reminder: Reminder | null;
+};
+
+export function HomePersonalInboxDetail({
+  currentPubkey,
+  draftItem,
+  mode,
+  onBack,
+  onDeleteDraft,
+  reminder,
+}: HomePersonalInboxDetailProps) {
+  if (mode === "drafts") {
+    return (
+      <DraftDetailPane
+        item={draftItem}
+        key={draftItem?.entry.key ?? "empty"}
+        onBack={onBack}
+        onDelete={onDeleteDraft}
+      />
+    );
+  }
+
+  if (mode === "reminders") {
+    return (
+      <ReminderDetailPane
+        onBack={onBack}
+        pubkey={currentPubkey ?? ""}
+        reminder={reminder}
+      />
+    );
+  }
+
+  return null;
+}
diff --git a/desktop/src/features/home/ui/HomeView.tsx b/desktop/src/features/home/ui/HomeView.tsx
index 2bcb231e9d9..0f7c851643c 100644
--- a/desktop/src/features/home/ui/HomeView.tsx
+++ b/desktop/src/features/home/ui/HomeView.tsx
@@ -9,21 +9,23 @@ import { RightAuxiliaryPane } from "@/features/channels/ui/RightAuxiliaryPane";
 import { ChannelManagementSheet } from "@/features/channels/ui/ChannelManagementSheet";
 import {
   type InboxFilter,
-  type InboxContextMessage,
-  type InboxItem,
   type InboxReply,
   buildInboxItems,
+  findInboxItemByEventId,
   formatInboxFullTimestamp,
   getInboxItemConversationId,
 } from "@/features/home/lib/inbox";
 import { useInboxSelectionAnchor } from "@/features/home/useInboxSelectionAnchor";
+import { useOwnedAgentPubkeys } from "@/features/home/useOwnedAgentPubkeys";
 import {
-  getReactionTargetId,
+  filterInboxItems,
   matchesInboxFilter,
-  toInboxContextMessage,
 } from "@/features/home/lib/inboxViewHelpers";
+import { resolveInboxFilterSelection } from "@/features/home/lib/inboxSelection";
 import { useHomeInboxReadState } from "@/features/home/useHomeInboxReadState";
-import { useHomeDrafts } from "@/features/home/useHomeDrafts";
+import { useHomeInboxAutoSelection } from "@/features/home/useHomeInboxAutoSelection";
+import { useHomeInboxContextMessages } from "@/features/home/useHomeInboxContextMessages";
+import { useHomePersonalInbox } from "@/features/home/useHomePersonalInbox";
 import { useInboxThreadContext } from "@/features/home/useInboxThreadContext";
 import {
   type ProfilePanelTab,
@@ -35,32 +37,26 @@ import {
   profilePanelViewFromSearch,
 } from "@/features/profile/ui/UserProfilePanelUtils";
 import {
-  INBOX_COLUMN_MIN_WIDTH_PX,
   INBOX_SINGLE_COLUMN_BREAKPOINT_PX,
   useResizableInboxListWidth,
 } from "@/features/home/useResizableInboxListWidth";
+import { getHomePaneLayout } from "@/features/home/lib/homePaneLayout";
+import { getHomeMessageCapabilities } from "@/features/home/lib/homeMessageCapabilities";
 import { HomeLoadingState } from "@/features/home/ui/HomeLoadingState";
 import { InboxDetailPane } from "@/features/home/ui/InboxDetailPane";
 import { InboxListPane } from "@/features/home/ui/InboxListPane";
-import { DraftDetailPane } from "@/features/messages/ui/DraftDetailPane";
+import { HomePersonalInboxDetail } from "@/features/home/ui/HomePersonalInboxDetail";
 import {
   useChannelMessagesQuery,
   useToggleReactionMutation,
 } from "@/features/messages/hooks";
-import {
-  collectMessageMentionPubkeys,
-  formatTimelineMessages,
-} from "@/features/messages/lib/formatTimelineMessages";
+import { collectMessageMentionPubkeys } from "@/features/messages/lib/formatTimelineMessages";
 import { formatTime } from "@/features/messages/lib/dateFormatters";
 import { splitOutgoingTags } from "@/features/messages/lib/imetaMediaMarkdown";
 import { getThreadReference } from "@/features/messages/lib/threading";
 import { useUsersBatchQuery } from "@/features/profile/hooks";
 import { useRelaySelfQuery } from "@/features/moderation/hooks";
 import { resolveUserLabel } from "@/features/profile/lib/identity";
-import {
-  countDueReminders,
-  useRemindersQuery,
-} from "@/features/reminders/hooks";
 import { useRemindLater } from "@/features/reminders/ui/RemindMeLaterProvider";
 import { deleteMessage, sendChannelMessage } from "@/shared/api/tauri";
 import type { HomeFeedResponse } from "@/shared/api/types";
@@ -82,27 +78,6 @@ const INBOX_SEARCH_KEYS = [
   "profileView",
 ] as const;
 
-/**
- * Finds the InboxItem whose stable conversation contains the given event ID.
- * Checks `item.id` (the current representative/latest event) first, then
- * falls back to `item.groupItems` so that a deep-linked or URL-anchored event
- * that is no longer the representative still resolves to its row.
- */
-function findItemByEventId(
-  items: readonly InboxItem[],
-  eventId: string,
-): InboxItem | null {
-  // Fast path: representative event matches (the common case).
-  const direct = items.find((item) => item.id === eventId);
-  if (direct) return direct;
-  // Slow path: event is a non-representative group member (e.g. original
-  // mention that was later superseded by a newer reply as the representative).
-  return (
-    items.find((item) => item.groupItems.some((gi) => gi.id === eventId)) ??
-    null
-  );
-}
-
 type HomeViewProps = {
   feed?: HomeFeedResponse;
   isLoading?: boolean;
@@ -142,18 +117,29 @@ export function HomeView({
   const isReminders = filter === "reminders";
   const isDrafts = filter === "drafts";
   const isMessagesMode = !isReminders && !isDrafts;
-  const remindersQuery = useRemindersQuery(currentPubkey);
-  const dueReminderCount = countDueReminders(remindersQuery.data ?? []);
+  const allowMixedPersonalSelection = filter === "all";
   const {
-    activeCount: activeDraftCount,
-    deleteDraft: handleDeleteDraft,
-    items: draftItems,
-    selectedItem: selectedDraftItem,
-    selectedKey: selectedDraftKey,
-    selectDraft: setSelectedDraftKey,
-  } = useHomeDrafts({
+    drafts: {
+      activeCount: activeDraftCount,
+      deleteDraft: handleDeleteDraft,
+      items: draftItems,
+      selectedItem: selectedDraftItem,
+      selectedKey: selectedDraftKey,
+      selectDraft: setSelectedDraftKey,
+    },
+    dueReminderCount,
+    pendingReminders,
+    reminders: {
+      selectedId: selectedReminderId,
+      selectedItem: selectedReminder,
+      select: setSelectedReminderId,
+    },
+  } = useHomePersonalInbox({
+    allowMixedSelection: allowMixedPersonalSelection,
+    currentPubkey,
     isDrafts,
     isNarrowHomeViewport,
+    isReminders,
     viewportWidthPx: homeInboxWidthPx,
   });
   // `?item=` is Messages-mode-only machinery: a reminder never enters the
@@ -167,37 +153,23 @@ export function HomeView({
   const profilePanelView = profilePanelViewFromSearch(
     inboxSearchValues.profileView,
   );
-  // Selection state — two-tier design so explicit and automatic selections
-  // have distinct ownership:
-  //
-  //   urlSelectedItemId  — explicit/user anchor, URL-authoritative.  Written
-  //     only by handleUserSelectItem (via applyInboxSearchPatch) and by
-  //     back/forward navigation.  Never touched by background data loads.
-  //
-  //   autoSelectedEventId — default desktop selection when the URL carries no
-  //     explicit anchor.  Written only by the auto-selection effect.  Never
-  //     triggers a history push.
-  //
-  //   selectedEventId — the effective anchor used everywhere below: the URL
-  //     anchor when present, otherwise the auto-selected fallback.  Derived
-  //     synchronously, no separate state — so there is no mirror-revert race.
+  // Explicit selection is URL-owned; automatic desktop selection stays local.
   const [autoSelectedEventId, setAutoSelectedEventId] = React.useState<
     string | null
   >(null);
+  const [unreadBoundary, setUnreadBoundary] = React.useState<{
+    conversationId: string;
+    eventId: string;
+  } | null>(null);
   const selectedEventId = urlSelectedItemId ?? autoSelectedEventId;
   const [managedChannelId, setManagedChannelId] = React.useState<string | null>(
     null,
   );
   const { goChannel } = useAppNavigation();
   const openDmMutation = useOpenDmMutation();
-  // handleUserSelectItem: explicit selection — only patches the URL.
-  // No local setSelectedEventId call; the URL patch triggers a TanStack Router
-  // navigation which updates urlSelectedItemId, which becomes selectedEventId
-  // on the next render.  This avoids the mirror-revert race where
-  // useEffect([urlSelectedItemId]) would fire before navigation commits and
-  // overwrite the optimistically-set local state with the stale URL null.
   const handleUserSelectItem = React.useCallback(
     (itemId: string | null) => {
+      setAutoSelectedEventId(null);
       applyInboxSearchPatch({ item: itemId });
     },
     [applyInboxSearchPatch],
@@ -267,6 +239,7 @@ export function HomeView({
     getMessageReadAt,
     feedItemState,
     markChannelRead,
+    markMessageRead,
     markThreadRead,
     readStateVersion,
   } = useAppShell();
@@ -290,7 +263,6 @@ export function HomeView({
       ? (getThreadReference(activeLatchedItem.tags).parentId ??
         activeLatchedItem.id)
       : null;
-
   const channelsQuery = useChannelsQuery();
   const channels = channelsQuery.data;
   const selectedChannelIdCandidate = React.useMemo(() => {
@@ -321,6 +293,13 @@ export function HomeView({
   const threadContext = useInboxThreadContext(
     threadContextFeedItem,
     channelMessages,
+    {
+      fullChannel:
+        selectedChannel?.channelType === "dm" ||
+        threadContextFeedItem?.channelType === "dm",
+      hasChannelLoadError: channelMessagesQuery.isError,
+      isChannelLoading: channelMessagesQuery.isPending,
+    },
   );
 
   const feedProfilePubkeys = React.useMemo(
@@ -342,6 +321,11 @@ export function HomeView({
     enabled: feedProfilePubkeys.length > 0,
   });
   const feedProfiles = feedProfilesQuery.data?.profiles;
+  const ownedAgentPubkeys = useOwnedAgentPubkeys(
+    true,
+    feedProfiles,
+    currentPubkey,
+  );
   const feedOwnerPubkeys = React.useMemo(
     () => [
       ...new Set(
@@ -356,8 +340,6 @@ export function HomeView({
     enabled: feedOwnerPubkeys.length > 0,
   });
   const feedOwnerProfiles = feedOwnerProfilesQuery.data?.profiles;
-  // Agent set for the inbox list/detail bot badges: the community-scoped
-  // baseline widened with this surface's profile lookup.
   const communityAgentPubkeys = useKnownAgentPubkeys();
   const inboxAgentPubkeys = React.useMemo(() => {
     const pubkeys = new Set(communityAgentPubkeys);
@@ -370,16 +352,28 @@ export function HomeView({
 
     return pubkeys;
   }, [feedProfiles, communityAgentPubkeys]);
-  const inboxItems = React.useMemo(
-    () =>
-      buildInboxItems({
-        channels,
-        currentPubkey,
-        feed,
-        profiles: feedProfiles,
-      }),
-    [channels, currentPubkey, feed, feedProfiles],
-  );
+  // biome-ignore lint/correctness/useExhaustiveDependencies: readStateVersion invalidates the stable getChannelReadAt callback
+  const inboxItems = React.useMemo(() => {
+    const items = buildInboxItems({
+      channels,
+      currentPubkey,
+      feed,
+      getChannelReadAt,
+      getMessageReadAt,
+      getThreadReadAt,
+      profiles: feedProfiles,
+    });
+    return filterInboxItems(items);
+  }, [
+    channels,
+    currentPubkey,
+    feed,
+    feedProfiles,
+    getChannelReadAt,
+    getMessageReadAt,
+    getThreadReadAt,
+    readStateVersion,
+  ]);
   const { effectiveDoneSet, markItemRead, markItemUnread } =
     useHomeInboxReadState({
       items: inboxItems,
@@ -390,20 +384,18 @@ export function HomeView({
       localDoneSet: doneSet,
       localUnreadSet: unreadSet,
       markChannelRead,
+      markMessageRead,
       markThreadRead,
       markDoneLocal: markDone,
       markUnreadLocal: markUnread,
       undoDoneLocal: undoDone,
       undoUnreadLocal: undoUnread,
     });
-  // Resolve the selected row and stable conversation ID from inboxItems
-  // (unfiltered). We need conversationId before filtering so we can keep the
-  // selected item visible when unreadOnly is on. The event anchor may point to
-  // any event in the group (representative or older member), so search both.
+  // Resolve selection before filtering so unread-only can retain its active row.
   const selectedItemFromAll = React.useMemo(
     () =>
       selectedEventId
-        ? (findItemByEventId(inboxItems, selectedEventId) ?? null)
+        ? findInboxItemByEventId(inboxItems, selectedEventId)
         : null,
     [inboxItems, selectedEventId],
   );
@@ -421,7 +413,7 @@ export function HomeView({
   const filteredItems = React.useMemo(() => {
     return inboxItems.filter(
       (item) =>
-        matchesInboxFilter(item, filter) &&
+        matchesInboxFilter(item, filter, ownedAgentPubkeys) &&
         (!unreadOnly ||
           !effectiveDoneSet.has(item.id) ||
           item.conversationId === selectedConversationId),
@@ -430,99 +422,45 @@ export function HomeView({
     effectiveDoneSet,
     filter,
     inboxItems,
+    ownedAgentPubkeys,
     selectedConversationId,
     unreadOnly,
   ]);
-  // Prefer the filtered view for the selected item so that filter/unread
-  // changes can still dismiss it, but fall back to the unfiltered row so a
-  // live representative-event change (which keeps the conversation in the
-  // filter) does not make selectedItem go null mid-session.
+  // A filter change may only retain detail for a conversation that remains
+  // visible. The filter handler selects the next valid row in the same update,
+  // so the detail pane never renders a stale conversation between states.
   const selectedItem = React.useMemo(() => {
     if (!selectedEventId) return null;
-    // Primary: find by event anchor in the filtered view.
-    const fromFiltered = findItemByEventId(filteredItems, selectedEventId);
+    const fromFiltered = findInboxItemByEventId(filteredItems, selectedEventId);
     if (fromFiltered) return fromFiltered;
-    // Secondary: event anchor is in an unfiltered row (e.g., dismissed item).
-    if (selectedItemFromAll) return selectedItemFromAll;
-    // Tertiary: anchor has been displaced from all groupItems (e.g., a very old
-    // event that fell off the feed window). Resolve by conversationId so the
-    // correct row stays selected and the auto-selection effect doesn't replace
-    // the anchor with a different conversation.
     if (selectedConversationId) {
       return (
         filteredItems.find(
           (item) => item.conversationId === selectedConversationId,
-        ) ??
-        inboxItems.find(
-          (item) => item.conversationId === selectedConversationId,
-        ) ??
-        null
+        ) ?? null
       );
     }
     return null;
-  }, [
-    filteredItems,
-    inboxItems,
-    selectedConversationId,
-    selectedEventId,
-    selectedItemFromAll,
-  ]);
-  const contextMessages = React.useMemo<InboxContextMessage[]>(() => {
-    if (!selectedItem) {
-      return [];
+  }, [filteredItems, selectedConversationId, selectedEventId]);
+  const unreadBoundaryEventId = React.useMemo(() => {
+    if (!selectedItem) return null;
+    if (unreadBoundary?.conversationId === selectedItem.conversationId) {
+      return unreadBoundary.eventId;
     }
-
-    const eventById = new Map(
-      threadContext.events.map((event) => [event.id, event]),
-    );
-    const contextEventIds = new Set(eventById.keys());
-    const reactionEvents = [
-      ...(channelMessages ?? []),
-      ...threadContext.reactionEvents,
-    ].filter((event) => {
-      if (event.kind !== KIND_REACTION) {
-        return false;
-      }
-
-      const targetId = getReactionTargetId(event.tags);
-      return Boolean(targetId && contextEventIds.has(targetId));
-    });
-    const currentUserAvatarUrl = currentPubkey
-      ? (feedProfiles?.[currentPubkey.toLowerCase()]?.avatarUrl ?? null)
-      : null;
-    const timelineMessages = formatTimelineMessages(
-      [...threadContext.events, ...reactionEvents],
-      selectedChannel,
-      currentPubkey,
-      currentUserAvatarUrl,
-      feedProfiles,
-      undefined,
-      undefined,
-      undefined,
-      relaySelfPubkey,
-      feedOwnerProfiles,
-    );
-
-    return timelineMessages.map((message) =>
-      toInboxContextMessage(message, {
-        eventById,
-        fallbackAuthorPubkey: selectedItem.item.pubkey,
-        profiles: feedProfiles,
-        selectedItemId: selectedEventId ?? selectedItem.id,
-      }),
-    );
-  }, [
+    return effectiveDoneSet.has(selectedItem.id) ? null : selectedItem.id;
+  }, [effectiveDoneSet, selectedItem, unreadBoundary]);
+  const contextMessages = useHomeInboxContextMessages({
     channelMessages,
     currentPubkey,
-    feedProfiles,
-    feedOwnerProfiles,
+    events: threadContext.events,
+    ownerProfiles: feedOwnerProfiles,
+    profiles: feedProfiles,
+    reactionEvents: threadContext.reactionEvents,
     relaySelfPubkey,
     selectedChannel,
     selectedEventId,
     selectedItem,
-    threadContext.events,
-    threadContext.reactionEvents,
-  ]);
+  });
   const selectedItemReplies = React.useMemo<InboxReply[]>(() => {
     if (!selectedItem) return [];
     const localReplies =
@@ -530,73 +468,20 @@ export function HomeView({
     const contextIds = new Set(contextMessages.map((message) => message.id));
     return localReplies.filter((reply) => !contextIds.has(reply.id));
   }, [contextMessages, localRepliesByItemId, selectedItem]);
-  React.useEffect(() => {
-    // Auto-selection is Messages-mode-only: in Reminders mode no FeedItem is
-    // ever selected, so default-selecting one behind the reminders list would
-    // be wasted work and could drive narrow-viewport detail off a stale feed
-    // selection.
-    if (!isMessagesMode) {
-      return;
-    }
-
-    // The URL carries an explicit anchor — auto-selection must not overwrite
-    // it. Clear any stale auto fallback so it cannot reappear if back later
-    // returns to a no-item entry.
-    if (urlSelectedItemId !== null) {
-      setAutoSelectedEventId(null);
-      return;
-    }
-
-    // While the feed is loading (e.g. a reload restoring `?item=` from the
-    // URL) the selected item simply hasn't arrived yet — don't clobber it.
-    if (isLoading || !feed) {
-      return;
-    }
-
-    if (filteredItems.length === 0) {
-      setAutoSelectedEventId(null);
-      return;
-    }
-
-    // Don't default-select before the width is measured: at width 0
-    // isNarrowHomeViewport is false, so narrow Home would cold-load into detail.
-    if (homeInboxWidthPx === 0) {
-      return;
-    }
-
-    // The event anchor is still valid if the conversation it belongs to is
-    // still present in the filtered list. A live representative-event change
-    // does NOT invalidate the anchor (the same conversationId is still there).
-    if (
-      selectedConversationId !== null &&
-      filteredItems.some(
-        (item) => item.conversationId === selectedConversationId,
-      )
-    ) {
-      return;
-    }
-
-    // A cold URL anchor is being resolved via getEventById — the user navigated
-    // to a specific event that is not yet in the inbox list. Do not overwrite
-    // selectedEventId; wait for cold recovery to commit before auto-selecting.
-    if (coldResolutionPending) {
-      return;
-    }
-
-    setAutoSelectedEventId(
-      isNarrowHomeViewport ? null : (filteredItems[0]?.id ?? null),
-    );
-  }, [
+  useHomeInboxAutoSelection({
     coldResolutionPending,
-    feed,
     filteredItems,
+    hasFeed: Boolean(feed),
+    hasPersonalSelection:
+      selectedDraftItem !== null || selectedReminder !== null,
     homeInboxWidthPx,
     isLoading,
     isMessagesMode,
     isNarrowHomeViewport,
     selectedConversationId,
+    setAutoSelectedEventId,
     urlSelectedItemId,
-  ]);
+  });
 
   React.useEffect(() => {
     void selectedConversationId;
@@ -604,6 +489,54 @@ export function HomeView({
     setIsSendingReply(false);
   }, [selectedConversationId]);
 
+  const handleFilterChange = React.useCallback(
+    (nextFilter: InboxFilter) => {
+      const nextItems = inboxItems.filter(
+        (item) =>
+          matchesInboxFilter(item, nextFilter, ownedAgentPubkeys) &&
+          (!unreadOnly ||
+            !effectiveDoneSet.has(item.id) ||
+            item.conversationId === selectedConversationId),
+      );
+      const selection = resolveInboxFilterSelection({
+        isNarrow: isNarrowHomeViewport,
+        items: nextItems,
+        selectedConversationId,
+      });
+
+      setUnreadBoundary(null);
+      setSelectedDraftKey(null);
+      setSelectedReminderId(null);
+      setFilter(nextFilter);
+
+      if (
+        nextFilter === "reminders" ||
+        nextFilter === "drafts" ||
+        selection.preserveSelection
+      ) {
+        if (nextFilter === "reminders" || nextFilter === "drafts") {
+          setAutoSelectedEventId(null);
+          applyInboxSearchPatch({ item: null });
+        }
+        return;
+      }
+
+      applyInboxSearchPatch({ item: null });
+      setAutoSelectedEventId(selection.autoSelectedEventId);
+    },
+    [
+      applyInboxSearchPatch,
+      effectiveDoneSet,
+      inboxItems,
+      isNarrowHomeViewport,
+      ownedAgentPubkeys,
+      selectedConversationId,
+      setSelectedDraftKey,
+      setSelectedReminderId,
+      unreadOnly,
+    ],
+  );
+
   if (isLoading && !feed) {
     return <HomeLoadingState />;
   }
@@ -629,63 +562,43 @@ export function HomeView({
     );
   }
 
-  const canReact =
-    selectedItem !== null &&
-    selectedItem.item.channelId !== null &&
-    availableChannelIds.has(selectedItem.item.channelId);
-  const canReply =
-    canReact &&
-    selectedItem.item.kind !== 45001 &&
-    selectedItem.item.kind !== 45003;
-  const disabledReplyReason =
-    canReply || !selectedItem
-      ? null
-      : selectedItem.item.channelId
-        ? availableChannelIds.has(selectedItem.item.channelId)
-          ? "This item does not support inline replies yet."
-          : "Open the linked channel to reply."
-        : "This inbox item does not have a reply target.";
-  const canDelete =
-    selectedItem !== null &&
-    currentPubkey?.trim().toLowerCase() ===
-      selectedItem.item.pubkey.trim().toLowerCase();
-  const isSinglePanelDetailView =
-    isMessagesMode &&
-    isNarrowHomeViewport &&
-    selectedEventId !== null &&
-    !isSinglePanelAuxiliaryView;
-  const isSinglePanelDraftDetailView =
-    isDrafts &&
-    isNarrowHomeViewport &&
-    selectedDraftItem !== null &&
-    !isSinglePanelAuxiliaryView;
-  const showListPane =
-    !isSinglePanelDetailView &&
-    !isSinglePanelDraftDetailView &&
-    !isSinglePanelAuxiliaryView;
-  const showDetailPane =
-    !isSinglePanelAuxiliaryView &&
-    ((isMessagesMode && (!isNarrowHomeViewport || isSinglePanelDetailView)) ||
-      (isDrafts && (!isNarrowHomeViewport || isSinglePanelDraftDetailView)));
-  const auxiliaryPaneWidthPx = isSinglePanelAuxiliaryView
-    ? homeInboxWidthPx
-    : threadPanelWidthPx;
-  const maxEffectiveInboxListWidthPx =
-    homeInboxWidthPx > 0
-      ? Math.max(
-          INBOX_COLUMN_MIN_WIDTH_PX,
-          homeInboxWidthPx -
-            INBOX_COLUMN_MIN_WIDTH_PX -
-            (hasAuxiliaryPane ? auxiliaryPaneWidthPx : 0),
-        )
-      : undefined;
-  const effectiveInboxListWidthPx =
-    homeInboxWidthPx > 0
-      ? Math.min(
-          inboxListWidthPx,
-          maxEffectiveInboxListWidthPx ?? inboxListWidthPx,
-        )
-      : inboxListWidthPx;
+  const { canDelete, canReact, canReply, disabledReplyReason } =
+    getHomeMessageCapabilities(
+      selectedItem,
+      currentPubkey,
+      availableChannelIds,
+    );
+  const detailMode = isDrafts
+    ? "drafts"
+    : isReminders
+      ? "reminders"
+      : selectedDraftItem
+        ? "drafts"
+        : selectedReminder
+          ? "reminders"
+          : "messages";
+  const {
+    auxiliaryPaneWidthPx,
+    effectiveInboxListWidthPx,
+    isSinglePanelDetailView,
+    isSinglePanelDraftDetailView,
+    isSinglePanelReminderDetailView,
+    showDetailPane,
+    showListPane,
+  } = getHomePaneLayout({
+    hasAuxiliaryPane,
+    homeWidthPx: homeInboxWidthPx,
+    inboxListWidthPx,
+    isDrafts: detailMode === "drafts",
+    isMessagesMode: detailMode === "messages",
+    isNarrow: isNarrowHomeViewport,
+    isReminders: detailMode === "reminders",
+    isSinglePanelAuxiliaryView,
+    selectedDraft: selectedDraftItem !== null,
+    selectedEvent: selectedEventId !== null,
+    selectedReminder: selectedReminder !== null,
+    threadPanelWidthPx,
+  });
 
   return (
     <ProfilePanelProvider onOpenProfilePanel={handleOpenProfilePanel}>
@@ -731,7 +644,7 @@ export function HomeView({
               filter={filter}
               items={filteredItems}
               onDeleteDraft={handleDeleteDraft}
-              onFilterChange={setFilter}
+              onFilterChange={handleFilterChange}
               onMarkRead={markItemRead}
               onMarkUnread={markItemUnread}
               onOpenDirect={(item) => {
@@ -758,14 +671,38 @@ export function HomeView({
                 });
               }}
               onSelect={(itemId) => {
+                const item = findInboxItemByEventId(inboxItems, itemId);
+                setUnreadBoundary(
+                  item && !effectiveDoneSet.has(item.id)
+                    ? {
+                        conversationId: item.conversationId,
+                        eventId: item.id,
+                      }
+                    : null,
+                );
+                setSelectedDraftKey(null);
+                setSelectedReminderId(null);
                 handleUserSelectItem(itemId);
                 markItemRead(itemId);
               }}
-              onSelectDraft={setSelectedDraftKey}
+              onSelectDraft={(draftKey) => {
+                setUnreadBoundary(null);
+                setSelectedReminderId(null);
+                handleUserSelectItem(null);
+                setSelectedDraftKey(draftKey);
+              }}
+              onSelectReminder={(reminderId) => {
+                setUnreadBoundary(null);
+                setSelectedDraftKey(null);
+                handleUserSelectItem(null);
+                setSelectedReminderId(reminderId);
+              }}
               onUnreadOnlyChange={setUnreadOnly}
               reminderPubkey={currentPubkey}
+              reminders={pendingReminders}
               selectedConversationId={selectedConversationId}
               selectedDraftKey={selectedDraftKey}
+              selectedReminderId={selectedReminderId}
               showRightDivider={showListPane && showDetailPane}
               unreadOnly={unreadOnly}
             />
@@ -794,7 +731,7 @@ export function HomeView({
             <span className="absolute bottom-0 left-1/2 top-0 w-px -translate-x-1/2 bg-transparent transition-colors group-hover:bg-border/80 group-focus-visible:bg-border/80" />
           </button>
 
-          {showDetailPane && isMessagesMode ? (
+          {showDetailPane && detailMode === "messages" ? (
             <InboxDetailPane
               agentPubkeys={inboxAgentPubkeys}
               canDelete={canDelete}
@@ -810,12 +747,14 @@ export function HomeView({
               isDeletingMessage={isDeletingMessage}
               isSendingReply={isSendingReply}
               isSinglePanelView={isSinglePanelDetailView}
+              hasThreadContextLoadError={threadContext.hasLoadError}
               isThreadContextLoading={threadContext.isLoading}
               item={selectedItem}
               latchedDefaultParentId={latchedDefaultParentId}
               messages={contextMessages}
               profiles={feedProfiles}
               selectedEventId={selectedEventId}
+              unreadBoundaryEventId={unreadBoundaryEventId}
               onBack={
                 isSinglePanelDetailView
                   ? () => {
@@ -931,16 +870,20 @@ export function HomeView({
               replies={selectedItemReplies}
             />
           ) : null}
-          {showDetailPane && isDrafts ? (
-            <DraftDetailPane
-              item={selectedDraftItem}
-              key={selectedDraftItem?.entry.key ?? "empty"}
+          {showDetailPane && detailMode !== "messages" ? (
+            <HomePersonalInboxDetail
+              currentPubkey={currentPubkey}
+              draftItem={selectedDraftItem}
+              mode={detailMode}
               onBack={
                 isSinglePanelDraftDetailView
                   ? () => setSelectedDraftKey(null)
-                  : undefined
+                  : isSinglePanelReminderDetailView
+                    ? () => setSelectedReminderId(null)
+                    : undefined
               }
-              onDelete={handleDeleteDraft}
+              onDeleteDraft={handleDeleteDraft}
+              reminder={selectedReminder}
             />
           ) : null}
           {profilePanelPubkey ? (
diff --git a/desktop/src/features/home/ui/InboxDetailPane.tsx b/desktop/src/features/home/ui/InboxDetailPane.tsx
index 5d6d98323f1..9b6ff57e172 100644
--- a/desktop/src/features/home/ui/InboxDetailPane.tsx
+++ b/desktop/src/features/home/ui/InboxDetailPane.tsx
@@ -1,4 +1,12 @@
-import { ArrowLeft, Hash, Mail, MoreHorizontal, Trash2 } from "lucide-react";
+import {
+  AlertCircle,
+  ArrowLeft,
+  ExternalLink,
+  LoaderCircle,
+  Mail,
+  MoreHorizontal,
+  Trash2,
+} from "lucide-react";
 import * as React from "react";
 
 import type {
@@ -11,6 +19,7 @@ import { ProjectInboxDetail } from "@/features/home/ui/ProjectInboxDetail";
 import { ChannelMembersBar } from "@/features/channels/ui/ChannelMembersBar";
 import { useCommunities } from "@/features/communities/useCommunities";
 import { formatInboxTypeLabel } from "@/features/home/lib/inbox";
+import { hasInboxThreadContext } from "@/features/home/lib/inboxViewHelpers";
 import {
   type InboxDisplayMessage,
   InboxMessageRow,
@@ -60,6 +69,7 @@ type InboxDetailPaneProps = {
   isDeletingMessage?: boolean;
   isSendingReply?: boolean;
   isSinglePanelView?: boolean;
+  hasThreadContextLoadError?: boolean;
   isThreadContextLoading?: boolean;
   item: InboxItem | null;
   messages?: InboxContextMessage[];
@@ -75,6 +85,7 @@ type InboxDetailPaneProps = {
    * representative `item.id`.
    */
   selectedEventId: string | null;
+  unreadBoundaryEventId?: string | null;
   /**
    * The default reply-parent event ID derived from the latched anchor's tags
    * in HomeView (`parentId ?? anchor.id`). Populated once the anchor is found
@@ -95,7 +106,7 @@ type InboxDetailPaneProps = {
     content: string;
     mediaTags?: string[][];
     mentionPubkeys: string[];
-    parentEventId: string;
+    parentEventId: string | null;
   }) => Promise<void>;
   onToggleReaction?: (
     message: TimelineMessage,
@@ -129,6 +140,7 @@ function InboxMessageDetailPane({
   isDeletingMessage = false,
   isSendingReply = false,
   isSinglePanelView = false,
+  hasThreadContextLoadError = false,
   isThreadContextLoading = false,
   item,
   messages = [],
@@ -138,6 +150,7 @@ function InboxMessageDetailPane({
   contextChannelName = null,
   currentPubkey,
   selectedEventId,
+  unreadBoundaryEventId = null,
   latchedDefaultParentId = null,
   onBack,
   onDelete,
@@ -161,6 +174,7 @@ function InboxMessageDetailPane({
   // scroll centering) key on this.
   const conversationId = item?.conversationId ?? null;
   const selectedChannelId = item?.item.channelId ?? null;
+  const isDirectMessage = item?.item.channelType === "dm";
   // Build the plain, non-virtualized timeline the shared hook anchors against.
   // Live arrivals rerun its layout compensation without changing the target.
 
@@ -372,7 +386,8 @@ function InboxMessageDetailPane({
   // (derived from the selected-event anchor at conversation entry), which does
   // not change when a live incoming message advances the representative item.
   const composerParentEventId =
-    replyTarget?.id ?? capturedDefaultParentId ?? item.id;
+    replyTarget?.id ??
+    (isDirectMessage ? null : (capturedDefaultParentId ?? item.id));
   const composerReplyTarget =
     replyTarget && replyTarget.id !== item.id
       ? {
@@ -388,10 +403,27 @@ function InboxMessageDetailPane({
     item.item.channelType === "forum"
       ? item.item.channelType
       : null;
-  const contextLabel = channelContextName ?? formatInboxTypeLabel(item);
-  const hasChannelContext = Boolean(channelContextName);
+  const isThreadContext =
+    !isDirectMessage && hasInboxThreadContext(item, messages);
+  const contextLabel = isThreadContext
+    ? isDirectMessage
+      ? `Thread with ${item.senderLabel}`
+      : channelContextName
+        ? `Thread in #${channelContextName}`
+        : "Thread"
+    : isDirectMessage
+      ? `DM with ${item.senderLabel}`
+      : channelContextName
+        ? `Message in #${channelContextName}`
+        : formatInboxTypeLabel(item);
   const contextChannelId = item.item.channelId;
-  const contextThreadRootId = getThreadReference(item.item.tags).rootId;
+  const sourceEventId = selectedEventId ?? item.id;
+  const contextThreadRootId = isThreadContext ? item.conversationId : null;
+  const openContextLabel = isThreadContext
+    ? "Open full thread"
+    : isDirectMessage
+      ? "Open conversation"
+      : "Open in channel";
 
   const handleSelectReplyTarget = (message: InboxDisplayMessage) => {
     setReplyTargetId((currentReplyTargetId) =>
@@ -430,34 +462,31 @@ function InboxMessageDetailPane({
                 ) : null}
                 <div className="min-w-0">
                   {canOpenChannel && contextChannelId ? (
-                    <button
-                      className="flex min-w-0 items-center gap-[4px] text-left text-sm font-semibold leading-5 tracking-tight text-foreground hover:underline focus-visible:outline-hidden focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2"
-                      onClick={() =>
-                        onOpenContext(
-                          contextChannelId,
-                          item.id,
-                          contextThreadRootId,
-                        )
-                      }
-                      title={item.fullTimestampLabel}
-                      type="button"
-                    >
-                      {hasChannelContext ? (
-                        <Hash className="h-4 w-4 shrink-0" color="gray" />
-                      ) : null}
-                      <span className="min-w-0 translate-y-px truncate">
-                        {contextLabel}
-                      </span>
-                    </button>
+                    <h2 className="min-w-0">
+                      <button
+                        className="block min-w-0 text-left text-sm font-semibold leading-5 tracking-tight text-foreground hover:underline focus-visible:outline-hidden focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2"
+                        data-testid="home-inbox-context-title"
+                        onClick={() =>
+                          onOpenContext(
+                            contextChannelId,
+                            sourceEventId,
+                            contextThreadRootId,
+                          )
+                        }
+                        title={openContextLabel}
+                        type="button"
+                      >
+                        <span className="block min-w-0 translate-y-px truncate">
+                          {contextLabel}
+                        </span>
+                      </button>
+                    </h2>
                   ) : (
                     <h2
-                      className="flex min-w-0 items-center gap-[4px] text-sm font-semibold leading-5 tracking-tight text-foreground"
+                      className="min-w-0 text-sm font-semibold leading-5 tracking-tight text-foreground"
                       title={item.fullTimestampLabel}
                     >
-                      {hasChannelContext ? (
-                        <Hash className="h-4 w-4 shrink-0" color="gray" />
-                      ) : null}
-                      <span className="min-w-0 translate-y-px truncate">
+                      <span className="block min-w-0 translate-y-px truncate">
                         {contextLabel}
                       </span>
                     </h2>
@@ -468,6 +497,30 @@ function InboxMessageDetailPane({
               <TooltipProvider delayDuration={200}>
                 <div className="flex shrink-0 items-center gap-1">
                   <UpdateIndicator />
+                  {canOpenChannel && contextChannelId ? (
+                    <Tooltip>
+                      <TooltipTrigger asChild>
+                        <Button
+                          aria-label={openContextLabel}
+                          className="rounded-full text-muted-foreground"
+                          data-testid="home-inbox-open-context"
+                          onClick={() =>
+                            onOpenContext(
+                              contextChannelId,
+                              sourceEventId,
+                              contextThreadRootId,
+                            )
+                          }
+                          size="icon"
+                          type="button"
+                          variant="ghost"
+                        >
+                          <ExternalLink />
+                        </Button>
+                      </TooltipTrigger>
+                      <TooltipContent>{openContextLabel}</TooltipContent>
+                    </Tooltip>
+                  ) : null}
                   {channel ? (
                     <ChannelMembersBar
                       channel={channel}
@@ -502,8 +555,27 @@ function InboxMessageDetailPane({
           ref={scrollContainerRef}
         >
           <div ref={contentRef}>
+            {isThreadContextLoading && displayMessages.length <= 1 ? (
+              <div
+                className="mx-4 mb-2 flex items-center gap-2 rounded-md bg-muted/50 px-3 py-2 text-sm text-muted-foreground"
+                data-testid="home-inbox-context-loading"
+              >
+                <LoaderCircle className="h-4 w-4 shrink-0 animate-spin" />
+                <span>Loading surrounding context...</span>
+              </div>
+            ) : null}
+            {hasThreadContextLoadError ? (
+              <div
+                className="mx-4 mb-2 flex items-center gap-2 rounded-md bg-destructive/10 px-3 py-2 text-sm text-destructive"
+                data-testid="home-inbox-context-error"
+              >
+                <AlertCircle className="h-4 w-4 shrink-0" />
+                <span>Some message context could not be loaded.</span>
+              </div>
+            ) : null}
             {displayMessages.map((message, index) => {
-              const isAfterSeparator = index === 1;
+              const hasUnreadBoundary = message.id === unreadBoundaryEventId;
+              const isAfterSeparator = index === 1 || hasUnreadBoundary;
               const previousMessage = displayMessages[index - 1];
               const isContinuation =
                 !isAfterSeparator &&
@@ -528,6 +600,7 @@ function InboxMessageDetailPane({
                   message={message}
                   onSelectReplyTarget={handleSelectReplyTarget}
                   onToggleReaction={onToggleReaction}
+                  showUnreadBoundary={hasUnreadBoundary}
                 />
               );
             })}
@@ -561,17 +634,25 @@ function InboxMessageDetailPane({
           />
           <div className="pointer-events-auto">
             <MessageComposer
-              audienceContext={{
-                type: "thread",
-                threadRootId: item.conversationId,
-                initialAgentPubkeys,
-              }}
+              audienceContext={
+                isDirectMessage
+                  ? null
+                  : {
+                      type: "thread",
+                      threadRootId: item.conversationId,
+                      initialAgentPubkeys,
+                    }
+              }
               channelId={item.item.channelId}
               channelName={item.channelLabel ?? "channel"}
               channelType={composerChannelType}
               containerClassName="px-4 pb-4 sm:px-4"
               disabled={!canReply}
-              draftKey={`thread:${item.conversationId}`}
+              draftKey={
+                isDirectMessage
+                  ? (item.item.channelId ?? item.conversationId)
+                  : `thread:${item.conversationId}`
+              }
               isSending={isSendingReply}
               onCancelReply={
                 composerReplyTarget ? () => setReplyTargetId(null) : undefined
@@ -586,7 +667,9 @@ function InboxMessageDetailPane({
               }
               placeholder={
                 canReply
-                  ? `Send reply to ${item.channelLabel ? `#${item.channelLabel} thread` : "channel thread"}`
+                  ? isDirectMessage
+                    ? `Message ${item.senderLabel}`
+                    : `Send reply to ${item.channelLabel ? `#${item.channelLabel} thread` : "channel thread"}`
                   : (disabledReplyReason ??
                     "Replies are not available for this item.")
               }
diff --git a/desktop/src/features/home/ui/InboxFilterMenu.tsx b/desktop/src/features/home/ui/InboxFilterMenu.tsx
new file mode 100644
index 00000000000..6fcc759731b
--- /dev/null
+++ b/desktop/src/features/home/ui/InboxFilterMenu.tsx
@@ -0,0 +1,107 @@
+import { ChevronDown } from "lucide-react";
+
+import type { InboxFilter } from "@/features/home/lib/inbox";
+import { cn } from "@/shared/lib/cn";
+import {
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuRadioGroup,
+  DropdownMenuRadioItem,
+  DropdownMenuSeparator,
+  DropdownMenuTrigger,
+} from "@/shared/ui/dropdown-menu";
+
+const INBOX_FILTER_OPTIONS: Array<{
+  label: string;
+  value: InboxFilter;
+}> = [
+  { value: "all", label: "All" },
+  { value: "project", label: "Projects" },
+  { value: "mention", label: "Mentions" },
+  { value: "thread", label: "Threads" },
+  { value: "needs_action", label: "Needs action" },
+  { value: "agent_activity", label: "Agents" },
+  { value: "reminders", label: "Reminders" },
+  { value: "drafts", label: "Drafts" },
+];
+
+const TRIGGER_CLASS =
+  "inline-flex h-8 shrink-0 items-center justify-center rounded-lg text-muted-foreground transition-colors hover:bg-muted/70 hover:text-foreground focus-visible:outline-hidden focus-visible:ring-1 focus-visible:ring-ring data-[state=open]:bg-muted/70 data-[state=open]:text-foreground disabled:pointer-events-none disabled:opacity-50 [&_svg]:pointer-events-none [&_svg]:size-4 [&_svg]:shrink-0 relative -ml-2 w-auto gap-1 px-2 text-sm font-medium text-foreground";
+
+type InboxFilterMenuProps = {
+  activeDraftCount: number;
+  dueReminderCount: number;
+  filter: InboxFilter;
+  onFilterChange: (value: InboxFilter) => void;
+  reminderCount: number;
+};
+
+export function InboxFilterMenu({
+  activeDraftCount,
+  dueReminderCount,
+  filter,
+  onFilterChange,
+  reminderCount,
+}: InboxFilterMenuProps) {
+  const activeFilter = INBOX_FILTER_OPTIONS.find(
+    (option) => option.value === filter,
+  );
+  const statusLabel =
+    dueReminderCount > 0
+      ? `${dueReminderCount} due reminder${dueReminderCount === 1 ? "" : "s"}`
+      : activeDraftCount > 0
+        ? `${activeDraftCount} active draft${activeDraftCount === 1 ? "" : "s"}`
+        : null;
+
+  return (
+    <DropdownMenu>
+      <DropdownMenuTrigger asChild>
+        <button
+          aria-label={`Filter inbox: ${activeFilter?.label ?? "All"}${statusLabel ? `. ${statusLabel}` : ""}`}
+          className={cn(TRIGGER_CLASS)}
+          data-testid="inbox-filter-trigger"
+          type="button"
+        >
+          <span>{activeFilter?.label ?? "All"}</span>
+          <ChevronDown className="text-muted-foreground" />
+        </button>
+      </DropdownMenuTrigger>
+      <DropdownMenuContent align="start" className="w-52">
+        <DropdownMenuRadioGroup
+          onValueChange={(value) => onFilterChange(value as InboxFilter)}
+          value={filter}
+        >
+          {INBOX_FILTER_OPTIONS.map((option) => (
+            <div key={option.value}>
+              {option.value === "reminders" ? (
+                <DropdownMenuSeparator className="my-2 bg-border/60" />
+              ) : null}
+              <DropdownMenuRadioItem value={option.value}>
+                <span className="flex flex-1 items-center gap-2">
+                  <span>{option.label}</span>
+                  <span className="ml-auto flex items-center gap-1.5">
+                    {option.value === "reminders" && reminderCount > 0 ? (
+                      <span
+                        className="inline-flex h-4 min-w-4 items-center justify-center rounded-full bg-primary px-1 text-2xs font-semibold leading-none text-primary-foreground"
+                        data-testid="inbox-reminder-badge-option"
+                      >
+                        {reminderCount}
+                      </span>
+                    ) : option.value === "drafts" && activeDraftCount > 0 ? (
+                      <span
+                        className="inline-flex h-4 min-w-4 items-center justify-center rounded-full bg-primary px-1 text-2xs font-semibold leading-none text-primary-foreground"
+                        data-testid="inbox-draft-badge-option"
+                      >
+                        {activeDraftCount}
+                      </span>
+                    ) : null}
+                  </span>
+                </span>
+              </DropdownMenuRadioItem>
+            </div>
+          ))}
+        </DropdownMenuRadioGroup>
+      </DropdownMenuContent>
+    </DropdownMenu>
+  );
+}
diff --git a/desktop/src/features/home/ui/InboxListPane.tsx b/desktop/src/features/home/ui/InboxListPane.tsx
index 603ebc2beb6..fa214dc730e 100644
--- a/desktop/src/features/home/ui/InboxListPane.tsx
+++ b/desktop/src/features/home/ui/InboxListPane.tsx
@@ -1,10 +1,4 @@
-import {
-  ChevronDown,
-  Clock,
-  Ellipsis,
-  ExternalLink,
-  MailOpen,
-} from "lucide-react";
+import { Bell, Clock, Ellipsis, ExternalLink, MailOpen } from "lucide-react";
 import * as React from "react";
 
 import {
@@ -13,12 +7,19 @@ import {
   type InboxItem,
   type InboxTypeLabel,
 } from "@/features/home/lib/inbox";
+import { buildInboxListRows } from "@/features/home/lib/inboxListRows";
+import { InboxFilterMenu } from "@/features/home/ui/InboxFilterMenu";
 import {
   DraftsPanel,
   type DraftViewItem,
 } from "@/features/messages/ui/DraftsPanel";
 import { UserProfilePopover } from "@/features/profile/ui/UserProfilePopover";
-import { RemindersPanel } from "@/features/reminders/ui/RemindersPanel";
+import type { Reminder } from "@/features/reminders/lib/reminderTypes";
+import { isDue } from "@/features/reminders/lib/reminderFilters";
+import {
+  RemindersPanel,
+  useReminderSources,
+} from "@/features/reminders/ui/RemindersPanel";
 import { TopChromeInsetHeader } from "@/shared/layout/TopChromeInsetHeader";
 import { cn } from "@/shared/lib/cn";
 import { normalizePubkey } from "@/shared/lib/pubkey";
@@ -34,13 +35,6 @@ import {
   MENTION_CHIP_BASE_CLASSES,
   MESSAGE_MARKDOWN_CLASS,
 } from "@/shared/ui/mentionChip";
-import {
-  DropdownMenu,
-  DropdownMenuContent,
-  DropdownMenuRadioGroup,
-  DropdownMenuRadioItem,
-  DropdownMenuTrigger,
-} from "@/shared/ui/dropdown-menu";
 import { Popover, PopoverContent, PopoverTrigger } from "@/shared/ui/popover";
 import { Separator } from "@/shared/ui/separator";
 import { Switch } from "@/shared/ui/switch";
@@ -48,24 +42,34 @@ import { Tooltip, TooltipContent, TooltipTrigger } from "@/shared/ui/tooltip";
 import { UserAvatar } from "@/shared/ui/UserAvatar";
 import { VirtualizedList } from "@/shared/ui/VirtualizedList";
 
-const FILTER_OPTIONS: Array<{ label: string; value: InboxFilter }> = [
-  { value: "all", label: "All" },
-  { value: "project", label: "Projects" },
-  { value: "mention", label: "Mentions" },
-  { value: "thread", label: "Threads" },
-  { value: "needs_action", label: "Needs Action" },
-  { value: "activity", label: "Activity" },
-  { value: "agent_activity", label: "Agents" },
-  { value: "reminders", label: "Reminders" },
-  { value: "drafts", label: "Drafts" },
-];
+const INBOX_EMPTY_STATE_TITLES: Record<InboxFilter, string> = {
+  all: "No activity yet",
+  project: "No project work found",
+  mention: "No mentions found",
+  thread: "No threads found",
+  needs_action: "Nothing needs action",
+  agent_activity: "No agent updates found",
+  reminders: "No reminders",
+  drafts: "No drafts",
+};
+
+const INBOX_UNREAD_EMPTY_STATE_TITLES: Record<InboxFilter, string> = {
+  all: "No unread activity",
+  project: "No unread project work",
+  mention: "No unread mentions",
+  thread: "No unread threads",
+  needs_action: "No unread items needing action",
+  agent_activity: "No unread agent updates",
+  reminders: "No unread reminders",
+  drafts: "No unread drafts",
+};
 
 const INBOX_HEADER_ICON_BUTTON_CLASS =
   "inline-flex h-8 w-8 shrink-0 items-center justify-center rounded-lg text-muted-foreground transition-colors hover:bg-muted/70 hover:text-foreground focus-visible:outline-hidden focus-visible:ring-1 focus-visible:ring-ring data-[state=open]:bg-muted/70 data-[state=open]:text-foreground disabled:pointer-events-none disabled:opacity-50 [&_svg]:pointer-events-none [&_svg]:size-4 [&_svg]:shrink-0";
 const INBOX_PANE_RIGHT_DIVIDER_CLASS =
   "after:pointer-events-none after:absolute after:inset-y-0 after:right-0 after:z-40 after:w-px after:bg-border/35 after:content-['']";
 
-function ActivityLabel({
+function InboxLabel({
   isDone,
   isActionRequired,
   label,
@@ -102,6 +106,71 @@ function ActivityLabel({
   );
 }
 
+function formatReminderStatus(notBefore: number | undefined) {
+  if (notBefore === undefined) return "Pending";
+  const secondsUntil = notBefore - Math.floor(Date.now() / 1_000);
+  if (secondsUntil <= 0) return "Reminder due";
+  if (secondsUntil < 60) return "Reminder in less than a minute";
+  if (secondsUntil < 3_600) {
+    return `Reminder in ${Math.floor(secondsUntil / 60)}m`;
+  }
+  if (secondsUntil < 86_400) {
+    return `Reminder in ${Math.floor(secondsUntil / 3_600)}h`;
+  }
+  return `Reminder in ${Math.floor(secondsUntil / 86_400)}d`;
+}
+
+function PersonalItemRow({
+  id,
+  location,
+  onClick,
+  preview,
+  selected,
+  status,
+}: {
+  id: string;
+  location: InboxTypeLabel | null;
+  onClick: () => void;
+  preview: string;
+  selected: boolean;
+  status: string;
+}) {
+  return (
+    <button
+      aria-current={selected ? "true" : undefined}
+      className={cn(
+        "flex w-full items-center gap-3 border-b border-border/45 px-4 py-3 text-left transition-colors hover:bg-muted/40 focus-visible:bg-muted/40 focus-visible:outline-hidden",
+        selected && "bg-muted/40",
+      )}
+      data-testid={`home-all-reminders-${id}`}
+      onClick={onClick}
+      type="button"
+    >
+      <span className="flex h-9 w-9 shrink-0 items-center justify-center rounded-full bg-muted text-muted-foreground">
+        <Bell className="h-4 w-4" />
+      </span>
+      <span className="min-w-0 flex-1">
+        <span className="block text-sm font-semibold text-foreground">
+          Reminder
+        </span>
+        {location ? (
+          <InboxLabel
+            isActionRequired={false}
+            isDone={false}
+            label={location}
+          />
+        ) : null}
+        <span className="block truncate text-sm text-muted-foreground">
+          {preview}
+        </span>
+      </span>
+      <span className="shrink-0 text-xs font-medium text-muted-foreground">
+        {status}
+      </span>
+    </button>
+  );
+}
+
 type InboxListPaneProps = {
   activeReminderEventIds?: ReadonlySet<string>;
   agentPubkeys?: ReadonlySet<string>;
@@ -118,12 +187,15 @@ type InboxListPaneProps = {
   onRemindLater: (item: InboxItem) => void;
   onSelect: (itemId: string) => void;
   onSelectDraft: (draftKey: string) => void;
+  onSelectReminder: (reminderId: string) => void;
   onUnreadOnlyChange: (checked: boolean) => void;
   selectedConversationId: string | null;
   selectedDraftKey: string | null;
   showRightDivider?: boolean;
   dueReminderCount: number;
   reminderPubkey?: string;
+  reminders: readonly Reminder[];
+  selectedReminderId: string | null;
   unreadOnly: boolean;
 };
 
@@ -143,24 +215,41 @@ export function InboxListPane({
   onRemindLater,
   onSelect,
   onSelectDraft,
+  onSelectReminder,
   onUnreadOnlyChange,
   selectedConversationId,
   selectedDraftKey,
   showRightDivider = false,
   dueReminderCount,
   reminderPubkey,
+  reminders,
+  selectedReminderId,
   unreadOnly,
 }: InboxListPaneProps) {
-  const activeFilter = FILTER_OPTIONS.find((option) => option.value === filter);
   const isReminders = filter === "reminders";
   const isDrafts = filter === "drafts";
-  const inboxStatusLabel =
-    dueReminderCount > 0
-      ? `${dueReminderCount} due reminder${dueReminderCount === 1 ? "" : "s"}`
-      : activeDraftCount > 0
-        ? `${activeDraftCount} active draft${activeDraftCount === 1 ? "" : "s"}`
-        : null;
+  const isMixedInboxView = filter === "all";
   const scrollRef = React.useRef<HTMLDivElement>(null);
+  const inboxRows = React.useMemo(
+    () =>
+      buildInboxListRows({
+        items,
+        reminders: unreadOnly
+          ? []
+          : reminders.filter((reminder) =>
+              isDue(reminder, Math.floor(Date.now() / 1_000)),
+            ),
+      }),
+    [items, reminders, unreadOnly],
+  );
+  const visibleInboxRows = React.useMemo(
+    () =>
+      isMixedInboxView
+        ? inboxRows
+        : inboxRows.filter((row) => row.kind === "inbox"),
+    [inboxRows, isMixedInboxView],
+  );
+  const reminderSources = useReminderSources(reminders);
   const unreadVisibleItemCount = React.useMemo(
     () =>
       items.reduce((count, item) => count + (doneSet.has(item.id) ? 0 : 1), 0),
@@ -174,10 +263,14 @@ export function InboxListPane({
     }
   }, [doneSet, items, onMarkRead]);
 
-  const renderItem = (item: InboxItem) => {
+  const renderItem = (item: InboxItem, dueReminder?: Reminder) => {
     const isSelected = item.conversationId === selectedConversationId;
     const isDone = doneSet.has(item.id);
-    const hasActiveReminder = activeReminderEventIds?.has(item.id) ?? false;
+    const hasActiveReminder =
+      dueReminder !== undefined ||
+      [item.id, ...item.groupItems.map((groupItem) => groupItem.id)].some(
+        (eventId) => activeReminderEventIds?.has(eventId) ?? false,
+      );
     const hasChannelTarget = Boolean(item.item.channelId);
     const typeLabel = getInboxTypeLabel(item);
     const isSenderAgent =
@@ -283,14 +376,28 @@ export function InboxListPane({
                       className="h-1.5 w-1.5 rounded-full bg-primary"
                     />
                   ) : null}
+                  {item.unreadCount > 1 ? (
+                    <span data-testid="home-inbox-unread-count">
+                      {item.unreadCount} unread
+                    </span>
+                  ) : null}
                   {item.timestampLabel}
                 </span>
               </div>
-              <ActivityLabel
+              <InboxLabel
                 isActionRequired={item.isActionRequired}
                 isDone={isDone}
                 label={typeLabel}
               />
+              {dueReminder ? (
+                <div
+                  className="mt-1 flex items-center gap-1 text-2xs font-medium text-amber-600/80 dark:text-amber-300/80"
+                  data-testid="home-inbox-reminder-due"
+                >
+                  <Bell className="h-3 w-3" />
+                  Reminder due
+                </div>
+              ) : null}
 
               <div
                 className={cn(
@@ -428,7 +535,7 @@ export function InboxListPane({
                       className="text-sm font-medium text-foreground"
                       htmlFor="inbox-unread-only-switch"
                     >
-                      Show unread
+                      Show unread only
                     </label>
                     <Switch
                       checked={unreadOnly}
@@ -457,71 +564,13 @@ export function InboxListPane({
               </Popover>
             </div>
             <div className="order-1 flex shrink-0 items-center justify-start">
-              <DropdownMenu>
-                <DropdownMenuTrigger asChild>
-                  <button
-                    aria-label={`Filter inbox: ${activeFilter?.label ?? "All"}${inboxStatusLabel ? `. ${inboxStatusLabel}` : ""}`}
-                    className={cn(
-                      INBOX_HEADER_ICON_BUTTON_CLASS,
-                      "relative -ml-2 w-auto gap-1 px-2 text-sm font-medium text-foreground",
-                    )}
-                    data-testid="inbox-filter-trigger"
-                    type="button"
-                  >
-                    <span>{activeFilter?.label ?? "All"}</span>
-                    <ChevronDown className="h-4 w-4 text-muted-foreground" />
-                    {dueReminderCount > 0 ? (
-                      <span
-                        aria-hidden="true"
-                        className="absolute right-1.5 top-0 h-1.5 w-1.5 rounded-full bg-primary ring-2 ring-background"
-                        data-testid="inbox-reminder-badge"
-                      />
-                    ) : activeDraftCount > 0 ? (
-                      <span
-                        aria-hidden="true"
-                        className="absolute right-1.5 top-0 h-1.5 w-1.5 rounded-full bg-primary ring-2 ring-background"
-                        data-testid="inbox-draft-badge"
-                      />
-                    ) : null}
-                  </button>
-                </DropdownMenuTrigger>
-                <DropdownMenuContent align="start" className="w-48">
-                  <DropdownMenuRadioGroup
-                    onValueChange={(value) =>
-                      onFilterChange(value as InboxFilter)
-                    }
-                    value={filter}
-                  >
-                    {FILTER_OPTIONS.map((option) => (
-                      <DropdownMenuRadioItem
-                        key={option.value}
-                        value={option.value}
-                      >
-                        <span className="flex flex-1 items-center justify-between gap-2">
-                          {option.label}
-                          {option.value === "reminders" &&
-                          dueReminderCount > 0 ? (
-                            <span
-                              className="inline-flex h-4 min-w-4 items-center justify-center rounded-full bg-primary px-1 text-2xs font-semibold leading-none text-primary-foreground"
-                              data-testid="inbox-reminder-badge-option"
-                            >
-                              {dueReminderCount}
-                            </span>
-                          ) : option.value === "drafts" &&
-                            activeDraftCount > 0 ? (
-                            <span
-                              className="inline-flex h-4 min-w-4 items-center justify-center rounded-full bg-primary px-1 text-2xs font-semibold leading-none text-primary-foreground"
-                              data-testid="inbox-draft-badge-option"
-                            >
-                              {activeDraftCount}
-                            </span>
-                          ) : null}
-                        </span>
-                      </DropdownMenuRadioItem>
-                    ))}
-                  </DropdownMenuRadioGroup>
-                </DropdownMenuContent>
-              </DropdownMenu>
+              <InboxFilterMenu
+                activeDraftCount={activeDraftCount}
+                dueReminderCount={dueReminderCount}
+                filter={filter}
+                onFilterChange={onFilterChange}
+                reminderCount={reminders.length}
+              />
             </div>
           </div>
         </div>
@@ -533,7 +582,12 @@ export function InboxListPane({
           data-testid="home-inbox-reminders"
         >
           {reminderPubkey ? (
-            <RemindersPanel includeDone pubkey={reminderPubkey} />
+            <RemindersPanel
+              onSelectReminder={onSelectReminder}
+              presentation="inbox-list"
+              pubkey={reminderPubkey}
+              selectedReminderId={selectedReminderId}
+            />
           ) : null}
         </div>
       ) : isDrafts ? (
@@ -554,27 +608,62 @@ export function InboxListPane({
           data-testid="home-inbox-list"
           ref={scrollRef}
         >
-          {items.length === 0 ? (
+          {visibleInboxRows.length > 0 ? (
+            <VirtualizedList
+              estimateSize={96}
+              getItemKey={(row) => row.key}
+              items={visibleInboxRows}
+              renderItem={(row) => {
+                if (row.kind === "inbox") {
+                  return renderItem(row.item, row.dueReminder);
+                }
+
+                const source = reminderSources.get(row.reminder.id);
+                return (
+                  <PersonalItemRow
+                    id={row.reminder.id}
+                    location={
+                      source?.channel
+                        ? source.channel.channelType === "dm"
+                          ? {
+                              text: `In DM with ${source.channelLabel}`,
+                              channelLabel: null,
+                            }
+                          : { text: "In", channelLabel: source.channelLabel }
+                        : null
+                    }
+                    onClick={() => {
+                      onSelectReminder(row.reminder.id);
+                    }}
+                    preview={
+                      row.reminder.content.target?.preview ||
+                      row.reminder.content.note ||
+                      "Reminder"
+                    }
+                    selected={selectedReminderId === row.reminder.id}
+                    status={formatReminderStatus(row.reminder.notBefore)}
+                  />
+                );
+              }}
+              scrollRef={scrollRef}
+            />
+          ) : (
             <div className="flex h-full min-h-64 items-center justify-center px-6 text-center">
               <div>
                 <p className="text-sm font-medium text-foreground">
-                  {unreadOnly ? "No unread messages" : "No messages found"}
+                  {unreadOnly
+                    ? INBOX_UNREAD_EMPTY_STATE_TITLES[filter]
+                    : INBOX_EMPTY_STATE_TITLES[filter]}
                 </p>
                 <p className="mt-1 text-sm text-muted-foreground">
                   {unreadOnly
-                    ? "Turn off the unread filter to see read messages."
-                    : "Switch back to all mail to see more messages."}
+                    ? "Turn off Show unread only to see read activity."
+                    : filter === "all"
+                      ? "New activity will appear here."
+                      : "Switch back to All to see other activity."}
                 </p>
               </div>
             </div>
-          ) : (
-            <VirtualizedList
-              estimateSize={96}
-              getItemKey={(item) => item.id}
-              items={items}
-              renderItem={renderItem}
-              scrollRef={scrollRef}
-            />
           )}
         </div>
       )}
diff --git a/desktop/src/features/home/ui/InboxMessageRow.tsx b/desktop/src/features/home/ui/InboxMessageRow.tsx
index aaad2bcbd91..04deafb3ffd 100644
--- a/desktop/src/features/home/ui/InboxMessageRow.tsx
+++ b/desktop/src/features/home/ui/InboxMessageRow.tsx
@@ -9,6 +9,7 @@ import { getConfigNudgeAuthorPubkey } from "@/features/messages/ui/configNudgeAu
 import { MessageActionBar } from "@/features/messages/ui/MessageActionBar";
 import { MessageAgentOwner } from "@/features/messages/ui/MessageAgentOwner";
 import { MessageReactions } from "@/features/messages/ui/MessageReactions";
+import { UnreadDivider } from "@/features/messages/ui/UnreadDivider";
 import { useReactionHandler } from "@/features/messages/ui/useReactionHandler";
 import { useMessageEmoji } from "@/features/messages/lib/useMessageEmoji";
 import { UserProfilePopover } from "@/features/profile/ui/UserProfilePopover";
@@ -36,6 +37,7 @@ type InboxMessageRowProps = {
     emoji: string,
     remove: boolean,
   ) => Promise<void>;
+  showUnreadBoundary?: boolean;
 };
 
 export function InboxMessageRow({
@@ -48,6 +50,7 @@ export function InboxMessageRow({
   message,
   onSelectReplyTarget,
   onToggleReaction,
+  showUnreadBoundary = false,
 }: InboxMessageRowProps) {
   const timelineMessage = React.useMemo(
     () => toTimelineMessage(message),
@@ -89,6 +92,7 @@ export function InboxMessageRow({
 
   return (
     <div className="relative px-2">
+      {showUnreadBoundary ? <UnreadDivider /> : null}
       {message.isSelected ? (
         <div
           aria-hidden="true"
diff --git a/desktop/src/features/home/useHomeDrafts.ts b/desktop/src/features/home/useHomeDrafts.ts
index faf646d54f4..8d9accda611 100644
--- a/desktop/src/features/home/useHomeDrafts.ts
+++ b/desktop/src/features/home/useHomeDrafts.ts
@@ -7,19 +7,21 @@ import {
 } from "@/features/messages/ui/DraftsPanel";
 
 type UseHomeDraftsOptions = {
-  isDrafts: boolean;
+  autoSelect: boolean;
   isNarrowHomeViewport: boolean;
+  selectionEnabled: boolean;
   viewportWidthPx: number;
 };
 
 export function useHomeDrafts({
-  isDrafts,
+  autoSelect,
   isNarrowHomeViewport,
+  selectionEnabled,
   viewportWidthPx,
 }: UseHomeDraftsOptions) {
-  const items = useDraftViewItems(isDrafts);
+  const items = useDraftViewItems(selectionEnabled);
   const optimisticActiveCount = useActiveDraftCount(new Map());
-  const activeCount = isDrafts
+  const activeCount = selectionEnabled
     ? items.filter((item) => item.rootStatus !== "deleted").length
     : optimisticActiveCount;
   const [selectedKey, setSelectedKey] = React.useState<string | null>(null);
@@ -27,10 +29,18 @@ export function useHomeDrafts({
     items.find((item) => item.entry.key === selectedKey) ?? null;
 
   React.useEffect(() => {
-    if (!isDrafts) {
+    if (!selectionEnabled) {
       setSelectedKey(null);
       return;
     }
+    if (
+      selectedKey !== null &&
+      !items.some((item) => item.entry.key === selectedKey)
+    ) {
+      setSelectedKey(null);
+      return;
+    }
+    if (!autoSelect) return;
     if (viewportWidthPx === 0) {
       return;
     }
@@ -41,7 +51,14 @@ export function useHomeDrafts({
       return;
     }
     setSelectedKey(isNarrowHomeViewport ? null : (items[0]?.entry.key ?? null));
-  }, [isDrafts, isNarrowHomeViewport, items, selectedKey, viewportWidthPx]);
+  }, [
+    autoSelect,
+    isNarrowHomeViewport,
+    items,
+    selectedKey,
+    selectionEnabled,
+    viewportWidthPx,
+  ]);
 
   const deleteDraft = React.useCallback(
     (draftKey: string) => {
diff --git a/desktop/src/features/home/useHomeInboxAutoSelection.ts b/desktop/src/features/home/useHomeInboxAutoSelection.ts
new file mode 100644
index 00000000000..1cd738c64ca
--- /dev/null
+++ b/desktop/src/features/home/useHomeInboxAutoSelection.ts
@@ -0,0 +1,73 @@
+import * as React from "react";
+
+import type { InboxItem } from "@/features/home/lib/inbox";
+
+type UseHomeInboxAutoSelectionOptions = {
+  coldResolutionPending: boolean;
+  filteredItems: readonly Pick<InboxItem, "conversationId" | "id">[];
+  hasFeed: boolean;
+  hasPersonalSelection: boolean;
+  homeInboxWidthPx: number;
+  isLoading: boolean;
+  isMessagesMode: boolean;
+  isNarrowHomeViewport: boolean;
+  selectedConversationId: string | null;
+  setAutoSelectedEventId: React.Dispatch<React.SetStateAction<string | null>>;
+  urlSelectedItemId: string | null;
+};
+
+export function useHomeInboxAutoSelection({
+  coldResolutionPending,
+  filteredItems,
+  hasFeed,
+  hasPersonalSelection,
+  homeInboxWidthPx,
+  isLoading,
+  isMessagesMode,
+  isNarrowHomeViewport,
+  selectedConversationId,
+  setAutoSelectedEventId,
+  urlSelectedItemId,
+}: UseHomeInboxAutoSelectionOptions) {
+  React.useEffect(() => {
+    if (!isMessagesMode) return;
+
+    if (hasPersonalSelection || urlSelectedItemId !== null) {
+      setAutoSelectedEventId(null);
+      return;
+    }
+
+    if (isLoading || !hasFeed) return;
+
+    if (filteredItems.length === 0) {
+      setAutoSelectedEventId(null);
+      return;
+    }
+
+    // Wait for the width measurement so narrow Home does not cold-load detail.
+    if (homeInboxWidthPx === 0) return;
+
+    const selectedConversationIsVisible =
+      selectedConversationId !== null &&
+      filteredItems.some(
+        (item) => item.conversationId === selectedConversationId,
+      );
+    if (selectedConversationIsVisible || coldResolutionPending) return;
+
+    setAutoSelectedEventId(
+      isNarrowHomeViewport ? null : (filteredItems[0]?.id ?? null),
+    );
+  }, [
+    coldResolutionPending,
+    filteredItems,
+    hasFeed,
+    hasPersonalSelection,
+    homeInboxWidthPx,
+    isLoading,
+    isMessagesMode,
+    isNarrowHomeViewport,
+    selectedConversationId,
+    setAutoSelectedEventId,
+    urlSelectedItemId,
+  ]);
+}
diff --git a/desktop/src/features/home/useHomeInboxContextMessages.ts b/desktop/src/features/home/useHomeInboxContextMessages.ts
new file mode 100644
index 00000000000..b8693c6941f
--- /dev/null
+++ b/desktop/src/features/home/useHomeInboxContextMessages.ts
@@ -0,0 +1,87 @@
+import * as React from "react";
+
+import type { InboxContextMessage, InboxItem } from "@/features/home/lib/inbox";
+import {
+  getReactionTargetId,
+  toInboxContextMessage,
+} from "@/features/home/lib/inboxViewHelpers";
+import { formatTimelineMessages } from "@/features/messages/lib/formatTimelineMessages";
+import type { UserProfileLookup } from "@/features/profile/lib/identity";
+import type { Channel, RelayEvent } from "@/shared/api/types";
+import { KIND_REACTION } from "@/shared/constants/kinds";
+
+type UseHomeInboxContextMessagesOptions = {
+  channelMessages?: RelayEvent[];
+  currentPubkey?: string;
+  events: RelayEvent[];
+  ownerProfiles?: UserProfileLookup;
+  profiles?: UserProfileLookup;
+  reactionEvents: RelayEvent[];
+  relaySelfPubkey?: string | null;
+  selectedChannel: Channel | null;
+  selectedEventId: string | null;
+  selectedItem: InboxItem | null;
+};
+
+export function useHomeInboxContextMessages({
+  channelMessages,
+  currentPubkey,
+  events,
+  ownerProfiles,
+  profiles,
+  reactionEvents,
+  relaySelfPubkey,
+  selectedChannel,
+  selectedEventId,
+  selectedItem,
+}: UseHomeInboxContextMessagesOptions): InboxContextMessage[] {
+  return React.useMemo(() => {
+    if (!selectedItem) return [];
+
+    const eventById = new Map(events.map((event) => [event.id, event]));
+    const contextEventIds = new Set(eventById.keys());
+    const contextReactions = [
+      ...(channelMessages ?? []),
+      ...reactionEvents,
+    ].filter((event) => {
+      if (event.kind !== KIND_REACTION) return false;
+      const targetId = getReactionTargetId(event.tags);
+      return Boolean(targetId && contextEventIds.has(targetId));
+    });
+    const currentUserAvatarUrl = currentPubkey
+      ? (profiles?.[currentPubkey.toLowerCase()]?.avatarUrl ?? null)
+      : null;
+    const timelineMessages = formatTimelineMessages(
+      [...events, ...contextReactions],
+      selectedChannel,
+      currentPubkey,
+      currentUserAvatarUrl,
+      profiles,
+      undefined,
+      undefined,
+      undefined,
+      relaySelfPubkey,
+      ownerProfiles,
+    );
+
+    return timelineMessages.map((message) =>
+      toInboxContextMessage(message, {
+        eventById,
+        fallbackAuthorPubkey: selectedItem.item.pubkey,
+        profiles,
+        selectedItemId: selectedEventId ?? selectedItem.id,
+      }),
+    );
+  }, [
+    channelMessages,
+    currentPubkey,
+    events,
+    ownerProfiles,
+    profiles,
+    reactionEvents,
+    relaySelfPubkey,
+    selectedChannel,
+    selectedEventId,
+    selectedItem,
+  ]);
+}
diff --git a/desktop/src/features/home/useHomeInboxReadState.test.mjs b/desktop/src/features/home/useHomeInboxReadState.test.mjs
index a6f4c90bcc6..4af181379a8 100644
--- a/desktop/src/features/home/useHomeInboxReadState.test.mjs
+++ b/desktop/src/features/home/useHomeInboxReadState.test.mjs
@@ -168,7 +168,7 @@ test("thread inbox row read state includes per-message marker", () => {
   );
 });
 
-test("thread inbox row read state uses newest thread or message marker", () => {
+test("thread inbox row read state follows the per-message marker", () => {
   const replyItem = feedItem({
     id: "reply-event",
     createdAt: 200,
@@ -185,6 +185,30 @@ test("thread inbox row read state uses newest thread or message marker", () => {
       getThreadReadAt: () => 250,
       getMessageReadAt: () => 200,
     }),
-    250,
+    200,
+  );
+});
+
+test("parent-only replies use their parent as the thread read context", () => {
+  const replyItem = feedItem({
+    id: "reply-event",
+    createdAt: 200,
+    tags: [
+      ["h", CHANNEL_ID],
+      ["e", "parent-event", "", "reply"],
+    ],
+  });
+  let resolvedRootId = null;
+
+  assert.equal(
+    resolveInboxItemReadAt(inboxItem([replyItem]), {
+      getChannelReadAt: () => 100,
+      getThreadReadAt: (rootId) => {
+        resolvedRootId = rootId;
+        return 150;
+      },
+    }),
+    150,
   );
+  assert.equal(resolvedRootId, "parent-event");
 });
diff --git a/desktop/src/features/home/useHomeInboxReadState.ts b/desktop/src/features/home/useHomeInboxReadState.ts
index 167c87337a7..624e72a0f5e 100644
--- a/desktop/src/features/home/useHomeInboxReadState.ts
+++ b/desktop/src/features/home/useHomeInboxReadState.ts
@@ -1,7 +1,6 @@
 import * as React from "react";
 
 import type { InboxItem } from "@/features/home/lib/inbox";
-import { maxReadAt } from "@/features/channels/readState/readStateFormat";
 import {
   getThreadReference,
   isThreadReply,
@@ -29,6 +28,8 @@ type UseHomeInboxReadStateOptions = {
   ) => void;
   /** Advance the thread read marker to the given unix-seconds timestamp. */
   markThreadRead: (rootId: string, timestamp: number) => void;
+  /** Advance a reply's per-message read marker to the given unix-seconds timestamp. */
+  markMessageRead: (messageId: string, timestamp: number) => void;
   /** Local fallback: mark a non-channel item done. */
   markDoneLocal: (id: string) => void;
   /** Local inbox row override: mark an item unread without touching the channel. */
@@ -46,7 +47,8 @@ function getInboxThreadRootId(item: InboxItem): string | null {
     return null;
   }
 
-  return getThreadReference(item.item.tags).rootId;
+  const thread = getThreadReference(item.item.tags);
+  return thread.rootId ?? thread.parentId;
 }
 
 export function getGroupedChannelReadTimestamp(
@@ -95,10 +97,10 @@ export function resolveInboxItemReadAt(
   const channelId = item.item.channelId;
   const threadRootId = getInboxThreadRootId(item);
   if (threadRootId) {
-    return maxReadAt(
-      options.getThreadReadAt(threadRootId, channelId),
-      options.getMessageReadAt?.(item.item.id) ?? null,
-    );
+    if (options.getMessageReadAt) {
+      return options.getMessageReadAt(item.item.id);
+    }
+    return options.getThreadReadAt(threadRootId, channelId);
   }
 
   return channelId ? options.getChannelReadAt(channelId) : null;
@@ -110,9 +112,10 @@ export function resolveInboxItemReadAt(
  * belong to a channel (reminders etc.).
  *
  * "Mark as read" on channel-backed items is routed through `markChannelRead`;
- * thread rows use their own `thread:<root>` marker so they do not affect the
- * sidebar channel dot. "Mark unread" is item-local: it only reopens the
- * specific inbox row and must not light up the channel.
+ * thread rows advance the same per-message markers as the channel thread
+ * panel, plus the aggregate `thread:<root>` marker for compatibility. "Mark
+ * unread" is item-local: it only reopens the specific inbox row and must not
+ * light up the channel.
  */
 export function useHomeInboxReadState({
   items,
@@ -124,6 +127,7 @@ export function useHomeInboxReadState({
   localUnreadSet = EMPTY_ITEM_SET,
   markChannelRead,
   markThreadRead,
+  markMessageRead,
   markDoneLocal,
   markUnreadLocal,
   undoDoneLocal,
@@ -183,6 +187,14 @@ export function useHomeInboxReadState({
       }
       const threadRootId = item ? getInboxThreadRootId(item) : null;
       if (item && threadRootId) {
+        const markedReplyIds = new Set<string>();
+        for (const reply of [item.item, ...item.groupItems]) {
+          if (!isThreadReply(reply.tags) || markedReplyIds.has(reply.id)) {
+            continue;
+          }
+          markedReplyIds.add(reply.id);
+          markMessageRead(reply.id, reply.createdAt);
+        }
         markThreadRead(threadRootId, item.latestActivityAt);
         const groupedChannelRead = getGroupedChannelReadTimestamp(item);
         if (groupedChannelRead) {
@@ -204,7 +216,14 @@ export function useHomeInboxReadState({
       }
       markDoneLocal(itemId);
     },
-    [itemById, markChannelRead, markDoneLocal, markThreadRead, undoUnreadLocal],
+    [
+      itemById,
+      markChannelRead,
+      markDoneLocal,
+      markMessageRead,
+      markThreadRead,
+      undoUnreadLocal,
+    ],
   );
 
   const markItemUnread = React.useCallback(
diff --git a/desktop/src/features/home/useHomePersonalInbox.ts b/desktop/src/features/home/useHomePersonalInbox.ts
new file mode 100644
index 00000000000..5c4fd6037df
--- /dev/null
+++ b/desktop/src/features/home/useHomePersonalInbox.ts
@@ -0,0 +1,90 @@
+import * as React from "react";
+
+import { useHomeDrafts } from "@/features/home/useHomeDrafts";
+import {
+  countDueReminders,
+  useRemindersQuery,
+} from "@/features/reminders/hooks";
+import { groupReminders } from "@/features/reminders/lib/reminderFilters";
+
+type UseHomePersonalInboxOptions = {
+  allowMixedSelection: boolean;
+  currentPubkey?: string;
+  isDrafts: boolean;
+  isNarrowHomeViewport: boolean;
+  isReminders: boolean;
+  viewportWidthPx: number;
+};
+
+export function useHomePersonalInbox({
+  allowMixedSelection,
+  currentPubkey,
+  isDrafts,
+  isNarrowHomeViewport,
+  isReminders,
+  viewportWidthPx,
+}: UseHomePersonalInboxOptions) {
+  const remindersQuery = useRemindersQuery(currentPubkey);
+  const dueReminderCount = countDueReminders(remindersQuery.data ?? []);
+  const pendingReminders = React.useMemo(
+    () =>
+      groupReminders(remindersQuery.data ?? []).flatMap(
+        (group) => group.reminders,
+      ),
+    [remindersQuery.data],
+  );
+  const [selectedReminderId, selectReminder] = React.useState<string | null>(
+    null,
+  );
+  const selectedReminder =
+    pendingReminders.find((reminder) => reminder.id === selectedReminderId) ??
+    null;
+
+  React.useEffect(() => {
+    const selectionEnabled = isReminders || allowMixedSelection;
+    if (!selectionEnabled) {
+      selectReminder(null);
+      return;
+    }
+    if (
+      selectedReminderId !== null &&
+      !pendingReminders.some((reminder) => reminder.id === selectedReminderId)
+    ) {
+      selectReminder(null);
+      return;
+    }
+    if (!isReminders) return;
+    if (viewportWidthPx === 0 || selectedReminder !== null) return;
+    selectReminder(
+      isNarrowHomeViewport ? null : (pendingReminders[0]?.id ?? null),
+    );
+  }, [
+    allowMixedSelection,
+    isNarrowHomeViewport,
+    isReminders,
+    pendingReminders,
+    selectedReminderId,
+    selectedReminder,
+    viewportWidthPx,
+  ]);
+
+  // Drafts are only listed (and selectable) under the dedicated Drafts
+  // filter — they never appear in the mixed All view.
+  const drafts = useHomeDrafts({
+    autoSelect: isDrafts,
+    isNarrowHomeViewport,
+    selectionEnabled: isDrafts,
+    viewportWidthPx,
+  });
+
+  return {
+    drafts,
+    dueReminderCount,
+    pendingReminders,
+    reminders: {
+      selectedId: selectedReminderId,
+      selectedItem: selectedReminder,
+      select: selectReminder,
+    },
+  };
+}
diff --git a/desktop/src/features/home/useInboxThreadContext.ts b/desktop/src/features/home/useInboxThreadContext.ts
index b3c1da94852..67a46957f91 100644
--- a/desktop/src/features/home/useInboxThreadContext.ts
+++ b/desktop/src/features/home/useInboxThreadContext.ts
@@ -7,10 +7,14 @@ import { relayClient } from "@/shared/api/relayClient";
 import { buildChannelReactionAuxFilter } from "@/shared/api/relayChannelFilters";
 import { getEventById } from "@/shared/api/tauri";
 import type { FeedItem, RelayEvent } from "@/shared/api/types";
-import { HOME_MENTION_EVENT_KINDS } from "@/shared/constants/kinds";
+import {
+  CHANNEL_TIMELINE_CONTENT_KINDS,
+  HOME_MENTION_EVENT_KINDS,
+} from "@/shared/constants/kinds";
 
 type InboxThreadContextResult = {
   events: RelayEvent[];
+  hasLoadError: boolean;
   isLoading: boolean;
   /** kind:7 events referencing the context messages, fetched by `#e`. */
   reactionEvents: RelayEvent[];
@@ -19,6 +23,10 @@ type InboxThreadContextResult = {
 };
 
 const THREAD_CONTEXT_LIMIT = 100;
+const MAX_ANCESTOR_HOPS = 50;
+const CHANNEL_CONTEXT_EVENT_KINDS = new Set<number>(
+  CHANNEL_TIMELINE_CONTENT_KINDS,
+);
 
 function dedupeEvents(events: RelayEvent[]): RelayEvent[] {
   const eventsById = new Map<string, RelayEvent>();
@@ -36,8 +44,14 @@ function getThreadRootId(event: RelayEvent): string {
 export function useInboxThreadContext(
   item: FeedItem | null,
   channelMessages: RelayEvent[] | undefined,
+  options: {
+    fullChannel?: boolean;
+    hasChannelLoadError?: boolean;
+    isChannelLoading?: boolean;
+  } = {},
 ): InboxThreadContextResult {
   const [fetchedEvents, setFetchedEvents] = React.useState<RelayEvent[]>([]);
+  const [hasLoadError, setHasLoadError] = React.useState(false);
   const [isLoading, setIsLoading] = React.useState(false);
 
   const selectedEvent = React.useMemo(
@@ -52,12 +66,14 @@ export function useInboxThreadContext(
     ? getThreadReference(selectedEvent.tags).parentId
     : null;
   const selectedChannelId = item?.channelId ?? null;
+  const fullChannel = options.fullChannel === true;
 
   React.useEffect(() => {
     let isCancelled = false;
 
-    if (!selectedEvent || !selectedThreadRootId) {
+    if (fullChannel || !selectedEvent || !selectedThreadRootId) {
       setFetchedEvents([]);
+      setHasLoadError(false);
       setIsLoading(false);
       return () => {
         isCancelled = true;
@@ -72,6 +88,7 @@ export function useInboxThreadContext(
       }
 
       setIsLoading(true);
+      setHasLoadError(false);
 
       try {
         const selection = {
@@ -80,22 +97,48 @@ export function useInboxThreadContext(
           selectedParentId,
           selectedThreadRootId: threadRootId,
         };
-        const eventIds = new Set<string>([threadRootId]);
-        if (selectedParentId) {
-          eventIds.add(selectedParentId);
-        }
+        const ancestorEventsPromise = (async () => {
+          const eventsById = new Map<string, RelayEvent>();
+          let failed = false;
 
-        const ancestorEventsPromise = Promise.all(
-          [...eventIds]
-            .filter((eventId) => eventId !== targetEvent.id)
-            .map(async (eventId) => {
-              try {
-                return await getEventById(eventId);
-              } catch {
-                return null;
-              }
-            }),
-        );
+          const fetchEvent = async (eventId: string) => {
+            if (eventId === targetEvent.id || eventsById.has(eventId)) {
+              return eventsById.get(eventId) ?? targetEvent;
+            }
+
+            try {
+              const event = await getEventById(eventId);
+              eventsById.set(event.id, event);
+              return event;
+            } catch {
+              failed = true;
+              return null;
+            }
+          };
+
+          if (threadRootId !== targetEvent.id) {
+            await fetchEvent(threadRootId);
+          }
+
+          let ancestorId = selectedParentId;
+          const seen = new Set<string>([targetEvent.id]);
+          let hops = 0;
+          while (
+            ancestorId &&
+            !seen.has(ancestorId) &&
+            hops < MAX_ANCESTOR_HOPS
+          ) {
+            seen.add(ancestorId);
+            const ancestor = await fetchEvent(ancestorId);
+            if (!ancestor || ancestorId === threadRootId) {
+              break;
+            }
+            ancestorId = getThreadReference(ancestor.tags).parentId;
+            hops += 1;
+          }
+
+          return { events: [...eventsById.values()], failed };
+        })();
 
         const descendantEventsPromise =
           selectedChannelId && threadRootId
@@ -106,9 +149,18 @@ export function useInboxThreadContext(
                   kinds: [...HOME_MENTION_EVENT_KINDS],
                   limit: THREAD_CONTEXT_LIMIT,
                 })
-                .catch(() => [])
-            : Promise.resolve([]);
-        const [ancestorEvents, descendantEvents] = await Promise.all([
+                .then((events) => ({ events, failed: false }))
+                .catch((error) => {
+                  console.error(
+                    "Failed to hydrate Inbox thread context",
+                    selectedChannelId,
+                    threadRootId,
+                    error,
+                  );
+                  return { events: [] as RelayEvent[], failed: true };
+                })
+            : Promise.resolve({ events: [] as RelayEvent[], failed: false });
+        const [ancestorResult, descendantResult] = await Promise.all([
           ancestorEventsPromise,
           descendantEventsPromise,
         ]);
@@ -117,14 +169,20 @@ export function useInboxThreadContext(
           return;
         }
 
+        setHasLoadError(ancestorResult.failed || descendantResult.failed);
         setFetchedEvents(
           dedupeEvents(
-            [...ancestorEvents, ...descendantEvents].filter(
+            [...ancestorResult.events, ...descendantResult.events].filter(
               (event): event is RelayEvent =>
                 event !== null && isInboxThreadContextEvent(event, selection),
             ),
           ),
         );
+      } catch (error) {
+        if (!isCancelled) {
+          console.error("Failed to load Inbox message context", error);
+          setHasLoadError(true);
+        }
       } finally {
         if (!isCancelled) {
           setIsLoading(false);
@@ -142,6 +200,7 @@ export function useInboxThreadContext(
     selectedEvent,
     selectedParentId,
     selectedThreadRootId,
+    fullChannel,
   ]);
 
   const events = React.useMemo(() => {
@@ -149,6 +208,15 @@ export function useInboxThreadContext(
       return [];
     }
 
+    if (fullChannel) {
+      return dedupeEvents([
+        selectedEvent,
+        ...(channelMessages ?? []).filter((event) =>
+          CHANNEL_CONTEXT_EVENT_KINDS.has(event.kind),
+        ),
+      ]);
+    }
+
     const localContext = (channelMessages ?? []).filter((event) => {
       return isInboxThreadContextEvent(event, {
         selectedChannelId,
@@ -175,6 +243,7 @@ export function useInboxThreadContext(
   }, [
     channelMessages,
     fetchedEvents,
+    fullChannel,
     selectedChannelId,
     selectedEvent,
     selectedParentId,
@@ -240,7 +309,10 @@ export function useInboxThreadContext(
 
   return {
     events,
-    isLoading,
+    hasLoadError: fullChannel
+      ? options.hasChannelLoadError === true
+      : hasLoadError,
+    isLoading: fullChannel ? options.isChannelLoading === true : isLoading,
     reactionEvents,
     refreshReactions,
   };
diff --git a/desktop/src/features/home/useOwnedAgentPubkeys.ts b/desktop/src/features/home/useOwnedAgentPubkeys.ts
new file mode 100644
index 00000000000..8fe614156da
--- /dev/null
+++ b/desktop/src/features/home/useOwnedAgentPubkeys.ts
@@ -0,0 +1,17 @@
+import * as React from "react";
+
+import { useManagedAgentsQuery } from "@/features/agents/hooks";
+import { mergeOwnedAgentPubkeys } from "@/features/agents/knownAgentPubkeys";
+import type { UserProfileLookup } from "@/features/profile/lib/identity";
+
+export function useOwnedAgentPubkeys(
+  enabled: boolean,
+  profiles: UserProfileLookup | undefined,
+  currentPubkey: string | undefined,
+) {
+  const managedAgents = useManagedAgentsQuery({ enabled }).data;
+  return React.useMemo(
+    () => mergeOwnedAgentPubkeys(managedAgents, profiles, currentPubkey),
+    [currentPubkey, managedAgents, profiles],
+  );
+}
diff --git a/desktop/src/features/messages/lib/messageSnapshot.ts b/desktop/src/features/messages/lib/messageSnapshot.ts
index a62d877b047..d4a183c2ff6 100644
--- a/desktop/src/features/messages/lib/messageSnapshot.ts
+++ b/desktop/src/features/messages/lib/messageSnapshot.ts
@@ -17,6 +17,7 @@
 import { mergeTimelineHistoryMessages } from "@/features/messages/lib/messageQueryKeys";
 import { normalizeRelayUrl } from "@/features/profile/lib/selfProfileStorage";
 import type { RelayEvent } from "@/shared/api/types";
+import { setLocalStorageItemWithRecovery } from "@/shared/lib/localStorageQuota";
 
 const STORAGE_KEY_PREFIX = "buzz-channel-messages.v1";
 
@@ -147,7 +148,7 @@ export function writeMessageSnapshot(
     }
 
     evictOldestSnapshots(relayPrefix(relayUrl), key);
-    window.localStorage.setItem(
+    setLocalStorageItemWithRecovery(
       key,
       JSON.stringify({
         version: 1,
diff --git a/desktop/src/features/messages/lib/selectionBlockFormatting.test.mjs b/desktop/src/features/messages/lib/selectionBlockFormatting.test.mjs
new file mode 100644
index 00000000000..75d04cdde31
--- /dev/null
+++ b/desktop/src/features/messages/lib/selectionBlockFormatting.test.mjs
@@ -0,0 +1,230 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+
+import { getSchema, Node } from "@tiptap/core";
+import StarterKit from "@tiptap/starter-kit";
+import { EditorState, TextSelection } from "@tiptap/pm/state";
+
+import { CustomEmojiNode } from "./customEmojiNode.ts";
+
+import {
+  isolateSelectionForBlockFormatting,
+  mergeSelectedTextblocksIntoCodeBlock,
+  splitSelectedLinesForListFormatting,
+} from "./selectionBlockFormatting.ts";
+
+// Matching useRichTextEditor's StarterKit configuration (minus things
+// irrelevant to block isolation).
+const MentionNode = Node.create({
+  name: "mention",
+  group: "inline",
+  inline: true,
+  atom: true,
+  addAttributes: () => ({ label: { default: "" } }),
+});
+const UnknownLeaf = Node.create({
+  name: "unknownLeaf",
+  group: "inline",
+  inline: true,
+  atom: true,
+  addAttributes: () => ({ internalId: { default: "secret" } }),
+});
+
+const schema = getSchema([
+  StarterKit.configure({
+    hardBreak: { keepMarks: true },
+    heading: false,
+    trailingNode: false,
+    link: false,
+  }),
+  MentionNode,
+  CustomEmojiNode.configure({
+    resolveUrl: () => undefined,
+    shortcodes: () => [],
+  }),
+  UnknownLeaf,
+]);
+
+const para = (...content) => schema.nodes.paragraph.create(null, content);
+const br = () => schema.nodes.hardBreak.create();
+const t = (text) => schema.text(text);
+
+function doc(...content) {
+  return schema.nodes.doc.create(null, content);
+}
+
+function stateWithCaret(documentNode, caret) {
+  return EditorState.create({
+    doc: documentNode,
+    selection: TextSelection.create(documentNode, caret),
+  });
+}
+
+function paragraphTexts(documentNode) {
+  const texts = [];
+  documentNode.forEach((node) => {
+    texts.push(node.textContent);
+  });
+  return texts;
+}
+
+test("caret between hard breaks isolates only its line", () => {
+  // <p>before␍target␍after</p> with the caret inside "target".
+  const state = stateWithCaret(
+    doc(para(t("before"), br(), t("target"), br(), t("after"))),
+    10,
+  );
+
+  const transaction = state.tr;
+  assert.equal(isolateSelectionForBlockFormatting(transaction), true);
+
+  const next = state.apply(transaction);
+  assert.deepEqual(paragraphTexts(next.doc), ["before", "target", "after"]);
+  assert.equal(next.selection.empty, true);
+  assert.equal(next.selection.$from.parent.textContent, "target");
+});
+
+test("caret on an empty trailing line isolates an empty paragraph", () => {
+  // "before" + Shift+Enter, caret at the end — the reported bug shape.
+  const state = stateWithCaret(doc(para(t("before"), br())), 8);
+
+  const transaction = state.tr;
+  assert.equal(isolateSelectionForBlockFormatting(transaction), true);
+
+  const next = state.apply(transaction);
+  assert.deepEqual(paragraphTexts(next.doc), ["before", ""]);
+  assert.equal(next.selection.empty, true);
+  assert.equal(next.selection.$from.parent.textContent, "");
+});
+
+test("caret on the first line splits only after that line", () => {
+  const state = stateWithCaret(doc(para(t("first"), br(), t("rest"))), 3);
+
+  const transaction = state.tr;
+  assert.equal(isolateSelectionForBlockFormatting(transaction), true);
+
+  const next = state.apply(transaction);
+  assert.deepEqual(paragraphTexts(next.doc), ["first", "rest"]);
+  assert.equal(next.selection.$from.parent.textContent, "first");
+});
+
+test("caret on the last line splits only before that line", () => {
+  const state = stateWithCaret(doc(para(t("rest"), br(), t("last"))), 8);
+
+  const transaction = state.tr;
+  assert.equal(isolateSelectionForBlockFormatting(transaction), true);
+
+  const next = state.apply(transaction);
+  assert.deepEqual(paragraphTexts(next.doc), ["rest", "last"]);
+  assert.equal(next.selection.$from.parent.textContent, "last");
+});
+
+test("caret in a single-line paragraph is a no-op", () => {
+  const state = stateWithCaret(doc(para(t("only line"))), 4);
+
+  const transaction = state.tr;
+  assert.equal(isolateSelectionForBlockFormatting(transaction), false);
+  assert.equal(transaction.steps.length, 0);
+});
+
+test("exact block-boundary selection excludes endpoint paragraphs", () => {
+  const documentNode = doc(para(t("alpha")), para(t("beta")), para(t("gamma")));
+  for (const backward of [false, true]) {
+    const state = EditorState.create({
+      doc: documentNode,
+      selection: TextSelection.create(
+        documentNode,
+        backward ? 14 : 6,
+        backward ? 6 : 14,
+      ),
+    });
+    const transaction = state.tr;
+    isolateSelectionForBlockFormatting(transaction);
+    assert.equal(mergeSelectedTextblocksIntoCodeBlock(transaction), true);
+    const next = state.apply(transaction);
+    assert.deepEqual(
+      next.doc.toJSON(),
+      doc(
+        para(t("alpha")),
+        schema.nodes.codeBlock.create(null, t("beta")),
+        para(t("gamma")),
+      ).toJSON(),
+    );
+  }
+});
+
+test("selection isolation still splits around the selected text", () => {
+  const documentNode = doc(para(t("before selected after")));
+  const state = EditorState.create({
+    doc: documentNode,
+    // "selected" spans positions 8..16.
+    selection: TextSelection.create(documentNode, 8, 16),
+  });
+
+  const transaction = state.tr;
+  assert.equal(isolateSelectionForBlockFormatting(transaction), true);
+
+  const next = state.apply(transaction);
+  assert.deepEqual(paragraphTexts(next.doc), ["before ", "selected", " after"]);
+  assert.equal(
+    next.doc.textBetween(next.selection.from, next.selection.to),
+    "selected",
+  );
+});
+
+test("list splitting turns selected hard breaks into separate textblocks", () => {
+  const documentNode = doc(para(t("one"), br(), t("two"), br(), t("three")));
+  const state = EditorState.create({
+    doc: documentNode,
+    selection: TextSelection.create(documentNode, 1, 14),
+  });
+
+  const transaction = state.tr;
+  assert.equal(splitSelectedLinesForListFormatting(transaction), true);
+  const next = state.apply(transaction);
+  assert.deepEqual(paragraphTexts(next.doc), ["one", "two", "three"]);
+});
+
+test("code merge preserves hard breaks", () => {
+  const documentNode = doc(para(t("one"), br(), t("two")), para(t("three")));
+  const state = EditorState.create({
+    doc: documentNode,
+    selection: TextSelection.create(
+      documentNode,
+      1,
+      documentNode.content.size - 1,
+    ),
+  });
+
+  const transaction = state.tr;
+  assert.equal(mergeSelectedTextblocksIntoCodeBlock(transaction), true);
+  const next = state.apply(transaction);
+  assert.equal(next.doc.firstChild.type.name, "codeBlock");
+  assert.equal(next.doc.firstChild.textContent, "one\ntwo\nthree");
+});
+
+test("code merge preserves meaningful inline atoms and drops unknown leaves", () => {
+  const documentNode = doc(
+    para(
+      t("hello "),
+      schema.nodes.mention.create({ label: "@Taylor Ho" }),
+      t(" "),
+      schema.nodes.customEmoji.create({ shortcode: "party" }),
+      schema.nodes.unknownLeaf.create(),
+    ),
+  );
+  const state = EditorState.create({
+    doc: documentNode,
+    selection: TextSelection.create(
+      documentNode,
+      1,
+      documentNode.content.size - 1,
+    ),
+  });
+
+  const transaction = state.tr;
+  assert.equal(mergeSelectedTextblocksIntoCodeBlock(transaction), true);
+  const next = state.apply(transaction);
+  assert.equal(next.doc.firstChild.textContent, "hello @Taylor Ho :party:");
+  assert.equal(next.doc.firstChild.textContent.includes("secret"), false);
+});
diff --git a/desktop/src/features/messages/lib/selectionBlockFormatting.ts b/desktop/src/features/messages/lib/selectionBlockFormatting.ts
new file mode 100644
index 00000000000..9d9792ad045
--- /dev/null
+++ b/desktop/src/features/messages/lib/selectionBlockFormatting.ts
@@ -0,0 +1,341 @@
+import type { Node as ProseMirrorNode } from "@tiptap/pm/model";
+import { TextSelection, type Transaction } from "@tiptap/pm/state";
+import { canSplit } from "@tiptap/pm/transform";
+
+function canSplitInsideTextblock(
+  transaction: Transaction,
+  position: number,
+): boolean {
+  const $position = transaction.doc.resolve(position);
+  return (
+    $position.parent.inlineContent &&
+    $position.parentOffset > 0 &&
+    $position.parentOffset < $position.parent.content.size &&
+    canSplit(transaction.doc, position)
+  );
+}
+
+function mapRangeThroughLatestStep(
+  transaction: Transaction,
+  from: number,
+  to: number,
+): { from: number; to: number } {
+  const stepMap = transaction.steps.at(-1)?.getMap();
+  return stepMap
+    ? {
+        from: stepMap.map(from, 1),
+        to: stepMap.map(to, -1),
+      }
+    : { from, to };
+}
+
+/**
+ * Isolate the hard-break-delimited line under a collapsed caret.
+ *
+ * The composer represents Shift+Enter lines as `hardBreak` nodes inside one
+ * paragraph, so a block toggle at a collapsed caret otherwise reformats every
+ * line of the draft. Replacing the line's bordering hard breaks with block
+ * splits gives the caret's line its own textblock, which scopes the following
+ * block toggle to just that line.
+ */
+function isolateCaretLineForBlockFormatting(transaction: Transaction): boolean {
+  const { $from } = transaction.selection;
+  if (!$from.parent.isTextblock || !$from.parent.inlineContent) return false;
+
+  const blockStart = $from.start();
+  const blockEnd = $from.end();
+  let caret = transaction.selection.from;
+
+  let lineFrom = blockStart;
+  let lineTo = blockEnd;
+  $from.parent.forEach((child, offset) => {
+    if (child.type.name !== "hardBreak") return;
+    const breakFrom = blockStart + offset;
+    const breakTo = breakFrom + child.nodeSize;
+    if (breakTo <= caret) lineFrom = breakTo;
+    if (breakFrom >= caret) lineTo = Math.min(lineTo, breakFrom);
+  });
+
+  // No hard breaks around the caret — the line already is the whole
+  // textblock, so the block toggle is correctly scoped as-is.
+  if (lineFrom === blockStart && lineTo === blockEnd) return false;
+
+  const nodeAfterLine = transaction.doc.resolve(lineTo).nodeAfter;
+  if (nodeAfterLine?.type.name === "hardBreak") {
+    transaction.delete(lineTo, lineTo + nodeAfterLine.nodeSize);
+    if (canSplit(transaction.doc, lineTo)) {
+      transaction.split(lineTo);
+      const stepMap = transaction.steps.at(-1)?.getMap();
+      if (stepMap) {
+        caret = stepMap.map(caret, -1);
+        lineFrom = stepMap.map(lineFrom, -1);
+      }
+    }
+  }
+
+  const nodeBeforeLine = transaction.doc.resolve(lineFrom).nodeBefore;
+  if (nodeBeforeLine?.type.name === "hardBreak") {
+    transaction.delete(lineFrom - nodeBeforeLine.nodeSize, lineFrom);
+    let stepMap = transaction.steps.at(-1)?.getMap();
+    if (stepMap) {
+      caret = stepMap.map(caret, 1);
+      lineFrom = stepMap.map(lineFrom, -1);
+    }
+    if (canSplit(transaction.doc, lineFrom)) {
+      transaction.split(lineFrom);
+      stepMap = transaction.steps.at(-1)?.getMap();
+      if (stepMap) caret = stepMap.map(caret, 1);
+    }
+  }
+
+  transaction.setSelection(TextSelection.create(transaction.doc, caret));
+  return true;
+}
+
+function listItemTextRange(
+  $position: Transaction["selection"]["$from"],
+): { from: number; to: number } | null {
+  let itemDepth = -1;
+  for (let depth = $position.depth; depth > 0; depth -= 1) {
+    if ($position.node(depth).type.name === "listItem") {
+      itemDepth = depth;
+      break;
+    }
+  }
+  if (itemDepth < 0) return null;
+
+  const item = $position.node(itemDepth);
+  const itemPosition = $position.before(itemDepth);
+  let from: number | null = null;
+  let to: number | null = null;
+  item.descendants((node, relativePosition) => {
+    if (!node.isTextblock) return true;
+    const position = itemPosition + 1 + relativePosition;
+    from ??= position + 1;
+    to = position + node.nodeSize - 1;
+    return false;
+  });
+  return from === null || to === null ? null : { from, to };
+}
+
+/** Expand partial list endpoint selections to whole list-item textblocks. */
+function expandSelectionToListItems(transaction: Transaction): boolean {
+  const selection = transaction.selection;
+  if (!(selection instanceof TextSelection) || selection.empty) return false;
+
+  const startItem = listItemTextRange(selection.$from);
+  const endItem = listItemTextRange(selection.$to);
+  if (!(startItem || endItem)) return false;
+
+  const isBackward = selection.anchor > selection.head;
+  const from = startItem?.from ?? selection.from;
+  const to = endItem?.to ?? selection.to;
+  transaction.setSelection(
+    TextSelection.create(
+      transaction.doc,
+      isBackward ? to : from,
+      isBackward ? from : to,
+    ),
+  );
+  return true;
+}
+
+export function selectionIncludesList(transaction: Transaction): boolean {
+  const { from, to } = transaction.selection;
+  let includesList = false;
+  transaction.doc.nodesBetween(from, to, (node) => {
+    if (node.type.name === "listItem") {
+      includesList = true;
+      return false;
+    }
+    return !includesList;
+  });
+  return includesList;
+}
+
+function normalizeSelectionBlockBoundaries(transaction: Transaction): boolean {
+  const selection = transaction.selection;
+  if (!(selection instanceof TextSelection) || selection.empty) return false;
+
+  const isBackward = selection.anchor > selection.head;
+  let { from, to } = selection;
+  if (
+    selection.$from.parent.isTextblock &&
+    selection.$from.parentOffset === selection.$from.parent.content.size &&
+    selection.$from.depth > 0
+  ) {
+    from = selection.$from.after();
+  }
+  if (
+    selection.$to.parent.isTextblock &&
+    selection.$to.parentOffset === 0 &&
+    selection.$to.depth > 0
+  ) {
+    to = selection.$to.before();
+  }
+  if (from >= to) return false;
+
+  transaction.setSelection(
+    TextSelection.create(
+      transaction.doc,
+      isBackward ? to : from,
+      isBackward ? from : to,
+    ),
+  );
+  return from !== selection.from || to !== selection.to;
+}
+
+/**
+ * Isolate the current text selection at exact block boundaries.
+ *
+ * ProseMirror's block commands operate on whole textblocks. The composer can
+ * hold an entire draft in one paragraph, so toggling a list or code block for
+ * a substring otherwise formats the whole draft. Splitting at the selection
+ * end and start first gives the selected text its own block while preserving
+ * the surrounding content as sibling paragraphs. A collapsed caret isolates
+ * its hard-break-delimited line so the block format starts at that line.
+ *
+ * This mutates the transaction supplied by a Tiptap command chain so the
+ * isolation and the following block toggle remain one undoable edit.
+ */
+export function isolateSelectionForBlockFormatting(
+  transaction: Transaction,
+): boolean {
+  if (!(transaction.selection instanceof TextSelection)) {
+    return false;
+  }
+
+  if (transaction.selection.empty) {
+    return isolateCaretLineForBlockFormatting(transaction);
+  }
+
+  expandSelectionToListItems(transaction);
+  normalizeSelectionBlockBoundaries(transaction);
+  const isBackward = transaction.selection.anchor > transaction.selection.head;
+  let { from, to } = transaction.selection;
+
+  const nodeAfterSelection = transaction.doc.resolve(to).nodeAfter;
+  if (nodeAfterSelection?.type.name === "hardBreak") {
+    transaction.delete(to, to + nodeAfterSelection.nodeSize);
+    ({ from, to } = mapRangeThroughLatestStep(transaction, from, to));
+  }
+
+  const nodeBeforeSelection = transaction.doc.resolve(from).nodeBefore;
+  if (nodeBeforeSelection?.type.name === "hardBreak") {
+    transaction.delete(from - nodeBeforeSelection.nodeSize, from);
+    ({ from, to } = mapRangeThroughLatestStep(transaction, from, to));
+  }
+
+  if (canSplitInsideTextblock(transaction, to)) {
+    transaction.split(to);
+    ({ from, to } = mapRangeThroughLatestStep(transaction, from, to));
+  }
+
+  if (canSplitInsideTextblock(transaction, from)) {
+    transaction.split(from);
+    ({ from, to } = mapRangeThroughLatestStep(transaction, from, to));
+  }
+
+  transaction.setSelection(
+    TextSelection.create(
+      transaction.doc,
+      isBackward ? to : from,
+      isBackward ? from : to,
+    ),
+  );
+  return true;
+}
+
+/** Split each selected hard-break line into a textblock before list wrapping. */
+export function splitSelectedLinesForListFormatting(
+  transaction: Transaction,
+): boolean {
+  if (!(transaction.selection instanceof TextSelection)) return false;
+  if (transaction.selection.empty) {
+    return isolateCaretLineForBlockFormatting(transaction);
+  }
+
+  const isBackward = transaction.selection.anchor > transaction.selection.head;
+  isolateSelectionForBlockFormatting(transaction);
+  let { from, to } = transaction.selection;
+  const breakPositions: number[] = [];
+
+  transaction.doc.nodesBetween(from, to, (node, position) => {
+    if (node.type.name === "hardBreak") breakPositions.push(position);
+  });
+
+  for (const position of breakPositions.reverse()) {
+    transaction.delete(position, position + 1);
+    ({ from, to } = mapRangeThroughLatestStep(transaction, from, to));
+    if (!canSplit(transaction.doc, position)) continue;
+    transaction.split(position);
+    ({ from, to } = mapRangeThroughLatestStep(transaction, from, to));
+  }
+
+  transaction.setSelection(
+    TextSelection.create(
+      transaction.doc,
+      isBackward ? to : from,
+      isBackward ? from : to,
+    ),
+  );
+  return true;
+}
+
+function selectedTextblocks(
+  transaction: Transaction,
+): Array<{ node: ProseMirrorNode; position: number }> {
+  const blocks: Array<{ node: ProseMirrorNode; position: number }> = [];
+  const { from, to } = transaction.selection;
+  transaction.doc.nodesBetween(from, to, (node, position) => {
+    if (node.isTextblock) {
+      blocks.push({ node, position });
+      return false;
+    }
+    return true;
+  });
+  return blocks;
+}
+
+function leafTextForCode(leaf: ProseMirrorNode): string {
+  if (leaf.type.name === "hardBreak") return "\n";
+
+  const schemaText = leaf.type.spec.leafText?.(leaf);
+  if (schemaText !== undefined) return schemaText;
+
+  // Inline atoms should survive conversion whenever they expose a meaningful
+  // textual identity. Unknown leaves intentionally fall back to an empty
+  // string rather than leaking implementation attributes into user content.
+  const attrs = leaf.attrs as Record<string, unknown>;
+  if (typeof attrs.label === "string") return attrs.label;
+  if (typeof attrs.shortcode === "string") return `:${attrs.shortcode}:`;
+  return "";
+}
+
+function textblockTextForCode(node: ProseMirrorNode): string {
+  return node.textBetween(0, node.content.size, "\n", leafTextForCode);
+}
+
+/** Replace selected textblocks with one newline-joined code block. */
+export function mergeSelectedTextblocksIntoCodeBlock(
+  transaction: Transaction,
+): boolean {
+  if (!(transaction.selection instanceof TextSelection)) return false;
+  if (transaction.selection.empty) return false;
+
+  const blocks = selectedTextblocks(transaction);
+  const codeBlock = transaction.doc.type.schema.nodes.codeBlock;
+  const first = blocks[0];
+  const last = blocks.at(-1);
+  if (!(codeBlock && first && last)) return false;
+
+  const text = blocks.map(({ node }) => textblockTextForCode(node)).join("\n");
+  const from = first.position;
+  const to = last.position + last.node.nodeSize;
+  const content = text ? transaction.doc.type.schema.text(text) : undefined;
+  transaction.replaceWith(from, to, codeBlock.create(null, content));
+  transaction.setSelection(
+    TextSelection.create(transaction.doc, from + 1, from + 1 + text.length),
+  );
+  return true;
+}
diff --git a/desktop/src/features/messages/ui/ComposerActivityAccessory.tsx b/desktop/src/features/messages/ui/ComposerActivityAccessory.tsx
new file mode 100644
index 00000000000..69889001ef2
--- /dev/null
+++ b/desktop/src/features/messages/ui/ComposerActivityAccessory.tsx
@@ -0,0 +1,47 @@
+import type { ReactNode } from "react";
+import { AnimatePresence, motion, useReducedMotion } from "motion/react";
+
+import { cn } from "@/shared/lib/cn";
+
+type ComposerActivityAccessoryProps = {
+  children: ReactNode;
+  className?: string;
+  testId?: string;
+  visible: boolean;
+};
+
+/**
+ * Fades activity content into the composer dock's reserved bottom rail without
+ * changing layout height. This keeps timeline scroll padding stable.
+ */
+export function ComposerActivityAccessory({
+  children,
+  className,
+  testId,
+  visible,
+}: ComposerActivityAccessoryProps) {
+  const prefersReducedMotion = useReducedMotion();
+
+  return (
+    <AnimatePresence initial={false}>
+      {visible ? (
+        <motion.div
+          animate={{ opacity: 1 }}
+          className={cn(
+            "composer-dock-activity absolute inset-x-0 z-10 bg-background",
+            className,
+          )}
+          data-testid={testId}
+          exit={{ opacity: 0 }}
+          initial={{ opacity: 0 }}
+          transition={{
+            duration: prefersReducedMotion ? 0 : 0.2,
+            ease: [0.23, 1, 0.32, 1],
+          }}
+        >
+          {children}
+        </motion.div>
+      ) : null}
+    </AnimatePresence>
+  );
+}
diff --git a/desktop/src/features/messages/ui/ComposerAttachments.tsx b/desktop/src/features/messages/ui/ComposerAttachments.tsx
index 6a14aa498a4..bee38e321ce 100644
--- a/desktop/src/features/messages/ui/ComposerAttachments.tsx
+++ b/desktop/src/features/messages/ui/ComposerAttachments.tsx
@@ -7,6 +7,7 @@ import {
   HatGlasses,
   Pencil,
   Play,
+  UploadCloud,
   Users,
   X,
 } from "lucide-react";
@@ -39,13 +40,18 @@ import { ComposerImageEditor } from "./ComposerImageEditor";
 export function DropZoneOverlay({ className }: { className?: string }) {
   return (
     <div
+      data-testid="drop-zone-overlay"
       className={cn(
         "pointer-events-none absolute inset-0 z-10 flex items-center justify-center rounded-2xl border-2 border-dashed border-primary bg-primary/10",
         className,
       )}
     >
-      <span className="text-sm font-medium text-primary">
-        Drop files to upload
+      <span
+        className="flex items-center gap-2 rounded-full bg-foreground px-4 py-2 text-sm font-semibold text-background shadow-sm ring-1 ring-background/15"
+        data-testid="drop-zone-label"
+      >
+        <UploadCloud aria-hidden="true" className="size-4" />
+        <span>Drop files to upload</span>
       </span>
     </div>
   );
diff --git a/desktop/src/features/messages/ui/ComposerDockBackdrop.tsx b/desktop/src/features/messages/ui/ComposerDockBackdrop.tsx
new file mode 100644
index 00000000000..840be49beae
--- /dev/null
+++ b/desktop/src/features/messages/ui/ComposerDockBackdrop.tsx
@@ -0,0 +1,33 @@
+import { cn } from "@/shared/lib/cn";
+
+type ComposerDockBackdropProps = {
+  gutterClassName: string;
+};
+
+/**
+ * Owns the dock's stable backdrop blur separately from the resizing composer.
+ * An opaque rail mask covers the portion released for activity content.
+ */
+export function ComposerDockBackdrop({
+  gutterClassName,
+}: ComposerDockBackdropProps) {
+  return (
+    <>
+      <div
+        aria-hidden="true"
+        className={cn(
+          "pointer-events-none absolute inset-y-0 z-0",
+          gutterClassName,
+        )}
+        data-testid="composer-dock-backdrop"
+      >
+        <div className="h-full w-full rounded-2xl backdrop-blur-md dark:backdrop-blur-xl" />
+      </div>
+      <div
+        aria-hidden="true"
+        className="composer-dock-rail-mask pointer-events-none absolute inset-x-0 bottom-0 z-[5] bg-background"
+        data-testid="composer-dock-rail-mask"
+      />
+    </>
+  );
+}
diff --git a/desktop/src/features/messages/ui/ComposerDockToolbar.tsx b/desktop/src/features/messages/ui/ComposerDockToolbar.tsx
new file mode 100644
index 00000000000..6e62076d122
--- /dev/null
+++ b/desktop/src/features/messages/ui/ComposerDockToolbar.tsx
@@ -0,0 +1,30 @@
+import type { ComponentProps } from "react";
+
+import { MessageComposerToolbar } from "@/features/messages/ui/MessageComposerToolbar";
+
+type ComposerDockToolbarProps = ComponentProps<
+  typeof MessageComposerToolbar
+> & {
+  layoutMode: "dock" | "standalone";
+};
+
+/**
+ * Keeps the composer dock's total height stable by trading a quiet-state spacer
+ * for the equal-height activity rail outside the composer.
+ */
+export function ComposerDockToolbar({
+  layoutMode,
+  ...toolbarProps
+}: ComposerDockToolbarProps) {
+  return (
+    <>
+      {layoutMode === "dock" ? (
+        <div
+          aria-hidden="true"
+          className="composer-dock-quiet-spacer shrink-0"
+        />
+      ) : null}
+      <MessageComposerToolbar {...toolbarProps} />
+    </>
+  );
+}
diff --git a/desktop/src/features/messages/ui/FormattingToolbar.tsx b/desktop/src/features/messages/ui/FormattingToolbar.tsx
index a605b3dcd9c..afe2cb22a52 100644
--- a/desktop/src/features/messages/ui/FormattingToolbar.tsx
+++ b/desktop/src/features/messages/ui/FormattingToolbar.tsx
@@ -1,4 +1,5 @@
 import * as React from "react";
+import { TextSelection } from "@tiptap/pm/state";
 import type { Editor } from "@tiptap/react";
 import {
   Bold,
@@ -15,6 +16,12 @@ import {
 
 import { cn } from "@/shared/lib/cn";
 import { Tooltip, TooltipContent, TooltipTrigger } from "@/shared/ui/tooltip";
+import {
+  isolateSelectionForBlockFormatting,
+  mergeSelectedTextblocksIntoCodeBlock,
+  selectionIncludesList,
+  splitSelectedLinesForListFormatting,
+} from "@/features/messages/lib/selectionBlockFormatting";
 import { getEditorSpoilerRangeState } from "@/features/messages/lib/spoilerFormatting";
 import { SPOILER_MARK_NAME } from "@/features/messages/lib/spoilerMark";
 
@@ -29,6 +36,11 @@ type FormattingToolbarProps = {
   onLinkButton?: () => void;
 };
 
+type FormattingSelectionRange = {
+  anchor: number;
+  head: number;
+};
+
 type ActiveStates = {
   bold: boolean;
   italic: boolean;
@@ -117,6 +129,9 @@ export const FormattingToolbar = React.memo(function FormattingToolbar({
   disabled = false,
   onLinkButton,
 }: FormattingToolbarProps) {
+  const pendingSelectionRef = React.useRef<FormattingSelectionRange | null>(
+    null,
+  );
   const [activeStates, setActiveStates] = React.useState<ActiveStates | null>(
     () => (editor ? getActiveStates(editor) : null),
   );
@@ -137,36 +152,97 @@ export const FormattingToolbar = React.memo(function FormattingToolbar({
     };
   }, [editor]);
 
-  const toggleBold = React.useCallback(() => {
-    editor?.chain().focus().toggleBold().run();
+  const captureSelection = React.useCallback(() => {
+    if (!editor || editor.state.selection.empty) {
+      pendingSelectionRef.current = null;
+      return;
+    }
+
+    const { anchor, head } = editor.state.selection;
+    pendingSelectionRef.current = { anchor, head };
   }, [editor]);
 
-  const toggleItalic = React.useCallback(() => {
-    editor?.chain().focus().toggleItalic().run();
+  const formattingChain = React.useCallback(() => {
+    if (!editor) return null;
+
+    const range = pendingSelectionRef.current;
+    pendingSelectionRef.current = null;
+    const chain = editor.chain();
+
+    if (
+      range &&
+      range.anchor !== range.head &&
+      range.anchor <= editor.state.doc.content.size &&
+      range.head <= editor.state.doc.content.size
+    ) {
+      chain.command(({ tr }) => {
+        tr.setSelection(TextSelection.create(tr.doc, range.anchor, range.head));
+        return true;
+      });
+    }
+
+    return chain.focus();
   }, [editor]);
 
+  const toggleBold = React.useCallback(() => {
+    formattingChain()?.toggleBold().run();
+  }, [formattingChain]);
+
+  const toggleItalic = React.useCallback(() => {
+    formattingChain()?.toggleItalic().run();
+  }, [formattingChain]);
+
   const toggleStrike = React.useCallback(() => {
-    editor?.chain().focus().toggleStrike().run();
-  }, [editor]);
+    formattingChain()?.toggleStrike().run();
+  }, [formattingChain]);
 
   const toggleCode = React.useCallback(() => {
-    editor?.chain().focus().toggleCode().run();
-  }, [editor]);
+    formattingChain()?.toggleCode().run();
+  }, [formattingChain]);
 
   const toggleCodeBlock = React.useCallback(() => {
-    editor?.chain().focus().toggleCodeBlock().run();
-  }, [editor]);
+    const chain = formattingChain();
+    if (!chain) return;
+    chain
+      .command(({ tr, chain: currentChain }) => {
+        if (tr.selection.empty) {
+          isolateSelectionForBlockFormatting(tr);
+          return currentChain().toggleCodeBlock().run();
+        }
+
+        isolateSelectionForBlockFormatting(tr);
+        if (selectionIncludesList(tr)) {
+          return currentChain()
+            .liftListItem("listItem")
+            .command(({ tr: currentTransaction }) =>
+              mergeSelectedTextblocksIntoCodeBlock(currentTransaction),
+            )
+            .run();
+        }
+        return mergeSelectedTextblocksIntoCodeBlock(tr);
+      })
+      .run();
+  }, [formattingChain]);
+
+  const restorePendingSelection = React.useCallback(() => {
+    formattingChain()?.run();
+  }, [formattingChain]);
 
   const toggleLink = React.useCallback(() => {
     if (!editor) return;
 
-    // Preferred path: open the link-edit modal, which handles add, edit, and
-    // remove with proper display-text + URL fields.
+    // Restore the range captured on pointer-down before opening the modal.
+    // WKWebView may otherwise collapse it as focus moves to the toolbar.
     if (onLinkButton) {
+      restorePendingSelection();
       onLinkButton();
       return;
     }
 
+    const chain = formattingChain();
+    if (!chain) return;
+    chain.run();
+
     // Legacy fallback (no modal wired): the native prompts below are a no-op
     // in the Tauri WebView, so this path effectively does nothing there.
     if (editor.isActive("link")) {
@@ -189,24 +265,55 @@ export const FormattingToolbar = React.memo(function FormattingToolbar({
         editor.chain().focus().insertContent(`[${label}](${url})`).run();
       }
     }
-  }, [editor, onLinkButton]);
+  }, [editor, formattingChain, onLinkButton, restorePendingSelection]);
 
   const toggleBulletList = React.useCallback(() => {
-    editor?.chain().focus().toggleBulletList().run();
-  }, [editor]);
+    formattingChain()
+      ?.command(({ tr }) => {
+        splitSelectedLinesForListFormatting(tr);
+        return true;
+      })
+      .command(({ tr, chain: currentChain }) => {
+        if (!selectionIncludesList(tr)) return true;
+        return currentChain().liftListItem("listItem").run();
+      })
+      .toggleBulletList()
+      .run();
+  }, [formattingChain]);
 
   const toggleOrderedList = React.useCallback(() => {
-    editor?.chain().focus().toggleOrderedList().run();
-  }, [editor]);
+    formattingChain()
+      ?.command(({ tr }) => {
+        splitSelectedLinesForListFormatting(tr);
+        return true;
+      })
+      .command(({ tr, chain: currentChain }) => {
+        if (!selectionIncludesList(tr)) return true;
+        return currentChain().liftListItem("listItem").run();
+      })
+      .toggleOrderedList()
+      .run();
+  }, [formattingChain]);
 
   const toggleBlockquote = React.useCallback(() => {
-    editor?.chain().focus().toggleBlockquote().run();
-  }, [editor]);
+    formattingChain()
+      ?.command(({ tr }) => {
+        isolateSelectionForBlockFormatting(tr);
+        return true;
+      })
+      .command(({ tr, chain: currentChain }) => {
+        if (!selectionIncludesList(tr)) return true;
+        return currentChain().liftListItem("listItem").run();
+      })
+      .toggleBlockquote()
+      .run();
+  }, [formattingChain]);
 
   const toggleSpoiler = React.useCallback(() => {
     if (!editor) return;
+    restorePendingSelection();
     toggleSpoilerFormatting(editor);
-  }, [editor]);
+  }, [editor, restorePendingSelection]);
 
   if (!editor || !activeStates) return null;
 
@@ -289,6 +396,7 @@ export const FormattingToolbar = React.memo(function FormattingToolbar({
               aria-pressed={item.active}
               disabled={disabled}
               onClick={() => item.action()}
+              onMouseDown={captureSelection}
               className={cn(
                 "inline-flex h-7 w-7 min-w-7 items-center justify-center rounded-md text-sm font-medium transition-colors",
                 "hover:bg-muted hover:text-foreground",
diff --git a/desktop/src/features/messages/ui/MessageComposer.tsx b/desktop/src/features/messages/ui/MessageComposer.tsx
index 8c0c5740493..df3a734cee3 100644
--- a/desktop/src/features/messages/ui/MessageComposer.tsx
+++ b/desktop/src/features/messages/ui/MessageComposer.tsx
@@ -21,15 +21,11 @@ import {
 } from "@/features/messages/lib/imetaMediaMarkdown";
 
 import { useAttachmentEditing } from "@/features/messages/lib/useAttachmentEditing";
-import {
-  type MediaUploadController,
-  useMediaUpload,
-} from "@/features/messages/lib/useMediaUpload";
+import { useMediaUpload } from "@/features/messages/lib/useMediaUpload";
 import { useMentions } from "@/features/messages/lib/useMentions";
 import { diffAddedMentionPubkeys } from "@/features/messages/lib/threading";
 import { getPersistentAgentAudienceScope } from "@/features/messages/lib/persistentAgentAudience";
 import { useIdentityQuery } from "@/shared/api/hooks";
-import type { UserProfileLookup } from "@/features/profile/lib/identity";
 import {
   hasMentionClipboardHtml,
   normalizeMentionClipboardHtml,
@@ -45,7 +41,6 @@ import { useComposerSpoilerParticles } from "@/features/messages/lib/useComposer
 import { useTypingBroadcast } from "@/features/messages/useTypingBroadcast";
 import { getBuzzCodeBlockClipboardText } from "@/shared/lib/codeBlockClipboard";
 import { cn } from "@/shared/lib/cn";
-import type { ChannelType } from "@/shared/api/types";
 import { ChannelAutocomplete } from "./ChannelAutocomplete";
 import { ComposerReplyEditBanner } from "./ComposerReplyEditBanner";
 import { ComposerAttachments, DropZoneOverlay } from "./ComposerAttachments";
@@ -54,101 +49,14 @@ import {
   MentionAutocomplete,
   type MentionSuggestion,
 } from "./MentionAutocomplete";
-import { MessageComposerToolbar } from "./MessageComposerToolbar";
+import { ComposerDockToolbar } from "./ComposerDockToolbar";
 import { NonMemberMentionDialog } from "./NonMemberMentionDialog";
 import { useMentionSendFlow } from "./useMentionSendFlow";
 import { usePersistentAgentMentionHydration } from "./usePersistentAgentMentionHydration";
 import { useComposerContentState } from "./useComposerContentState";
 import { useDraftPersistLifecycle } from "./useDraftPersistSnapshot";
 
-type MessageComposerAudienceContext = {
-  type: "thread";
-  threadRootId: string;
-  initialAgentPubkeys?: readonly string[];
-};
-type MessageComposerProps = {
-  audienceContext?: MessageComposerAudienceContext | null;
-  channelId?: string | null;
-  channelName: string;
-  channelType?: ChannelType | null;
-  containerClassName?: string;
-  disabled?: boolean;
-  draftKey?: string;
-  /**
-   * When provided, the composer fires `submitMessage` once on mount after
-   * the draft matching this key has been loaded into the editor. This powers
-   * the "Send message" confirm-dialog flow in the Drafts panel. The callback
-   * `onAutoSubmitComplete` must clear the trigger (e.g. remove `?autoSend`
-   * from the URL) — it is called synchronously before `submitMessage` fires
-   * so the param is gone before any navigation the send might cause.
-   *
-   * Fires at most once per mount: a stable key value that persists across
-   * re-renders does NOT re-fire.
-   */
-  autoSubmitDraftKey?: string | null;
-  /** Called when the auto-submit fires so the parent can clear the trigger. */
-  onAutoSubmitComplete?: () => void;
-  editTarget?: {
-    author: string;
-    body: string;
-    id: string;
-    /**
-     * NIP-92 imeta attachments on the original event, in tag order. Loaded
-     * into the composer's pending-imeta state on edit-open so the user sees
-     * them as removable thumbnails (just like the send path) and can add
-     * more. The submit path emits a fresh full imeta tag set on the edit
-     * event; the receiver overlays it.
-     */
-    imetaMedia?: ImetaMedia[];
-  } | null;
-  isSending?: boolean;
-  mediaController?: MediaUploadController;
-  onCancelEdit?: () => void;
-  onCancelReply?: () => void;
-  /**
-   * Invoked when the user presses ↑ in an empty composer that is not already
-   * in edit mode. The owner should locate the most recent message authored by
-   * the current user within this composer's scope (main timeline, DM, or
-   * thread) and enter edit mode for it. Return `true` if a target was found
-   * and edit mode was entered, so the composer can swallow the keystroke;
-   * return `false` to let the arrow key fall through normally.
-   */
-  onEditLastOwnMessage?: () => boolean;
-  onEditSave?: (
-    content: string,
-    mediaTags?: string[][],
-    mentionPubkeys?: string[],
-  ) => Promise<void>;
-  /** Captures send context synchronously before awaits can change navigation. */
-  onCaptureSendContext?: () => {
-    parentEventId: string | null;
-    threadHeadId: string | null;
-  } | null;
-  /** Resolves the channel required to prepare mentions before sending. */
-  onPrepareSendChannel?: (pubkeys?: string[]) => Promise<string | null>;
-  onPreparingMentionSendChange?: (isPreparing: boolean) => void;
-  onSend: (
-    content: string,
-    mentionPubkeys: string[],
-    mediaTags?: string[][],
-    channelId?: string | null,
-    threadContext?: {
-      parentEventId: string | null;
-      threadHeadId: string | null;
-    } | null,
-  ) => Promise<void>;
-  placeholder?: string;
-  profiles?: UserProfileLookup;
-  replyTarget?: {
-    author: string;
-    body: string;
-    id: string;
-  } | null;
-  showTopBorder?: boolean;
-  toolbarExtraActions?: React.ReactNode;
-  typingParentEventId?: string | null;
-  typingRootEventId?: string | null;
-};
+import type { MessageComposerProps } from "./MessageComposer.types";
 
 function MessageComposerImpl({
   audienceContext = null,
@@ -156,6 +64,7 @@ function MessageComposerImpl({
   channelName,
   channelType = null,
   containerClassName,
+  layoutMode = "standalone",
   disabled = false,
   draftKey,
   autoSubmitDraftKey = null,
@@ -990,7 +899,11 @@ function MessageComposerImpl({
             onCancelReply={onCancelReply}
           />
           <form
-            className="relative z-10 isolate rounded-2xl border border-border/50 bg-background/80 px-3 pb-2 pt-3 shadow-none backdrop-blur-md supports-[backdrop-filter]:bg-background/70 dark:bg-background/70 dark:backdrop-blur-xl dark:supports-[backdrop-filter]:bg-background/55 sm:px-4"
+            className={cn(
+              "relative z-10 isolate rounded-2xl border border-border/50 bg-background/80 px-3 pb-2 pt-3 shadow-none supports-[backdrop-filter]:bg-background/70 dark:bg-background/70 dark:supports-[backdrop-filter]:bg-background/55 sm:px-4",
+              layoutMode === "standalone" &&
+                "backdrop-blur-md dark:backdrop-blur-xl",
+            )}
             data-testid="message-composer"
             onDragEnter={ownsDropZone ? media.handleDragEnter : undefined}
             onDragLeave={ownsDropZone ? media.handleDragLeave : undefined}
@@ -1072,7 +985,8 @@ function MessageComposerImpl({
               <EditorContent editor={richText.editor} />
             </div>
 
-            <MessageComposerToolbar
+            <ComposerDockToolbar
+              layoutMode={layoutMode}
               composerDisabled={disabled}
               editor={richText.editor}
               extraActions={toolbarExtraActions}
diff --git a/desktop/src/features/messages/ui/MessageComposer.types.ts b/desktop/src/features/messages/ui/MessageComposer.types.ts
new file mode 100644
index 00000000000..800474c3dd3
--- /dev/null
+++ b/desktop/src/features/messages/ui/MessageComposer.types.ts
@@ -0,0 +1,98 @@
+import type { ReactNode } from "react";
+
+import type { ImetaMedia } from "@/features/messages/lib/imetaMediaMarkdown";
+import type { MediaUploadController } from "@/features/messages/lib/useMediaUpload";
+import type { UserProfileLookup } from "@/features/profile/lib/identity";
+import type { ChannelType } from "@/shared/api/types";
+
+export type MessageComposerProps = {
+  audienceContext?: {
+    type: "thread";
+    threadRootId: string;
+    initialAgentPubkeys?: readonly string[];
+  } | null;
+  channelId?: string | null;
+  channelName: string;
+  channelType?: ChannelType | null;
+  containerClassName?: string;
+  /**
+   * `dock` delegates backdrop blur and bottom-rail geometry to a surrounding
+   * composer dock. `standalone` keeps both concerns inside this component.
+   */
+  layoutMode?: "dock" | "standalone";
+  disabled?: boolean;
+  draftKey?: string;
+  /**
+   * When provided, the composer fires `submitMessage` once on mount after
+   * the draft matching this key has been loaded into the editor. This powers
+   * the "Send message" confirm-dialog flow in the Drafts panel. The callback
+   * `onAutoSubmitComplete` must clear the trigger (e.g. remove `?autoSend`
+   * from the URL) — it is called synchronously before `submitMessage` fires
+   * so the param is gone before any navigation the send might cause.
+   *
+   * Fires at most once per mount: a stable key value that persists across
+   * re-renders does NOT re-fire.
+   */
+  autoSubmitDraftKey?: string | null;
+  /** Called when the auto-submit fires so the parent can clear the trigger. */
+  onAutoSubmitComplete?: () => void;
+  editTarget?: {
+    author: string;
+    body: string;
+    id: string;
+    /**
+     * NIP-92 imeta attachments on the original event, in tag order. Loaded
+     * into the composer's pending-imeta state on edit-open so the user sees
+     * them as removable thumbnails (just like the send path) and can add
+     * more. The submit path emits a fresh full imeta tag set on the edit
+     * event; the receiver overlays it.
+     */
+    imetaMedia?: ImetaMedia[];
+  } | null;
+  isSending?: boolean;
+  mediaController?: MediaUploadController;
+  onCancelEdit?: () => void;
+  onCancelReply?: () => void;
+  /**
+   * Invoked when the user presses ↑ in an empty composer that is not already
+   * in edit mode. The owner should locate the most recent message authored by
+   * the current user within this composer's scope (main timeline, DM, or
+   * thread) and enter edit mode for it. Return `true` if a target was found
+   * and edit mode was entered, so the composer can swallow the keystroke;
+   * return `false` to let the arrow key fall through normally.
+   */
+  onEditLastOwnMessage?: () => boolean;
+  onEditSave?: (
+    content: string,
+    mediaTags?: string[][],
+    mentionPubkeys?: string[],
+  ) => Promise<void>;
+  /** Captures send context synchronously before awaits can change navigation. */
+  onCaptureSendContext?: () => {
+    parentEventId: string | null;
+    threadHeadId: string | null;
+  } | null;
+  onPrepareSendChannel?: (pubkeys?: string[]) => Promise<string | null>;
+  onPreparingMentionSendChange?: (isPreparing: boolean) => void;
+  onSend: (
+    content: string,
+    mentionPubkeys: string[],
+    mediaTags?: string[][],
+    channelId?: string | null,
+    threadContext?: {
+      parentEventId: string | null;
+      threadHeadId: string | null;
+    } | null,
+  ) => Promise<void>;
+  placeholder?: string;
+  profiles?: UserProfileLookup;
+  replyTarget?: {
+    author: string;
+    body: string;
+    id: string;
+  } | null;
+  showTopBorder?: boolean;
+  toolbarExtraActions?: ReactNode;
+  typingParentEventId?: string | null;
+  typingRootEventId?: string | null;
+};
diff --git a/desktop/src/features/messages/ui/MessageRow.tsx b/desktop/src/features/messages/ui/MessageRow.tsx
index 86038347b76..afcb3e863c8 100644
--- a/desktop/src/features/messages/ui/MessageRow.tsx
+++ b/desktop/src/features/messages/ui/MessageRow.tsx
@@ -505,9 +505,7 @@ export const MessageRow = React.memo(
       message.pending || message.edited ? (
         <>
           {message.pending ? (
-            <p className="font-medium uppercase tracking-[0.14em] text-primary/80">
-              Sending
-            </p>
+            <p className="font-medium text-primary/80">Sending</p>
           ) : null}
           {message.edited ? (
             <Tooltip>
diff --git a/desktop/src/features/messages/ui/MessageThreadPanel.tsx b/desktop/src/features/messages/ui/MessageThreadPanel.tsx
index 0cd4d67238a..08a57fa4c65 100644
--- a/desktop/src/features/messages/ui/MessageThreadPanel.tsx
+++ b/desktop/src/features/messages/ui/MessageThreadPanel.tsx
@@ -38,6 +38,8 @@ import {
 import { Button } from "@/shared/ui/button";
 import { Separator } from "@/shared/ui/separator";
 import type { VideoReviewContext } from "@/shared/ui/VideoPlayer";
+import { ComposerActivityAccessory } from "./ComposerActivityAccessory";
+import { ComposerDockBackdrop } from "./ComposerDockBackdrop";
 import { MessageComposer } from "./MessageComposer";
 import { ThreadMessageSkeleton } from "./MessageThreadPanelSkeleton";
 import { MessageRow, type ThreadDepthGuideAction } from "./MessageRow";
@@ -79,6 +81,7 @@ type MessageThreadPanelProps = ThreadPanelLayoutProps & {
   onMarkRead?: (message: TimelineMessage) => void;
   onExpandReplies: (message: TimelineMessage) => void;
   onScrollTargetResolved: () => void;
+  onScrollTargetSettled?: (messageId: string) => void;
   scrollTargetHighlights?: boolean;
   onSelectReplyTarget: (message: TimelineMessage) => void;
   onSend: (
@@ -106,7 +109,8 @@ type MessageThreadPanelProps = ThreadPanelLayoutProps & {
   threadReplyUnreadCounts?: ReadonlyMap<string, number>;
   threadTypingPubkeys: string[];
   threadHeadVideoReviewContext?: VideoReviewContext;
-  toolbarExtraActions?: React.ReactNode;
+  activityAccessoryContent?: React.ReactNode;
+  activityAccessoryVisible: boolean;
   widthPx: number;
   isFollowingThread?: boolean;
   isMessageUnreadById?: (messageId: string) => boolean;
@@ -207,6 +211,7 @@ export function MessageThreadPanel({
   onMarkRead,
   onExpandReplies,
   onScrollTargetResolved,
+  onScrollTargetSettled,
   onSelectReplyTarget,
   onSend,
   onToggleReaction,
@@ -222,7 +227,8 @@ export function MessageThreadPanel({
   threadUnreadCount,
   threadReplyUnreadCounts,
   threadTypingPubkeys,
-  toolbarExtraActions,
+  activityAccessoryContent,
+  activityAccessoryVisible,
   widthPx,
   transparentChrome = false,
   autoSendDraftKey = null,
@@ -241,11 +247,10 @@ export function MessageThreadPanel({
   const threadHeadId = threadHead?.id ?? null;
   useEscapeKey(onClose, isOverlay || isSinglePanelView || isFocusMode);
   const hasConstrainedColumn = columnMaxWidthPx != null;
-  useComposerHeightPadding(
-    threadBodyRef,
-    threadComposerWrapperRef,
-    isSinglePanelView,
-  );
+  // Whether the composer dock trades its quiet-state spacer for the
+  // conditional activity accessory (agent working and/or someone typing).
+  const hasComposerBottomActivity =
+    activityAccessoryVisible || threadTypingPubkeys.length > 0;
 
   // Live ref so onCaptureSendContext can read reply state at submit time
   // (before any async mention-flow awaits change navigation state).
@@ -480,17 +485,31 @@ export function MessageThreadPanel({
     threadHead,
   ]);
 
-  const { isAtBottom, newMessageCount, onScroll, scrollToBottom } =
-    useAnchoredScroll({
-      channelId: threadHeadId,
-      contentRef: threadContentRef,
-      isLoading: threadRepliesPending || repliesRenderState === "pending",
-      messages: threadMessages,
-      highlightTargetMessage: scrollTargetHighlights,
-      onTargetReached: onScrollTargetResolved,
-      scrollContainerRef: threadBodyRef,
-      targetMessageId: scrollTargetId,
-    });
+  const {
+    isAtBottom,
+    newMessageCount,
+    onScroll,
+    scrollToBottom,
+    settleAtBottomAfterLayout,
+  } = useAnchoredScroll({
+    channelId: threadHeadId,
+    contentRef: threadContentRef,
+    isLoading: threadRepliesPending || repliesRenderState === "pending",
+    messages: threadMessages,
+    highlightTargetMessage: scrollTargetHighlights,
+    onTargetReached: onScrollTargetResolved,
+    onTargetSettled: onScrollTargetSettled,
+    pinTargetCentered: !scrollTargetHighlights,
+    scrollContainerRef: threadBodyRef,
+    targetMessageId: scrollTargetId,
+  });
+  useComposerHeightPadding(
+    threadBodyRef,
+    threadComposerWrapperRef,
+    isSinglePanelView,
+    "padding",
+    settleAtBottomAfterLayout,
+  );
 
   const knownAgentPubkeys = useKnownAgentPubkeys();
   const initialAgentPubkeys = React.useMemo(() => {
@@ -816,65 +835,75 @@ export function MessageThreadPanel({
         ref={threadComposerWrapperRef}
       >
         <div
-          className={cn(
-            "composer-overlay-corner-masks pointer-events-auto",
-            hasConstrainedColumn && THREAD_PANEL_COLUMN_CLASS,
-          )}
+          className={cn(hasConstrainedColumn && THREAD_PANEL_COLUMN_CLASS)}
           style={
             hasConstrainedColumn ? { maxWidth: columnMaxWidthPx } : undefined
           }
         >
-          <MessageComposer
-            audienceContext={{
-              type: "thread",
-              threadRootId: threadHead.id,
-              initialAgentPubkeys,
-            }}
-            channelId={channelId}
-            channelName={channelName}
-            channelType={channel?.channelType ?? null}
-            containerClassName={THREAD_PANEL_COMPOSER_GUTTER_CLASS}
-            disabled={disabled || isSending || !channelId}
-            draftKey={`thread:${threadHead.id}`}
-            autoSubmitDraftKey={autoSendDraftKey}
-            onAutoSubmitComplete={onAutoSubmitComplete}
-            editTarget={editTarget}
-            isSending={isSending}
-            onCancelEdit={onCancelEdit}
-            onCancelReply={composerReplyTarget ? onCancelReply : undefined}
-            onCaptureSendContext={onCaptureSendContext}
-            onEditLastOwnMessage={onEditLastOwnMessage}
-            onEditSave={onEditSave}
-            onSend={onSend}
-            placeholder={`Reply in thread to ${threadHead.author}`}
-            profiles={profiles}
-            replyTarget={composerReplyTarget}
-            typingParentEventId={threadHead.id}
-            typingRootEventId={threadHead.rootId}
-          />
           <div
             className={cn(
-              "min-h-8 bg-background pb-1.5 pt-0",
-              THREAD_PANEL_COMPOSER_GUTTER_CLASS,
+              "composer-dock composer-overlay-corner-masks relative pointer-events-auto",
+              hasComposerBottomActivity && "composer-dock--with-activity",
             )}
           >
-            <div className="mx-auto flex h-full w-full max-w-4xl items-center gap-2 overflow-visible">
-              {toolbarExtraActions ? (
-                <div className="flex min-w-0 flex-1 overflow-visible">
-                  {toolbarExtraActions}
-                </div>
-              ) : null}
-              {threadTypingPubkeys.length > 0 ? (
-                <TypingIndicatorRow
-                  channel={channel}
-                  className="min-w-0 flex-1 py-0 pl-[calc(0.75rem+1px)] pr-0 sm:pl-[calc(1rem+1px)]"
-                  currentPubkey={currentPubkey}
-                  profiles={profiles}
-                  typingPubkeys={threadTypingPubkeys}
-                  variant="activity"
-                />
-              ) : null}
-            </div>
+            <ComposerDockBackdrop gutterClassName="inset-x-5" />
+            <MessageComposer
+              audienceContext={{
+                type: "thread",
+                threadRootId: threadHead.id,
+                initialAgentPubkeys,
+              }}
+              channelId={channelId}
+              channelName={channelName}
+              channelType={channel?.channelType ?? null}
+              containerClassName={cn(
+                THREAD_PANEL_COMPOSER_GUTTER_CLASS,
+                "pb-0",
+              )}
+              layoutMode="dock"
+              disabled={disabled || isSending || !channelId}
+              draftKey={`thread:${threadHead.id}`}
+              autoSubmitDraftKey={autoSendDraftKey}
+              onAutoSubmitComplete={onAutoSubmitComplete}
+              editTarget={editTarget}
+              isSending={isSending}
+              onCancelEdit={onCancelEdit}
+              onCancelReply={composerReplyTarget ? onCancelReply : undefined}
+              onCaptureSendContext={onCaptureSendContext}
+              onEditLastOwnMessage={onEditLastOwnMessage}
+              onEditSave={onEditSave}
+              onSend={onSend}
+              placeholder={`Reply in thread to ${threadHead.author}`}
+              profiles={profiles}
+              replyTarget={composerReplyTarget}
+              typingParentEventId={threadHead.id}
+              typingRootEventId={threadHead.rootId}
+            />
+            {/* The activity accessory is anchored in the dock's reserved bottom
+              rail, so fading it cannot change the observed overlay height or
+              move the conversation. Its natural content height remains responsive. */}
+            <ComposerActivityAccessory
+              className={THREAD_PANEL_COMPOSER_GUTTER_CLASS}
+              visible={hasComposerBottomActivity}
+            >
+              <div className="mx-auto flex w-full max-w-4xl items-center gap-2 overflow-visible pl-2">
+                {activityAccessoryVisible && activityAccessoryContent ? (
+                  <div className="flex min-w-0 flex-1 overflow-visible">
+                    {activityAccessoryContent}
+                  </div>
+                ) : null}
+                {threadTypingPubkeys.length > 0 ? (
+                  <TypingIndicatorRow
+                    channel={channel}
+                    className="min-w-0 flex-1 py-0 pl-[calc(0.75rem+1px)] pr-0 sm:pl-[calc(1rem+1px)]"
+                    currentPubkey={currentPubkey}
+                    profiles={profiles}
+                    typingPubkeys={threadTypingPubkeys}
+                    variant="activity"
+                  />
+                ) : null}
+              </div>
+            </ComposerActivityAccessory>
           </div>
         </div>
       </div>
diff --git a/desktop/src/features/messages/ui/MessageTimeline.tsx b/desktop/src/features/messages/ui/MessageTimeline.tsx
index 73526da5e80..cc5fb1e3dc6 100644
--- a/desktop/src/features/messages/ui/MessageTimeline.tsx
+++ b/desktop/src/features/messages/ui/MessageTimeline.tsx
@@ -32,6 +32,7 @@ import { useSettleGatedPrependMessages } from "./useSettleGatedPrependMessages";
 
 export type MessageTimelineHandle = {
   scrollToBottomOnNextUpdate: () => void;
+  settleAtBottom: () => boolean;
 };
 
 type MessageTimelineProps = {
@@ -433,8 +434,13 @@ const MessageTimelineBase = React.forwardRef<
     ref,
     () => ({
       scrollToBottomOnNextUpdate: prepareForOwnMessage,
+      settleAtBottom: () => {
+        if (!timelineVirtualizerApi) return false;
+        scrollToBottom("auto");
+        return true;
+      },
     }),
-    [prepareForOwnMessage],
+    [prepareForOwnMessage, scrollToBottom, timelineVirtualizerApi],
   );
 
   // Jump-to-message is purely DOM-based now: all loaded rows are mounted, so
diff --git a/desktop/src/features/messages/ui/SelectionFormattingTray.tsx b/desktop/src/features/messages/ui/SelectionFormattingTray.tsx
index e7e29cab357..9eb24a970c8 100644
--- a/desktop/src/features/messages/ui/SelectionFormattingTray.tsx
+++ b/desktop/src/features/messages/ui/SelectionFormattingTray.tsx
@@ -195,6 +195,7 @@ export function SelectionFormattingTray({
           ? "-translate-x-1/2 -translate-y-full"
           : "-translate-x-1/2",
       )}
+      data-buzz-selection-formatting-tray
       data-testid="selection-formatting-tray"
       onMouseDown={(event) => event.preventDefault()}
       role="toolbar"
diff --git a/desktop/src/features/messages/ui/TimelineSkeleton.tsx b/desktop/src/features/messages/ui/TimelineSkeleton.tsx
index 143fb1d71ea..7d290be6e62 100644
--- a/desktop/src/features/messages/ui/TimelineSkeleton.tsx
+++ b/desktop/src/features/messages/ui/TimelineSkeleton.tsx
@@ -2,6 +2,7 @@ import * as React from "react";
 
 import type { TimelineMessage } from "@/features/messages/types";
 import { cn } from "@/shared/lib/cn";
+import { setLocalStorageItemWithRecovery } from "@/shared/lib/localStorageQuota";
 import { Skeleton } from "@/shared/ui/skeleton";
 
 const TIMELINE_SKELETON_CACHE_PREFIX = "buzz-timeline-skeleton-shape.v1";
@@ -35,6 +36,7 @@ export type TimelineSkeletonRowShape = {
 
 type TimelineSkeletonCachePayload = {
   rows: TimelineSkeletonRowShape[];
+  updatedAt: number;
   version: 1;
 };
 
@@ -133,11 +135,12 @@ function writeTimelineSkeletonRows(
 
   const payload: TimelineSkeletonCachePayload = {
     rows: rows.slice(0, 4),
+    updatedAt: Date.now(),
     version: 1,
   };
 
   try {
-    window.localStorage.setItem(cacheKey, JSON.stringify(payload));
+    setLocalStorageItemWithRecovery(cacheKey, JSON.stringify(payload));
   } catch {
     // localStorage can be unavailable or full in embedded webviews.
   }
diff --git a/desktop/src/features/messages/ui/TypingIndicatorRow.tsx b/desktop/src/features/messages/ui/TypingIndicatorRow.tsx
index efb5b9ef092..ef9a8f1846a 100644
--- a/desktop/src/features/messages/ui/TypingIndicatorRow.tsx
+++ b/desktop/src/features/messages/ui/TypingIndicatorRow.tsx
@@ -79,9 +79,7 @@ export function TypingIndicatorRow({
       aria-live="polite"
       className={cn(
         "shrink-0 bg-transparent",
-        isActivityVariant
-          ? "flex h-7 items-center px-0 py-0"
-          : "px-4 py-2 sm:px-6",
+        isActivityVariant ? "flex items-center px-0 py-0" : "px-4 py-2 sm:px-6",
         className,
       )}
       {...(labels.length > 0
diff --git a/desktop/src/features/messages/ui/anchoredScrollPolicy.ts b/desktop/src/features/messages/ui/anchoredScrollPolicy.ts
new file mode 100644
index 00000000000..5dfec80b836
--- /dev/null
+++ b/desktop/src/features/messages/ui/anchoredScrollPolicy.ts
@@ -0,0 +1,71 @@
+import type { TimelineMessageDelta } from "@/features/messages/lib/timelineSnapshot";
+
+export function getPinnedCenterDrift({
+  contentTop,
+  currentContentTop,
+}: {
+  contentTop: number;
+  currentContentTop: number;
+}): number | null {
+  const drift = currentContentTop - contentTop;
+  return Math.abs(drift) > 0.5 ? drift : null;
+}
+
+export function shouldIgnorePinnedCenterScroll({
+  currentScrollTop,
+  expectedScrollTop,
+  isWritingScroll,
+}: {
+  currentScrollTop: number;
+  expectedScrollTop: number | null;
+  isWritingScroll: boolean;
+}): boolean {
+  return isWritingScroll || expectedScrollTop === currentScrollTop;
+}
+
+// Programmatic bottom pins require the physical floor, not merely the looser
+// UI at-bottom threshold used for unread affordances.
+const TRUE_BOTTOM_THRESHOLD_PX = 1;
+
+type BottomSettleContainer = Pick<
+  HTMLDivElement,
+  "scrollHeight" | "clientHeight" | "scrollTop" | "scrollTo"
+>;
+
+export function settleProgrammaticBottomPin(
+  container: BottomSettleContainer,
+): boolean {
+  container.scrollTo({ top: container.scrollHeight, behavior: "auto" });
+  return (
+    container.scrollHeight - container.clientHeight - container.scrollTop <=
+    TRUE_BOTTOM_THRESHOLD_PX
+  );
+}
+
+export function shouldSettleForSplitPanel({
+  isAtBottom,
+  splitPanelOpen,
+}: {
+  isAtBottom: boolean;
+  splitPanelOpen: boolean;
+}): boolean {
+  return isAtBottom && splitPanelOpen;
+}
+
+export function shouldSettleVirtualizedBottom({
+  isAtBottom,
+  messageDelta,
+  messagesArrived,
+  messagesChanged,
+}: {
+  isAtBottom: boolean;
+  messageDelta: TimelineMessageDelta;
+  messagesArrived: number;
+  messagesChanged: boolean;
+}): boolean {
+  return (
+    isAtBottom &&
+    messageDelta !== "prepend" &&
+    (messagesArrived > 0 || messagesChanged)
+  );
+}
diff --git a/desktop/src/features/messages/ui/useAnchoredScroll.lifecycle.test.mjs b/desktop/src/features/messages/ui/useAnchoredScroll.lifecycle.test.mjs
index 2df5a22efe4..1fdfb058574 100644
--- a/desktop/src/features/messages/ui/useAnchoredScroll.lifecycle.test.mjs
+++ b/desktop/src/features/messages/ui/useAnchoredScroll.lifecycle.test.mjs
@@ -173,7 +173,7 @@ function makePinnedCenterNodes() {
         listener(event);
     },
     getBoundingClientRect() {
-      return { top: 0 };
+      return { bottom: this.clientHeight, top: 0 };
     },
     querySelector() {
       return row;
@@ -218,7 +218,8 @@ function makePinnedCenterNodes() {
     disconnect() {}
 
     observe(target) {
-      this.target = target;
+      this.targets ??= [];
+      this.targets.push(target);
     }
   };
 
@@ -232,12 +233,13 @@ function makePinnedCenterNodes() {
   };
 }
 
-function Harness({ channelId, refs }) {
+function Harness({ channelId, onTargetSettled, refs }) {
   useAnchoredScroll({
     channelId,
     contentRef: refs.content,
     isLoading: false,
     messages: [{ id: "selected" }],
+    onTargetSettled,
     pinTargetCentered: true,
     scrollContainerRef: refs.container,
     targetMessageId: "selected",
@@ -245,6 +247,18 @@ function Harness({ channelId, refs }) {
   return null;
 }
 
+function BottomStateHarness({ messages, onState, refs }) {
+  const anchored = useAnchoredScroll({
+    channelId: "conversation",
+    contentRef: refs.content,
+    isLoading: false,
+    messages,
+    scrollContainerRef: refs.container,
+  });
+  onState(anchored);
+  return null;
+}
+
 function VirtualTargetHarness({ refs }) {
   const didRun = React.useRef(false);
   const bottomApi = useVirtualizedBottomSettle(
@@ -293,7 +307,10 @@ test("channel change attaches pinned-center observers after refs mount", async (
   });
 
   assert.equal(nodes.resizeObservers.length, 1);
-  assert.equal(nodes.resizeObservers[0].target, nodes.content);
+  assert.deepEqual(nodes.resizeObservers[0].targets, [
+    nodes.content,
+    nodes.container,
+  ]);
   assert.equal(nodes.container.listeners.get("wheel")?.length, 1);
 
   await act(async () => {
@@ -312,6 +329,108 @@ test("channel change attaches pinned-center observers after refs mount", async (
   });
 });
 
+test("container resize clears a stale new-message state at the physical floor", async () => {
+  const refs = {
+    container: { current: null },
+    content: { current: null },
+  };
+  const root = createRoot(document.createElement("div"));
+  const nodes = makePinnedCenterNodes();
+  refs.container.current = nodes.container;
+  refs.content.current = nodes.content;
+  let state = null;
+  const render = (messages) =>
+    root.render(
+      React.createElement(BottomStateHarness, {
+        messages,
+        onState: (nextState) => {
+          state = nextState;
+        },
+        refs,
+      }),
+    );
+
+  await act(async () => render([{ id: "first" }]));
+  await act(async () => new Promise((resolve) => setTimeout(resolve, 0)));
+  nodes.container.scrollTop = 100;
+  await act(async () => state.onScroll());
+  nodes.container.scrollTop = 100;
+  await act(async () => state.onScroll());
+  await act(async () => render([{ id: "first" }, { id: "second" }]));
+  assert.equal(state.isAtBottom, false);
+  assert.equal(state.newMessageCount, 1);
+
+  // A taller viewport reaches the floor without producing a native scroll.
+  nodes.container.clientHeight = 900;
+  await act(async () => nodes.resizeObservers[0].callback());
+
+  assert.equal(state.isAtBottom, true);
+  assert.equal(state.newMessageCount, 0);
+  await act(async () => root.unmount());
+});
+
+test("pinned target resize reconciles bottom state before retiring", async () => {
+  const refs = {
+    container: { current: null },
+    content: { current: null },
+  };
+  const root = createRoot(document.createElement("div"));
+  const settled = [];
+  const nodes = makePinnedCenterNodes();
+  refs.container.current = nodes.container;
+  refs.content.current = nodes.content;
+
+  await act(async () => {
+    root.render(
+      React.createElement(Harness, {
+        channelId: "conversation",
+        onTargetSettled: (messageId) => settled.push(messageId),
+        refs,
+      }),
+    );
+  });
+
+  assert.deepEqual(settled, [], "initial target reach is not settled");
+  nodes.moveSelectedRowBy(96);
+  nodes.resizeObservers[0].callback();
+  assert.deepEqual(settled, [], "resize callback waits for the paint frame");
+  await act(async () => new Promise((resolve) => setTimeout(resolve, 0)));
+
+  assert.deepEqual(settled, ["selected"]);
+  assert.deepEqual(nodes.container.scrollWrites, [96]);
+  await act(async () => root.unmount());
+});
+
+test("user interaction releases and retires a pending pinned target", async () => {
+  const refs = {
+    container: { current: null },
+    content: { current: null },
+  };
+  const root = createRoot(document.createElement("div"));
+  const settled = [];
+  const nodes = makePinnedCenterNodes();
+  refs.container.current = nodes.container;
+  refs.content.current = nodes.content;
+
+  await act(async () => {
+    root.render(
+      React.createElement(Harness, {
+        channelId: "conversation",
+        onTargetSettled: (messageId) => settled.push(messageId),
+        refs,
+      }),
+    );
+  });
+  await act(async () => nodes.container.dispatchEvent({ type: "wheel" }));
+  nodes.moveSelectedRowBy(96);
+  nodes.resizeObservers[0].callback();
+  await act(async () => new Promise((resolve) => setTimeout(resolve, 0)));
+
+  assert.deepEqual(settled, ["selected"]);
+  assert.deepEqual(nodes.container.scrollWrites, []);
+  await act(async () => root.unmount());
+});
+
 test("mounted virtual target retires bottom intent before direct centering", async () => {
   const resizeObservers = [];
   globalThis.ResizeObserver = class {
diff --git a/desktop/src/features/messages/ui/useAnchoredScroll.test.mjs b/desktop/src/features/messages/ui/useAnchoredScroll.test.mjs
index ba1acb7aa64..28273f08bb8 100644
--- a/desktop/src/features/messages/ui/useAnchoredScroll.test.mjs
+++ b/desktop/src/features/messages/ui/useAnchoredScroll.test.mjs
@@ -7,7 +7,7 @@ import {
   shouldIgnorePinnedCenterScroll,
   shouldSettleForSplitPanel,
   shouldSettleVirtualizedBottom,
-} from "./useAnchoredScroll.ts";
+} from "./anchoredScrollPolicy.ts";
 
 function fakeContainer({ clientHeight, scrollHeight, scrollTop }) {
   const writes = [];
diff --git a/desktop/src/features/messages/ui/useAnchoredScroll.ts b/desktop/src/features/messages/ui/useAnchoredScroll.ts
index 34929fc26e7..add9439599a 100644
--- a/desktop/src/features/messages/ui/useAnchoredScroll.ts
+++ b/desktop/src/features/messages/ui/useAnchoredScroll.ts
@@ -1,9 +1,14 @@
 import * as React from "react";
 
+import { classifyTimelineMessageDelta } from "@/features/messages/lib/timelineSnapshot";
 import {
-  classifyTimelineMessageDelta,
-  type TimelineMessageDelta,
-} from "@/features/messages/lib/timelineSnapshot";
+  getPinnedCenterDrift,
+  settleProgrammaticBottomPin,
+  shouldIgnorePinnedCenterScroll,
+  shouldSettleForSplitPanel,
+  shouldSettleVirtualizedBottom,
+} from "./anchoredScrollPolicy";
+import { useVirtualizedViewportResize } from "./useVirtualizedViewportResize";
 
 /**
  * Distance (in CSS pixels) below which we consider the scroll position
@@ -12,81 +17,12 @@ import {
  * rounding from the layout engine.
  */
 const AT_BOTTOM_THRESHOLD_PX = 32;
-// Tests and user-visible "pinned" affordances need the view at the physical
-// floor, not merely within the looser UI at-bottom threshold. The loose
-// threshold decides whether the user is close enough to count as reading the
-// latest message; this strict threshold decides when a programmatic bottom pin
-// has actually finished settling.
-const TRUE_BOTTOM_THRESHOLD_PX = 1;
 
 type AnchorState =
   | { kind: "at-bottom" }
   | { kind: "message"; messageId: string; topOffset: number }
   | { kind: "pinned-center"; messageId: string; contentTop: number };
 
-export function getPinnedCenterDrift({
-  contentTop,
-  currentContentTop,
-}: {
-  contentTop: number;
-  currentContentTop: number;
-}): number | null {
-  const drift = currentContentTop - contentTop;
-  return Math.abs(drift) > 0.5 ? drift : null;
-}
-
-export function shouldIgnorePinnedCenterScroll({
-  currentScrollTop,
-  expectedScrollTop,
-  isWritingScroll,
-}: {
-  currentScrollTop: number;
-  expectedScrollTop: number | null;
-  isWritingScroll: boolean;
-}): boolean {
-  return isWritingScroll || expectedScrollTop === currentScrollTop;
-}
-
-type BottomSettleContainer = Pick<
-  HTMLDivElement,
-  "scrollHeight" | "clientHeight" | "scrollTop" | "scrollTo"
->;
-
-export function settleProgrammaticBottomPin(
-  container: BottomSettleContainer,
-): boolean {
-  container.scrollTo({ top: container.scrollHeight, behavior: "auto" });
-  return isAtTrueBottom(container);
-}
-
-export function shouldSettleForSplitPanel({
-  isAtBottom,
-  splitPanelOpen,
-}: {
-  isAtBottom: boolean;
-  splitPanelOpen: boolean;
-}): boolean {
-  return isAtBottom && splitPanelOpen;
-}
-
-export function shouldSettleVirtualizedBottom({
-  isAtBottom,
-  messageDelta,
-  messagesArrived,
-  messagesChanged,
-}: {
-  isAtBottom: boolean;
-  messageDelta: TimelineMessageDelta;
-  messagesArrived: number;
-  messagesChanged: boolean;
-}): boolean {
-  return (
-    isAtBottom &&
-    messageDelta !== "prepend" &&
-    (messagesArrived > 0 || messagesChanged)
-  );
-}
-
 type UseAnchoredScrollOptions = {
   /** Scroll container. Owned by the parent so external refs still compose. */
   scrollContainerRef: React.RefObject<HTMLDivElement | null>;
@@ -109,6 +45,8 @@ type UseAnchoredScrollOptions = {
   /** Keeps a targeted message centered until the user deliberately scrolls. */
   pinTargetCentered?: boolean;
   onTargetReached?: (messageId: string) => void;
+  /** Reports a pinned target after resize correction and one paint frame. */
+  onTargetSettled?: (messageId: string) => void;
   virtualCancelBottomIntent?: () => void;
   virtualScrollToMessage?: (
     messageId: string,
@@ -135,6 +73,9 @@ type UseAnchoredScrollResult = {
   highlightedMessageId: string | null;
   /** Imperative: scroll to bottom. */
   scrollToBottom: (behavior?: ScrollBehavior) => void;
+  /** Re-pins after a layout owner changes trailing geometry. Returns true when
+   *  the hook handled the settlement, including a preserved pinned target. */
+  settleAtBottomAfterLayout: () => boolean;
   /** Arm a one-shot scroll-to-bottom that fires on the next appended message
    *  (used by the composer's send flow). */
   scrollToBottomOnNextUpdate: () => void;
@@ -160,18 +101,6 @@ function isAtBottomNow(
   );
 }
 
-function isAtTrueBottom(
-  container: Pick<
-    HTMLDivElement,
-    "scrollHeight" | "clientHeight" | "scrollTop"
-  >,
-) {
-  return (
-    container.scrollHeight - container.clientHeight - container.scrollTop <=
-    TRUE_BOTTOM_THRESHOLD_PX
-  );
-}
-
 /**
  * Pick an anchor for the current scroll position.
  *
@@ -230,6 +159,7 @@ export function useAnchoredScroll({
   highlightTargetMessage = true,
   pinTargetCentered = false,
   onTargetReached,
+  onTargetSettled,
   virtualCancelBottomIntent,
   virtualScrollToMessage,
   virtualScrollToBottom,
@@ -278,6 +208,7 @@ export function useAnchoredScroll({
   const programmaticScrollTopRef = React.useRef<number | null>(null);
   const isWritingScrollRef = React.useRef(false);
   const programmaticScrollRafRef = React.useRef<number | null>(null);
+  const targetSettleRafRef = React.useRef<number | null>(null);
 
   // Reset everything when the channel changes — the layout effect that runs
   // immediately after this reset is responsible for either jumping to bottom
@@ -303,6 +234,10 @@ export function useAnchoredScroll({
       cancelAnimationFrame(programmaticScrollRafRef.current);
       programmaticScrollRafRef.current = null;
     }
+    if (targetSettleRafRef.current !== null) {
+      cancelAnimationFrame(targetSettleRafRef.current);
+      targetSettleRafRef.current = null;
+    }
     if (highlightTimeoutRef.current !== null) {
       window.clearTimeout(highlightTimeoutRef.current);
       highlightTimeoutRef.current = null;
@@ -382,6 +317,40 @@ export function useAnchoredScroll({
     if (atBottom) setNewMessageCount(0);
   }, [scrollContainerRef]);
 
+  const schedulePinnedTargetSettle = React.useCallback(
+    (messageId: string) => {
+      if (!onTargetSettled) return;
+      if (targetSettleRafRef.current !== null) {
+        cancelAnimationFrame(targetSettleRafRef.current);
+      }
+      targetSettleRafRef.current = requestAnimationFrame(() => {
+        targetSettleRafRef.current = null;
+        const container = scrollContainerRef.current;
+        const anchor = anchorRef.current;
+        if (
+          !container ||
+          anchor.kind !== "pinned-center" ||
+          anchor.messageId !== messageId
+        ) {
+          return;
+        }
+        const row = container.querySelector<HTMLElement>(
+          `[data-message-id="${CSS.escape(messageId)}"]`,
+        );
+        if (!row) return;
+        const rowRect = row.getBoundingClientRect();
+        const containerRect = container.getBoundingClientRect();
+        if (
+          rowRect.bottom > containerRect.top &&
+          rowRect.top < containerRect.bottom
+        ) {
+          onTargetSettled(messageId);
+        }
+      });
+    },
+    [onTargetSettled, scrollContainerRef],
+  );
+
   const scrollToBottomImperative = React.useCallback(
     (behavior: ScrollBehavior = "auto") => {
       const container = scrollContainerRef.current;
@@ -417,6 +386,35 @@ export function useAnchoredScroll({
     forceBottomOnNextAppendRef.current = true;
   }, []);
 
+  const settleAtBottomAfterLayout = React.useCallback(() => {
+    const container = scrollContainerRef.current;
+    if (!container) return false;
+    if (anchorRef.current.kind === "pinned-center") {
+      repinPinnedCenter();
+      const atBottom = isAtBottomNow(container);
+      setIsAtBottom((previous) =>
+        previous === atBottom ? previous : atBottom,
+      );
+      if (atBottom) setNewMessageCount(0);
+      schedulePinnedTargetSettle(anchorRef.current.messageId);
+      return true;
+    }
+    if (!isAtBottomNow(container)) return false;
+
+    anchorRef.current = { kind: "at-bottom" };
+    setIsAtBottom(true);
+    setNewMessageCount(0);
+    if (!virtualizerOwnsPrependAnchoring) {
+      container.scrollTo({ top: container.scrollHeight, behavior: "auto" });
+    }
+    return true;
+  }, [
+    repinPinnedCenter,
+    schedulePinnedTargetSettle,
+    scrollContainerRef,
+    virtualizerOwnsPrependAnchoring,
+  ]);
+
   const highlightMessage = React.useCallback((messageId: string) => {
     if (highlightTimeoutRef.current !== null) {
       window.clearTimeout(highlightTimeoutRef.current);
@@ -752,11 +750,11 @@ export function useAnchoredScroll({
     isLoading,
     messages,
     onTargetReached,
+    repinPinnedCenter,
     scrollContainerRef,
     scrollToBottomImperative,
     scrollToMessageImperative,
     targetMessageId,
-    repinPinnedCenter,
     virtualScrollToBottom,
     virtualSettleAtBottom,
     virtualizerOwnsPrependAnchoring,
@@ -777,9 +775,8 @@ export function useAnchoredScroll({
     const observer = new ResizeObserver(() => {
       const container = scrollContainerRef.current;
       if (!container) return;
-      if (anchorRef.current.kind === "pinned-center") {
-        repinPinnedCenter();
-      } else if (
+      if (settleAtBottomAfterLayout()) return;
+      if (
         anchorRef.current.kind === "at-bottom" &&
         !virtualizerOwnsPrependAnchoring
       ) {
@@ -787,24 +784,50 @@ export function useAnchoredScroll({
       }
     });
     observer.observe(content);
-    return () => observer.disconnect();
+    const container = scrollContainerRef.current;
+    if (container && container !== content) observer.observe(container);
+    return () => {
+      observer.disconnect();
+      if (targetSettleRafRef.current !== null) {
+        cancelAnimationFrame(targetSettleRafRef.current);
+        targetSettleRafRef.current = null;
+      }
+    };
   }, [
     channelId,
     contentRef,
-    repinPinnedCenter,
     scrollContainerRef,
+    settleAtBottomAfterLayout,
     virtualizerOwnsPrependAnchoring,
   ]);
 
+  useVirtualizedViewportResize(
+    scrollContainerRef,
+    virtualizerAtBottomRef,
+    virtualizerOwnsPrependAnchoring ? virtualSettleAtBottom : undefined,
+  );
+
   // Pinned centers survive our own corrections but release as soon as the
-  // reader deliberately takes control of the scroll position.
+  // reader deliberately takes control of the scroll position or the caller
+  // retires the temporary target after layout settlement.
+  React.useEffect(() => {
+    if (!pinTargetCentered) releasePinnedCenter();
+  }, [pinTargetCentered, releasePinnedCenter]);
+
   // biome-ignore lint/correctness/useExhaustiveDependencies: channelId deliberately re-subscribes after a keyed or conditional scroll-container mount replaces ref.current.
   React.useEffect(() => {
     if (!pinTargetCentered) return;
     const container = scrollContainerRef.current;
     if (!container) return;
 
-    const handleUserInteraction = () => releasePinnedCenter();
+    const handleUserInteraction = () => {
+      const pinnedMessageId =
+        anchorRef.current.kind === "pinned-center"
+          ? anchorRef.current.messageId
+          : null;
+      releasePinnedCenter();
+      if (pinnedMessageId) onTargetSettled?.(pinnedMessageId);
+    };
     container.addEventListener("wheel", handleUserInteraction, {
       passive: true,
     });
@@ -817,7 +840,13 @@ export function useAnchoredScroll({
       container.removeEventListener("touchstart", handleUserInteraction);
       container.removeEventListener("keydown", handleUserInteraction);
     };
-  }, [channelId, pinTargetCentered, releasePinnedCenter, scrollContainerRef]);
+  }, [
+    channelId,
+    onTargetSettled,
+    pinTargetCentered,
+    releasePinnedCenter,
+    scrollContainerRef,
+  ]);
 
   // ---------------------------------------------------------------------------
   // Target message handling (deep link, jump-to-reply, etc.). Distinct from
@@ -896,6 +925,9 @@ export function useAnchoredScroll({
       if (programmaticScrollRafRef.current !== null) {
         cancelAnimationFrame(programmaticScrollRafRef.current);
       }
+      if (targetSettleRafRef.current !== null) {
+        cancelAnimationFrame(targetSettleRafRef.current);
+      }
     };
   }, []);
 
@@ -918,6 +950,7 @@ export function useAnchoredScroll({
     newMessageCount,
     highlightedMessageId,
     scrollToBottom: scrollToBottomImperative,
+    settleAtBottomAfterLayout,
     scrollToBottomOnNextUpdate,
     scrollToMessage: scrollToMessageImperative,
     onVirtualizerAtBottomStateChange,
diff --git a/desktop/src/features/messages/ui/useComposerHeightPadding.test.mjs b/desktop/src/features/messages/ui/useComposerHeightPadding.test.mjs
new file mode 100644
index 00000000000..23bfa901532
--- /dev/null
+++ b/desktop/src/features/messages/ui/useComposerHeightPadding.test.mjs
@@ -0,0 +1,31 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+
+import { shouldUseComposerPaddingFallback } from "./useComposerHeightPadding.ts";
+
+test("composer padding fallback follows initial measurement and growth", () => {
+  assert.equal(
+    shouldUseComposerPaddingFallback({
+      nextPadding: 100,
+      previousPadding: null,
+    }),
+    true,
+  );
+  assert.equal(
+    shouldUseComposerPaddingFallback({
+      nextPadding: 120,
+      previousPadding: 100,
+    }),
+    true,
+  );
+});
+
+test("composer padding fallback does not force-scroll on shrink", () => {
+  assert.equal(
+    shouldUseComposerPaddingFallback({
+      nextPadding: 100,
+      previousPadding: 120,
+    }),
+    false,
+  );
+});
diff --git a/desktop/src/features/messages/ui/useComposerHeightPadding.ts b/desktop/src/features/messages/ui/useComposerHeightPadding.ts
index c4f9beb3ec2..9990ce50661 100644
--- a/desktop/src/features/messages/ui/useComposerHeightPadding.ts
+++ b/desktop/src/features/messages/ui/useComposerHeightPadding.ts
@@ -2,20 +2,35 @@ import * as React from "react";
 
 import { observeElementBlockSize } from "@/shared/layout/observeElementBlockSize";
 
+export function shouldUseComposerPaddingFallback({
+  nextPadding,
+  previousPadding,
+}: {
+  nextPadding: number;
+  previousPadding: number | null;
+}): boolean {
+  return previousPadding === null || nextPadding > previousPadding;
+}
+
 /**
  * Observes the height of the composer overlay and sets the scroll
  * container's `paddingBottom` to match, so content is never hidden
  * behind the absolutely-positioned composer.
  *
- * If the user is already scrolled to the bottom when padding increases,
- * auto-scrolls to keep them at the bottom (no visible gap).
+ * If the reader is already near the bottom, the legacy fallback follows only
+ * initial measurement and growth. Consumers with semantic bottom ownership may
+ * provide `settleAtBottom` to handle both growth and shrink safely.
  */
 export function useComposerHeightPadding(
   scrollContainerRef: React.RefObject<HTMLElement | null>,
   composerRef: React.RefObject<HTMLElement | null>,
   resetKey?: unknown,
   mode: "padding" | "css-variable" = "padding",
+  settleAtBottom?: () => boolean,
 ) {
+  const settleAtBottomRef = React.useRef(settleAtBottom);
+  settleAtBottomRef.current = settleAtBottom;
+
   React.useEffect(() => {
     void resetKey;
     const scrollEl = scrollContainerRef.current;
@@ -70,10 +85,18 @@ export function useComposerHeightPadding(
       }
       lastPadding = padding;
 
-      if (
-        wasAtBottom &&
-        (previousPadding === null || padding > previousPadding)
-      ) {
+      if (wasAtBottom && previousPadding !== padding) {
+        if (settleAtBottomRef.current?.()) {
+          return;
+        }
+        if (
+          !shouldUseComposerPaddingFallback({
+            nextPadding: padding,
+            previousPadding,
+          })
+        ) {
+          return;
+        }
         followBottom();
         if (followBottomFrame !== null) {
           cancelAnimationFrame(followBottomFrame);
diff --git a/desktop/src/features/messages/ui/useVirtualizedViewportResize.test.mjs b/desktop/src/features/messages/ui/useVirtualizedViewportResize.test.mjs
new file mode 100644
index 00000000000..e284460c172
--- /dev/null
+++ b/desktop/src/features/messages/ui/useVirtualizedViewportResize.test.mjs
@@ -0,0 +1,15 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+
+import { shouldSettleVirtualizedViewportResize } from "./useVirtualizedViewportResize.ts";
+
+test("viewport resize follows the virtualizer's explicit bottom state", () => {
+  assert.equal(
+    shouldSettleVirtualizedViewportResize({ virtualizerAtBottom: true }),
+    true,
+  );
+  assert.equal(
+    shouldSettleVirtualizedViewportResize({ virtualizerAtBottom: false }),
+    false,
+  );
+});
diff --git a/desktop/src/features/messages/ui/useVirtualizedViewportResize.ts b/desktop/src/features/messages/ui/useVirtualizedViewportResize.ts
new file mode 100644
index 00000000000..d3273a09b62
--- /dev/null
+++ b/desktop/src/features/messages/ui/useVirtualizedViewportResize.ts
@@ -0,0 +1,39 @@
+import * as React from "react";
+
+export function shouldSettleVirtualizedViewportResize({
+  virtualizerAtBottom,
+}: {
+  virtualizerAtBottom: boolean;
+}): boolean {
+  return virtualizerAtBottom;
+}
+
+/** Re-settles a bottom-pinned virtualized timeline after viewport reflow. */
+export function useVirtualizedViewportResize(
+  scrollContainerRef: React.RefObject<HTMLDivElement | null>,
+  virtualizerAtBottomRef: React.RefObject<boolean>,
+  settleAtBottom?: () => void,
+) {
+  React.useEffect(() => {
+    const container = scrollContainerRef.current;
+    if (
+      !container ||
+      !settleAtBottom ||
+      typeof ResizeObserver === "undefined"
+    ) {
+      return;
+    }
+
+    const observer = new ResizeObserver(() => {
+      if (
+        shouldSettleVirtualizedViewportResize({
+          virtualizerAtBottom: virtualizerAtBottomRef.current,
+        })
+      ) {
+        settleAtBottom();
+      }
+    });
+    observer.observe(container);
+    return () => observer.disconnect();
+  }, [scrollContainerRef, settleAtBottom, virtualizerAtBottomRef]);
+}
diff --git a/desktop/src/features/onboarding/assets/harness-logos/chatgpt.png b/desktop/src/features/onboarding/assets/harness-logos/chatgpt.png
deleted file mode 100644
index 3a339cc0fe4..00000000000
Binary files a/desktop/src/features/onboarding/assets/harness-logos/chatgpt.png and /dev/null differ
diff --git a/desktop/src/features/onboarding/assets/harness-logos/goose.png b/desktop/src/features/onboarding/assets/harness-logos/goose.png
deleted file mode 100644
index 3fd794bd15d..00000000000
Binary files a/desktop/src/features/onboarding/assets/harness-logos/goose.png and /dev/null differ
diff --git a/desktop/src/features/onboarding/ui/HarnessMarks.tsx b/desktop/src/features/onboarding/ui/HarnessMarks.tsx
new file mode 100644
index 00000000000..48d2da4404a
--- /dev/null
+++ b/desktop/src/features/onboarding/ui/HarnessMarks.tsx
@@ -0,0 +1,49 @@
+import type * as React from "react";
+
+// Monochrome brand marks rendered inline with `currentColor` so they adapt to
+// dark/light themes without the brightness/invert filter the old PNG pipeline
+// needed. Provenance for each path is recorded in
+// desktop/public/harness-logos/CREDITS.md.
+
+type MarkProps = { className?: string };
+
+/// Goose mark from Block's own goose repo (Apache-2.0).
+function GooseMark({ className }: MarkProps) {
+  return (
+    <svg
+      aria-hidden="true"
+      className={className}
+      fill="currentColor"
+      role="img"
+      viewBox="0 0 45 45"
+      xmlns="http://www.w3.org/2000/svg"
+    >
+      <path d="M43.2098 39.2492L39.8118 36.4522C37.9646 34.9318 36.3923 33.1051 35.1631 31.0529C33.4647 28.2172 31.1178 25.8243 28.3164 24.071L26.9482 23.2744C26.4794 22.9485 26.1525 22.4405 26.106 21.8675C26.0762 21.4981 26.1647 21.1678 26.3712 20.8771C27.0837 19.873 30.9617 15.6995 31.6365 15.1411C32.5056 14.4228 33.4739 13.8253 34.3724 13.1412C34.5001 13.0438 34.6283 12.9469 34.7545 12.8481C34.7589 12.8437 34.7653 12.8403 34.7692 12.8363C35.0574 12.6088 35.3295 12.3671 35.5458 12.0803C36.5993 10.8604 36.5783 9.82938 36.5783 9.82938C36.5783 9.82938 36.5793 9.8284 36.5798 9.82791C36.4677 9.5534 36.0645 8.69902 35.2449 8.29825C35.9696 8.28406 36.7872 8.55564 37.1582 8.91873C37.6039 8.21947 37.8922 7.76585 38.3404 7.00347C38.4471 6.82241 38.5038 6.48771 38.2998 6.30029C38.2998 6.30029 38.2988 6.30029 38.2978 6.30029C38.2978 6.30029 38.2978 6.29931 38.2978 6.29833C38.2939 6.29442 38.289 6.29148 38.2851 6.28757C38.2812 6.28365 38.2787 6.27925 38.2743 6.27485C38.2743 6.27485 38.2734 6.27485 38.2724 6.27485C38.2724 6.27485 38.2724 6.27387 38.2724 6.27289C38.2641 6.26457 38.2548 6.25821 38.246 6.25038C38.2406 6.245 38.2362 6.23864 38.2313 6.23276C38.2254 6.22787 38.219 6.22347 38.2137 6.21808C38.2053 6.20977 38.2 6.19949 38.1911 6.19166C38.1911 6.19166 38.1897 6.19117 38.1892 6.19166C38.1892 6.19166 38.1892 6.19068 38.1892 6.1897C38.1853 6.18579 38.1804 6.18285 38.1765 6.17894C38.1726 6.17502 38.1696 6.17013 38.1657 6.16621C38.1657 6.16621 38.1642 6.16572 38.1637 6.16621C38.1637 6.16621 38.1637 6.16524 38.1637 6.16426C37.9763 5.9602 37.6416 6.01697 37.4606 6.12364C36.4692 6.70693 35.5047 7.33475 34.6351 7.88525C34.6351 7.88525 33.6046 7.86372 32.3842 8.91775C32.097 9.13452 31.8552 9.4066 31.6282 9.69433C31.6238 9.69873 31.6199 9.7046 31.6164 9.70901C31.5171 9.83476 31.4202 9.96297 31.3233 10.0912C30.6387 10.9901 30.0417 11.958 29.3234 12.8271C28.7656 13.5023 24.5915 17.3798 23.5874 18.0923C23.2967 18.2988 22.9669 18.3879 22.597 18.3575C22.0245 18.3115 21.5161 17.9842 21.1902 17.5154L20.3935 16.1472C18.6402 13.3448 16.2474 10.9989 13.4117 9.30041C11.3594 8.0712 9.5332 6.49847 8.01234 4.65172L5.2153 1.25377C5.0773 1.08642 4.81306 1.11382 4.71422 1.30662C4.39615 1.92612 3.78888 3.23411 3.32353 4.99327C3.31227 5.03487 3.32206 5.07891 3.34946 5.11218C3.92786 5.81095 5.26717 7.35089 6.8624 8.65351C6.97348 8.74403 6.88246 8.92313 6.74447 8.88496C5.36846 8.51013 4.03062 7.90825 3.02944 7.39542C2.94772 7.35383 2.84887 7.4057 2.83713 7.49672C2.68152 8.74354 2.64139 10.1127 2.80581 11.5562C2.8107 11.6032 2.84055 11.6438 2.8841 11.6629C4.02572 12.1596 5.85143 12.8804 7.76816 13.3389C7.90713 13.3722 7.90273 13.5723 7.76229 13.5992C6.26982 13.8801 4.70688 13.9427 3.43656 13.9261C3.3475 13.9251 3.28193 14.0093 3.30591 14.0949C3.56085 14.9958 3.90632 15.9118 4.3619 16.8342C4.55029 17.2487 4.75532 17.6553 4.97504 18.0532C5.01271 18.1212 5.08562 18.1618 5.16343 18.1584C6.21207 18.107 7.47946 17.9964 8.75369 17.7713C8.97095 17.7331 9.08741 18.0189 8.90391 18.1417C8.03877 18.7201 7.11588 19.2183 6.25758 19.6283C6.14259 19.6836 6.1054 19.8304 6.18125 19.9327C6.69114 20.6236 7.25191 21.2774 7.86114 21.8866C7.86114 21.8866 10.8608 24.9763 10.9425 25.2185C12.6928 23.4261 15.5701 21.4394 18.7474 19.7047C14.4921 23.1672 12.1198 25.7235 10.9258 27.1758L10.0935 28.3439C9.66091 28.9507 9.2856 29.5951 8.97193 30.2709C7.92231 32.5292 6.19201 37.0966 6.19201 37.0966C6.0594 37.4543 6.16755 37.8072 6.39753 38.0371C6.40292 38.0425 6.4083 38.0479 6.41417 38.0528C6.41955 38.0582 6.42445 38.0641 6.42983 38.0694C6.66031 38.2999 7.01263 38.4076 7.37033 38.275C7.37033 38.275 11.9368 36.5447 14.1961 35.495C14.8719 35.1814 15.5168 34.8056 16.1231 34.3735L17.4095 33.457C18.0907 32.9715 19.0234 33.0489 19.615 33.6405L22.5804 36.6058C23.1896 37.2151 23.8433 37.7758 24.5343 38.2857C24.637 38.3611 24.7833 38.3244 24.8386 38.2094C25.2492 37.3516 25.7473 36.4277 26.3252 35.5631C26.4481 35.3796 26.7343 35.4965 26.6957 35.7133C26.4701 36.988 26.3605 38.2554 26.3086 39.3035C26.3047 39.3809 26.3458 39.4543 26.4138 39.4919C26.8112 39.7121 27.2178 39.9172 27.6327 40.1051C28.5551 40.5606 29.4717 40.9066 30.3721 41.1611C30.4577 41.185 30.5419 41.1195 30.5409 41.0304C30.5237 39.7596 30.5864 38.1967 30.8677 36.7047C30.8942 36.5638 31.0943 36.5593 31.1281 36.6988C31.5861 38.616 32.3069 40.4417 32.8041 41.5829C32.8231 41.6264 32.8633 41.6558 32.9107 41.6612C34.3543 41.8256 35.7234 41.7855 36.9703 41.6298C37.0618 41.6186 37.1136 41.5197 37.0715 41.4375C36.5587 40.4364 35.9568 39.0975 35.582 37.7225C35.5443 37.584 35.7229 37.4935 35.8135 37.6046C37.1161 39.1998 38.656 40.5391 39.3548 41.1175C39.3881 41.1449 39.4326 41.1542 39.4737 41.1434C41.2333 40.6786 42.5413 40.0713 43.1604 39.7528C43.3532 39.6539 43.3806 39.3897 43.2132 39.2517L43.2098 39.2492Z" />
+    </svg>
+  );
+}
+
+/// Cursor mark (simple-icons, CC0).
+function CursorMark({ className }: MarkProps) {
+  return (
+    <svg
+      aria-hidden="true"
+      className={className}
+      fill="currentColor"
+      role="img"
+      viewBox="0 0 24 24"
+      xmlns="http://www.w3.org/2000/svg"
+    >
+      <path d="M11.503.131 1.891 5.678a.84.84 0 0 0-.42.726v11.188c0 .3.162.575.42.724l9.609 5.55a1 1 0 0 0 .998 0l9.61-5.55a.84.84 0 0 0 .42-.724V6.404a.84.84 0 0 0-.42-.726L12.497.131a1.01 1.01 0 0 0-.996 0M2.657 6.338h18.55c.263 0 .43.287.297.515L12.23 22.918c-.062.107-.229.064-.229-.06V12.335a.59.59 0 0 0-.295-.51l-9.11-5.257c-.109-.063-.064-.23.061-.23" />
+    </svg>
+  );
+}
+
+/// Theme-adaptive inline marks, keyed by runtime/preset id. Consulted before
+/// the bitmap logo maps in `RuntimeIcon`. Codex deliberately has no entry:
+/// the OpenAI blossom was removed from simple-icons v16 at the vendor's
+/// request, so Codex renders RuntimeIcon's neutral terminal-glyph fallback.
+export const RUNTIME_MARKS: Record<string, React.FC<MarkProps>> = {
+  cursor: CursorMark,
+  goose: GooseMark,
+};
diff --git a/desktop/src/features/onboarding/ui/IdentityKeyHelpDialog.tsx b/desktop/src/features/onboarding/ui/IdentityKeyHelpDialog.tsx
index e597dfdbd1b..0abcd77cb02 100644
--- a/desktop/src/features/onboarding/ui/IdentityKeyHelpDialog.tsx
+++ b/desktop/src/features/onboarding/ui/IdentityKeyHelpDialog.tsx
@@ -67,6 +67,7 @@ export function IdentityKeyHelpDialog() {
       <DialogContent
         className="buzz-onboarding-neutral-theme max-w-[47.5rem] -translate-y-5"
         closeButtonClassName={ONBOARDING_INK_ICON_CLASS}
+        data-system-color-scheme="light"
         data-testid="identity-key-help-dialog"
         overlayVariant="transparent"
         surface="textured"
diff --git a/desktop/src/features/onboarding/ui/InviteRedeemForm.tsx b/desktop/src/features/onboarding/ui/InviteRedeemForm.tsx
index 78929cde160..fa50552ba2e 100644
--- a/desktop/src/features/onboarding/ui/InviteRedeemForm.tsx
+++ b/desktop/src/features/onboarding/ui/InviteRedeemForm.tsx
@@ -118,7 +118,7 @@ export function InviteRedeemForm({
     const code = parsedInvite?.code;
     let cancelled = false;
     const timeoutId = window.setTimeout(() => {
-      void getJoinPolicy(relayWsUrl)
+      void getJoinPolicy(relayWsUrl, code ? "webview" : "native")
         .then((policy) => {
           if (cancelled || !policy) return;
           setJoinPolicy(policy);
@@ -156,7 +156,7 @@ export function InviteRedeemForm({
         setPolicyError(null);
         setIsLoadingPolicy(true);
         try {
-          const policy = await getJoinPolicy(normalizedRelayUrl);
+          const policy = await getJoinPolicy(normalizedRelayUrl, "native");
           if (!policy) {
             onConnect?.(normalizedRelayUrl, apiToken.trim() || undefined);
             return;
@@ -205,7 +205,7 @@ export function InviteRedeemForm({
       setPolicyError(null);
       setIsLoadingPolicy(true);
       try {
-        const policy = await getJoinPolicy(relayWsUrl);
+        const policy = await getJoinPolicy(relayWsUrl, "webview");
         if (!policy) {
           onRedeem(relayWsUrl, parsedInvite.code);
           return;
diff --git a/desktop/src/features/onboarding/ui/RuntimeIcon.tsx b/desktop/src/features/onboarding/ui/RuntimeIcon.tsx
index 2debea409b8..f9c201d1154 100644
--- a/desktop/src/features/onboarding/ui/RuntimeIcon.tsx
+++ b/desktop/src/features/onboarding/ui/RuntimeIcon.tsx
@@ -3,17 +3,15 @@ import { TerminalSquare } from "lucide-react";
 
 import type { AcpRuntimeCatalogEntry } from "@/shared/api/types";
 import { cn } from "@/shared/lib/cn";
-import { useTheme } from "@/shared/theme/ThemeProvider";
 import { BuzzMark } from "@/shared/ui/buzz-logo/BuzzMark";
-import chatgptLogoUrl from "../assets/harness-logos/chatgpt.png?inline";
 import claudeLogoUrl from "../assets/harness-logos/claude.png?inline";
-import gooseLogoUrl from "../assets/harness-logos/goose.png?inline";
+import { RUNTIME_MARKS } from "./HarnessMarks";
 
 // Bundled logos for compiled-in runtimes (inline base64, no network fetch).
+// Monochrome marks live in RUNTIME_MARKS instead — inline SVGs that follow
+// `currentColor`, so they adapt to dark/light without bitmap filters.
 const RUNTIME_LOGOS: Record<string, string> = {
   claude: claudeLogoUrl,
-  codex: chatgptLogoUrl,
-  goose: gooseLogoUrl,
 };
 
 // Public-path logos for bundled presets. Served from /harness-logos/ at runtime.
@@ -51,15 +49,20 @@ export function RuntimeIcon({
   runtime: AcpRuntimeCatalogEntry;
 }) {
   const [imageFailed, setImageFailed] = React.useState(false);
-  const { isDark } = useTheme();
   // Only use bundled logo maps — never render user-supplied avatar URLs for
   // custom/preset entries (tracking pixel / spoofing vector, security line).
   const id = runtime.id.trim().toLowerCase();
   const imageUrl = getRuntimeLogoUrl(runtime);
-  const shouldForceForegroundColor = !imageUrl && id === "goose";
+  const Mark = RUNTIME_MARKS[id];
 
   if (isBuzzRuntime(runtime)) {
-    return <BuzzMark className="h-7 w-10 text-foreground" />;
+    // The mark's wide viewBox letterboxes inside a square box, so honoring
+    // the caller's size keeps it optically in line with the square logos.
+    return <BuzzMark className={cn(className, "text-foreground")} />;
+  }
+
+  if (Mark) {
+    return <Mark className={cn(className, "p-0.5 text-foreground")} />;
   }
 
   if (imageUrl && !imageFailed) {
@@ -71,8 +74,6 @@ export function RuntimeIcon({
           className,
           id === "omp" && "bg-[#0d0d0d] p-1",
           id === "grok" && "bg-white p-1",
-          shouldForceForegroundColor &&
-            (isDark ? "brightness-0 invert" : "brightness-0"),
         )}
         onError={() => setImageFailed(true)}
         src={imageUrl}
diff --git a/desktop/src/features/onboarding/ui/SetupStep.tsx b/desktop/src/features/onboarding/ui/SetupStep.tsx
index b6a6a5dd57b..843206aa706 100644
--- a/desktop/src/features/onboarding/ui/SetupStep.tsx
+++ b/desktop/src/features/onboarding/ui/SetupStep.tsx
@@ -388,7 +388,7 @@ function runtimeDetailText(runtime: AcpRuntimeCatalogEntry): string {
     runtime.availability === "cli_missing" ||
     runtime.availability === "not_installed"
   ) {
-    return "CLI not detected; the desktop app alone isn’t enough.";
+    return "CLI not detected.";
   }
   return "";
 }
diff --git a/desktop/src/features/onboarding/ui/presetLogos.test.mjs b/desktop/src/features/onboarding/ui/presetLogos.test.mjs
index 6f477fff658..0ff2193155d 100644
--- a/desktop/src/features/onboarding/ui/presetLogos.test.mjs
+++ b/desktop/src/features/onboarding/ui/presetLogos.test.mjs
@@ -16,6 +16,7 @@ import path from "node:path";
 import test from "node:test";
 import { fileURLToPath } from "node:url";
 
+import { RUNTIME_MARKS } from "./HarnessMarks.tsx";
 import { PRESET_LOGOS } from "./RuntimeIcon.tsx";
 
 const desktopRoot = path.resolve(
@@ -46,28 +47,19 @@ test("PRESET_HARNESSES parse found the preset ids", () => {
   );
 });
 
-const FALLBACK_ONLY_PRESETS = new Set([
-  // Cursor publishes official assets, but neither its brand page nor terms grant
-  // third parties permission to redistribute them. Keep the generic icon.
-  "cursor",
-]);
-
 for (const id of presetIds) {
-  test(`preset "${id}" has a bundled logo or an approved fallback`, () => {
-    const logoPath = PRESET_LOGOS[id];
-    if (FALLBACK_ONLY_PRESETS.has(id)) {
-      assert.equal(
-        logoPath,
-        undefined,
-        `preset "${id}" must keep the generic TerminalSquare fallback until ` +
-          "its vendor grants logo redistribution permission",
-      );
+  test(`preset "${id}" has a bundled logo or inline mark`, () => {
+    // Inline SVG marks (RUNTIME_MARKS) take precedence over bitmap logos —
+    // e.g. Cursor's mark ships as an inline CC0 simple-icons path, not a
+    // file under desktop/public.
+    if (RUNTIME_MARKS[id]) {
       return;
     }
+    const logoPath = PRESET_LOGOS[id];
     assert.ok(
       logoPath,
-      `preset "${id}" has no PRESET_LOGOS entry — it renders the generic ` +
-        `TerminalSquare fallback. Add desktop/public${logoPath ?? `/harness-logos/${id}.png`} ` +
+      `preset "${id}" has no RUNTIME_MARKS or PRESET_LOGOS entry — it renders ` +
+        `the generic TerminalSquare fallback. Add desktop/public${logoPath ?? `/harness-logos/${id}.png`} ` +
         `and map it in RuntimeIcon.tsx.`,
     );
     assert.ok(
@@ -88,3 +80,19 @@ test("PRESET_LOGOS has no entries for unknown presets", () => {
     `PRESET_LOGOS maps ids the backend does not emit as presets: ${unknown.join(", ")}`,
   );
 });
+
+test("codex ships no bundled mark or logo (vendor-removed OpenAI blossom)", () => {
+  // The OpenAI blossom was removed from simple-icons v16 at the vendor's
+  // request — Codex must render RuntimeIcon's neutral terminal-glyph
+  // fallback, not a re-bundled copy of the withdrawn mark.
+  assert.equal(
+    RUNTIME_MARKS.codex,
+    undefined,
+    "codex has a RUNTIME_MARKS entry — the OpenAI blossom must not ship without explicit approval",
+  );
+  assert.equal(
+    PRESET_LOGOS.codex,
+    undefined,
+    "codex has a PRESET_LOGOS entry — no bundled Codex logo is approved",
+  );
+});
diff --git a/desktop/src/features/onboarding/useClaimInvite.ts b/desktop/src/features/onboarding/useClaimInvite.ts
index 56ca185a261..3134953617c 100644
--- a/desktop/src/features/onboarding/useClaimInvite.ts
+++ b/desktop/src/features/onboarding/useClaimInvite.ts
@@ -3,6 +3,7 @@ import * as React from "react";
 import { useCommunityOnboarding } from "@/features/onboarding/communityOnboarding";
 import {
   inviteErrorMessage,
+  isInviteExhaustedError,
   isInviteExpiredError,
 } from "@/shared/api/inviteHelpers";
 import { claimInvite } from "@/shared/api/invites";
@@ -39,7 +40,9 @@ export function useClaimInvite() {
           {
             error: isInviteExpiredError(error)
               ? "This invite code has expired — ask for a new one."
-              : inviteErrorMessage(error),
+              : isInviteExhaustedError(error)
+                ? "This invite has reached its use limit. Ask for a new invite."
+                : inviteErrorMessage(error),
           },
           transaction.id,
         ),
diff --git a/desktop/src/features/reminders/ui/RemindersPanel.tsx b/desktop/src/features/reminders/ui/RemindersPanel.tsx
index 651768a2510..a96d167756a 100644
--- a/desktop/src/features/reminders/ui/RemindersPanel.tsx
+++ b/desktop/src/features/reminders/ui/RemindersPanel.tsx
@@ -1,4 +1,4 @@
-import { Bell, Check, Clock, X } from "lucide-react";
+import { ArrowLeft, Bell, Check, Clock, ExternalLink, X } from "lucide-react";
 import * as React from "react";
 import { toast } from "sonner";
 
@@ -22,6 +22,9 @@ import type { Reminder } from "@/features/reminders/lib/reminderTypes";
 import { SnoozeMenu } from "@/features/reminders/ui/SnoozeMenu";
 import { resolveChannelDisplayLabel } from "@/features/sidebar/lib/channelLabels";
 import { useIdentityQuery } from "@/shared/api/hooks";
+import type { Channel } from "@/shared/api/types";
+import { TopChromeInsetHeader } from "@/shared/layout/TopChromeInsetHeader";
+import { cn } from "@/shared/lib/cn";
 import { normalizePubkey } from "@/shared/lib/pubkey";
 import { Button } from "@/shared/ui/button";
 import { UserAvatar } from "@/shared/ui/UserAvatar";
@@ -29,12 +32,56 @@ import { UserAvatar } from "@/shared/ui/UserAvatar";
 const UNKNOWN_CHANNEL_LABEL = "Unknown channel";
 
 /** Author identity + source channel resolved for a reminder's target. */
-type ReminderSource = {
+export type ReminderSource = {
   authorLabel: string;
   avatarUrl: string | null;
+  channel: Channel | null;
   channelLabel: string;
 };
 
+export function useReminderSources(reminders: readonly Reminder[]) {
+  const identityQuery = useIdentityQuery();
+  const currentPubkey = identityQuery.data?.pubkey;
+  const channelsQuery = useChannelsQuery();
+  const channels = channelsQuery.data;
+  const authorPubkeys = React.useMemo(
+    () =>
+      reminders
+        .map((reminder) => reminder.content.target?.authorPubkey)
+        .filter((authorPubkey): authorPubkey is string => !!authorPubkey),
+    [reminders],
+  );
+  const usersBatchQuery = useUsersBatchQuery(authorPubkeys);
+  const profiles: UserProfileLookup | undefined =
+    usersBatchQuery.data?.profiles;
+
+  return React.useMemo(() => {
+    const channelsById = new Map(
+      (channels ?? []).map((channel) => [channel.id, channel]),
+    );
+    const map = new Map<string, ReminderSource>();
+    for (const reminder of reminders) {
+      const target = reminder.content.target;
+      if (!hasNavigableTarget(target)) continue;
+      const channel = channelsById.get(target.channelId);
+      map.set(reminder.id, {
+        authorLabel: resolveUserLabel({
+          currentPubkey,
+          profiles,
+          pubkey: target.authorPubkey,
+        }),
+        avatarUrl:
+          profiles?.[normalizePubkey(target.authorPubkey)]?.avatarUrl ?? null,
+        channel: channel ?? null,
+        channelLabel: channel
+          ? resolveChannelDisplayLabel(channel, currentPubkey, profiles)
+          : UNKNOWN_CHANNEL_LABEL,
+      });
+    }
+    return map;
+  }, [channels, currentPubkey, profiles, reminders]);
+}
+
 function formatRelativeTime(timestamp: number): string {
   const now = Math.floor(Date.now() / 1_000);
   const diff = timestamp - now;
@@ -53,16 +100,29 @@ function formatRelativeTime(timestamp: number): string {
   return `in ${Math.floor(diff / 86400)}d`;
 }
 
+function formatReminderSourceLocation(source: ReminderSource): string {
+  if (!source.channel) return source.channelLabel;
+  return source.channel.channelType === "dm"
+    ? `DM with ${source.channelLabel}`
+    : `#${source.channelLabel}`;
+}
+
 function ReminderRow({
+  isSelected = false,
+  presentation = "card",
   reminder,
   pubkey,
   source,
   onNavigate,
+  onSelect,
 }: {
+  isSelected?: boolean;
+  presentation?: "inbox-list" | "card";
   reminder: Reminder;
   pubkey: string;
   source: ReminderSource | null;
   onNavigate: (reminder: Reminder) => void;
+  onSelect?: (reminder: Reminder) => void;
 }) {
   const { complete, snooze, cancel } = useReminderMutations(pubkey);
   const isDone = reminder.content.status === "done";
@@ -97,13 +157,31 @@ function ReminderRow({
     !isDone && reminder.notBefore
       ? reminder.notBefore <= Math.floor(Date.now() / 1_000)
       : false;
+  const isInboxList = presentation === "inbox-list";
 
   return (
-    <div className="flex items-start gap-3 rounded-md border p-3">
+    <div
+      className={cn(
+        "flex items-start gap-3 transition-colors",
+        isInboxList
+          ? "border-b border-border/45 px-4 py-4 hover:bg-muted/40 focus-within:bg-muted/40"
+          : "rounded-md border p-3",
+        isInboxList && isSelected && "bg-muted/40",
+      )}
+      data-testid={`home-reminder-item-${reminder.id}`}
+    >
+      {isInboxList ? (
+        <span className="flex h-9 w-9 shrink-0 items-center justify-center rounded-full bg-muted text-muted-foreground">
+          <Bell className="h-4 w-4" />
+        </span>
+      ) : null}
       <button
         className="flex min-w-0 flex-1 flex-col items-start gap-1 text-left enabled:hover:opacity-80 disabled:cursor-default"
-        disabled={!isNavigable}
-        onClick={isNavigable ? () => onNavigate(reminder) : undefined}
+        disabled={!isInboxList && !isNavigable}
+        onClick={() => {
+          if (isInboxList) onSelect?.(reminder);
+          else if (isNavigable) onNavigate(reminder);
+        }}
         type="button"
       >
         {source ? (
@@ -118,7 +196,9 @@ function ReminderRow({
               {source.authorLabel}
             </span>
             <span className="shrink-0">in</span>
-            <span className="truncate">{source.channelLabel}</span>
+            <span className="truncate">
+              {formatReminderSourceLocation(source)}
+            </span>
           </div>
         ) : null}
         <p className="max-w-full truncate text-sm font-medium">
@@ -140,7 +220,7 @@ function ReminderRow({
           </p>
         ) : null}
       </button>
-      {isDone ? null : (
+      {isDone || isInboxList ? null : (
         <div className="flex shrink-0 items-center gap-1">
           <Button
             className="h-7 w-7 p-0"
@@ -178,59 +258,20 @@ function ReminderRow({
 export function RemindersPanel({
   pubkey,
   includeDone = false,
+  onSelectReminder,
+  presentation = "card",
+  selectedReminderId,
 }: {
   pubkey: string;
   includeDone?: boolean;
+  onSelectReminder?: (reminderId: string) => void;
+  presentation?: "inbox-list" | "card";
+  selectedReminderId?: string | null;
 }) {
   const remindersQuery = useRemindersQuery(pubkey);
   const reminders = remindersQuery.data;
   const { goChannel } = useAppNavigation();
-  const identityQuery = useIdentityQuery();
-  const currentPubkey = identityQuery.data?.pubkey;
-  const channelsQuery = useChannelsQuery();
-  const channels = channelsQuery.data;
-
-  const authorPubkeys = React.useMemo(
-    () =>
-      (reminders ?? [])
-        .map((reminder) => reminder.content.target?.authorPubkey)
-        .filter((authorPubkey): authorPubkey is string => !!authorPubkey),
-    [reminders],
-  );
-  const usersBatchQuery = useUsersBatchQuery(authorPubkeys);
-  const profiles: UserProfileLookup | undefined =
-    usersBatchQuery.data?.profiles;
-
-  // Look up each reminder's author + source channel from the live profile and
-  // channel queries. Channels/profiles can be missing — reminders outlive the
-  // context they were set in (left/archived channel, hidden DM) — so fall back
-  // to a resolved-or-truncated author label and a neutral channel label.
-  const sources = React.useMemo(() => {
-    const channelsById = new Map(
-      (channels ?? []).map((channel) => [channel.id, channel]),
-    );
-    const map = new Map<string, ReminderSource>();
-    for (const reminder of reminders ?? []) {
-      const target = reminder.content.target;
-      if (!hasNavigableTarget(target)) {
-        continue;
-      }
-      const channel = channelsById.get(target.channelId);
-      map.set(reminder.id, {
-        authorLabel: resolveUserLabel({
-          currentPubkey,
-          profiles,
-          pubkey: target.authorPubkey,
-        }),
-        avatarUrl:
-          profiles?.[normalizePubkey(target.authorPubkey)]?.avatarUrl ?? null,
-        channelLabel: channel
-          ? resolveChannelDisplayLabel(channel, currentPubkey, profiles)
-          : UNKNOWN_CHANNEL_LABEL,
-      });
-    }
-    return map;
-  }, [reminders, channels, profiles, currentPubkey]);
+  const sources = useReminderSources(reminders ?? []);
 
   const handleNavigate = React.useCallback(
     async (reminder: Reminder) => {
@@ -252,6 +293,10 @@ export function RemindersPanel({
     () => groupReminders(reminders ?? [], includeDone),
     [reminders, includeDone],
   );
+  const inboxReminders = React.useMemo(
+    () => groups.flatMap((group) => group.reminders),
+    [groups],
+  );
 
   if (remindersQuery.isLoading) {
     return (
@@ -273,6 +318,25 @@ export function RemindersPanel({
     );
   }
 
+  if (presentation === "inbox-list") {
+    return (
+      <div className="min-h-0 flex-1 overflow-y-auto">
+        {inboxReminders.map((reminder) => (
+          <ReminderRow
+            isSelected={reminder.id === selectedReminderId}
+            key={reminder.id}
+            onNavigate={handleNavigate}
+            onSelect={(selected) => onSelectReminder?.(selected.id)}
+            presentation="inbox-list"
+            pubkey={pubkey}
+            reminder={reminder}
+            source={sources.get(reminder.id) ?? null}
+          />
+        ))}
+      </div>
+    );
+  }
+
   return (
     <div className="flex-1 space-y-4 overflow-y-auto p-4">
       {groups.map((group) => (
@@ -294,3 +358,178 @@ export function RemindersPanel({
     </div>
   );
 }
+
+export function ReminderDetailPane({
+  onBack,
+  pubkey,
+  reminder,
+}: {
+  onBack?: () => void;
+  pubkey: string;
+  reminder: Reminder | null;
+}) {
+  const { goChannel } = useAppNavigation();
+  const reminderList = React.useMemo(
+    () => (reminder ? [reminder] : []),
+    [reminder],
+  );
+  const sources = useReminderSources(reminderList);
+  const { complete, snooze, cancel } = useReminderMutations(pubkey);
+
+  if (!reminder) {
+    return (
+      <section className="flex min-h-0 min-w-0 flex-col bg-background">
+        <TopChromeInsetHeader flush>
+          <div className="flex min-h-9 items-center px-4 py-2">
+            <span className="text-sm font-semibold">Reminder</span>
+          </div>
+        </TopChromeInsetHeader>
+        <div className="flex flex-1 items-center justify-center p-8 text-sm text-muted-foreground">
+          Select a reminder
+        </div>
+      </section>
+    );
+  }
+
+  const source = sources.get(reminder.id) ?? null;
+  const isDone = reminder.content.status === "done";
+  const isActing = complete.isPending || snooze.isPending || cancel.isPending;
+  const isNavigable = hasNavigableTarget(reminder.content.target);
+  const preview =
+    reminder.content.target?.preview || reminder.content.note || "Reminder";
+
+  const handleNavigate = async () => {
+    const destination = await resolveReminderDestination(
+      reminder.content.target,
+    );
+    if (!destination) return;
+    void goChannel(destination.channelId, {
+      messageId: destination.messageId,
+      threadRootId: destination.threadRootId,
+    });
+  };
+
+  return (
+    <section
+      className="flex min-h-0 min-w-0 flex-col bg-background"
+      data-testid="home-reminder-detail"
+    >
+      <TopChromeInsetHeader flush>
+        <div className="flex min-h-9 items-center gap-2 px-4 py-2">
+          {onBack ? (
+            <Button
+              aria-label="Back to reminders"
+              className="h-8 w-8 p-0"
+              onClick={onBack}
+              size="icon"
+              type="button"
+              variant="ghost"
+            >
+              <ArrowLeft className="h-4 w-4" />
+            </Button>
+          ) : null}
+          <span className="text-sm font-semibold">Reminder</span>
+        </div>
+      </TopChromeInsetHeader>
+
+      <div className="min-h-0 flex-1 overflow-y-auto px-6 py-8">
+        <div className="mx-auto max-w-2xl">
+          {source ? (
+            <div className="flex items-center gap-2 text-sm text-muted-foreground">
+              <UserAvatar
+                avatarUrl={source.avatarUrl}
+                className="h-6 w-6"
+                displayName={source.authorLabel}
+                size="sm"
+              />
+              <span className="font-medium text-foreground">
+                {source.authorLabel}
+              </span>
+              <span>in</span>
+              <span>{formatReminderSourceLocation(source)}</span>
+            </div>
+          ) : null}
+
+          <p className="mt-5 whitespace-pre-wrap text-base leading-6 text-foreground">
+            {preview}
+          </p>
+          {reminder.content.target && reminder.content.note ? (
+            <div className="mt-5 border-l-2 border-border pl-4">
+              <p className="text-xs font-medium uppercase text-muted-foreground">
+                Note
+              </p>
+              <p className="mt-1 whitespace-pre-wrap text-sm text-foreground">
+                {reminder.content.note}
+              </p>
+            </div>
+          ) : null}
+
+          {reminder.notBefore ? (
+            <div className="mt-6 flex items-center gap-2 text-sm text-muted-foreground">
+              <Clock className="h-4 w-4" />
+              <span>{formatRelativeTime(reminder.notBefore)}</span>
+            </div>
+          ) : null}
+
+          <div className="mt-8 flex flex-wrap items-center gap-2">
+            <Button
+              disabled={!isNavigable}
+              onClick={() => void handleNavigate()}
+              size="sm"
+              type="button"
+              variant="outline"
+            >
+              <ExternalLink className="h-4 w-4" />
+              Open message
+            </Button>
+            {isDone ? null : (
+              <>
+                <Button
+                  disabled={isActing}
+                  onClick={() =>
+                    complete.mutate(reminder, {
+                      onSuccess: () => toast.success("Reminder completed"),
+                      onError: () => toast.error("Failed to complete reminder"),
+                    })
+                  }
+                  size="sm"
+                  type="button"
+                >
+                  <Check className="h-4 w-4" />
+                  Complete
+                </Button>
+                <SnoozeMenu
+                  disabled={isActing}
+                  onSnooze={(notBefore) =>
+                    snooze.mutate(
+                      { reminder, notBefore },
+                      {
+                        onSuccess: () => toast.success("Reminder snoozed"),
+                        onError: () => toast.error("Failed to snooze reminder"),
+                      },
+                    )
+                  }
+                />
+                <Button
+                  disabled={isActing}
+                  onClick={() =>
+                    cancel.mutate(reminder, {
+                      onSuccess: () => toast.success("Reminder cancelled"),
+                      onError: () => toast.error("Failed to cancel reminder"),
+                    })
+                  }
+                  size="sm"
+                  type="button"
+                  variant="ghost"
+                >
+                  <X className="h-4 w-4" />
+                  Cancel
+                </Button>
+              </>
+            )}
+          </div>
+        </div>
+      </div>
+    </section>
+  );
+}
diff --git a/desktop/src/features/search/hooks.ts b/desktop/src/features/search/hooks.ts
index 038c6511f6a..a2db8deeb94 100644
--- a/desktop/src/features/search/hooks.ts
+++ b/desktop/src/features/search/hooks.ts
@@ -6,23 +6,45 @@ export function useSearchMessagesQuery(
   query: string,
   options?: {
     channelId?: string;
+    authors?: string[];
+    since?: number | null;
+    until?: number | null;
     enabled?: boolean;
     limit?: number;
+    unresolvedOperator?: boolean;
   },
 ) {
   const trimmedQuery = query.trim();
   const enabled = options?.enabled ?? true;
   const limit = options?.limit ?? 12;
   const channelId = options?.channelId;
+  const authors = options?.authors;
+  const since = options?.since ?? null;
+  const until = options?.until ?? null;
+  const unresolvedOperator = options?.unresolvedOperator ?? false;
 
   return useQuery({
-    queryKey: ["search-messages", trimmedQuery, limit, channelId ?? null],
+    queryKey: [
+      "search-messages",
+      trimmedQuery,
+      limit,
+      channelId ?? null,
+      authors ?? null,
+      since,
+      until,
+      unresolvedOperator,
+    ],
     queryFn: () =>
       searchMessages({
         q: trimmedQuery,
         limit,
         channelId,
+        authors,
+        since: since ?? undefined,
+        until: until ?? undefined,
       }),
+    // Call sites own the "when to search" floor (FTS length / unresolved
+    // operators). Keep a single threshold here so it cannot drift.
     enabled: enabled && trimmedQuery.length >= 2,
     staleTime: 30_000,
     gcTime: 5 * 60 * 1_000,
diff --git a/desktop/src/features/search/lib/parseSearchOperators.test.mjs b/desktop/src/features/search/lib/parseSearchOperators.test.mjs
new file mode 100644
index 00000000000..a528073edc2
--- /dev/null
+++ b/desktop/src/features/search/lib/parseSearchOperators.test.mjs
@@ -0,0 +1,118 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+
+import {
+  isChannelUuid,
+  isHexPubkey,
+  normalizeFromHandle,
+  normalizeInChannel,
+  parseSearchOperators,
+} from "./parseSearchOperators.ts";
+
+test("leaves plain text unchanged", () => {
+  assert.deepEqual(parseSearchOperators("  deploy  "), {
+    text: "deploy",
+    from: null,
+    in: null,
+    since: null,
+    until: null,
+  });
+});
+
+test("extracts from / in / after / before and keeps remaining FTS text", () => {
+  const parsed = parseSearchOperators(
+    "deploy from:deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef in:#general after:2024-01-15 before:2024-02-01 status",
+  );
+  assert.equal(parsed.text, "deploy status");
+  assert.equal(
+    parsed.from,
+    "deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef",
+  );
+  assert.equal(parsed.in, "#general");
+  assert.equal(
+    parsed.since,
+    Math.floor(new Date(2024, 0, 15).getTime() / 1000),
+  );
+  assert.equal(
+    parsed.until,
+    Math.floor(new Date(2024, 1, 1).getTime() / 1000) - 1,
+  );
+});
+
+test("before: excludes the named day's exact local midnight", () => {
+  const localMidnight = Math.floor(new Date(2024, 1, 1).getTime() / 1000);
+  const parsed = parseSearchOperators("deploy before:2024-02-01");
+
+  assert.equal(parsed.until, localMidnight - 1);
+  // The relay keeps events where `created_at <= until`, so a message stamped
+  // exactly at midnight must fail that predicate.
+  assert.equal(localMidnight <= parsed.until, false);
+});
+
+test("keeps invalid date operators in the FTS text", () => {
+  const parsed = parseSearchOperators("notes after:yesterday before:soon");
+  assert.equal(parsed.text, "notes after:yesterday before:soon");
+  assert.equal(parsed.since, null);
+  assert.equal(parsed.until, null);
+});
+
+test("later operators of the same kind win", () => {
+  const parsed = parseSearchOperators(
+    "from:@alice from:@bob in:one in:two after:2024-01-01 after:2024-03-01",
+  );
+  assert.equal(parsed.from, "@bob");
+  assert.equal(parsed.in, "two");
+  assert.equal(parsed.since, Math.floor(new Date(2024, 2, 1).getTime() / 1000));
+  assert.equal(parsed.text, "");
+});
+
+test("rejects impossible calendar dates", () => {
+  const parsed = parseSearchOperators("x after:2024-02-30");
+  assert.equal(parsed.since, null);
+  assert.equal(parsed.text, "x after:2024-02-30");
+});
+
+test("does not treat hyphen or slash adjacent tokens as operators", () => {
+  assert.deepEqual(parseSearchOperators("built-in:react hooks"), {
+    text: "built-in:react hooks",
+    from: null,
+    in: null,
+    since: null,
+    until: null,
+  });
+  assert.deepEqual(parseSearchOperators("sign-in:flow broken"), {
+    text: "sign-in:flow broken",
+    from: null,
+    in: null,
+    since: null,
+    until: null,
+  });
+  assert.deepEqual(parseSearchOperators("https://x.com/in:foo"), {
+    text: "https://x.com/in:foo",
+    from: null,
+    in: null,
+    since: null,
+    until: null,
+  });
+});
+
+test("strips trailing punctuation from operator values", () => {
+  const parsed = parseSearchOperators("deploy in:general, from:@alice.");
+  assert.equal(parsed.in, "#general".replace("#", "") || "general");
+  assert.equal(parsed.in, "general");
+  assert.equal(parsed.from, "@alice");
+  assert.equal(parsed.text, "deploy");
+});
+
+test("helpers recognize hex pubkeys and channel uuids", () => {
+  assert.equal(
+    isHexPubkey(
+      "deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef",
+    ),
+    true,
+  );
+  assert.equal(isHexPubkey("npub1abc"), false);
+  assert.equal(isChannelUuid("11111111-1111-1111-1111-111111111111"), true);
+  assert.equal(normalizeFromHandle("@alice"), "alice");
+  assert.equal(normalizeInChannel("#general"), "general");
+});
diff --git a/desktop/src/features/search/lib/parseSearchOperators.ts b/desktop/src/features/search/lib/parseSearchOperators.ts
new file mode 100644
index 00000000000..ffa56b28f69
--- /dev/null
+++ b/desktop/src/features/search/lib/parseSearchOperators.ts
@@ -0,0 +1,168 @@
+/**
+ * Parse Slack-style search operators out of a free-text query.
+ *
+ * Remaining text is the FTS / prefix query. Invalid operator tokens (for example
+ * `after:yesterday`) are left in the text so they still participate in FTS.
+ *
+ * Name resolution for `from:` / `in:` happens at the call site (autocomplete or
+ * local channel/user lists). This module only splits syntax.
+ *
+ * Operators must start at a token boundary (start of string or whitespace). A
+ * word-boundary `\b` is intentionally avoided: it also matches after `-` / `/`,
+ * which would turn `built-in:react` or `https://x.com/in:foo` into operators.
+ */
+
+export type ParsedSearchOperators = {
+  /** FTS / prefix query with operators removed. */
+  text: string;
+  /** Raw `from:` value (pubkey hex, npub, @name, …), if present. */
+  from: string | null;
+  /** Raw `in:` value (channel uuid, #name, …), if present. */
+  in: string | null;
+  /**
+   * `after:YYYY-MM-DD` → unix seconds at local start of that day (inclusive).
+   * Messages at or after this timestamp match.
+   */
+  since: number | null;
+  /**
+   * `before:YYYY-MM-DD` → one second before local start of that day, because
+   * NIP-01 `until` is an *inclusive* upper bound. Messages strictly before
+   * local midnight match, so the named calendar day itself is not included
+   * (Slack-compatible).
+   */
+  until: number | null;
+};
+
+/** Token-start only — not `\b`, which fires after hyphens and slashes. */
+const OPERATOR_RE = /(?:^|\s)(from|in|after|before):(\S+)/gi;
+
+function parseLocalDayStart(value: string): number | null {
+  const match = /^(\d{4})-(\d{2})-(\d{2})$/.exec(value);
+  if (!match) {
+    return null;
+  }
+
+  const year = Number(match[1]);
+  const month = Number(match[2]);
+  const day = Number(match[3]);
+  if (month < 1 || month > 12 || day < 1 || day > 31) {
+    return null;
+  }
+
+  const date = new Date(year, month - 1, day);
+  if (
+    date.getFullYear() !== year ||
+    date.getMonth() !== month - 1 ||
+    date.getDate() !== day
+  ) {
+    return null;
+  }
+
+  return Math.floor(date.getTime() / 1000);
+}
+
+/** Drop trailing punctuation so `in:general,` still resolves to `general`. */
+function cleanOperatorValue(value: string): string {
+  return value.replace(/[.,;:!?]+$/g, "");
+}
+
+/**
+ * Extract `from:` / `in:` / `after:` / `before:` operators from `raw`.
+ *
+ * Later occurrences of the same operator win. Date operators that are not
+ * `YYYY-MM-DD` stay in the returned `text`.
+ *
+ * Multi-word handles (`from:@Will Pfleger`) are a known limitation of part 1:
+ * only the first whitespace-delimited token is captured.
+ */
+export function parseSearchOperators(raw: string): ParsedSearchOperators {
+  let from: string | null = null;
+  let inValue: string | null = null;
+  let since: number | null = null;
+  let until: number | null = null;
+
+  const kept: string[] = [];
+  let lastIndex = 0;
+
+  for (const match of raw.matchAll(OPERATOR_RE)) {
+    const index = match.index ?? 0;
+    kept.push(raw.slice(lastIndex, index));
+    lastIndex = index + match[0].length;
+
+    const kind = match[1].toLowerCase();
+    const value = cleanOperatorValue(match[2]);
+
+    if (kind === "from") {
+      from = value;
+      continue;
+    }
+    if (kind === "in") {
+      inValue = value;
+      continue;
+    }
+    if (kind === "after") {
+      const parsed = parseLocalDayStart(value);
+      if (parsed === null) {
+        kept.push(match[0]);
+      } else {
+        since = parsed;
+      }
+      continue;
+    }
+    if (kind === "before") {
+      const parsed = parseLocalDayStart(value);
+      if (parsed === null) {
+        kept.push(match[0]);
+      } else {
+        // NIP-01 `until` is inclusive, so step back one second to keep
+        // `before:` exclusive of the named day's midnight.
+        until = parsed - 1;
+      }
+    }
+  }
+
+  kept.push(raw.slice(lastIndex));
+
+  return {
+    text: kept.join("").replace(/\s+/g, " ").trim(),
+    from,
+    in: inValue,
+    since,
+    until,
+  };
+}
+
+const HEX_PUBKEY_RE = /^[0-9a-f]{64}$/i;
+const UUID_RE =
+  /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+
+/** True when `value` is a 64-char hex pubkey (optional `0x` rejected). */
+export function isHexPubkey(value: string): boolean {
+  return HEX_PUBKEY_RE.test(value);
+}
+
+/** Strip a leading `@` from a `from:` value. */
+export function normalizeFromHandle(value: string): string {
+  return value.startsWith("@") ? value.slice(1) : value;
+}
+
+/** Strip a leading `#` from an `in:` value. */
+export function normalizeInChannel(value: string): string {
+  return value.startsWith("#") ? value.slice(1) : value;
+}
+
+/** True when `value` is a channel UUID. */
+export function isChannelUuid(value: string): boolean {
+  return UUID_RE.test(value);
+}
+
+/**
+ * Result of resolving a `from:` / `in:` operator against local candidates.
+ *
+ * Distinguishes "no operator" from "operator present but unmatched" so callers
+ * never silently widen the search when resolution fails.
+ */
+export type OperatorResolveResult<T> =
+  | { status: "none" }
+  | { status: "resolved"; value: T }
+  | { status: "unresolved" };
diff --git a/desktop/src/features/search/ui/TopbarSearch.tsx b/desktop/src/features/search/ui/TopbarSearch.tsx
index aae242fb53c..67c4abb6e9c 100644
--- a/desktop/src/features/search/ui/TopbarSearch.tsx
+++ b/desktop/src/features/search/ui/TopbarSearch.tsx
@@ -409,6 +409,7 @@ export function TopbarSearch({
   const {
     channelLookup,
     debouncedQuery,
+    isWaitingOnFromResolution,
     query,
     resultProfiles,
     results,
@@ -487,7 +488,10 @@ export function TopbarSearch({
   const activeResults = isShowingSuggestions
     ? suggestionResults
     : groupedSearchResults;
-  const isSearchLoading = searchQuery.isLoading || userSearchQuery.isLoading;
+  const isSearchLoading =
+    isWaitingOnFromResolution ||
+    searchQuery.isLoading ||
+    userSearchQuery.isLoading;
 
   const openSearchDialog = React.useCallback(() => {
     setSelectedMenuIndex(0);
diff --git a/desktop/src/features/search/useSearchResults.ts b/desktop/src/features/search/useSearchResults.ts
index e90c5c5f8f7..b31d69a954d 100644
--- a/desktop/src/features/search/useSearchResults.ts
+++ b/desktop/src/features/search/useSearchResults.ts
@@ -11,6 +11,14 @@ import {
 } from "@/features/profile/hooks";
 import { rankUserCandidatesBySearch } from "@/features/profile/lib/userCandidateSearch";
 import { useSearchMessagesQuery } from "@/features/search/hooks";
+import {
+  isChannelUuid,
+  isHexPubkey,
+  normalizeFromHandle,
+  normalizeInChannel,
+  parseSearchOperators,
+  type OperatorResolveResult,
+} from "@/features/search/lib/parseSearchOperators";
 import type { SearchResult } from "@/features/search/ui/SearchResultItem";
 import type { Channel, SearchHit, UserSearchResult } from "@/shared/api/types";
 import { normalizePubkey } from "@/shared/lib/pubkey";
@@ -34,6 +42,56 @@ function dedupeSearchHits(hits: SearchHit[]) {
   });
 }
 
+function resolveChannelIdFromOperator(
+  raw: string | null,
+  channels: Channel[],
+  channelLabels?: Record<string, string>,
+): OperatorResolveResult<string> {
+  if (!raw) {
+    return { status: "none" };
+  }
+  const value = normalizeInChannel(raw);
+  if (!value) {
+    return { status: "none" };
+  }
+  if (isChannelUuid(value)) {
+    return { status: "resolved", value };
+  }
+  const needle = value.toLowerCase();
+  const match = channels.find((channel) => {
+    const label = channelLabels?.[channel.id]?.trim() || channel.name;
+    return (
+      channel.name.toLowerCase() === needle || label.toLowerCase() === needle
+    );
+  });
+  return match
+    ? { status: "resolved", value: match.id }
+    : { status: "unresolved" };
+}
+
+function resolveAuthorFromOperator(
+  raw: string | null,
+  candidates: Array<{ pubkey: string; displayName?: string | null }>,
+): OperatorResolveResult<string> {
+  if (!raw) {
+    return { status: "none" };
+  }
+  if (isHexPubkey(raw)) {
+    return { status: "resolved", value: normalizePubkey(raw) };
+  }
+  const handle = normalizeFromHandle(raw).toLowerCase();
+  if (!handle) {
+    return { status: "unresolved" };
+  }
+  const match = candidates.find((candidate) => {
+    const name = candidate.displayName?.trim().toLowerCase();
+    return name === handle || normalizePubkey(candidate.pubkey) === handle;
+  });
+  return match
+    ? { status: "resolved", value: normalizePubkey(match.pubkey) }
+    : { status: "unresolved" };
+}
+
 export function useSearchResults({
   channelLabels,
   channels,
@@ -55,21 +113,128 @@ export function useSearchResults({
     [channels],
   );
 
-  const searchQuery = useSearchMessagesQuery(debouncedQuery, {
-    enabled,
+  const parsedQuery = React.useMemo(
+    () => parseSearchOperators(debouncedQuery),
+    [debouncedQuery],
+  );
+
+  const channelResolution = React.useMemo(
+    () => resolveChannelIdFromOperator(parsedQuery.in, channels, channelLabels),
+    [parsedQuery.in, channels, channelLabels],
+  );
+
+  const ftsQuery = parsedQuery.text;
+
+  const hasSearchQuery =
+    debouncedQuery.trim().length >= MIN_SEARCH_QUERY_LENGTH ||
+    parsedQuery.since !== null ||
+    parsedQuery.until !== null ||
+    parsedQuery.from !== null ||
+    parsedQuery.in !== null;
+
+  const searchBackedQueriesEnabled = enabled && hasSearchQuery;
+
+  const fromHandleForLookup =
+    parsedQuery.from && !isHexPubkey(parsedQuery.from)
+      ? normalizeFromHandle(parsedQuery.from)
+      : "";
+
+  const managedAgentsQuery = useManagedAgentsQuery({
+    enabled: searchBackedQueriesEnabled,
+  });
+  const relayAgentsQuery = useRelayAgentsQuery({
+    enabled: searchBackedQueriesEnabled,
+  });
+  // Resolve `from:@name` against people, not only agents.
+  const fromUserSearchQuery = useUserSearchQuery(fromHandleForLookup, {
+    enabled: searchBackedQueriesEnabled && fromHandleForLookup.length >= 1,
     limit,
   });
+  const userSearchQuery = useUserSearchQuery(ftsQuery, {
+    enabled: searchBackedQueriesEnabled,
+    limit,
+  });
+
+  const authorCandidateSeed = React.useMemo(() => {
+    const candidates: Array<{ pubkey: string; displayName?: string | null }> =
+      [];
+    const seen = new Set<string>();
+    const push = (pubkey: string, displayName?: string | null) => {
+      const key = normalizePubkey(pubkey);
+      if (seen.has(key)) {
+        return;
+      }
+      seen.add(key);
+      candidates.push({ pubkey: key, displayName });
+    };
+    for (const agent of managedAgentsQuery.data ?? []) {
+      push(agent.pubkey, agent.name);
+    }
+    for (const agent of relayAgentsQuery.data ?? []) {
+      push(agent.pubkey, agent.name);
+    }
+    for (const user of fromUserSearchQuery.data ?? []) {
+      push(user.pubkey, user.displayName);
+    }
+    for (const user of userSearchQuery.data ?? []) {
+      push(user.pubkey, user.displayName);
+    }
+    return candidates;
+  }, [
+    managedAgentsQuery.data,
+    relayAgentsQuery.data,
+    fromUserSearchQuery.data,
+    userSearchQuery.data,
+  ]);
 
-  const messageResults = React.useMemo(
-    () => dedupeSearchHits(searchQuery.data?.hits ?? []),
-    [searchQuery.data?.hits],
+  const authorResolution = React.useMemo(
+    () => resolveAuthorFromOperator(parsedQuery.from, authorCandidateSeed),
+    [parsedQuery.from, authorCandidateSeed],
   );
+
+  const hasUnresolvedOperator =
+    authorResolution.status === "unresolved" ||
+    channelResolution.status === "unresolved";
+
+  // While `from:@name` user search is still loading, hold off so we do not
+  // flash an unresolved empty state before candidates arrive.
+  const waitingOnFromResolution =
+    Boolean(fromHandleForLookup) &&
+    fromUserSearchQuery.isLoading &&
+    authorResolution.status === "unresolved";
+
+  const searchQuery = useSearchMessagesQuery(ftsQuery, {
+    enabled:
+      enabled &&
+      !hasUnresolvedOperator &&
+      !waitingOnFromResolution &&
+      ftsQuery.length >= MIN_SEARCH_QUERY_LENGTH,
+    limit,
+    channelId:
+      channelResolution.status === "resolved"
+        ? channelResolution.value
+        : undefined,
+    authors:
+      authorResolution.status === "resolved"
+        ? [authorResolution.value]
+        : undefined,
+    since: parsedQuery.since,
+    until: parsedQuery.until,
+    unresolvedOperator: hasUnresolvedOperator,
+  });
+
+  const messageResults = React.useMemo(() => {
+    if (hasUnresolvedOperator) {
+      return [];
+    }
+    return dedupeSearchHits(searchQuery.data?.hits ?? []);
+  }, [hasUnresolvedOperator, searchQuery.data?.hits]);
   const channelResults = React.useMemo(() => {
-    if (debouncedQuery.length < MIN_SEARCH_QUERY_LENGTH) {
+    if (ftsQuery.length < MIN_SEARCH_QUERY_LENGTH) {
       return [];
     }
 
-    const normalizedQuery = debouncedQuery.toLowerCase();
+    const normalizedQuery = ftsQuery.toLowerCase();
 
     return channels
       .filter(
@@ -100,21 +265,7 @@ export function useSearchResults({
         return aDisplayName.localeCompare(bDisplayName);
       })
       .slice(0, 5);
-  }, [channelLabels, channels, debouncedQuery]);
-
-  const hasSearchQuery = debouncedQuery.length >= MIN_SEARCH_QUERY_LENGTH;
-  const searchBackedQueriesEnabled = enabled && hasSearchQuery;
-
-  const userSearchQuery = useUserSearchQuery(debouncedQuery, {
-    enabled: searchBackedQueriesEnabled,
-    limit,
-  });
-  const managedAgentsQuery = useManagedAgentsQuery({
-    enabled: searchBackedQueriesEnabled,
-  });
-  const relayAgentsQuery = useRelayAgentsQuery({
-    enabled: searchBackedQueriesEnabled,
-  });
+  }, [channelLabels, channels, ftsQuery]);
   const managedAgentPubkeys = React.useMemo(
     () =>
       new Set(
@@ -145,11 +296,11 @@ export function useSearchResults({
     return pubkeys;
   }, [managedAgentPubkeys, relayAgentsQuery.data]);
   const userResults = React.useMemo<UserSearchResult[]>(() => {
-    if (debouncedQuery.length < MIN_SEARCH_QUERY_LENGTH) {
+    if (ftsQuery.length < MIN_SEARCH_QUERY_LENGTH) {
       return [];
     }
 
-    const normalizedQuery = debouncedQuery.toLowerCase();
+    const normalizedQuery = ftsQuery.toLowerCase();
     const candidatesByPubkey = new Map<string, UserSearchResult>();
 
     const matchesQuery = (candidate: UserSearchResult) =>
@@ -241,11 +392,11 @@ export function useSearchResults({
       candidates: [...candidatesByPubkey.values()],
       getLabel: formatUserResultName,
       limit,
-      query: debouncedQuery,
+      query: ftsQuery,
     });
   }, [
-    debouncedQuery,
     eligibleAgentPubkeys,
+    ftsQuery,
     isArchivedDiscovery,
     limit,
     managedAgentPubkeys,
@@ -318,6 +469,7 @@ export function useSearchResults({
     channelLookup,
     channelResults,
     debouncedQuery,
+    isWaitingOnFromResolution: waitingOnFromResolution,
     messageResults,
     query,
     resultProfiles: resultProfilesQuery.data?.profiles,
diff --git a/desktop/src/features/settings/ui/ActiveAgentCommunitiesSettingsCard.tsx b/desktop/src/features/settings/ui/ActiveAgentCommunitiesSettingsCard.tsx
deleted file mode 100644
index 268bd863f28..00000000000
--- a/desktop/src/features/settings/ui/ActiveAgentCommunitiesSettingsCard.tsx
+++ /dev/null
@@ -1,133 +0,0 @@
-import * as React from "react";
-
-import { useManagedAgentsQuery } from "@/features/agents/hooks";
-import {
-  useManagedAgentRuntimeAction,
-  useManagedAgentRuntimesQuery,
-} from "@/features/agents/managedAgentRuntimeHooks";
-import {
-  agentCommunityAvailability,
-  agentCommunityStatusDetail,
-  managedAgentRuntimeKey,
-} from "@/features/agents/managedAgentRuntimeStatus";
-import type { ManagedAgentRuntimeStatus } from "@/shared/api/types";
-import { Button } from "@/shared/ui/button";
-import { Badge } from "@/shared/ui/badge";
-import { truncatePubkey } from "@/shared/lib/pubkey";
-import { SettingsSectionHeader } from "./SettingsSectionHeader";
-
-export function ActiveAgentCommunitiesSettingsCard() {
-  const agentsQuery = useManagedAgentsQuery();
-  const runtimesQuery = useManagedAgentRuntimesQuery();
-  const action = useManagedAgentRuntimeAction();
-  const [pendingRuntimeKey, setPendingRuntimeKey] = React.useState<
-    string | null
-  >(null);
-
-  const agentNames = React.useMemo(
-    () =>
-      new Map(
-        (agentsQuery.data ?? []).map((agent) => [
-          agent.pubkey.toLowerCase(),
-          agent.name,
-        ]),
-      ),
-    [agentsQuery.data],
-  );
-  const runtimes = runtimesQuery.data ?? [];
-
-  async function runAction(runtime: ManagedAgentRuntimeStatus) {
-    setPendingRuntimeKey(managedAgentRuntimeKey(runtime));
-    try {
-      await action.mutateAsync({
-        action:
-          runtime.lifecycle === "starting" ||
-          runtime.lifecycle === "listening" ||
-          runtime.lifecycle === "waking" ||
-          runtime.lifecycle === "ready"
-            ? "stop"
-            : runtime.lifecycle === "stopped"
-              ? "start"
-              : "restart",
-        pubkey: runtime.pubkey,
-        relayUrl: runtime.relayUrl,
-      });
-    } finally {
-      setPendingRuntimeKey(null);
-    }
-  }
-
-  return (
-    <section className="min-w-0" data-testid="active-agent-communities">
-      <SettingsSectionHeader
-        title="Active in communities"
-        description="See and control each community where this device runs your agents."
-      />
-      <div className="overflow-hidden rounded-xl border border-border/60">
-        {runtimesQuery.isPending ? (
-          <p className="px-4 py-3 text-sm text-muted-foreground">Loading…</p>
-        ) : runtimes.length === 0 ? (
-          <p className="px-4 py-3 text-sm text-muted-foreground">
-            No agent community runtimes found.
-          </p>
-        ) : (
-          runtimes.map((runtime) => {
-            const status = agentCommunityAvailability(runtime);
-            const detail = agentCommunityStatusDetail(runtime);
-            const runtimeKey = managedAgentRuntimeKey(runtime);
-            const pending = pendingRuntimeKey === runtimeKey;
-            return (
-              <div
-                className="flex items-center gap-3 border-b border-border/60 px-4 py-3 last:border-b-0"
-                data-pubkey={runtime.pubkey}
-                data-relay-url={runtime.relayUrl}
-                data-testid="agent-community-runtime"
-                key={runtimeKey}
-              >
-                <div className="min-w-0 flex-1">
-                  <div className="flex flex-wrap items-center gap-2">
-                    <p className="text-sm font-medium">
-                      {agentNames.get(runtime.pubkey.toLowerCase()) ??
-                        truncatePubkey(runtime.pubkey)}
-                    </p>
-                    <Badge
-                      variant={status === "Here" ? "default" : "secondary"}
-                    >
-                      {status}
-                    </Badge>
-                  </div>
-                  <p className="truncate text-xs text-muted-foreground">
-                    {runtime.relayUrl}
-                  </p>
-                  {detail ? (
-                    <p className="text-xs text-muted-foreground">{detail}</p>
-                  ) : null}
-                </div>
-                {runtime.localSetup ? (
-                  <Button
-                    disabled={pending}
-                    onClick={() => void runAction(runtime)}
-                    size="sm"
-                    type="button"
-                    variant="outline"
-                  >
-                    {pending
-                      ? "Working…"
-                      : runtime.lifecycle === "stopped"
-                        ? "Start"
-                        : runtime.lifecycle === "failed"
-                          ? "Restart"
-                          : "Stop"}
-                  </Button>
-                ) : null}
-              </div>
-            );
-          })
-        )}
-      </div>
-      {action.error instanceof Error ? (
-        <p className="mt-2 text-sm text-destructive">{action.error.message}</p>
-      ) : null}
-    </section>
-  );
-}
diff --git a/desktop/src/features/settings/ui/CustomHarnessForm.tsx b/desktop/src/features/settings/ui/CustomHarnessForm.tsx
new file mode 100644
index 00000000000..52e79062650
--- /dev/null
+++ b/desktop/src/features/settings/ui/CustomHarnessForm.tsx
@@ -0,0 +1,471 @@
+import * as React from "react";
+import { Plus, X } from "lucide-react";
+
+import {
+  useManagedAgentPrereqsQuery,
+  useSaveCustomHarnessMutation,
+} from "@/features/agents/hooks";
+import {
+  PERSONA_FIELD_CONTROL_CLASS,
+  PERSONA_FIELD_SHELL_CLASS,
+  PERSONA_LABEL_OPTIONAL_CLASS,
+} from "@/features/agents/ui/agentConfigOptions";
+import { cn } from "@/shared/lib/cn";
+import { Button } from "@/shared/ui/button";
+import { Input } from "@/shared/ui/input";
+import { Spinner } from "@/shared/ui/spinner";
+
+import {
+  commaArgError,
+  type CustomFormValues,
+  definitionFromFormValues,
+  idFromLabel,
+} from "./harnessFormLogic";
+
+// ── Shared empty state ────────────────────────────────────────────────────────
+
+export const EMPTY_CUSTOM_FORM: CustomFormValues = {
+  id: "",
+  label: "",
+  command: "",
+  args: [],
+  env: [],
+  installInstructionsUrl: "",
+  installHint: "",
+};
+
+// ── Inline command validation ─────────────────────────────────────────────────
+
+function CommandAvailabilityBadge({ command }: { command: string }) {
+  const trimmed = command.trim();
+  const prereqs = useManagedAgentPrereqsQuery(trimmed, "", {
+    enabled: trimmed.length > 0,
+  });
+
+  if (!trimmed || prereqs.isLoading) return null;
+
+  const available = prereqs.data?.acp.available;
+  if (available === undefined) return null;
+
+  return (
+    <span
+      className={cn(
+        "inline-flex items-center rounded-md px-2 py-0.5 text-xs font-medium",
+        available
+          ? "bg-emerald-500/15 text-emerald-600 dark:text-emerald-400"
+          : "bg-amber-500/15 text-amber-600 dark:text-amber-400",
+      )}
+    >
+      {available ? "Found on PATH" : "Not found on PATH"}
+    </span>
+  );
+}
+
+// ── Shared field chrome (matches the Create agent dialog) ────────────────────
+
+function FieldShell({
+  children,
+  className,
+}: {
+  children: React.ReactNode;
+  className?: string;
+}) {
+  return (
+    <div
+      className={cn(
+        "flex min-h-11 items-center px-3",
+        PERSONA_FIELD_SHELL_CLASS,
+        className,
+      )}
+    >
+      {children}
+    </div>
+  );
+}
+
+const FIELD_INPUT_CLASS = cn(
+  "h-8 px-0 py-0 leading-6",
+  PERSONA_FIELD_CONTROL_CLASS,
+);
+
+// ── Args / env editors ────────────────────────────────────────────────────────
+
+function ArgsEditor({
+  args,
+  onChange,
+}: {
+  args: string[];
+  onChange: (next: string[]) => void;
+}) {
+  function set(index: number, value: string) {
+    const next = [...args];
+    next[index] = value;
+    onChange(next);
+  }
+
+  return (
+    <div className="space-y-2">
+      {args.map((arg, i) => (
+        // biome-ignore lint/suspicious/noArrayIndexKey: positional arg list
+        <div className="flex items-center gap-2" key={i}>
+          <FieldShell className="flex-1">
+            <Input
+              className={cn(FIELD_INPUT_CLASS, "font-mono")}
+              onChange={(e) => set(i, e.target.value)}
+              placeholder={`arg ${i + 1}`}
+              value={arg}
+            />
+          </FieldShell>
+          <Button
+            aria-label="Remove argument"
+            onClick={() => onChange(args.filter((_, idx) => idx !== i))}
+            size="icon"
+            type="button"
+            variant="ghost"
+          >
+            <X className="h-4 w-4" />
+          </Button>
+        </div>
+      ))}
+      <Button
+        onClick={() => onChange([...args, ""])}
+        size="sm"
+        type="button"
+        variant="outline"
+      >
+        <Plus className="mr-1 h-4 w-4" />
+        Add argument
+      </Button>
+    </div>
+  );
+}
+
+function EnvEditor({
+  env,
+  onChange,
+}: {
+  env: Array<{ key: string; value: string }>;
+  onChange: (next: Array<{ key: string; value: string }>) => void;
+}) {
+  function set(index: number, field: "key" | "value", value: string) {
+    onChange(env.map((e, i) => (i === index ? { ...e, [field]: value } : e)));
+  }
+
+  return (
+    <div className="space-y-2">
+      {env.map((pair, i) => (
+        // biome-ignore lint/suspicious/noArrayIndexKey: positional env list
+        <div className="flex items-center gap-2" key={i}>
+          <FieldShell className="flex-1">
+            <Input
+              className={cn(FIELD_INPUT_CLASS, "font-mono")}
+              onChange={(e) => set(i, "key", e.target.value)}
+              placeholder="KEY"
+              value={pair.key}
+            />
+          </FieldShell>
+          <FieldShell className="flex-2">
+            <Input
+              className={cn(FIELD_INPUT_CLASS, "font-mono")}
+              onChange={(e) => set(i, "value", e.target.value)}
+              placeholder="value"
+              value={pair.value}
+            />
+          </FieldShell>
+          <Button
+            aria-label="Remove env var"
+            onClick={() => onChange(env.filter((_, idx) => idx !== i))}
+            size="icon"
+            type="button"
+            variant="ghost"
+          >
+            <X className="h-4 w-4" />
+          </Button>
+        </div>
+      ))}
+      <Button
+        onClick={() => onChange([...env, { key: "", value: "" }])}
+        size="sm"
+        type="button"
+        variant="outline"
+      >
+        <Plus className="mr-1 h-4 w-4" />
+        Add env var
+      </Button>
+    </div>
+  );
+}
+
+// ── Custom harness form ───────────────────────────────────────────────────────
+
+/**
+ * Create/edit form for a custom harness. Name and Command are the only
+ * required fields — that's all a working ACP harness needs. ID (auto-derived
+ * from name), arguments, env vars, docs URL, and install hint follow inline.
+ */
+export function CustomHarnessForm({
+  initial,
+  originalId,
+  onCancel,
+  onSaved,
+  chromeless = false,
+  header,
+}: {
+  initial?: Partial<CustomFormValues>;
+  /** Id of the harness being edited, if this is an edit (not new). Used to
+   * delete the old file when the id changes. */
+  originalId?: string;
+  onCancel: () => void;
+  /** Receives the id the harness was saved under (the form may rewrite it). */
+  onSaved: (id: string) => void;
+  /** Render without the bordered card chrome (for embedding in the catalog
+   * dialog detail pane). */
+  chromeless?: boolean;
+  /** Optional intro block rendered at the top of the scrollable body
+   * (chromeless mode) so it scrolls with the fields. */
+  header?: React.ReactNode;
+}) {
+  const [form, setForm] = React.useState<CustomFormValues>({
+    ...EMPTY_CUSTOM_FORM,
+    ...initial,
+  });
+  const [error, setError] = React.useState<string | null>(null);
+  const save = useSaveCustomHarnessMutation();
+
+  // Save stays disabled until every required field is satisfied: the three
+  // required text fields are non-blank and no args/env row is left empty.
+  const requiredFieldsSatisfied =
+    form.label.trim().length > 0 &&
+    form.command.trim().length > 0 &&
+    form.id.trim().length > 0 &&
+    form.args.every((arg) => arg.trim().length > 0) &&
+    form.env.every((pair) => pair.key.trim().length > 0);
+
+  function field(
+    key: keyof Pick<
+      CustomFormValues,
+      "id" | "label" | "command" | "installInstructionsUrl" | "installHint"
+    >,
+  ) {
+    return (e: React.ChangeEvent<HTMLInputElement>) => {
+      const value = e.target.value;
+      setForm((prev) => {
+        const next = { ...prev, [key]: value };
+        // Auto-derive id from label when id is empty or was auto-derived.
+        if (
+          key === "label" &&
+          (!prev.id || prev.id === idFromLabel(prev.label))
+        ) {
+          next.id = idFromLabel(value);
+        }
+        return next;
+      });
+    };
+  }
+
+  async function handleSubmit(e: React.FormEvent) {
+    e.preventDefault();
+    setError(null);
+    // Mirror the backend comma-in-args rejection so the user gets an inline
+    // error naming the offending argument before the round-trip.
+    const commaError = commaArgError(form.args);
+    if (commaError) {
+      setError(commaError);
+      return;
+    }
+    try {
+      const definition = definitionFromFormValues(form);
+      await save.mutateAsync({ definition, originalId });
+      onSaved(definition.id);
+    } catch (err) {
+      setError(err instanceof Error ? err.message : String(err));
+    }
+  }
+
+  return (
+    <form
+      className={cn(
+        chromeless
+          ? "flex min-h-0 flex-1 flex-col"
+          : "space-y-5 rounded-2xl border border-border/60 bg-muted/10 px-4 py-4",
+      )}
+      data-testid="custom-harness-form"
+      onSubmit={(e) => void handleSubmit(e)}
+    >
+      {chromeless ? null : (
+        <div className="flex items-center justify-between">
+          <p className="text-sm font-medium">
+            {originalId ? "Edit harness" : "Add custom harness"}
+          </p>
+          <button
+            aria-label="Cancel"
+            className="rounded-md p-1 text-muted-foreground hover:bg-muted hover:text-foreground"
+            onClick={onCancel}
+            type="button"
+          >
+            <X className="h-4 w-4" />
+          </button>
+        </div>
+      )}
+
+      <div
+        className={cn(
+          "space-y-5",
+          chromeless && "min-h-0 flex-1 overflow-y-auto px-5 py-5",
+        )}
+      >
+        {header}
+
+        <div className="flex gap-3">
+          <div className="flex-1 space-y-1.5">
+            <label
+              className="text-sm font-medium text-foreground"
+              htmlFor="ch-label"
+            >
+              Name
+            </label>
+            <FieldShell>
+              <Input
+                className={FIELD_INPUT_CLASS}
+                id="ch-label"
+                onChange={field("label")}
+                placeholder="My Runtime"
+                required
+                value={form.label}
+              />
+            </FieldShell>
+          </div>
+
+          <div className="flex-1 space-y-1.5">
+            <label
+              className="text-sm font-medium text-foreground"
+              htmlFor="ch-id"
+            >
+              ID
+              <span className={PERSONA_LABEL_OPTIONAL_CLASS}>
+                (auto-derived)
+              </span>
+            </label>
+            <FieldShell>
+              <Input
+                className={cn(FIELD_INPUT_CLASS, "font-mono")}
+                id="ch-id"
+                onChange={field("id")}
+                placeholder="my-runtime"
+                required
+                value={form.id}
+              />
+            </FieldShell>
+          </div>
+        </div>
+
+        <div className="space-y-1.5">
+          <div className="flex items-center gap-2">
+            <label
+              className="text-sm font-medium text-foreground"
+              htmlFor="ch-command"
+            >
+              Command
+            </label>
+            <CommandAvailabilityBadge command={form.command} />
+          </div>
+          <FieldShell>
+            <Input
+              className={cn(FIELD_INPUT_CLASS, "font-mono")}
+              id="ch-command"
+              onChange={field("command")}
+              placeholder="my-agent-bin"
+              required
+              value={form.command}
+            />
+          </FieldShell>
+          <p className="text-xs text-muted-foreground">
+            Any command that speaks ACP over stdio works.
+          </p>
+        </div>
+
+        <div className="space-y-1.5">
+          <p className="text-sm font-medium text-foreground">Arguments</p>
+          <ArgsEditor
+            args={form.args}
+            onChange={(args) => setForm((p) => ({ ...p, args }))}
+          />
+        </div>
+
+        <div className="space-y-1.5">
+          <p className="text-sm font-medium text-foreground">
+            Env vars
+            <span className={PERSONA_LABEL_OPTIONAL_CLASS}>
+              (override at spawn time; Buzz-managed vars always win)
+            </span>
+          </p>
+          <EnvEditor
+            env={form.env}
+            onChange={(env) => setForm((p) => ({ ...p, env }))}
+          />
+        </div>
+
+        <div className="space-y-1.5">
+          <label
+            className="text-sm font-medium text-foreground"
+            htmlFor="ch-docs-url"
+          >
+            Docs URL
+            <span className={PERSONA_LABEL_OPTIONAL_CLASS}>(optional)</span>
+          </label>
+          <FieldShell>
+            <Input
+              className={FIELD_INPUT_CLASS}
+              id="ch-docs-url"
+              onChange={field("installInstructionsUrl")}
+              placeholder="https://example.com/docs"
+              value={form.installInstructionsUrl}
+            />
+          </FieldShell>
+        </div>
+
+        <div className="space-y-1.5">
+          <label
+            className="text-sm font-medium text-foreground"
+            htmlFor="ch-install-hint"
+          >
+            Install hint
+            <span className={PERSONA_LABEL_OPTIONAL_CLASS}>(optional)</span>
+          </label>
+          <FieldShell>
+            <Input
+              className={FIELD_INPUT_CLASS}
+              id="ch-install-hint"
+              onChange={field("installHint")}
+              placeholder="npm install -g my-harness"
+              value={form.installHint}
+            />
+          </FieldShell>
+        </div>
+
+        {error ? (
+          <p className="rounded-lg border border-destructive/30 bg-destructive/10 px-3 py-1.5 text-sm text-destructive">
+            {error}
+          </p>
+        ) : null}
+      </div>
+
+      <div
+        className={cn(
+          "flex justify-end gap-2",
+          chromeless
+            ? "shrink-0 border-t border-border/60 bg-background px-5 py-3"
+            : "pt-1",
+        )}
+      >
+        <Button
+          disabled={save.isPending || !requiredFieldsSatisfied}
+          type="submit"
+        >
+          {save.isPending ? <Spinner className="mr-2 h-3.5 w-3.5" /> : null}
+          Save
+        </Button>
+      </div>
+    </form>
+  );
+}
diff --git a/desktop/src/features/settings/ui/HarnessCatalogDialog.tsx b/desktop/src/features/settings/ui/HarnessCatalogDialog.tsx
new file mode 100644
index 00000000000..2bc689e9e83
--- /dev/null
+++ b/desktop/src/features/settings/ui/HarnessCatalogDialog.tsx
@@ -0,0 +1,612 @@
+import * as React from "react";
+import { ChevronRight, ExternalLink, Plus, Search } from "lucide-react";
+import { openUrl } from "@tauri-apps/plugin-opener";
+
+import {
+  useAcpRuntimesQuery,
+  useInstallAcpRuntimeMutation,
+} from "@/features/agents/hooks";
+import {
+  getRuntimeDisplayLabel,
+  RuntimeIcon,
+} from "@/features/onboarding/ui/RuntimeIcon";
+import type { AcpRuntimeCatalogEntry } from "@/shared/api/types";
+import { getInstallErrorMessage } from "@/shared/lib/installError";
+import { cn } from "@/shared/lib/cn";
+import {
+  AlertDialog,
+  AlertDialogAction,
+  AlertDialogCancel,
+  AlertDialogContent,
+  AlertDialogDescription,
+  AlertDialogFooter,
+  AlertDialogHeader,
+  AlertDialogTitle,
+} from "@/shared/ui/alert-dialog";
+import { Button } from "@/shared/ui/button";
+import { ChooserDialogContent } from "@/shared/ui/chooser-dialog-content";
+import { Dialog } from "@/shared/ui/dialog";
+import { Input } from "@/shared/ui/input";
+import { Skeleton } from "@/shared/ui/skeleton";
+import { Spinner } from "@/shared/ui/spinner";
+
+import { CustomHarnessForm } from "./CustomHarnessForm";
+import { harnessDescription } from "./harnessCatalogCopy";
+import {
+  adapterUpdateWarning,
+  catalogDialogEntries,
+  catalogPrimaryAction,
+  entryStatusLabel,
+  filterCatalogEntries,
+  groupCatalogEntries,
+  installLinkLabel,
+} from "./harnessCatalogLogic";
+
+/** Sentinel list selection for the "+ Custom harness" entry. */
+const CUSTOM_ENTRY_ID = "\u0000custom";
+
+/**
+ * "Add runtimes" — master-detail catalog dialog, modeled on the Agent
+ * Catalog (PersonaCatalogDialog): searchable left chooser, right detail pane
+ * with one neutral vendor-sourced sentence, operational setup state, and
+ * technical details, plus a primary Install / setup-guide CTA pinned in a
+ * bottom action bar (same position as the custom-harness Save button).
+ * "+ Custom harness" opens the progressive-disclosure form in the same pane.
+ */
+export function HarnessCatalogDialog({
+  onOpenChange,
+  open,
+}: {
+  onOpenChange: (open: boolean) => void;
+  open: boolean;
+}) {
+  const contentRef = React.useRef<HTMLDivElement | null>(null);
+  const runtimesQuery = useAcpRuntimesQuery();
+  const isLoading = runtimesQuery.isLoading;
+  const entries = React.useMemo(
+    () => catalogDialogEntries(runtimesQuery.data ?? []),
+    [runtimesQuery.data],
+  );
+  const [query, setQuery] = React.useState("");
+  const filtered = React.useMemo(
+    () => filterCatalogEntries(entries, query),
+    [entries, query],
+  );
+  const [selectedId, setSelectedId] = React.useState<string | null>(null);
+  const groups = React.useMemo(() => groupCatalogEntries(filtered), [filtered]);
+  // "Installed" is collapsed by default — the dialog exists to set up new
+  // runtimes. Searching force-expands it (VS Code-style) so matches are never
+  // hidden; likewise when there is nothing left to set up.
+  const [setupOpen, setSetupOpen] = React.useState(true);
+  const [installedOpen, setInstalledOpen] = React.useState(false);
+  const isSearching = query.trim().length > 0;
+  const setupExpanded = setupOpen || isSearching;
+  const installedExpanded =
+    installedOpen || isSearching || groups.setup.length === 0;
+
+  // Keep a valid selection: default to the first visible entry; hold on to
+  // the custom-form selection regardless of the filter.
+  React.useEffect(() => {
+    if (!open) return;
+    setSelectedId((current) => {
+      if (current === CUSTOM_ENTRY_ID) return current;
+      if (current && filtered.some((e) => e.id === current)) return current;
+      return filtered[0]?.id ?? null;
+    });
+  }, [open, filtered]);
+
+  // Reset transient state when the dialog closes.
+  React.useEffect(() => {
+    if (!open) {
+      setQuery("");
+      setSelectedId(null);
+      setSetupOpen(true);
+      setInstalledOpen(false);
+    }
+  }, [open]);
+
+  const selectedEntry =
+    selectedId === CUSTOM_ENTRY_ID
+      ? null
+      : (filtered.find((e) => e.id === selectedId) ?? null);
+
+  return (
+    <Dialog onOpenChange={onOpenChange} open={open}>
+      <ChooserDialogContent
+        className="h-[42rem] max-w-4xl"
+        contentClassName="flex min-h-0 flex-1 p-0"
+        data-testid="harness-catalog-dialog"
+        headerClassName="bg-sidebar pb-3 text-sidebar-foreground"
+        headerTestId="harness-catalog-dialog-header"
+        onOpenAutoFocus={(event) => {
+          event.preventDefault();
+          contentRef.current?.focus();
+        }}
+        ref={contentRef}
+        scrollAreaClassName="flex min-h-0 overflow-hidden px-0"
+        scrollAreaTestId="harness-catalog-dialog-body"
+        tabIndex={-1}
+        title="Add runtimes"
+      >
+        <div className="flex min-h-0 flex-1 flex-col overflow-hidden bg-sidebar sm:flex-row">
+          {/* Left: search + chooser list */}
+          <div className="flex max-h-56 min-h-0 flex-col sm:max-h-none sm:w-56">
+            <div className="px-3 pt-3">
+              <div className="relative">
+                <Search className="pointer-events-none absolute left-2.5 top-1/2 h-3.5 w-3.5 -translate-y-1/2 text-sidebar-foreground/50" />
+                <Input
+                  aria-label="Search runtimes"
+                  className="h-8 border-sidebar-border bg-sidebar-accent/40 pl-8 text-sm"
+                  data-testid="harness-catalog-search"
+                  onChange={(e) => setQuery(e.target.value)}
+                  placeholder="Search runtimes…"
+                  value={query}
+                />
+              </div>
+            </div>
+            <div
+              className="min-h-0 flex-1 overflow-y-auto px-2 py-3"
+              data-testid="harness-catalog-list"
+            >
+              <div className="space-y-1">
+                {isLoading ? (
+                  <CatalogListSkeleton />
+                ) : filtered.length === 0 ? (
+                  <p className="px-4 py-2 text-sm text-sidebar-foreground/60">
+                    No runtimes match.
+                  </p>
+                ) : (
+                  <>
+                    {groups.setup.length > 0 ? (
+                      <CatalogSection
+                        count={groups.setup.length}
+                        label="Setup"
+                        onToggle={() => setSetupOpen((v) => !v)}
+                        open={setupExpanded}
+                        testId="harness-catalog-section-setup"
+                      >
+                        {groups.setup.map((entry) => (
+                          <CatalogListItem
+                            entry={entry}
+                            isCurrent={entry.id === selectedId}
+                            key={entry.id}
+                            onSelect={() => setSelectedId(entry.id)}
+                          />
+                        ))}
+                      </CatalogSection>
+                    ) : null}
+                    {groups.installed.length > 0 ? (
+                      <CatalogSection
+                        count={groups.installed.length}
+                        label="Installed"
+                        onToggle={() => setInstalledOpen((v) => !v)}
+                        open={installedExpanded}
+                        testId="harness-catalog-section-installed"
+                      >
+                        {groups.installed.map((entry) => (
+                          <CatalogListItem
+                            entry={entry}
+                            isCurrent={entry.id === selectedId}
+                            key={entry.id}
+                            onSelect={() => setSelectedId(entry.id)}
+                          />
+                        ))}
+                      </CatalogSection>
+                    ) : null}
+                  </>
+                )}
+              </div>
+              <div className="my-2 border-t border-sidebar-border/60" />
+              <button
+                aria-current={
+                  selectedId === CUSTOM_ENTRY_ID ? "true" : undefined
+                }
+                className={cn(
+                  "flex w-full items-center gap-2 rounded-lg px-4 py-1.5 text-left transition-[background-color,color,box-shadow] focus:outline-hidden focus-visible:ring-2 focus-visible:ring-sidebar-ring/50 focus-visible:ring-offset-2 focus-visible:ring-offset-sidebar",
+                  selectedId === CUSTOM_ENTRY_ID
+                    ? "bg-sidebar-active text-sidebar-active-foreground"
+                    : "text-sidebar-foreground/70 hover:bg-sidebar-accent hover:text-sidebar-accent-foreground",
+                )}
+                data-testid="harness-catalog-list-item-custom"
+                onClick={() => setSelectedId(CUSTOM_ENTRY_ID)}
+                type="button"
+              >
+                <Plus className="h-4 w-4 shrink-0" />
+                <span className="min-w-0 flex-1 truncate text-sm font-medium">
+                  Custom harness
+                </span>
+              </button>
+            </div>
+          </div>
+
+          {/* Right: detail pane */}
+          <div className="relative z-10 ml-px flex min-h-0 flex-1 flex-col overflow-hidden rounded-tl-xl bg-background shadow-[-1px_0_0_0_hsl(var(--sidebar-border)/0.45)]">
+            <div
+              className="flex min-h-0 flex-1 flex-col overflow-hidden"
+              data-testid="harness-catalog-detail-pane"
+            >
+              {selectedId === CUSTOM_ENTRY_ID ? (
+                <CustomHarnessDetail onDone={() => onOpenChange(false)} />
+              ) : selectedEntry ? (
+                <CatalogDetail entry={selectedEntry} key={selectedEntry.id} />
+              ) : isLoading ? (
+                <div className="min-h-0 flex-1 overflow-y-auto px-5 py-5">
+                  <CatalogDetailSkeleton />
+                </div>
+              ) : (
+                <div className="min-h-0 flex-1 overflow-y-auto px-5 py-5">
+                  <div className="flex min-h-80 items-center justify-center rounded-lg border border-dashed border-border/70 px-6 text-center">
+                    <p className="max-w-sm text-sm text-muted-foreground">
+                      Select a runtime on the left, or add a custom one.
+                    </p>
+                  </div>
+                </div>
+              )}
+            </div>
+          </div>
+        </div>
+      </ChooserDialogContent>
+    </Dialog>
+  );
+}
+
+/**
+ * VS Code-style collapsible list section: chevron + uppercase label +
+ * trailing count badge. The header is a plain toggle — selection lives on
+ * the rows inside.
+ */
+function CatalogSection({
+  children,
+  count,
+  label,
+  onToggle,
+  open,
+  testId,
+}: {
+  children: React.ReactNode;
+  count: number;
+  label: string;
+  onToggle: () => void;
+  open: boolean;
+  testId: string;
+}) {
+  return (
+    <div>
+      <button
+        aria-expanded={open}
+        className="flex w-full items-center gap-1 rounded-md px-2 py-1 text-left text-2xs font-semibold uppercase tracking-wider text-sidebar-foreground/60 transition-colors hover:text-sidebar-foreground focus:outline-hidden focus-visible:ring-2 focus-visible:ring-sidebar-ring/50"
+        data-testid={testId}
+        onClick={onToggle}
+        type="button"
+      >
+        <ChevronRight
+          aria-hidden
+          className={cn(
+            "h-3 w-3 shrink-0 transition-transform",
+            open && "rotate-90",
+          )}
+        />
+        <span className="min-w-0 flex-1 truncate">{label}</span>
+        <span
+          className="ml-auto shrink-0 rounded-full bg-sidebar-accent px-1.5 py-px font-medium normal-case tracking-normal text-sidebar-foreground/70"
+          data-testid={`${testId}-count`}
+        >
+          {count}
+        </span>
+      </button>
+      {open ? <div className="space-y-1 pt-0.5">{children}</div> : null}
+    </div>
+  );
+}
+
+/** Pulsing placeholder rows shown while harness discovery is running. */
+function CatalogListSkeleton() {
+  const widths = ["w-24", "w-32", "w-20", "w-28", "w-24", "w-16"];
+  return (
+    <div
+      aria-label="Loading runtimes"
+      className="space-y-1"
+      data-testid="harness-catalog-list-skeleton"
+      role="status"
+    >
+      {widths.map((width, index) => (
+        <div
+          className="flex w-full items-center gap-2 rounded-lg px-4 py-1.5"
+          // Static placeholder list — order never changes.
+          // biome-ignore lint/suspicious/noArrayIndexKey: static skeleton rows
+          key={index}
+        >
+          <Skeleton className="h-6 w-6 shrink-0 rounded-md" />
+          <Skeleton className={cn("h-3.5 rounded", width)} />
+        </div>
+      ))}
+    </div>
+  );
+}
+
+/** Pulsing placeholder mirroring the detail-pane layout while loading. */
+function CatalogDetailSkeleton() {
+  return (
+    <div
+      aria-label="Loading runtime details"
+      className="flex min-h-full flex-col gap-6"
+      data-testid="harness-catalog-detail-skeleton"
+      role="status"
+    >
+      <div className="flex items-center gap-4">
+        <Skeleton className="h-16 w-16 rounded-xl" />
+        <div className="min-w-0 space-y-2">
+          <Skeleton className="h-5 w-40 rounded" />
+          <Skeleton className="h-4 w-16 rounded" />
+          <Skeleton className="h-7 w-24 rounded-md" />
+        </div>
+      </div>
+      <div className="space-y-2">
+        <Skeleton className="h-3.5 w-full rounded" />
+        <Skeleton className="h-3.5 w-11/12 rounded" />
+        <Skeleton className="h-3.5 w-2/3 rounded" />
+      </div>
+      <Skeleton className="h-28 w-full rounded-lg" />
+    </div>
+  );
+}
+
+function CatalogListItem({
+  entry,
+  isCurrent,
+  onSelect,
+}: {
+  entry: AcpRuntimeCatalogEntry;
+  isCurrent: boolean;
+  onSelect: () => void;
+}) {
+  const isReady = entry.availability === "available";
+
+  return (
+    <button
+      aria-current={isCurrent ? "true" : undefined}
+      className={cn(
+        "flex w-full items-center gap-2 rounded-lg px-4 py-1.5 text-left transition-[background-color,color,box-shadow] focus:outline-hidden focus-visible:ring-2 focus-visible:ring-sidebar-ring/50 focus-visible:ring-offset-2 focus-visible:ring-offset-sidebar",
+        isCurrent
+          ? "bg-sidebar-active text-sidebar-active-foreground"
+          : "text-sidebar-foreground/70 hover:bg-sidebar-accent hover:text-sidebar-accent-foreground",
+      )}
+      data-testid={`harness-catalog-list-item-${entry.id}`}
+      onClick={onSelect}
+      type="button"
+    >
+      <RuntimeIcon className="h-6 w-6" runtime={entry} />
+      <span className="min-w-0 flex-1 truncate text-sm font-medium">
+        {getRuntimeDisplayLabel(entry)}
+      </span>
+      {isReady ? (
+        <span
+          aria-label={`${entry.label} is ready`}
+          className="h-1.5 w-1.5 shrink-0 rounded-full bg-emerald-500"
+          role="img"
+        />
+      ) : null}
+    </button>
+  );
+}
+
+function CatalogDetail({ entry }: { entry: AcpRuntimeCatalogEntry }) {
+  const install = useInstallAcpRuntimeMutation();
+  const [installError, setInstallError] = React.useState<string | null>(null);
+  const [isUpdateWarningOpen, setIsUpdateWarningOpen] = React.useState(false);
+  const action = catalogPrimaryAction(entry);
+  const statusLabel = entryStatusLabel(entry);
+  const description = harnessDescription(entry.id);
+  const isReady = entry.availability === "available";
+  const docsUrl = entry.installInstructionsUrl.trim();
+
+  function handleInstall() {
+    setInstallError(null);
+    install.mutate(entry.id, {
+      onSuccess: (result) => {
+        if (!result.success) {
+          setInstallError(getInstallErrorMessage(result.steps));
+        }
+      },
+      onError: (error) => {
+        setInstallError(
+          error instanceof Error ? error.message : "Install failed.",
+        );
+      },
+    });
+  }
+
+  // Replacing an outdated adapter is a machine-wide mutation — gate it behind
+  // the same confirmation the runtime row shows (adapterUpdateWarning is the
+  // shared copy source). Fresh installs stay one-click.
+  function handlePrimaryClick() {
+    if (entry.availability === "adapter_outdated") {
+      setIsUpdateWarningOpen(true);
+      return;
+    }
+    handleInstall();
+  }
+
+  // The outline docs button only shows when the entry needs no setup action
+  // (already ready) — pair it with a hint so the muted styling reads as
+  // "nothing to do here" rather than a broken primary button.
+  const isSecondaryCta = action.kind !== "install" && action.kind !== "docs";
+
+  const primaryCta =
+    action.kind === "install" ? (
+      <Button
+        data-testid={`harness-catalog-install-${entry.id}`}
+        disabled={install.isPending}
+        onClick={handlePrimaryClick}
+        type="button"
+      >
+        {install.isPending ? <Spinner className="mr-2 h-3.5 w-3.5" /> : null}
+        {action.label}
+      </Button>
+    ) : docsUrl ? (
+      <Button
+        data-testid={
+          action.kind === "docs"
+            ? `harness-catalog-setup-${entry.id}`
+            : `harness-catalog-docs-${entry.id}`
+        }
+        onClick={() => void openUrl(docsUrl)}
+        type="button"
+        variant={action.kind === "docs" ? "default" : "outline"}
+      >
+        <ExternalLink className="mr-1 h-3.5 w-3.5" />
+        {action.kind === "docs" ? action.label : installLinkLabel(entry)}
+      </Button>
+    ) : null;
+
+  return (
+    <div className="flex min-h-0 flex-1 flex-col">
+      <div className="min-h-0 flex-1 space-y-6 overflow-y-auto px-5 py-5">
+        <div className="flex items-center gap-4">
+          <RuntimeIcon className="h-16 w-16" runtime={entry} />
+          <div className="min-w-0">
+            <h3 className="truncate text-xl font-semibold leading-snug">
+              {getRuntimeDisplayLabel(entry)}
+            </h3>
+            {statusLabel ? (
+              // entryStatusLabel is the single availability→label source
+              // shared with the row chip — when it has something to say
+              // (setup needed, sign-in needed, config error) it outranks the
+              // green Ready chip even for available entries.
+              <span
+                className="mt-1 inline-flex items-center rounded-md bg-muted px-2 py-0.5 text-xs font-medium text-muted-foreground"
+                data-testid={`harness-catalog-status-${entry.id}`}
+              >
+                {statusLabel}
+              </span>
+            ) : isReady ? (
+              <span className="mt-1 inline-flex items-center rounded-md bg-emerald-500/15 px-2 py-0.5 text-xs font-medium text-emerald-600 dark:text-emerald-400">
+                Ready
+              </span>
+            ) : null}
+          </div>
+        </div>
+
+        {description ? (
+          <p className="text-sm leading-6 text-muted-foreground">
+            {description}
+          </p>
+        ) : null}
+
+        {entry.installHint ? (
+          <div className="space-y-1">
+            <p className="text-xs font-semibold text-muted-foreground">Setup</p>
+            <p className="whitespace-pre-line text-sm leading-6 text-foreground">
+              {entry.installHint}
+            </p>
+          </div>
+        ) : null}
+
+        {installError ? (
+          <p className="whitespace-pre-line rounded-lg border border-destructive/30 bg-destructive/10 px-3 py-1.5 text-sm text-destructive">
+            {installError}
+          </p>
+        ) : null}
+
+        <TechnicalDetails entry={entry} />
+      </div>
+
+      {primaryCta ? (
+        <div className="flex shrink-0 items-center justify-end gap-3 border-t border-border/60 bg-background px-5 py-3">
+          {isSecondaryCta ? (
+            <p
+              className="text-xs text-muted-foreground/80"
+              data-testid={`harness-catalog-ready-hint-${entry.id}`}
+            >
+              Already set up
+            </p>
+          ) : null}
+          {primaryCta}
+        </div>
+      ) : null}
+      <AlertDialog
+        onOpenChange={setIsUpdateWarningOpen}
+        open={isUpdateWarningOpen}
+      >
+        <AlertDialogContent>
+          <AlertDialogHeader>
+            <AlertDialogTitle>Update {entry.label} adapter?</AlertDialogTitle>
+            <AlertDialogDescription>
+              {adapterUpdateWarning(entry)}
+            </AlertDialogDescription>
+          </AlertDialogHeader>
+          <AlertDialogFooter>
+            <AlertDialogCancel>Cancel</AlertDialogCancel>
+            <AlertDialogAction
+              data-testid={`harness-catalog-confirm-update-${entry.id}`}
+              onClick={handleInstall}
+            >
+              Update
+            </AlertDialogAction>
+          </AlertDialogFooter>
+        </AlertDialogContent>
+      </AlertDialog>
+    </div>
+  );
+}
+
+function TechnicalDetails({ entry }: { entry: AcpRuntimeCatalogEntry }) {
+  const rows: Array<{ label: string; value: string }> = [
+    { label: "ID", value: entry.id },
+    ...(entry.command ? [{ label: "Command", value: entry.command }] : []),
+    ...(entry.defaultArgs.length > 0
+      ? [{ label: "Arguments", value: entry.defaultArgs.join(" ") }]
+      : []),
+    ...(entry.underlyingCliPath
+      ? [{ label: "Underlying CLI", value: entry.underlyingCliPath }]
+      : []),
+    ...(entry.binaryPath ? [{ label: "Path", value: entry.binaryPath }] : []),
+    {
+      label: "Source",
+      value: entry.source === "builtin" ? "Built-in" : "Bundled preset",
+    },
+  ];
+
+  return (
+    <dl
+      className="space-y-1.5 rounded-lg border border-border/70 bg-card/70 px-4 py-3"
+      data-testid={`harness-catalog-technical-${entry.id}`}
+    >
+      {rows.map((row) => (
+        <div className="flex gap-3 text-sm" key={row.label}>
+          <dt className="w-28 shrink-0 text-xs font-semibold leading-5 text-muted-foreground">
+            {row.label}
+          </dt>
+          <dd className="min-w-0 break-all font-mono text-xs leading-5">
+            {row.value}
+          </dd>
+        </div>
+      ))}
+    </dl>
+  );
+}
+
+function CustomHarnessDetail({ onDone }: { onDone: () => void }) {
+  return (
+    <div
+      className="flex min-h-0 flex-1 flex-col"
+      data-testid="harness-catalog-custom-detail"
+    >
+      <CustomHarnessForm
+        chromeless
+        header={
+          <div>
+            <h3 className="text-xl font-semibold leading-snug">
+              Custom harness
+            </h3>
+            <p className="mt-1 text-sm text-muted-foreground">
+              Register any ACP-speaking agent tool as a selectable runtime.
+            </p>
+          </div>
+        }
+        onCancel={onDone}
+        onSaved={onDone}
+      />
+    </div>
+  );
+}
diff --git a/desktop/src/features/settings/ui/HarnessManagementCard.tsx b/desktop/src/features/settings/ui/HarnessManagementCard.tsx
deleted file mode 100644
index 758bf1ebbd5..00000000000
--- a/desktop/src/features/settings/ui/HarnessManagementCard.tsx
+++ /dev/null
@@ -1,669 +0,0 @@
-import * as React from "react";
-import { ExternalLink, Plus, Terminal, Trash2, X } from "lucide-react";
-import { openUrl } from "@tauri-apps/plugin-opener";
-
-import {
-  useAcpRuntimesQuery,
-  useDeleteCustomHarnessMutation,
-  useManagedAgentPrereqsQuery,
-  useManagedAgentsQuery,
-  usePersonasQuery,
-  useSaveCustomHarnessMutation,
-} from "@/features/agents/hooks";
-import type { AcpRuntimeCatalogEntry } from "@/shared/api/types";
-import { cn } from "@/shared/lib/cn";
-import { Button } from "@/shared/ui/button";
-import { Input } from "@/shared/ui/input";
-import { Spinner } from "@/shared/ui/spinner";
-
-import {
-  getRuntimeDisplayLabel,
-  RuntimeIcon,
-} from "../../onboarding/ui/RuntimeIcon";
-import {
-  commaArgError,
-  type CustomFormValues,
-  definitionFromFormValues,
-  formValuesFromCatalogEntry,
-  idFromLabel,
-} from "./harnessFormLogic";
-import {
-  customEntries as getCustomEntries,
-  deleteConfirmState,
-  sortedPresetEntries,
-} from "./harnessGalleryLogic";
-import { SettingsSectionHeader } from "./SettingsSectionHeader";
-
-// ── Preset card ───────────────────────────────────────────────────────────────
-//
-// Preset entries come from the backend catalog (source === "preset"), so we no
-// longer maintain a duplicate HARNESS_PRESETS array here. The backend
-// PRESET_HARNESSES static drives availability detection and canonical data.
-
-function PresetCard({ entry }: { entry: AcpRuntimeCatalogEntry }) {
-  const isDetected = entry.availability === "available";
-
-  return (
-    <div
-      className={cn(
-        "relative flex flex-col gap-3 rounded-2xl border px-4 py-4 text-sm transition-colors",
-        isDetected
-          ? "border-emerald-500/20 bg-emerald-500/5"
-          : "border-border/60 bg-muted/20",
-      )}
-      data-testid={`harness-preset-${entry.id}`}
-    >
-      <div className="flex items-center gap-3">
-        <RuntimeIcon className="h-8 w-8" runtime={entry} />
-        <div className="min-w-0 flex-1">
-          <p className="font-medium leading-none">
-            {getRuntimeDisplayLabel(entry)}
-          </p>
-          {entry.command ? (
-            <p className="mt-1 font-mono text-xs text-muted-foreground">
-              {entry.command}
-            </p>
-          ) : null}
-        </div>
-        {isDetected ? (
-          <span className="inline-flex shrink-0 items-center rounded-md bg-emerald-500/15 px-2 py-0.5 text-xs font-medium text-emerald-600 dark:text-emerald-400">
-            Detected
-          </span>
-        ) : null}
-      </div>
-
-      {/* Docs link for non-detected presets */}
-      {!isDetected && entry.installInstructionsUrl ? (
-        <div className="flex items-center gap-2">
-          <button
-            className="inline-flex items-center gap-1 text-xs text-muted-foreground underline-offset-2 hover:text-foreground hover:underline"
-            onClick={() => void openUrl(entry.installInstructionsUrl)}
-            type="button"
-          >
-            <ExternalLink className="h-3.5 w-3.5" />
-            Install
-          </button>
-        </div>
-      ) : null}
-    </div>
-  );
-}
-
-// ── Custom harness form ───────────────────────────────────────────────────────
-
-const EMPTY_FORM: CustomFormValues = {
-  id: "",
-  label: "",
-  command: "",
-  args: [],
-  env: [],
-  installInstructionsUrl: "",
-  installHint: "",
-};
-
-function CommandAvailabilityBadge({ command }: { command: string }) {
-  const trimmed = command.trim();
-  const prereqs = useManagedAgentPrereqsQuery(trimmed, "", {
-    enabled: trimmed.length > 0,
-  });
-
-  if (!trimmed || prereqs.isLoading) return null;
-
-  const available = prereqs.data?.acp.available;
-  if (available === undefined) return null;
-
-  return (
-    <span
-      className={cn(
-        "inline-flex items-center rounded-md px-2 py-0.5 text-xs font-medium",
-        available
-          ? "bg-emerald-500/15 text-emerald-600 dark:text-emerald-400"
-          : "bg-amber-500/15 text-amber-600 dark:text-amber-400",
-      )}
-    >
-      {available ? "Found on PATH" : "Not found on PATH"}
-    </span>
-  );
-}
-
-function ArgsEditor({
-  args,
-  onChange,
-}: {
-  args: string[];
-  onChange: (next: string[]) => void;
-}) {
-  function set(index: number, value: string) {
-    const next = [...args];
-    next[index] = value;
-    onChange(next);
-  }
-
-  function add() {
-    onChange([...args, ""]);
-  }
-
-  function remove(index: number) {
-    onChange(args.filter((_, i) => i !== index));
-  }
-
-  return (
-    <div className="space-y-1.5">
-      {args.map((arg, i) => (
-        // biome-ignore lint/suspicious/noArrayIndexKey: positional arg list
-        <div className="flex gap-1.5" key={i}>
-          <Input
-            className="h-8 flex-1 font-mono text-sm"
-            onChange={(e) => set(i, e.target.value)}
-            placeholder={`arg ${i + 1}`}
-            value={arg}
-          />
-          <button
-            aria-label="Remove argument"
-            className="flex h-8 w-8 items-center justify-center rounded-md text-muted-foreground hover:bg-muted hover:text-foreground"
-            onClick={() => remove(i)}
-            type="button"
-          >
-            <X className="h-3.5 w-3.5" />
-          </button>
-        </div>
-      ))}
-      <Button
-        className="h-7 gap-1.5 px-3 text-xs"
-        onClick={add}
-        size="sm"
-        type="button"
-        variant="ghost"
-      >
-        <Plus className="h-3.5 w-3.5" />
-        Add argument
-      </Button>
-    </div>
-  );
-}
-
-function EnvEditor({
-  env,
-  onChange,
-}: {
-  env: Array<{ key: string; value: string }>;
-  onChange: (next: Array<{ key: string; value: string }>) => void;
-}) {
-  function set(index: number, field: "key" | "value", value: string) {
-    const next = env.map((e, i) =>
-      i === index ? { ...e, [field]: value } : e,
-    );
-    onChange(next);
-  }
-
-  function add() {
-    onChange([...env, { key: "", value: "" }]);
-  }
-
-  function remove(index: number) {
-    onChange(env.filter((_, i) => i !== index));
-  }
-
-  return (
-    <div className="space-y-1.5">
-      {env.map((pair, i) => (
-        // biome-ignore lint/suspicious/noArrayIndexKey: positional env list
-        <div className="flex gap-1.5" key={i}>
-          <Input
-            className="h-8 w-1/3 font-mono text-sm"
-            onChange={(e) => set(i, "key", e.target.value)}
-            placeholder="KEY"
-            value={pair.key}
-          />
-          <Input
-            className="h-8 flex-1 font-mono text-sm"
-            onChange={(e) => set(i, "value", e.target.value)}
-            placeholder="value"
-            value={pair.value}
-          />
-          <button
-            aria-label="Remove env var"
-            className="flex h-8 w-8 items-center justify-center rounded-md text-muted-foreground hover:bg-muted hover:text-foreground"
-            onClick={() => remove(i)}
-            type="button"
-          >
-            <X className="h-3.5 w-3.5" />
-          </button>
-        </div>
-      ))}
-      <Button
-        className="h-7 gap-1.5 px-3 text-xs"
-        onClick={add}
-        size="sm"
-        type="button"
-        variant="ghost"
-      >
-        <Plus className="h-3.5 w-3.5" />
-        Add env var
-      </Button>
-    </div>
-  );
-}
-
-function CustomHarnessForm({
-  initial,
-  originalId,
-  onCancel,
-  onSaved,
-}: {
-  initial?: Partial<CustomFormValues>;
-  /** Id of the harness being edited, if this is an edit (not new). Used to
-   * delete the old file when the id changes. */
-  originalId?: string;
-  onCancel: () => void;
-  onSaved: () => void;
-}) {
-  const [form, setForm] = React.useState<CustomFormValues>({
-    ...EMPTY_FORM,
-    ...initial,
-  });
-  const [error, setError] = React.useState<string | null>(null);
-  const save = useSaveCustomHarnessMutation();
-
-  function field(
-    key: keyof Pick<
-      CustomFormValues,
-      "id" | "label" | "command" | "installInstructionsUrl" | "installHint"
-    >,
-  ) {
-    return (e: React.ChangeEvent<HTMLInputElement>) => {
-      const value = e.target.value;
-      setForm((prev) => {
-        const next = { ...prev, [key]: value };
-        // Auto-derive id from label when id is empty or was auto-derived.
-        if (
-          key === "label" &&
-          (!prev.id || prev.id === idFromLabel(prev.label))
-        ) {
-          next.id = idFromLabel(value);
-        }
-        return next;
-      });
-    };
-  }
-
-  async function handleSubmit(e: React.FormEvent) {
-    e.preventDefault();
-    setError(null);
-    // Mirror the backend comma-in-args rejection so the user gets an inline
-    // error naming the offending argument before the round-trip.
-    const commaError = commaArgError(form.args);
-    if (commaError) {
-      setError(commaError);
-      return;
-    }
-    try {
-      await save.mutateAsync({
-        definition: definitionFromFormValues(form),
-        originalId,
-      });
-      onSaved();
-    } catch (err) {
-      setError(err instanceof Error ? err.message : String(err));
-    }
-  }
-
-  return (
-    <form
-      className="space-y-3 rounded-2xl border border-border/60 bg-muted/10 px-4 py-4"
-      data-testid="custom-harness-form"
-      onSubmit={(e) => void handleSubmit(e)}
-    >
-      <div className="flex items-center justify-between">
-        <p className="text-sm font-medium">
-          {originalId ? "Edit harness" : "Add custom harness"}
-        </p>
-        <button
-          aria-label="Cancel"
-          className="rounded-md p-1 text-muted-foreground hover:bg-muted hover:text-foreground"
-          onClick={onCancel}
-          type="button"
-        >
-          <X className="h-4 w-4" />
-        </button>
-      </div>
-
-      <div className="grid grid-cols-2 gap-3">
-        <div className="space-y-1">
-          <p className="text-xs text-muted-foreground">Name</p>
-          <Input
-            className="h-8 text-sm"
-            id="ch-label"
-            onChange={field("label")}
-            placeholder="My Runtime"
-            required
-            value={form.label}
-          />
-        </div>
-        <div className="space-y-1">
-          <p className="text-xs text-muted-foreground">
-            ID <span className="text-muted-foreground/60">(auto-derived)</span>
-          </p>
-          <Input
-            className="h-8 font-mono text-sm"
-            id="ch-id"
-            onChange={field("id")}
-            placeholder="my-runtime"
-            required
-            value={form.id}
-          />
-        </div>
-      </div>
-
-      <div className="space-y-1">
-        <div className="flex items-center gap-2">
-          <p className="text-xs text-muted-foreground">Command</p>
-          <CommandAvailabilityBadge command={form.command} />
-        </div>
-        <Input
-          className="h-8 font-mono text-sm"
-          id="ch-command"
-          onChange={field("command")}
-          placeholder="my-agent-bin"
-          required
-          value={form.command}
-        />
-      </div>
-
-      <div className="space-y-1">
-        <p className="text-xs text-muted-foreground">Arguments</p>
-        <ArgsEditor
-          args={form.args}
-          onChange={(args) => setForm((p) => ({ ...p, args }))}
-        />
-      </div>
-
-      <div className="space-y-1">
-        <p className="text-xs text-muted-foreground">
-          Env vars{" "}
-          <span className="text-muted-foreground/60">
-            (override at spawn time; Buzz-managed vars always win)
-          </span>
-        </p>
-        <EnvEditor
-          env={form.env}
-          onChange={(env) => setForm((p) => ({ ...p, env }))}
-        />
-      </div>
-
-      <div className="space-y-1">
-        <p className="text-xs text-muted-foreground">
-          Docs URL <span className="text-muted-foreground/60">(optional)</span>
-        </p>
-        <Input
-          className="h-8 text-sm"
-          id="ch-docs-url"
-          onChange={field("installInstructionsUrl")}
-          placeholder="https://example.com/docs"
-          value={form.installInstructionsUrl}
-        />
-      </div>
-
-      <div className="space-y-1">
-        <p className="text-xs text-muted-foreground">
-          Install hint{" "}
-          <span className="text-muted-foreground/60">(optional)</span>
-        </p>
-        <Input
-          className="h-8 text-sm"
-          id="ch-install-hint"
-          onChange={field("installHint")}
-          placeholder="npm install -g my-harness"
-          value={form.installHint}
-        />
-      </div>
-
-      {error ? (
-        <p className="rounded-lg border border-destructive/30 bg-destructive/10 px-3 py-1.5 text-sm text-destructive">
-          {error}
-        </p>
-      ) : null}
-
-      <div className="flex justify-end gap-2 pt-1">
-        <Button onClick={onCancel} size="sm" type="button" variant="outline">
-          Cancel
-        </Button>
-        <Button disabled={save.isPending} size="sm" type="submit">
-          {save.isPending ? <Spinner className="mr-2 h-3.5 w-3.5" /> : null}
-          Save
-        </Button>
-      </div>
-    </form>
-  );
-}
-
-// ── Custom harness row ────────────────────────────────────────────────────────
-
-function CustomHarnessRow({ entry }: { entry: AcpRuntimeCatalogEntry }) {
-  const [editing, setEditing] = React.useState(false);
-  const [confirmingDelete, setConfirmingDelete] = React.useState(false);
-  const [deleteError, setDeleteError] = React.useState<string | null>(null);
-  const del = useDeleteCustomHarnessMutation();
-  // Blast-radius data for the delete confirmation — only fetched while the
-  // confirmation is open, so the row list doesn't poll agents. Confirm stays
-  // disabled until both queries settle (deleteConfirmState) so a quick click
-  // can't beat the "N agents will stop launching" warning.
-  const agentsQuery = useManagedAgentsQuery({ enabled: confirmingDelete });
-  const personasQuery = usePersonasQuery({ enabled: confirmingDelete });
-  const confirmState = deleteConfirmState(
-    entry.id,
-    entry.label,
-    agentsQuery,
-    personasQuery,
-  );
-
-  if (editing) {
-    return (
-      <CustomHarnessForm
-        initial={formValuesFromCatalogEntry(entry)}
-        originalId={entry.id}
-        onCancel={() => setEditing(false)}
-        onSaved={() => setEditing(false)}
-      />
-    );
-  }
-
-  return (
-    <div
-      className="flex flex-col gap-2 rounded-2xl border border-border/60 bg-muted/20 px-4 py-3 text-sm"
-      data-testid={`custom-harness-row-${entry.id}`}
-    >
-      <div className="flex items-center gap-3">
-        <Terminal className="h-6 w-6 shrink-0 text-muted-foreground" />
-        <div className="min-w-0 flex-1">
-          <p className="font-medium leading-none">{entry.label}</p>
-          <p className="mt-0.5 font-mono text-xs text-muted-foreground">
-            {entry.command ?? entry.id}
-            {(entry.defaultArgs ?? []).length > 0
-              ? ` ${(entry.defaultArgs ?? []).join(" ")}`
-              : ""}
-          </p>
-        </div>
-        {entry.availability === "available" ? (
-          <span className="inline-flex shrink-0 items-center rounded-md bg-emerald-500/15 px-2 py-0.5 text-xs font-medium text-emerald-600 dark:text-emerald-400">
-            Detected
-          </span>
-        ) : (
-          <span className="inline-flex shrink-0 items-center rounded-md bg-muted px-2 py-0.5 text-xs text-muted-foreground">
-            Not installed
-          </span>
-        )}
-        <div className="flex shrink-0 items-center gap-1">
-          <Button
-            className="h-7 px-3 text-xs"
-            data-testid={`custom-harness-edit-${entry.id}`}
-            onClick={() => setEditing(true)}
-            size="sm"
-            type="button"
-            variant="outline"
-          >
-            Edit
-          </Button>
-          {confirmingDelete ? (
-            <>
-              <Button
-                className="h-7 px-3 text-xs"
-                data-testid={`custom-harness-delete-confirm-${entry.id}`}
-                disabled={del.isPending || !confirmState.canConfirm}
-                onClick={() => {
-                  setDeleteError(null);
-                  del.mutate(entry.id, {
-                    onSuccess: () => setConfirmingDelete(false),
-                    onError: (err) => {
-                      setDeleteError(
-                        err instanceof Error ? err.message : String(err),
-                      );
-                      // Keep confirmation open so user sees the error.
-                    },
-                  });
-                }}
-                size="sm"
-                type="button"
-                variant="destructive"
-              >
-                {del.isPending ? <Spinner className="h-3.5 w-3.5" /> : "Delete"}
-              </Button>
-              <Button
-                className="h-7 px-3 text-xs"
-                onClick={() => {
-                  setConfirmingDelete(false);
-                  setDeleteError(null);
-                }}
-                size="sm"
-                type="button"
-                variant="ghost"
-              >
-                Cancel
-              </Button>
-            </>
-          ) : (
-            <button
-              aria-label={`Delete ${entry.label}`}
-              className="flex h-7 w-7 items-center justify-center rounded-md text-muted-foreground hover:bg-destructive/10 hover:text-destructive"
-              data-testid={`custom-harness-delete-${entry.id}`}
-              onClick={() => {
-                setDeleteError(null);
-                setConfirmingDelete(true);
-              }}
-              type="button"
-            >
-              <Trash2 className="h-4 w-4" />
-            </button>
-          )}
-        </div>
-      </div>
-      {confirmingDelete ? (
-        <p
-          className="rounded-lg border border-amber-500/30 bg-amber-500/10 px-3 py-1.5 text-sm text-amber-600 dark:text-amber-400"
-          data-testid={`custom-harness-delete-warning-${entry.id}`}
-        >
-          {confirmState.message}
-        </p>
-      ) : null}
-      {deleteError ? (
-        <p className="rounded-lg border border-destructive/30 bg-destructive/10 px-3 py-1.5 text-sm text-destructive">
-          {deleteError}
-        </p>
-      ) : null}
-    </div>
-  );
-}
-
-// ── Main component ────────────────────────────────────────────────────────────
-
-export function HarnessManagementCard() {
-  const runtimesQuery = useAcpRuntimesQuery();
-  const catalog = runtimesQuery.data ?? [];
-  const [showForm, setShowForm] = React.useState(false);
-  const [presetPrefill, setPresetPrefill] = React.useState<
-    Partial<CustomFormValues> | undefined
-  >(undefined);
-
-  // Preset entries come from the backend catalog; sort detected-first then
-  // alphabetically within each group — via the tested harnessGalleryLogic helper.
-  const presetEntries = React.useMemo(
-    () => sortedPresetEntries(catalog),
-    [catalog],
-  );
-
-  const customEntries = getCustomEntries(catalog);
-
-  function handleFormClose() {
-    setShowForm(false);
-    setPresetPrefill(undefined);
-  }
-
-  return (
-    <section
-      className="min-w-0 space-y-4"
-      data-testid="settings-harness-management"
-    >
-      <SettingsSectionHeader
-        title="Bring your own harness"
-        description="Register any ACP-speaking agent tool as a selectable runtime. Pick from presets or add a custom command."
-      />
-
-      {/* Preset gallery — driven from backend catalog, detected-first */}
-      {presetEntries.length > 0 ? (
-        <div className="space-y-3">
-          <p className="text-sm font-medium">Presets</p>
-          <div
-            className="grid grid-cols-1 gap-3 sm:grid-cols-2"
-            data-testid="harness-preset-gallery"
-          >
-            {presetEntries.map((entry) => (
-              <PresetCard entry={entry} key={entry.id} />
-            ))}
-          </div>
-        </div>
-      ) : null}
-
-      {/* Custom harnesses list */}
-      {customEntries.length > 0 ? (
-        <div className="space-y-3">
-          <p className="text-sm font-medium">Custom harnesses</p>
-          <div className="space-y-2" data-testid="custom-harness-list">
-            {customEntries.map((entry) => (
-              <CustomHarnessRow entry={entry} key={entry.id} />
-            ))}
-          </div>
-        </div>
-      ) : null}
-
-      {/* Add custom / form toggle */}
-      {showForm ? (
-        <CustomHarnessForm
-          initial={presetPrefill}
-          onCancel={handleFormClose}
-          onSaved={handleFormClose}
-        />
-      ) : (
-        <Button
-          className="gap-2"
-          data-testid="harness-add-custom-button"
-          onClick={() => {
-            setPresetPrefill(undefined);
-            setShowForm(true);
-          }}
-          size="sm"
-          type="button"
-          variant="outline"
-        >
-          <Plus className="h-4 w-4" />
-          Add custom harness
-        </Button>
-      )}
-
-      {runtimesQuery.error instanceof Error ? (
-        <p className="rounded-2xl bg-destructive/10 px-4 py-4 text-sm text-destructive">
-          {runtimesQuery.error.message}
-        </p>
-      ) : null}
-    </section>
-  );
-}
diff --git a/desktop/src/features/settings/ui/DoctorSettingsPanel.tsx b/desktop/src/features/settings/ui/HarnessRow.tsx
similarity index 52%
rename from desktop/src/features/settings/ui/DoctorSettingsPanel.tsx
rename to desktop/src/features/settings/ui/HarnessRow.tsx
index 96127876a82..de6666b8c3b 100644
--- a/desktop/src/features/settings/ui/DoctorSettingsPanel.tsx
+++ b/desktop/src/features/settings/ui/HarnessRow.tsx
@@ -1,15 +1,15 @@
 import * as React from "react";
-import { EllipsisVertical, ExternalLink, RefreshCw } from "lucide-react";
+import { EllipsisVertical, ExternalLink } from "lucide-react";
 import { openUrl } from "@tauri-apps/plugin-opener";
 
 import {
   useAcpAuthMethodsQuery,
-  useAcpRuntimesQuery,
   useConnectAcpRuntimeMutation,
-  useGitBashPrerequisiteQuery,
+  useDeleteCustomHarnessMutation,
   useInstallAcpRuntimeMutation,
+  useManagedAgentsQuery,
+  usePersonasQuery,
 } from "@/features/agents/hooks";
-import { ProfileAvatar } from "@/features/profile/ui/ProfileAvatar";
 import { RuntimeIcon } from "@/features/onboarding/ui/RuntimeIcon";
 import type { AcpAuthMethod, AcpRuntimeCatalogEntry } from "@/shared/api/types";
 import { getInstallErrorMessage } from "@/shared/lib/installError";
@@ -31,66 +31,45 @@ import {
   DropdownMenuItem,
   DropdownMenuTrigger,
 } from "@/shared/ui/dropdown-menu";
-import { SectionHeader } from "@/shared/ui/PageHeader";
 import { Spinner } from "@/shared/ui/spinner";
-import { Switch } from "@/shared/ui/switch";
 
-const RUNTIME_LOGO_URLS: Record<string, string> = {
-  "buzz-agent": "/app-icon@2x.png",
-  claude: "/runtime-icons/claude.png",
-  codex: "/runtime-icons/codex.png",
-  goose: "/runtime-icons/goose.svg",
-};
-
-const RUNTIME_LOGO_SCALE: Record<string, string> = {
-  "buzz-agent": "scale-110",
-  claude: "scale-110",
-  codex: "scale-110",
-  goose: "scale-125",
-};
-
-const RUNTIME_SORT_PRIORITY: Record<string, number> = {
-  "buzz-agent": 0,
-  goose: 1,
-};
+import { CustomHarnessForm } from "./CustomHarnessForm";
+import {
+  adapterUpdateWarning,
+  entryStatusLabel,
+  isDownloadPageUrl,
+} from "./harnessCatalogLogic";
+import { formValuesFromCatalogEntry } from "./harnessFormLogic";
+import { deleteConfirmState } from "./harnessGalleryLogic";
 
+/** Link label for the row's install-instructions URL. Distinct from the
+ * catalog's `installLinkLabel` — rows spell out what the guide covers
+ * (adapter vs CLI) because the row lacks the catalog's setup context. */
 function runtimeInstallGuideLabel(runtime: AcpRuntimeCatalogEntry) {
-  return runtime.availability === "adapter_missing" ||
+  if (
+    runtime.availability === "adapter_missing" ||
     runtime.availability === "adapter_outdated"
-    ? "Adapter install guide"
+  ) {
+    return "Adapter install guide";
+  }
+  return isDownloadPageUrl(runtime.installInstructionsUrl)
+    ? "Download page"
     : "CLI setup guide";
 }
 
 function RuntimeLogo({ runtime }: { runtime: AcpRuntimeCatalogEntry }) {
-  // Presets deliberately emit an empty avatar_url (no remote or user-supplied
-  // icon URLs), so route them through RuntimeIcon — the same component the
-  // preset gallery uses — which owns the PRESET_LOGOS map, the per-logo
-  // contrast treatments (omp needs a dark chip, grok a light one), and the
-  // terminal-glyph fallback for logo-less presets like Cursor (brand assets
-  // not licensed for bundling). Keying on `source` rather than logo presence
-  // keeps both surfaces identical for every preset. Builtins keep the
-  // ProfileAvatar path below.
-  if (runtime.source === "preset") {
-    return (
-      <span
-        className="flex h-9 w-9 shrink-0 items-center justify-center"
-        data-testid={`doctor-runtime-logo-${runtime.id}`}
-      >
-        <RuntimeIcon className="h-9 w-9" runtime={runtime} />
-      </span>
-    );
-  }
-
-  const avatarUrl = RUNTIME_LOGO_URLS[runtime.id] ?? runtime.avatarUrl;
-
+  // Single logo pipeline: RuntimeIcon owns every runtime asset — the
+  // theme-adaptive RUNTIME_MARKS, the BuzzMark, the bundled bitmap maps
+  // (RUNTIME_LOGOS / PRESET_LOGOS), and the terminal-glyph fallback. It never
+  // renders remote or user-supplied avatar URLs (security line), so the row
+  // and the catalog cannot drift apart.
   return (
-    <ProfileAvatar
-      avatarUrl={avatarUrl}
-      className="h-9 w-9 rounded-xl bg-background shadow-none"
-      imageClassName={RUNTIME_LOGO_SCALE[runtime.id]}
-      label={runtime.label}
-      testId={`doctor-runtime-logo-${runtime.id}`}
-    />
+    <span
+      className="flex h-9 w-9 shrink-0 items-center justify-center"
+      data-testid={`doctor-runtime-logo-${runtime.id}`}
+    >
+      <RuntimeIcon className="h-9 w-9" runtime={runtime} />
+    </span>
   );
 }
 
@@ -99,12 +78,16 @@ function RuntimeOverflowMenu({
   connectingMethodId,
   isConnecting,
   onConnect,
+  onDelete,
+  onEdit,
   runtime,
 }: {
   authMethods: AcpAuthMethod[];
   connectingMethodId: string | null;
   isConnecting: boolean;
   onConnect: (method: AcpAuthMethod) => void;
+  onDelete?: () => void;
+  onEdit?: () => void;
   runtime: AcpRuntimeCatalogEntry;
 }) {
   const hasInstructions =
@@ -113,7 +96,11 @@ function RuntimeOverflowMenu({
       runtime.authStatus.status === "logged_out" ||
       runtime.authStatus.status === "config_invalid");
   const hasActions =
-    runtime.nodeRequired || hasInstructions || authMethods.length > 0;
+    runtime.nodeRequired ||
+    hasInstructions ||
+    authMethods.length > 0 ||
+    Boolean(onEdit) ||
+    Boolean(onDelete);
 
   if (!hasActions) {
     return null;
@@ -161,6 +148,23 @@ function RuntimeOverflowMenu({
             {runtimeInstallGuideLabel(runtime)}
           </DropdownMenuItem>
         ) : null}
+        {onEdit ? (
+          <DropdownMenuItem
+            data-testid={`custom-harness-edit-${runtime.id}`}
+            onSelect={onEdit}
+          >
+            Edit
+          </DropdownMenuItem>
+        ) : null}
+        {onDelete ? (
+          <DropdownMenuItem
+            className="text-destructive focus:text-destructive"
+            data-testid={`custom-harness-delete-${runtime.id}`}
+            onSelect={onDelete}
+          >
+            Delete
+          </DropdownMenuItem>
+        ) : null}
       </DropdownMenuContent>
     </DropdownMenu>
   );
@@ -172,6 +176,8 @@ function RuntimeActions({
   isConnecting,
   isInstalling,
   onConnect,
+  onDelete,
+  onEdit,
   onInstall,
   runtime,
 }: {
@@ -180,10 +186,17 @@ function RuntimeActions({
   isConnecting: boolean;
   isInstalling: boolean;
   onConnect: (method: AcpAuthMethod) => void;
+  onDelete?: () => void;
+  onEdit?: () => void;
   onInstall: () => void;
   runtime: AcpRuntimeCatalogEntry;
 }) {
   const isAvailable = runtime.availability === "available";
+  // Signed-out rows carry the amber "Sign-in needed" status chip instead of a
+  // green Ready chip — auth-required is an explicit row-face state, and Ready
+  // must not claim otherwise.
+  const isAuthNeeded =
+    isAvailable && runtime.authStatus.status === "logged_out";
   const canInstall = runtime.canAutoInstall && !runtime.nodeRequired;
   const isWorking = isInstalling || isConnecting;
 
@@ -194,52 +207,62 @@ function RuntimeActions({
         connectingMethodId={connectingMethodId}
         isConnecting={isConnecting}
         onConnect={onConnect}
+        onDelete={onDelete}
+        onEdit={onEdit}
         runtime={runtime}
       />
       {isWorking ? (
-        <div className="flex h-5 w-9 items-center justify-center text-muted-foreground">
+        <div className="flex h-7 w-9 items-center justify-center text-muted-foreground">
           <Spinner
             aria-label={`${runtime.label} ${isInstalling ? "installing" : "connecting"}`}
             className="h-4 w-4 border-2"
             data-testid={`doctor-runtime-loading-${runtime.id}`}
           />
         </div>
-      ) : (
-        <Switch
-          aria-label={`${runtime.label} availability`}
-          checked={isAvailable}
-          className="disabled:cursor-default disabled:opacity-100"
-          data-testid={`doctor-runtime-toggle-${runtime.id}`}
-          disabled={isAvailable || !canInstall}
-          onCheckedChange={(checked) => {
-            if (checked) {
-              onInstall();
-            }
-          }}
-        />
-      )}
+      ) : isAvailable ? (
+        isAuthNeeded ? null : ( // Signed-out rows carry the amber status chip instead; never Install.
+          <span
+            className="inline-flex shrink-0 items-center rounded-md bg-emerald-500/15 px-2 py-0.5 text-xs font-medium text-emerald-600 dark:text-emerald-400"
+            data-testid={`doctor-runtime-ready-${runtime.id}`}
+          >
+            Ready
+          </span>
+        )
+      ) : canInstall ? (
+        // Rows needing multi-step setup render no action here — setup lives in
+        // the Add-runtimes catalog. Custom rows keep their ••• menu instead.
+        <Button
+          aria-label={`Install ${runtime.label}`}
+          className="h-7 px-3 text-xs"
+          data-testid={`doctor-runtime-install-${runtime.id}`}
+          onClick={onInstall}
+          size="sm"
+          type="button"
+          variant="outline"
+        >
+          {runtime.availability === "adapter_outdated" ? "Update" : "Install"}
+        </Button>
+      ) : null}
     </div>
   );
 }
 
 function RuntimeStatusChip({ runtime }: { runtime: AcpRuntimeCatalogEntry }) {
-  const label =
-    runtime.authStatus.status === "config_invalid"
-      ? "Config error"
-      : runtime.availability === "adapter_missing"
-        ? "Adapter needed"
-        : runtime.availability === "adapter_outdated"
-          ? "Update needed"
-          : runtime.availability === "cli_missing" ||
-              runtime.availability === "not_installed"
-            ? "CLI needed"
-            : null;
+  // Single availability→label source: entryStatusLabel drives this row chip
+  // AND the catalog detail chip, so the two surfaces cannot drift. That
+  // includes "Sign-in needed" for installed-but-signed-out runtimes — an
+  // explicit auth-required state on the row face, not just a ••• menu item.
+  const label = entryStatusLabel(runtime);
 
   if (!label) {
     return null;
   }
 
   const isConfigError = runtime.authStatus.status === "config_invalid";
+  const isAuthNeeded =
+    !isConfigError &&
+    runtime.availability === "available" &&
+    runtime.authStatus.status === "logged_out";
 
   return (
     <>
@@ -251,7 +274,9 @@ function RuntimeStatusChip({ runtime }: { runtime: AcpRuntimeCatalogEntry }) {
           "inline-flex shrink-0 items-center rounded-md px-2 py-0.5 text-xs font-medium",
           isConfigError
             ? "bg-destructive/10 text-destructive"
-            : "bg-muted text-muted-foreground",
+            : isAuthNeeded
+              ? "bg-amber-500/15 text-amber-600 dark:text-amber-400"
+              : "bg-muted text-muted-foreground",
         )}
         data-testid={`doctor-runtime-status-${runtime.id}`}
       >
@@ -261,56 +286,28 @@ function RuntimeStatusChip({ runtime }: { runtime: AcpRuntimeCatalogEntry }) {
   );
 }
 
-function RuntimeHeader({
-  authMethods,
-  connectingMethodId,
-  isConnecting,
-  isInstalling,
-  onConnect,
-  onInstall,
-  runtime,
-}: {
-  authMethods: AcpAuthMethod[];
-  connectingMethodId: string | null;
-  isConnecting: boolean;
-  isInstalling: boolean;
-  onConnect: (method: AcpAuthMethod) => void;
-  onInstall: () => void;
-  runtime: AcpRuntimeCatalogEntry;
-}) {
-  return (
-    <div className="flex items-center justify-between gap-4">
-      <div className="flex min-w-0 items-center gap-3">
-        <RuntimeLogo runtime={runtime} />
-        <div className="flex min-w-0 flex-wrap items-center gap-2">
-          <p className="min-w-0 text-sm font-medium">{runtime.label}</p>
-          <RuntimeStatusChip runtime={runtime} />
-        </div>
-      </div>
-      <RuntimeActions
-        authMethods={authMethods}
-        connectingMethodId={connectingMethodId}
-        isConnecting={isConnecting}
-        isInstalling={isInstalling}
-        onConnect={onConnect}
-        onInstall={onInstall}
-        runtime={runtime}
-      />
-    </div>
-  );
-}
-
-function RuntimeRow({
+/**
+ * One row in "Your runtimes".
+ *
+ * Carries the full operational surface for a ready (or one-click-ready)
+ * harness: logo, status chip, auth/overflow menu, install/connect flows, and
+ * — for custom harnesses — edit and delete with the blast-radius guard.
+ */
+export function HarnessRow({
   resetEpoch,
   runtime,
 }: {
   resetEpoch: number;
   runtime: AcpRuntimeCatalogEntry;
 }) {
+  const isCustom = runtime.source === "custom";
   const [terminalLaunchMethodId, setTerminalLaunchMethodId] = React.useState<
     string | null
   >(null);
   const [isUpdateWarningOpen, setIsUpdateWarningOpen] = React.useState(false);
+  const [editing, setEditing] = React.useState(false);
+  const [confirmingDelete, setConfirmingDelete] = React.useState(false);
+  const [deleteError, setDeleteError] = React.useState<string | null>(null);
   // Each row owns its mutation instance so concurrent installs each track
   // their own isPending / result state independently.
   const installMutation = useInstallAcpRuntimeMutation();
@@ -328,6 +325,20 @@ function RuntimeRow({
   const isInstalling = installMutation.isPending;
   const installError = installResult?.error ?? null;
 
+  const del = useDeleteCustomHarnessMutation();
+  // Blast-radius data for the delete confirmation — only fetched while the
+  // confirmation is open, so the row list doesn't poll agents. Confirm stays
+  // disabled until both queries settle (deleteConfirmState) so a quick click
+  // can't beat the "N agents will stop launching" warning.
+  const agentsQuery = useManagedAgentsQuery({ enabled: confirmingDelete });
+  const personasQuery = usePersonasQuery({ enabled: confirmingDelete });
+  const confirmState = deleteConfirmState(
+    runtime.id,
+    runtime.label,
+    agentsQuery,
+    personasQuery,
+  );
+
   function handleInstall() {
     setInstallResult(null);
     installMutation.mutate(runtime.id, {
@@ -374,42 +385,71 @@ function RuntimeRow({
         }`
       : null;
 
+  if (editing) {
+    return (
+      <CustomHarnessForm
+        initial={formValuesFromCatalogEntry(runtime)}
+        originalId={runtime.id}
+        onCancel={() => setEditing(false)}
+        onSaved={() => setEditing(false)}
+      />
+    );
+  }
+
   return (
     <div
       className="min-h-16 rounded-2xl border border-border/60 bg-muted/20 px-4 py-3.5 text-sm"
       data-testid={`doctor-runtime-${runtime.id}`}
     >
       <div className="min-w-0">
-        <RuntimeHeader
-          authMethods={authMethods}
-          connectingMethodId={connectMutation.variables?.methodId ?? null}
-          isConnecting={connectMutation.isPending}
-          isInstalling={isInstalling}
-          onConnect={(method) => {
-            setTerminalLaunchMethodId(null);
-            connectMutation.mutate(
-              {
-                runtimeId: runtime.id,
-                methodId: method.id,
-              },
-              {
-                onSuccess: (result) => {
-                  if (result.launched && method.type === "terminal") {
-                    setTerminalLaunchMethodId(method.id);
-                  }
+        <div className="flex items-center justify-between gap-4">
+          <div className="flex min-w-0 items-center gap-3">
+            <RuntimeLogo runtime={runtime} />
+            <div className="flex min-w-0 flex-wrap items-center gap-2">
+              <p className="min-w-0 text-sm font-medium">{runtime.label}</p>
+              <RuntimeStatusChip runtime={runtime} />
+            </div>
+          </div>
+          <RuntimeActions
+            authMethods={authMethods}
+            connectingMethodId={connectMutation.variables?.methodId ?? null}
+            isConnecting={connectMutation.isPending}
+            isInstalling={isInstalling}
+            onConnect={(method) => {
+              setTerminalLaunchMethodId(null);
+              connectMutation.mutate(
+                {
+                  runtimeId: runtime.id,
+                  methodId: method.id,
+                },
+                {
+                  onSuccess: (result) => {
+                    if (result.launched && method.type === "terminal") {
+                      setTerminalLaunchMethodId(method.id);
+                    }
+                  },
                 },
-              },
-            );
-          }}
-          onInstall={() => {
-            if (runtime.availability === "adapter_outdated") {
-              setIsUpdateWarningOpen(true);
-              return;
+              );
+            }}
+            onDelete={
+              isCustom
+                ? () => {
+                    setDeleteError(null);
+                    setConfirmingDelete(true);
+                  }
+                : undefined
             }
-            handleInstall();
-          }}
-          runtime={runtime}
-        />
+            onEdit={isCustom ? () => setEditing(true) : undefined}
+            onInstall={() => {
+              if (runtime.availability === "adapter_outdated") {
+                setIsUpdateWarningOpen(true);
+                return;
+              }
+              handleInstall();
+            }}
+            runtime={runtime}
+          />
+        </div>
 
         {runtime.availability !== "available" ? (
           <div
@@ -464,6 +504,57 @@ function RuntimeRow({
             to re-check {runtime.label}.
           </p>
         ) : null}
+        {confirmingDelete ? (
+          <div className="mt-2 space-y-2">
+            <p
+              className="rounded-lg border border-amber-500/30 bg-amber-500/10 px-3 py-1.5 text-sm text-amber-600 dark:text-amber-400"
+              data-testid={`custom-harness-delete-warning-${runtime.id}`}
+            >
+              {confirmState.message}
+            </p>
+            <div className="flex justify-end gap-2">
+              <Button
+                className="h-7 px-3 text-xs"
+                onClick={() => {
+                  setConfirmingDelete(false);
+                  setDeleteError(null);
+                }}
+                size="sm"
+                type="button"
+                variant="ghost"
+              >
+                Cancel
+              </Button>
+              <Button
+                className="h-7 px-3 text-xs"
+                data-testid={`custom-harness-delete-confirm-${runtime.id}`}
+                disabled={del.isPending || !confirmState.canConfirm}
+                onClick={() => {
+                  setDeleteError(null);
+                  del.mutate(runtime.id, {
+                    onSuccess: () => setConfirmingDelete(false),
+                    onError: (err) => {
+                      setDeleteError(
+                        err instanceof Error ? err.message : String(err),
+                      );
+                      // Keep confirmation open so user sees the error.
+                    },
+                  });
+                }}
+                size="sm"
+                type="button"
+                variant="destructive"
+              >
+                {del.isPending ? <Spinner className="h-3.5 w-3.5" /> : "Delete"}
+              </Button>
+            </div>
+          </div>
+        ) : null}
+        {deleteError ? (
+          <p className="mt-2 rounded-lg border border-destructive/30 bg-destructive/10 px-3 py-1.5 text-sm text-destructive">
+            {deleteError}
+          </p>
+        ) : null}
       </div>
       <AlertDialog
         onOpenChange={setIsUpdateWarningOpen}
@@ -473,9 +564,7 @@ function RuntimeRow({
           <AlertDialogHeader>
             <AlertDialogTitle>Update {runtime.label} adapter?</AlertDialogTitle>
             <AlertDialogDescription>
-              This replaces the machine-wide codex-acp adapter. Older Buzz
-              releases using the legacy adapter may lose community access until
-              @zed-industries/codex-acp@0.16.0 is restored.
+              {adapterUpdateWarning(runtime)}
             </AlertDialogDescription>
           </AlertDialogHeader>
           <AlertDialogFooter>
@@ -492,152 +581,3 @@ function RuntimeRow({
     </div>
   );
 }
-
-function GitBashCard({
-  prerequisite,
-}: {
-  prerequisite: NonNullable<
-    ReturnType<typeof useGitBashPrerequisiteQuery>["data"]
-  >;
-}) {
-  return (
-    <div
-      className={cn(
-        "min-h-16 rounded-2xl border px-4 py-4 text-sm",
-        prerequisite.available
-          ? "border-border/60 bg-muted/20"
-          : "border-amber-500/20 bg-amber-500/5",
-      )}
-      data-testid="doctor-git-bash"
-    >
-      <div className="min-w-0">
-        <div className="flex flex-wrap items-center justify-between gap-4">
-          <div className="flex min-w-0 flex-wrap items-center gap-2">
-            <p className="text-sm font-medium">Git Bash</p>
-            <span aria-hidden="true" className="text-muted-foreground/50">
-              ·
-            </span>
-            <span
-              className={cn(
-                "inline-flex shrink-0 items-center rounded-md px-2 py-0.5 text-xs font-medium",
-                prerequisite.available
-                  ? "bg-emerald-500/15 text-emerald-600 dark:text-emerald-400"
-                  : "bg-amber-500/15 text-amber-600 dark:text-amber-400",
-              )}
-            >
-              {prerequisite.available ? "Available" : "Action needed"}
-            </span>
-          </div>
-          {!prerequisite.available ? (
-            <button
-              className="inline-flex shrink-0 items-center gap-1 text-xs text-muted-foreground underline-offset-2 hover:text-foreground hover:underline"
-              onClick={() => void openUrl(prerequisite.installInstructionsUrl)}
-              type="button"
-            >
-              <ExternalLink className="h-4 w-4" /> Install Git for Windows
-            </button>
-          ) : null}
-        </div>
-        {!prerequisite.available ? (
-          <div className="mt-3 space-y-1 text-sm text-muted-foreground">
-            <p>Required for buzz-agent shell tools on Windows.</p>
-            <p>{prerequisite.installHint}</p>
-          </div>
-        ) : null}
-      </div>
-    </div>
-  );
-}
-
-export function DoctorSettingsPanel() {
-  const runtimesQuery = useAcpRuntimesQuery();
-  const gitBashQuery = useGitBashPrerequisiteQuery();
-  const runtimes = React.useMemo(
-    () =>
-      [...(runtimesQuery.data ?? [])].sort(
-        (left, right) =>
-          (RUNTIME_SORT_PRIORITY[left.id] ?? Number.MAX_SAFE_INTEGER) -
-          (RUNTIME_SORT_PRIORITY[right.id] ?? Number.MAX_SAFE_INTEGER),
-      ),
-    [runtimesQuery.data],
-  );
-  const isRefreshing = runtimesQuery.isFetching;
-  // Incremented each time the user clicks "Check again" so RuntimeRow
-  // useEffect clears stale install results from before the refresh.
-  const [resetEpoch, setResetEpoch] = React.useState(0);
-
-  return (
-    <section
-      className="min-w-0 space-y-4"
-      data-testid="settings-agent-runtimes"
-    >
-      <SectionHeader
-        className="items-center"
-        title="Agent runtimes"
-        description="Choose which agent tools Buzz can use on this device."
-        action={
-          <Button
-            disabled={isRefreshing}
-            onClick={() => {
-              setResetEpoch((e) => e + 1);
-              void runtimesQuery.refetch();
-              void gitBashQuery.refetch();
-            }}
-            size="sm"
-            type="button"
-            variant="outline"
-          >
-            <RefreshCw
-              className={cn("h-4 w-4", isRefreshing && "animate-spin")}
-            />
-            Check again
-          </Button>
-        }
-      />
-
-      <div className="space-y-8">
-        {gitBashQuery.data ? (
-          <section>
-            <div className="mb-3 text-sm">
-              <h2 className="text-lg font-semibold tracking-tight">
-                System prerequisites
-              </h2>
-              <p className="mt-1 text-sm font-normal text-muted-foreground">
-                Windows tools required by supported agents.
-              </p>
-            </div>
-            <GitBashCard prerequisite={gitBashQuery.data} />
-          </section>
-        ) : null}
-
-        <section aria-label="Supported agent runtimes">
-          {runtimesQuery.isLoading ? (
-            <div className="rounded-2xl bg-muted/20 px-4 py-4 text-sm font-normal text-muted-foreground">
-              Checking agent runtimes...
-            </div>
-          ) : runtimes.length > 0 ? (
-            <div className="space-y-3" data-testid="doctor-runtime-list">
-              {runtimes.map((runtime) => (
-                <RuntimeRow
-                  key={runtime.id}
-                  resetEpoch={resetEpoch}
-                  runtime={runtime}
-                />
-              ))}
-            </div>
-          ) : (
-            <div className="rounded-2xl bg-amber-500/10 px-4 py-4 text-sm text-warning">
-              No supported agent runtimes found.
-            </div>
-          )}
-
-          {runtimesQuery.error instanceof Error ? (
-            <p className="mt-3 rounded-2xl bg-destructive/10 px-4 py-4 text-sm text-destructive">
-              {runtimesQuery.error.message}
-            </p>
-          ) : null}
-        </section>
-      </div>
-    </section>
-  );
-}
diff --git a/desktop/src/features/settings/ui/HarnessesSettingsPanel.tsx b/desktop/src/features/settings/ui/HarnessesSettingsPanel.tsx
new file mode 100644
index 00000000000..10ca2a377f1
--- /dev/null
+++ b/desktop/src/features/settings/ui/HarnessesSettingsPanel.tsx
@@ -0,0 +1,211 @@
+import * as React from "react";
+import { ExternalLink, Plus, RefreshCw } from "lucide-react";
+import { openUrl } from "@tauri-apps/plugin-opener";
+
+import {
+  useAcpRuntimesQuery,
+  useGitBashPrerequisiteQuery,
+} from "@/features/agents/hooks";
+import type { AcpRuntimeCatalogEntry } from "@/shared/api/types";
+import { cn } from "@/shared/lib/cn";
+import { Button } from "@/shared/ui/button";
+import { SectionHeader } from "@/shared/ui/PageHeader";
+
+import { HarnessCatalogDialog } from "./HarnessCatalogDialog";
+import { HarnessRow } from "./HarnessRow";
+import { stableRowOrder, yourHarnessEntries } from "./harnessCatalogLogic";
+
+function GitBashCard({
+  prerequisite,
+}: {
+  prerequisite: NonNullable<
+    ReturnType<typeof useGitBashPrerequisiteQuery>["data"]
+  >;
+}) {
+  return (
+    <div
+      className={cn(
+        "min-h-16 rounded-2xl border px-4 py-4 text-sm",
+        prerequisite.available
+          ? "border-border/60 bg-muted/20"
+          : "border-amber-500/20 bg-amber-500/5",
+      )}
+      data-testid="doctor-git-bash"
+    >
+      <div className="min-w-0">
+        <div className="flex flex-wrap items-center justify-between gap-4">
+          <div className="flex min-w-0 flex-wrap items-center gap-2">
+            <p className="text-sm font-medium">Git Bash</p>
+            <span aria-hidden="true" className="text-muted-foreground/50">
+              ·
+            </span>
+            <span
+              className={cn(
+                "inline-flex shrink-0 items-center rounded-md px-2 py-0.5 text-xs font-medium",
+                prerequisite.available
+                  ? "bg-emerald-500/15 text-emerald-600 dark:text-emerald-400"
+                  : "bg-amber-500/15 text-amber-600 dark:text-amber-400",
+              )}
+            >
+              {prerequisite.available ? "Available" : "Action needed"}
+            </span>
+          </div>
+          {!prerequisite.available ? (
+            <button
+              className="inline-flex shrink-0 items-center gap-1 text-xs text-muted-foreground underline-offset-2 hover:text-foreground hover:underline"
+              onClick={() => void openUrl(prerequisite.installInstructionsUrl)}
+              type="button"
+            >
+              <ExternalLink className="h-4 w-4" /> Install Git for Windows
+            </button>
+          ) : null}
+        </div>
+        {!prerequisite.available ? (
+          <div className="mt-3 space-y-1 text-sm text-muted-foreground">
+            <p>Required for buzz-agent shell tools on Windows.</p>
+            <p>{prerequisite.installHint}</p>
+          </div>
+        ) : null}
+      </div>
+    </div>
+  );
+}
+
+/**
+ * Consolidated "Agent runtimes" surface for Settings → Agents.
+ *
+ * Replaces the old "Agent runtimes" (DoctorSettingsPanel) + "Bring your own
+ * harness" (HarnessManagementCard) pair with one operational area:
+ *
+ * - **Your runtimes** — stable rows for ready (or one-click-ready) runtimes
+ *   and everything the user authored. Row order never changes when a runtime
+ *   installs (stableRowOrder), so the page doesn't jump under the pointer.
+ * - **Add runtimes** — a master-detail catalog dialog for everything that
+ *   needs multi-step setup, plus the custom-harness form.
+ */
+export function HarnessesSettingsPanel() {
+  const runtimesQuery = useAcpRuntimesQuery();
+  const gitBashQuery = useGitBashPrerequisiteQuery();
+  const [catalogOpen, setCatalogOpen] = React.useState(false);
+  // Incremented each time the user clicks "Check again" so HarnessRow
+  // useEffect clears stale install results from before the refresh.
+  const [resetEpoch, setResetEpoch] = React.useState(0);
+
+  const entries = React.useMemo(
+    () => yourHarnessEntries(runtimesQuery.data ?? []),
+    [runtimesQuery.data],
+  );
+
+  // Sticky row order: initial sort once, then preserve relative order across
+  // refetches/toggles so enabling a harness never reorders the list.
+  const orderRef = React.useRef<string[]>([]);
+  const rows = React.useMemo(() => {
+    orderRef.current = stableRowOrder(orderRef.current, entries);
+    const byId = new Map(entries.map((e) => [e.id, e]));
+    return orderRef.current
+      .map((id) => byId.get(id))
+      .filter((e): e is AcpRuntimeCatalogEntry => e !== undefined);
+  }, [entries]);
+
+  const isRefreshing = runtimesQuery.isFetching;
+
+  return (
+    <section className="min-w-0 space-y-4" data-testid="settings-harnesses">
+      <SectionHeader
+        className="items-center"
+        title="Agent runtimes"
+        description="Choose which agent tools Buzz can use on this device."
+        action={
+          <Button
+            disabled={isRefreshing}
+            onClick={() => {
+              setResetEpoch((e) => e + 1);
+              void runtimesQuery.refetch();
+              void gitBashQuery.refetch();
+            }}
+            size="sm"
+            type="button"
+            variant="outline"
+          >
+            <RefreshCw
+              className={cn("h-4 w-4", isRefreshing && "animate-spin")}
+            />
+            Check again
+          </Button>
+        }
+      />
+
+      <div className="space-y-8">
+        {gitBashQuery.data ? (
+          <section>
+            <div className="mb-3 text-sm">
+              <h2 className="text-lg font-semibold tracking-tight">
+                System prerequisites
+              </h2>
+              <p className="mt-1 text-sm font-normal text-muted-foreground">
+                Windows tools required by supported agents.
+              </p>
+            </div>
+            <GitBashCard prerequisite={gitBashQuery.data} />
+          </section>
+        ) : null}
+
+        <section aria-label="Your runtimes">
+          {/* The sub-header only earns its keep when another section (System
+              prerequisites, Windows-only) shares the page; otherwise it just
+              restates the page header. */}
+          {gitBashQuery.data ? (
+            <div className="mb-3 text-sm">
+              <h2 className="text-lg font-semibold tracking-tight">
+                Your runtimes
+              </h2>
+              <p className="mt-1 text-sm font-normal text-muted-foreground">
+                Ready to use, or one click from installed.
+              </p>
+            </div>
+          ) : null}
+
+          {runtimesQuery.isLoading ? (
+            <div className="rounded-2xl bg-muted/20 px-4 py-4 text-sm font-normal text-muted-foreground">
+              Checking agent runtimes...
+            </div>
+          ) : rows.length > 0 ? (
+            <div className="space-y-3" data-testid="doctor-runtime-list">
+              {rows.map((runtime) => (
+                <HarnessRow
+                  key={runtime.id}
+                  resetEpoch={resetEpoch}
+                  runtime={runtime}
+                />
+              ))}
+            </div>
+          ) : (
+            <div className="rounded-2xl bg-amber-500/10 px-4 py-4 text-sm text-warning">
+              No agent runtimes ready yet — add one below.
+            </div>
+          )}
+
+          {runtimesQuery.error instanceof Error ? (
+            <p className="mt-3 rounded-2xl bg-destructive/10 px-4 py-4 text-sm text-destructive">
+              {runtimesQuery.error.message}
+            </p>
+          ) : null}
+
+          <Button
+            className="mt-3 gap-2"
+            data-testid="harness-add-button"
+            onClick={() => setCatalogOpen(true)}
+            size="sm"
+            type="button"
+            variant="outline"
+          >
+            <Plus className="h-4 w-4" />
+            Add runtimes
+          </Button>
+        </section>
+      </div>
+
+      <HarnessCatalogDialog onOpenChange={setCatalogOpen} open={catalogOpen} />
+    </section>
+  );
+}
diff --git a/desktop/src/features/settings/ui/SettingsPanels.tsx b/desktop/src/features/settings/ui/SettingsPanels.tsx
index 1940277774f..e74d1f38371 100644
--- a/desktop/src/features/settings/ui/SettingsPanels.tsx
+++ b/desktop/src/features/settings/ui/SettingsPanels.tsx
@@ -69,8 +69,7 @@ import {
   withAccentPreviewVars,
 } from "@/shared/theme/useThemePreviewVars";
 import { ChannelTemplatesSettingsCard } from "./ChannelTemplatesSettingsCard";
-import { DoctorSettingsPanel } from "./DoctorSettingsPanel";
-import { HarnessManagementCard } from "./HarnessManagementCard";
+import { HarnessesSettingsPanel } from "./HarnessesSettingsPanel";
 import { ExperimentalFeaturesCard } from "./ExperimentalFeaturesCard";
 import { KeyboardShortcutsCard } from "./KeyboardShortcutsCard";
 import { MeshComputeSettingsCard } from "@/features/mesh-compute/ui/MeshComputeSettingsCard";
@@ -78,7 +77,6 @@ import { MobilePairingCard } from "./MobilePairingCard";
 import { ModerationQueueCard } from "./ModerationQueueCard";
 import { NotificationSettingsCard } from "./NotificationSettingsCard";
 import { PreventSleepSettingsCard } from "./PreventSleepSettingsCard";
-import { ActiveAgentCommunitiesSettingsCard } from "./ActiveAgentCommunitiesSettingsCard";
 import { AgentDefaultsSettingsCard } from "./AgentDefaultsSettingsCard";
 import { HostedCommunitiesSettingsCard } from "./HostedCommunitiesSettingsCard";
 import { SettingsOptionGroup, SettingsOptionRow } from "./SettingsOptionGroup";
@@ -815,9 +813,7 @@ export function renderSettingsSection(
       return (
         <div className="space-y-12">
           <PreventSleepSettingsCard />
-          <DoctorSettingsPanel />
-          <HarnessManagementCard />
-          <ActiveAgentCommunitiesSettingsCard />
+          <HarnessesSettingsPanel />
           <AgentDefaultsSettingsCard />
         </div>
       );
diff --git a/desktop/src/features/settings/ui/harnessCatalogCopy.ts b/desktop/src/features/settings/ui/harnessCatalogCopy.ts
new file mode 100644
index 00000000000..79c55f01482
--- /dev/null
+++ b/desktop/src/features/settings/ui/harnessCatalogCopy.ts
@@ -0,0 +1,55 @@
+/**
+ * Curated one-line descriptions for harness catalog entries.
+ *
+ * Content policy (agreed in the BYOH UX thread): exactly ONE neutral,
+ * vendor-sourced category sentence per entry — what kind of tool it is —
+ * with provenance cited inline. No feature inventories, no marketing
+ * superlatives, no volatile model/provider claims. Operational setup copy
+ * (status, hints) stays generated from runtime state, never hand-authored
+ * here. Research: ~/.buzz/RESEARCH/BYOH_CATALOG_IA.md.
+ */
+
+const HARNESS_DESCRIPTIONS: Record<string, string> = {
+  // Built-in runtimes.
+  "buzz-agent": "Buzz's built-in agent runtime, bundled with the app.",
+  // Source: https://code.claude.com/docs/en/overview — "Claude Code is an
+  // agentic coding tool" that lives in the terminal.
+  claude: "Anthropic's agentic coding tool that runs in the terminal.",
+  // Source: https://developers.openai.com/codex — "Codex is OpenAI's coding
+  // agent".
+  codex: "OpenAI's coding agent, connected through the codex-acp adapter.",
+  // Source: https://block.github.io/goose/ — "an open source, extensible AI
+  // agent".
+  goose: "Block's open-source, extensible AI agent.",
+
+  // Bundled presets — sources per RESEARCH/BYOH_CATALOG_IA.md.
+  // Source: https://cursor.com/docs/cli/acp
+  cursor: "Cursor's coding agent, connected to Buzz through its ACP server.",
+  // Source: https://github.com/can1357/oh-my-pi
+  omp: "A terminal coding agent with integrated development tools.",
+  // Source: https://build.x.ai (docs unavailable during research; kept
+  // deliberately conservative).
+  grok: "xAI's coding agent, connected to Buzz through its ACP entrypoint.",
+  // Source: https://github.com/anomalyco/opencode
+  opencode: "An open-source coding agent.",
+  // Sources: https://github.com/MoonshotAI/kimi-cli,
+  // https://moonshotai.github.io/kimi-cli/en/
+  kimi: "A terminal coding agent for software development and command-line tasks.",
+  // Sources: https://ampcode.com, https://ampcode.com/manual
+  amp: "A coding agent from Sourcegraph.",
+  // Sources: https://github.com/NousResearch/hermes-agent,
+  // https://hermes-agent.nousresearch.com/docs/
+  hermes: "A general-purpose AI agent from Nous Research.",
+  // Sources: https://github.com/openclaw/openclaw,
+  // https://docs.openclaw.ai/start/getting-started
+  openclaw: "A personal AI assistant that runs on your own devices.",
+};
+
+/**
+ * One neutral sentence describing the harness, or null for entries we don't
+ * curate (customs, unknown ids). Callers must render nothing rather than
+ * invent copy.
+ */
+export function harnessDescription(id: string): string | null {
+  return HARNESS_DESCRIPTIONS[id.trim().toLowerCase()] ?? null;
+}
diff --git a/desktop/src/features/settings/ui/harnessCatalogLogic.test.mjs b/desktop/src/features/settings/ui/harnessCatalogLogic.test.mjs
new file mode 100644
index 00000000000..28843bdfd27
--- /dev/null
+++ b/desktop/src/features/settings/ui/harnessCatalogLogic.test.mjs
@@ -0,0 +1,400 @@
+import assert from "node:assert/strict";
+import { describe, it } from "node:test";
+
+import {
+  adapterUpdateWarning,
+  catalogDialogEntries,
+  catalogPrimaryAction,
+  entryStatusLabel,
+  filterCatalogEntries,
+  groupCatalogEntries,
+  isYourHarnessEntry,
+  stableRowOrder,
+  yourHarnessEntries,
+} from "./harnessCatalogLogic.ts";
+
+// ── Minimal catalog entry factory ────────────────────────────────────────────
+
+function entry(overrides = {}) {
+  return {
+    id: "test-id",
+    label: "Test",
+    source: "preset",
+    availability: "not_installed",
+    avatarUrl: "",
+    command: null,
+    binaryPath: null,
+    defaultArgs: [],
+    mcpCommand: null,
+    modelEnvVar: null,
+    providerEnvVar: null,
+    thinkingEnvVar: null,
+    installHint: "",
+    installInstructionsUrl: "",
+    canAutoInstall: false,
+    requiresExternalCli: false,
+    underlyingCliPath: null,
+    nodeRequired: false,
+    authStatus: { status: "not_applicable" },
+    loginHint: null,
+    ...overrides,
+  };
+}
+
+// ── isYourHarnessEntry / yourHarnessEntries ──────────────────────────────────
+
+describe("isYourHarnessEntry", () => {
+  it("includes available entries", () => {
+    assert.equal(
+      isYourHarnessEntry(entry({ availability: "available" })),
+      true,
+    );
+  });
+
+  it("includes one-click installable entries (auto-install, no node gate)", () => {
+    assert.equal(
+      isYourHarnessEntry(entry({ canAutoInstall: true, nodeRequired: false })),
+      true,
+    );
+  });
+
+  it("excludes auto-installable entries blocked on Node.js", () => {
+    assert.equal(
+      isYourHarnessEntry(entry({ canAutoInstall: true, nodeRequired: true })),
+      false,
+    );
+  });
+
+  it("excludes presets needing manual setup", () => {
+    assert.equal(
+      isYourHarnessEntry(
+        entry({ availability: "cli_missing", canAutoInstall: false }),
+      ),
+      false,
+    );
+  });
+
+  it("always includes custom entries regardless of readiness", () => {
+    assert.equal(
+      isYourHarnessEntry(
+        entry({ source: "custom", availability: "not_installed" }),
+      ),
+      true,
+    );
+  });
+});
+
+describe("yourHarnessEntries", () => {
+  it("filters to owned/ready rows only", () => {
+    const catalog = [
+      entry({ id: "ready", availability: "available" }),
+      entry({ id: "needs-setup", availability: "cli_missing" }),
+      entry({ id: "mine", source: "custom" }),
+    ];
+    assert.deepEqual(
+      yourHarnessEntries(catalog).map((e) => e.id),
+      ["ready", "mine"],
+    );
+  });
+});
+
+// ── catalogDialogEntries ─────────────────────────────────────────────────────
+
+describe("catalogDialogEntries", () => {
+  it("excludes custom entries and sorts needs-setup first, alpha within group", () => {
+    const catalog = [
+      entry({ id: "zed", label: "Zed", availability: "available" }),
+      entry({ id: "mine", label: "Mine", source: "custom" }),
+      entry({ id: "beta", label: "Beta", availability: "cli_missing" }),
+      entry({ id: "alpha", label: "Alpha", availability: "not_installed" }),
+    ];
+    assert.deepEqual(
+      catalogDialogEntries(catalog).map((e) => e.id),
+      ["alpha", "beta", "zed"],
+    );
+  });
+});
+
+// ── groupCatalogEntries ──────────────────────────────────────────────────────
+
+describe("groupCatalogEntries", () => {
+  it("splits ready entries into installed, everything else into setup", () => {
+    const entries = [
+      entry({ id: "needs-cli", availability: "cli_missing" }),
+      entry({ id: "ready", availability: "available" }),
+      entry({ id: "needs-adapter", availability: "adapter_missing" }),
+    ];
+    const groups = groupCatalogEntries(entries);
+    assert.deepEqual(
+      groups.setup.map((e) => e.id),
+      ["needs-cli", "needs-adapter"],
+    );
+    assert.deepEqual(
+      groups.installed.map((e) => e.id),
+      ["ready"],
+    );
+  });
+
+  it("preserves input order within each group", () => {
+    const entries = [
+      entry({ id: "b", availability: "available" }),
+      entry({ id: "a", availability: "available" }),
+    ];
+    assert.deepEqual(
+      groupCatalogEntries(entries).installed.map((e) => e.id),
+      ["b", "a"],
+    );
+  });
+
+  it("handles empty input", () => {
+    assert.deepEqual(groupCatalogEntries([]), { setup: [], installed: [] });
+  });
+});
+
+// ── filterCatalogEntries ─────────────────────────────────────────────────────
+
+describe("filterCatalogEntries", () => {
+  const entries = [
+    entry({ id: "kimi", label: "Kimi Code", command: "kimi" }),
+    entry({ id: "amp", label: "Amp", command: "amp" }),
+    entry({ id: "omp", label: "Oh My Pi", command: "omp" }),
+  ];
+
+  it("returns everything for a blank query", () => {
+    assert.equal(filterCatalogEntries(entries, "  ").length, 3);
+  });
+
+  it("matches label case-insensitively", () => {
+    assert.deepEqual(
+      filterCatalogEntries(entries, "kIMi").map((e) => e.id),
+      ["kimi"],
+    );
+  });
+
+  it("matches command", () => {
+    assert.deepEqual(
+      filterCatalogEntries(entries, "omp").map((e) => e.id),
+      ["omp"],
+    );
+  });
+
+  it("returns empty for no match", () => {
+    assert.equal(filterCatalogEntries(entries, "zzz").length, 0);
+  });
+});
+
+// ── stableRowOrder ───────────────────────────────────────────────────────────
+
+describe("stableRowOrder", () => {
+  it("initial order: priority builtins, then ready, then alpha", () => {
+    const entries = [
+      entry({ id: "zeta", label: "Zeta", availability: "available" }),
+      entry({
+        id: "goose",
+        label: "goose",
+        availability: "available",
+        source: "builtin",
+      }),
+      entry({ id: "off", label: "Aardvark", canAutoInstall: true }),
+      entry({
+        id: "buzz-agent",
+        label: "Buzz",
+        availability: "available",
+        source: "builtin",
+      }),
+    ];
+    assert.deepEqual(stableRowOrder([], entries), [
+      "buzz-agent",
+      "goose",
+      "zeta",
+      "off",
+    ]);
+  });
+
+  it("keeps previous relative order when availability changes (no reorder on install)", () => {
+    const before = ["buzz-agent", "zeta", "off"];
+    const entries = [
+      entry({ id: "off", label: "Aardvark", availability: "available" }), // just installed
+      entry({ id: "zeta", label: "Zeta", availability: "available" }),
+      entry({
+        id: "buzz-agent",
+        label: "Buzz",
+        availability: "available",
+        source: "builtin",
+      }),
+    ];
+    assert.deepEqual(stableRowOrder(before, entries), [
+      "buzz-agent",
+      "zeta",
+      "off",
+    ]);
+  });
+
+  it("drops removed ids and appends newcomers at the end", () => {
+    const before = ["buzz-agent", "deleted", "zeta"];
+    const entries = [
+      entry({ id: "zeta", label: "Zeta", availability: "available" }),
+      entry({ id: "buzz-agent", label: "Buzz", availability: "available" }),
+      entry({ id: "new-one", label: "New One", availability: "available" }),
+    ];
+    assert.deepEqual(stableRowOrder(before, entries), [
+      "buzz-agent",
+      "zeta",
+      "new-one",
+    ]);
+  });
+});
+
+// ── entryStatusLabel ─────────────────────────────────────────────────────────
+
+describe("entryStatusLabel", () => {
+  it("config error wins over availability", () => {
+    assert.equal(
+      entryStatusLabel(
+        entry({
+          availability: "available",
+          authStatus: { status: "config_invalid", diagnostic: "boom" },
+        }),
+      ),
+      "Config error",
+    );
+  });
+
+  it("maps availability states", () => {
+    assert.equal(
+      entryStatusLabel(entry({ availability: "adapter_missing" })),
+      "Adapter needed",
+    );
+    assert.equal(
+      entryStatusLabel(entry({ availability: "adapter_outdated" })),
+      "Update needed",
+    );
+    assert.equal(
+      entryStatusLabel(entry({ availability: "cli_missing" })),
+      "CLI needed",
+    );
+    assert.equal(
+      entryStatusLabel(entry({ availability: "not_installed" })),
+      "CLI needed",
+    );
+  });
+
+  it("flags sign-in for available-but-logged-out", () => {
+    assert.equal(
+      entryStatusLabel(
+        entry({
+          availability: "available",
+          authStatus: { status: "logged_out" },
+        }),
+      ),
+      "Sign-in needed",
+    );
+  });
+
+  it("is silent for ready + logged in", () => {
+    assert.equal(
+      entryStatusLabel(
+        entry({
+          availability: "available",
+          authStatus: { status: "logged_in" },
+        }),
+      ),
+      null,
+    );
+  });
+});
+
+// ── adapterUpdateWarning ─────────────────────────────────────────────────────
+
+describe("adapterUpdateWarning", () => {
+  it("keeps the codex-specific machine-wide caveat for codex", () => {
+    const copy = adapterUpdateWarning(
+      entry({ id: "codex", label: "Codex", command: "codex-acp" }),
+    );
+    assert.match(copy, /codex-acp/);
+    assert.match(copy, /@zed-industries\/codex-acp@0\.16\.0/);
+  });
+
+  it("never leaks codex package copy into other runtimes", () => {
+    const copy = adapterUpdateWarning(
+      entry({
+        id: "claude",
+        label: "Claude Code",
+        command: "claude-agent-acp",
+      }),
+    );
+    assert.match(copy, /claude-agent-acp/);
+    assert.doesNotMatch(copy, /codex/i);
+    assert.doesNotMatch(copy, /zed-industries/);
+  });
+
+  it("falls back to the label when the command is missing", () => {
+    const copy = adapterUpdateWarning(
+      entry({ id: "mystery", label: "Mystery Harness", command: null }),
+    );
+    assert.match(copy, /Mystery Harness/);
+    assert.doesNotMatch(copy, /codex/i);
+  });
+});
+
+// ── catalogPrimaryAction ─────────────────────────────────────────────────────
+
+describe("catalogPrimaryAction", () => {
+  it("no action for ready entries", () => {
+    assert.deepEqual(
+      catalogPrimaryAction(entry({ availability: "available" })),
+      { kind: "none" },
+    );
+  });
+
+  it("install for one-click installable", () => {
+    assert.deepEqual(catalogPrimaryAction(entry({ canAutoInstall: true })), {
+      kind: "install",
+      label: "Install",
+    });
+  });
+
+  it("update label for outdated adapters", () => {
+    assert.deepEqual(
+      catalogPrimaryAction(
+        entry({ availability: "adapter_outdated", canAutoInstall: true }),
+      ),
+      { kind: "install", label: "Update" },
+    );
+  });
+
+  it("docs fallback when auto-install is unavailable", () => {
+    assert.deepEqual(
+      catalogPrimaryAction(
+        entry({ installInstructionsUrl: "https://example.com" }),
+      ),
+      { kind: "docs", label: "Setup guide" },
+    );
+  });
+
+  it("docs fallback labels download pages honestly", () => {
+    assert.deepEqual(
+      catalogPrimaryAction(
+        entry({ installInstructionsUrl: "https://cursor.com/downloads" }),
+      ),
+      { kind: "docs", label: "Download page" },
+    );
+  });
+
+  it("node-gated installs fall back to docs", () => {
+    assert.deepEqual(
+      catalogPrimaryAction(
+        entry({
+          canAutoInstall: true,
+          nodeRequired: true,
+          installInstructionsUrl: "https://example.com",
+        }),
+      ),
+      { kind: "docs", label: "Setup guide" },
+    );
+  });
+
+  it("none when nothing is actionable", () => {
+    assert.deepEqual(catalogPrimaryAction(entry({})), { kind: "none" });
+  });
+});
diff --git a/desktop/src/features/settings/ui/harnessCatalogLogic.ts b/desktop/src/features/settings/ui/harnessCatalogLogic.ts
new file mode 100644
index 00000000000..2627135a778
--- /dev/null
+++ b/desktop/src/features/settings/ui/harnessCatalogLogic.ts
@@ -0,0 +1,226 @@
+/**
+ * Pure logic for the consolidated Harnesses settings surface and the
+ * Add-runtimes catalog dialog.
+ *
+ * Extracted for deterministic unit-testing — no React, no Tauri, no network.
+ */
+
+import type { AcpRuntimeCatalogEntry } from "@/shared/api/types";
+
+// Builtins that anchor the top of "Your runtimes" — mirrors the old
+// DoctorSettingsPanel RUNTIME_SORT_PRIORITY so the Buzz + Goose rows stay
+// where users learned to find them.
+const ROW_SORT_PRIORITY: Record<string, number> = {
+  "buzz-agent": 0,
+  goose: 1,
+};
+
+/**
+ * True when the entry earns a row in "Your runtimes":
+ *
+ * - it is ready (`availability === "available"`), or
+ * - one click of the Install button makes it ready (auto-install works), or
+ * - the user authored it (`source === "custom"` — owner rows keep their
+ *   edit/delete affordances regardless of readiness).
+ *
+ * Everything else needs multi-step setup and belongs in the Add-runtimes
+ * catalog with a real setup action — NOT an inert row control.
+ */
+export function isYourHarnessEntry(entry: AcpRuntimeCatalogEntry): boolean {
+  if (entry.source === "custom") return true;
+  if (entry.availability === "available") return true;
+  return entry.canAutoInstall && !entry.nodeRequired;
+}
+
+/** Entries that render as rows in "Your runtimes". */
+export function yourHarnessEntries(
+  catalog: readonly AcpRuntimeCatalogEntry[],
+): AcpRuntimeCatalogEntry[] {
+  return catalog.filter(isYourHarnessEntry);
+}
+
+/**
+ * Entries offered in the Add-runtimes catalog: every non-custom entry.
+ * Ready ones still show (marked as such) so the catalog doubles as a
+ * browsable inventory, like the Agent Catalog.
+ */
+export function catalogDialogEntries(
+  catalog: readonly AcpRuntimeCatalogEntry[],
+): AcpRuntimeCatalogEntry[] {
+  return catalog
+    .filter((e) => e.source !== "custom")
+    .sort(compareCatalogEntries);
+}
+
+/** Needs-setup entries first (that's why the user opened the dialog), then
+ * ready ones; alphabetical within each group. */
+function compareCatalogEntries(
+  a: AcpRuntimeCatalogEntry,
+  b: AcpRuntimeCatalogEntry,
+): number {
+  const aReady = a.availability === "available" ? 1 : 0;
+  const bReady = b.availability === "available" ? 1 : 0;
+  if (aReady !== bReady) return aReady - bReady;
+  return a.label.localeCompare(b.label);
+}
+
+/**
+ * Splits catalog entries into the two accordion sections of the Add-runtimes
+ * list: "Setup" (needs action — the reason the user opened the dialog) and
+ * "Installed" (already ready, collapsed by default). Relative order within
+ * each group is preserved from the input.
+ */
+export function groupCatalogEntries(
+  entries: readonly AcpRuntimeCatalogEntry[],
+): {
+  setup: AcpRuntimeCatalogEntry[];
+  installed: AcpRuntimeCatalogEntry[];
+} {
+  return {
+    setup: entries.filter((e) => e.availability !== "available"),
+    installed: entries.filter((e) => e.availability === "available"),
+  };
+}
+
+/** Case-insensitive catalog search across label, id, and command. */
+export function filterCatalogEntries(
+  entries: readonly AcpRuntimeCatalogEntry[],
+  query: string,
+): AcpRuntimeCatalogEntry[] {
+  const q = query.trim().toLowerCase();
+  if (!q) return [...entries];
+  return entries.filter(
+    (e) =>
+      e.label.toLowerCase().includes(q) ||
+      e.id.toLowerCase().includes(q) ||
+      (e.command ?? "").toLowerCase().includes(q),
+  );
+}
+
+function compareInitialRows(
+  a: AcpRuntimeCatalogEntry,
+  b: AcpRuntimeCatalogEntry,
+): number {
+  const aPriority = ROW_SORT_PRIORITY[a.id] ?? Number.MAX_SAFE_INTEGER;
+  const bPriority = ROW_SORT_PRIORITY[b.id] ?? Number.MAX_SAFE_INTEGER;
+  if (aPriority !== bPriority) return aPriority - bPriority;
+  const aOn = a.availability === "available" ? 0 : 1;
+  const bOn = b.availability === "available" ? 0 : 1;
+  if (aOn !== bOn) return aOn - bOn;
+  return a.label.localeCompare(b.label);
+}
+
+/**
+ * Stable row ordering for "Your runtimes".
+ *
+ * First render sorts priority builtins first, then ready-before-needs-setup,
+ * then alphabetically. Subsequent renders KEEP the previous relative order
+ * for ids that are still present — a row that just finished installing must
+ * not jump around under the pointer — and append newcomers (e.g. a harness
+ * just added from the catalog) using the initial comparator.
+ *
+ * Returns the ordered id list; callers map ids back to entries.
+ */
+export function stableRowOrder(
+  previousOrder: readonly string[],
+  entries: readonly AcpRuntimeCatalogEntry[],
+): string[] {
+  const present = new Set(entries.map((e) => e.id));
+  const kept = previousOrder.filter((id) => present.has(id));
+  const keptSet = new Set(kept);
+  const appended = entries
+    .filter((e) => !keptSet.has(e.id))
+    .sort(compareInitialRows)
+    .map((e) => e.id);
+  return [...kept, ...appended];
+}
+
+/** Human status label for a catalog entry; null when nothing needs saying. */
+export function entryStatusLabel(entry: AcpRuntimeCatalogEntry): string | null {
+  if (entry.authStatus.status === "config_invalid") return "Config error";
+  switch (entry.availability) {
+    case "adapter_missing":
+      return "Adapter needed";
+    case "adapter_outdated":
+      return "Update needed";
+    case "cli_missing":
+    case "not_installed":
+      return "CLI needed";
+    case "available":
+      return entry.authStatus.status === "logged_out" ? "Sign-in needed" : null;
+    default:
+      return null;
+  }
+}
+
+/**
+ * Body copy for the confirmation dialog shown before replacing an
+ * already-installed (but outdated) adapter.
+ *
+ * Codex carries a specific machine-wide caveat about the legacy Zed adapter
+ * contract; every other runtime gets generic, runtime-derived copy — Codex
+ * package names must never appear for another runtime.
+ */
+export function adapterUpdateWarning(entry: AcpRuntimeCatalogEntry): string {
+  if (entry.id === "codex") {
+    return (
+      "This replaces the machine-wide codex-acp adapter. Older Buzz " +
+      "releases using the legacy adapter may lose community access until " +
+      "@zed-industries/codex-acp@0.16.0 is restored."
+    );
+  }
+  const adapter = entry.command?.trim() || entry.label;
+  return (
+    `This replaces the machine-wide ${adapter} adapter. Other tools using ` +
+    "the currently installed adapter will switch to the updated version."
+  );
+}
+
+export type CatalogPrimaryAction =
+  | { kind: "install"; label: string }
+  | { kind: "docs"; label: string }
+  | { kind: "none" };
+
+/**
+ * True when the vendor's install link is a plain download page (e.g.
+ * cursor.com/downloads, kimi.ai/download) rather than written setup docs —
+ * "Setup guide" would over-promise for those.
+ */
+export function isDownloadPageUrl(url: string): boolean {
+  try {
+    return /download/i.test(new URL(url.trim()).pathname);
+  } catch {
+    return false;
+  }
+}
+
+/** Label for a link that opens `installInstructionsUrl`. */
+export function installLinkLabel(entry: AcpRuntimeCatalogEntry): string {
+  return isDownloadPageUrl(entry.installInstructionsUrl)
+    ? "Download page"
+    : "Setup guide";
+}
+
+/**
+ * Primary action for the catalog detail pane.
+ *
+ * - Ready → no action (the entry already has a row in Your runtimes).
+ * - One-click installable → Install.
+ * - Otherwise → open the vendor's setup guide or download page, when one
+ *   exists.
+ */
+export function catalogPrimaryAction(
+  entry: AcpRuntimeCatalogEntry,
+): CatalogPrimaryAction {
+  if (entry.availability === "available") return { kind: "none" };
+  if (entry.canAutoInstall && !entry.nodeRequired) {
+    return {
+      kind: "install",
+      label: entry.availability === "adapter_outdated" ? "Update" : "Install",
+    };
+  }
+  if (entry.installInstructionsUrl.trim().length > 0) {
+    return { kind: "docs", label: installLinkLabel(entry) };
+  }
+  return { kind: "none" };
+}
diff --git a/desktop/src/features/settings/ui/harnessGalleryLogic.test.mjs b/desktop/src/features/settings/ui/harnessGalleryLogic.test.mjs
index d7150f1ef3a..cbf8b6d353e 100644
--- a/desktop/src/features/settings/ui/harnessGalleryLogic.test.mjs
+++ b/desktop/src/features/settings/ui/harnessGalleryLogic.test.mjs
@@ -2,8 +2,6 @@ import assert from "node:assert/strict";
 import { describe, it } from "node:test";
 
 import {
-  sortedPresetEntries,
-  customEntries,
   isEditableEntry,
   countAgentsReferencingHarness,
   deleteHarnessConfirmMessage,
@@ -36,130 +34,6 @@ function entry(overrides = {}) {
   };
 }
 
-// ── sortedPresetEntries ───────────────────────────────────────────────────────
-
-describe("sortedPresetEntries", () => {
-  it("returns only preset-source entries", () => {
-    const catalog = [
-      entry({ id: "p1", source: "preset" }),
-      entry({ id: "c1", source: "custom" }),
-      entry({ id: "b1", source: "builtin" }),
-    ];
-    const result = sortedPresetEntries(catalog);
-    assert.equal(result.length, 1);
-    assert.equal(result[0].id, "p1");
-  });
-
-  it("places detected (available) entries before not-installed", () => {
-    const catalog = [
-      entry({
-        id: "not-there",
-        source: "preset",
-        availability: "not_installed",
-        label: "Alpha",
-      }),
-      entry({
-        id: "detected",
-        source: "preset",
-        availability: "available",
-        label: "Beta",
-      }),
-    ];
-    const result = sortedPresetEntries(catalog);
-    assert.equal(result[0].id, "detected", "detected entry must come first");
-    assert.equal(result[1].id, "not-there");
-  });
-
-  it("sorts alphabetically within detected group", () => {
-    const catalog = [
-      entry({
-        id: "z",
-        source: "preset",
-        availability: "available",
-        label: "Zebra",
-      }),
-      entry({
-        id: "a",
-        source: "preset",
-        availability: "available",
-        label: "Aardvark",
-      }),
-    ];
-    const result = sortedPresetEntries(catalog);
-    assert.equal(result[0].id, "a");
-    assert.equal(result[1].id, "z");
-  });
-
-  it("sorts alphabetically within not-installed group", () => {
-    const catalog = [
-      entry({
-        id: "z",
-        source: "preset",
-        availability: "not_installed",
-        label: "Zebra",
-      }),
-      entry({
-        id: "a",
-        source: "preset",
-        availability: "not_installed",
-        label: "Aardvark",
-      }),
-    ];
-    const result = sortedPresetEntries(catalog);
-    assert.equal(result[0].id, "a");
-    assert.equal(result[1].id, "z");
-  });
-
-  it("returns empty array when no preset entries", () => {
-    const catalog = [entry({ source: "custom" }), entry({ source: "builtin" })];
-    assert.deepEqual(sortedPresetEntries(catalog), []);
-  });
-
-  it("does not mutate the input array", () => {
-    const catalog = [
-      entry({
-        id: "z",
-        source: "preset",
-        availability: "available",
-        label: "Z",
-      }),
-      entry({
-        id: "a",
-        source: "preset",
-        availability: "available",
-        label: "A",
-      }),
-    ];
-    const original = [...catalog];
-    sortedPresetEntries(catalog);
-    assert.deepEqual(
-      catalog.map((e) => e.id),
-      original.map((e) => e.id),
-      "input array must not be mutated",
-    );
-  });
-});
-
-// ── customEntries ─────────────────────────────────────────────────────────────
-
-describe("customEntries", () => {
-  it("returns only custom-source entries", () => {
-    const catalog = [
-      entry({ id: "p1", source: "preset" }),
-      entry({ id: "c1", source: "custom" }),
-      entry({ id: "c2", source: "custom" }),
-    ];
-    const result = customEntries(catalog);
-    assert.equal(result.length, 2);
-    assert.ok(result.every((e) => e.source === "custom"));
-  });
-
-  it("returns empty when no custom entries", () => {
-    const catalog = [entry({ source: "preset" }), entry({ source: "builtin" })];
-    assert.deepEqual(customEntries(catalog), []);
-  });
-});
-
 // ── isEditableEntry ───────────────────────────────────────────────────────────
 
 describe("isEditableEntry", () => {
diff --git a/desktop/src/features/settings/ui/harnessGalleryLogic.ts b/desktop/src/features/settings/ui/harnessGalleryLogic.ts
index d3c782c530c..0c67ebf65d7 100644
--- a/desktop/src/features/settings/ui/harnessGalleryLogic.ts
+++ b/desktop/src/features/settings/ui/harnessGalleryLogic.ts
@@ -1,39 +1,11 @@
 /**
- * Pure logic helpers for the harness gallery (HarnessManagementCard).
+ * Pure logic helpers for custom-harness deletion (blast-radius confirmation).
  *
  * Extracted for deterministic unit-testing — no React, no Tauri, no network.
  */
 
 import type { AcpRuntimeCatalogEntry } from "@/shared/api/types";
 
-/**
- * Filter catalog entries to preset-only, sorted detected-first then
- * alphabetically within each group.
- *
- * "Detected" means availability === "available". This mirrors the
- * React.useMemo sort inside HarnessManagementCard.
- */
-export function sortedPresetEntries(
-  catalog: readonly AcpRuntimeCatalogEntry[],
-): AcpRuntimeCatalogEntry[] {
-  const presets = catalog.filter((e) => e.source === "preset");
-  return [...presets].sort((a, b) => {
-    const aDetected = a.availability === "available" ? 0 : 1;
-    const bDetected = b.availability === "available" ? 0 : 1;
-    if (aDetected !== bDetected) return aDetected - bDetected;
-    return a.label.localeCompare(b.label);
-  });
-}
-
-/**
- * Filter catalog entries to custom-only.
- */
-export function customEntries(
-  catalog: readonly AcpRuntimeCatalogEntry[],
-): AcpRuntimeCatalogEntry[] {
-  return catalog.filter((e) => e.source === "custom");
-}
-
 /**
  * Returns true iff the given catalog entry is editable by the user.
  * Only `source === "custom"` entries are editable/deletable.
diff --git a/desktop/src/features/sidebar/ui/AppSidebarPinnedHeader.tsx b/desktop/src/features/sidebar/ui/AppSidebarPinnedHeader.tsx
index 50298a92d18..a673492ef1e 100644
--- a/desktop/src/features/sidebar/ui/AppSidebarPinnedHeader.tsx
+++ b/desktop/src/features/sidebar/ui/AppSidebarPinnedHeader.tsx
@@ -91,7 +91,7 @@ export function AppSidebarPrimaryMenu({
 }: AppSidebarPrimaryMenuProps) {
   return (
     <SidebarHeader
-      className="cursor-default select-none px-2 pb-0 pt-0"
+      className="relative z-40 cursor-default select-none px-2 pb-0 pt-0"
       data-tauri-drag-region
       data-testid="sidebar-primary-menu"
     >
diff --git a/desktop/src/features/sidebar/ui/CommunityRail.tsx b/desktop/src/features/sidebar/ui/CommunityRail.tsx
index b15e0bab712..386ee206917 100644
--- a/desktop/src/features/sidebar/ui/CommunityRail.tsx
+++ b/desktop/src/features/sidebar/ui/CommunityRail.tsx
@@ -370,7 +370,7 @@ export function CommunityRail({
   return (
     <nav
       aria-label="Communities"
-      className="relative z-20 mb-2 mt-[calc(var(--buzz-top-chrome-height,40px)+1px)] flex w-14 shrink-0 flex-col items-center gap-2 overflow-y-auto bg-sidebar px-2.5 pb-3 pt-1.5"
+      className="relative z-20 flex w-14 shrink-0 flex-col items-center gap-2 overflow-y-auto bg-sidebar px-2.5 pb-5 pt-[calc(var(--buzz-top-chrome-height,40px)+7px)]"
       data-testid="community-rail"
     >
       <DndContext
diff --git a/desktop/src/features/sidebar/ui/sidebarLoadingSkeleton.tsx b/desktop/src/features/sidebar/ui/sidebarLoadingSkeleton.tsx
index 8db31bf044e..53222b32d3b 100644
--- a/desktop/src/features/sidebar/ui/sidebarLoadingSkeleton.tsx
+++ b/desktop/src/features/sidebar/ui/sidebarLoadingSkeleton.tsx
@@ -2,6 +2,7 @@ import * as React from "react";
 
 import type { Channel } from "@/shared/api/types";
 import { cn } from "@/shared/lib/cn";
+import { setLocalStorageItemWithRecovery } from "@/shared/lib/localStorageQuota";
 import {
   SidebarGroup,
   SidebarGroupContent,
@@ -36,6 +37,7 @@ type SidebarLoadingShape = {
 };
 
 type SidebarLoadingCachePayload = SidebarLoadingShape & {
+  updatedAt: number;
   version: 1;
 };
 
@@ -130,11 +132,12 @@ function writeSidebarLoadingShape(
   const payload: SidebarLoadingCachePayload = {
     channels: shape.channels.slice(0, 3),
     directMessages: shape.directMessages.slice(0, 2),
+    updatedAt: Date.now(),
     version: 1,
   };
 
   try {
-    window.localStorage.setItem(cacheKey, JSON.stringify(payload));
+    setLocalStorageItemWithRecovery(cacheKey, JSON.stringify(payload));
   } catch {
     // localStorage can be unavailable or full in embedded webviews.
   }
diff --git a/desktop/src/main.tsx b/desktop/src/main.tsx
index abc9916b3b0..890ef722264 100644
--- a/desktop/src/main.tsx
+++ b/desktop/src/main.tsx
@@ -13,6 +13,7 @@ import { EmojiBurstProvider } from "@/shared/ui/EmojiBurstProvider";
 import { PoofBurstProvider } from "@/shared/ui/PoofBurstProvider";
 import { Toaster } from "@/shared/ui/sonner";
 import { TooltipProvider } from "@/shared/ui/tooltip";
+import { recoverLocalStorageQuotaOnStartup } from "@/shared/lib/localStorageQuota";
 
 type E2eWindow = Window & {
   __BUZZ_E2E__?: unknown;
@@ -110,6 +111,7 @@ async function installE2eBridgeIfConfigured() {
 async function bootstrap() {
   resetDevWebviewStateFromUrl();
   configureDevE2eBridgeFromUrl();
+  recoverLocalStorageQuotaOnStartup();
   await installE2eBridgeIfConfigured();
   await migrateLegacyCommunityStorageBeforeRender();
   renderApp();
diff --git a/desktop/src/shared/api/inviteHelpers.test.mjs b/desktop/src/shared/api/inviteHelpers.test.mjs
index bdb62aa3a2b..895abfbb7db 100644
--- a/desktop/src/shared/api/inviteHelpers.test.mjs
+++ b/desktop/src/shared/api/inviteHelpers.test.mjs
@@ -3,6 +3,7 @@ import test from "node:test";
 
 import {
   inviteErrorMessage,
+  isInviteExhaustedError,
   isInviteExpiredError,
   relayHttpFromWs,
 } from "./inviteHelpers.ts";
@@ -34,3 +35,9 @@ test("invite expiry sentinel is recognized without hiding other errors", () => {
     "network unavailable",
   );
 });
+
+test("invite exhaustion sentinel is recognized distinctly from expiry", () => {
+  assert.equal(isInviteExhaustedError(new Error("invite_exhausted")), true);
+  assert.equal(isInviteExhaustedError(new Error("invite_expired")), false);
+  assert.equal(isInviteExhaustedError(new Error("invite_invalid")), false);
+});
diff --git a/desktop/src/shared/api/inviteHelpers.ts b/desktop/src/shared/api/inviteHelpers.ts
index 11ea60cc7e8..5fa15ce1ccd 100644
--- a/desktop/src/shared/api/inviteHelpers.ts
+++ b/desktop/src/shared/api/inviteHelpers.ts
@@ -1,4 +1,5 @@
 export const INVITE_EXPIRED_ERROR = "invite_expired";
+export const INVITE_EXHAUSTED_ERROR = "invite_exhausted";
 
 /**
  * Parsed invite — either a full (relay + code) or bare-code form.
@@ -17,6 +18,7 @@ export type ParsedInvite =
  * Accepted input forms:
  *  - `https://<relay>/invite/<code>` → `{ relayWsUrl: "wss://<relay>", code }`
  *  - `http://<relay>/invite/<code>`  → `{ relayWsUrl: "ws://<relay>", code }`
+ *  - `https://<relay>/<base>/invite/<code>` → `{ relayWsUrl: "wss://<relay>/<base>", code }`
  *  - `buzz://join?relay=<wsUrl>&code=<code>` → `{ relayWsUrl, code }`
  *  - bare code (no `://`, no `/`)    → `{ code }`
  *
@@ -51,16 +53,21 @@ export function parseInviteInput(input: string): ParsedInvite | null {
       return { relayWsUrl: relay, code };
     }
 
-    // https(s)://<relay>/invite/<code>
+    // https(s)://<relay>[/<base-path>]/invite/<code>
     if (url.protocol === "https:" || url.protocol === "http:") {
       if (url.username || url.password || url.hash) return null;
-      // pathname must be /invite/<code> with optional single trailing slash
-      const match = url.pathname.match(/^\/invite\/([^/]+)\/?$/);
-      if (!match?.[1]) return null;
-      const code = decodeURIComponent(match[1]);
+      // `/invite/<code>` may be preceded by a base path when the relay is served
+      // under one (BUZZ_BASE_PATH), e.g. https://host/relay/invite/<code>. The
+      // prefix is captured so it can be carried into the derived relay URL —
+      // rebuilding from `url.host` alone would drop it and the client would then
+      // dial a relay that isn't there.
+      const match = url.pathname.match(/^(\/.*?)?\/invite\/([^/]+)\/?$/);
+      if (!match?.[2]) return null;
+      const basePath = match[1] ?? "";
+      const code = decodeURIComponent(match[2]);
       // Convert scheme: https → wss, http → ws. url.host already includes port.
-      const relayWsUrl =
-        url.protocol === "https:" ? `wss://${url.host}` : `ws://${url.host}`;
+      const scheme = url.protocol === "https:" ? "wss" : "ws";
+      const relayWsUrl = `${scheme}://${url.host}${basePath}`;
       return { relayWsUrl, code };
     }
 
@@ -89,3 +96,7 @@ export function inviteErrorMessage(error: unknown): string {
 export function isInviteExpiredError(error: unknown): boolean {
   return inviteErrorMessage(error) === INVITE_EXPIRED_ERROR;
 }
+
+export function isInviteExhaustedError(error: unknown): boolean {
+  return inviteErrorMessage(error) === INVITE_EXHAUSTED_ERROR;
+}
diff --git a/desktop/src/shared/api/invites.test.mjs b/desktop/src/shared/api/invites.test.mjs
index eb4ca3dad12..eb3754435e3 100644
--- a/desktop/src/shared/api/invites.test.mjs
+++ b/desktop/src/shared/api/invites.test.mjs
@@ -1,7 +1,7 @@
 import assert from "node:assert/strict";
 import test from "node:test";
 
-import { getJoinPolicy } from "./invites.ts";
+import { getJoinPolicy, mintInvite } from "./invites.ts";
 
 function withFetch(response, run) {
   const originalFetch = globalThis.fetch;
@@ -28,7 +28,7 @@ test("getJoinPolicy maps relay-hosted Markdown and age requirements", async () =
       { status: 200 },
     ),
     async () => {
-      assert.deepEqual(await getJoinPolicy("wss://relay.example"), {
+      assert.deepEqual(await getJoinPolicy("wss://relay.example", "webview"), {
         termsMarkdown: "# Terms",
         privacyMarkdown: "# Privacy",
         ageAttestationRequired: true,
@@ -40,15 +40,172 @@ test("getJoinPolicy maps relay-hosted Markdown and age requirements", async () =
 
 test("getJoinPolicy preserves opt-in behavior for unconfigured and older relays", async () => {
   await withFetch(new Response(JSON.stringify({}), { status: 200 }), async () =>
-    assert.equal(await getJoinPolicy("wss://relay.example"), null),
+    assert.equal(await getJoinPolicy("wss://relay.example", "webview"), null),
   );
   await withFetch(new Response(null, { status: 404 }), async () =>
-    assert.equal(await getJoinPolicy("wss://relay.example"), null),
+    assert.equal(await getJoinPolicy("wss://relay.example", "webview"), null),
   );
 });
 
 test("getJoinPolicy fails closed on a policy endpoint error", async () => {
   await withFetch(new Response(null, { status: 503 }), async () =>
-    assert.rejects(getJoinPolicy("wss://relay.example"), /HTTP 503/),
+    assert.rejects(getJoinPolicy("wss://relay.example", "webview"), /HTTP 503/),
   );
 });
+
+test("getJoinPolicy maps the native command response", async () => {
+  const previousWindow = globalThis.window;
+  globalThis.window = {
+    __TAURI_INTERNALS__: {
+      invoke(command, args) {
+        assert.equal(command, "fetch_join_policy");
+        assert.deepEqual(args, { relayUrl: "wss://relay.example" });
+        return Promise.resolve({
+          terms_markdown: "# Terms",
+          privacy_markdown: "# Privacy",
+          age_attestation_required: true,
+          version: "policy-v1",
+        });
+      },
+    },
+  };
+
+  try {
+    assert.deepEqual(await getJoinPolicy("wss://relay.example", "native"), {
+      termsMarkdown: "# Terms",
+      privacyMarkdown: "# Privacy",
+      ageAttestationRequired: true,
+      version: "policy-v1",
+    });
+  } finally {
+    globalThis.window = previousWindow;
+  }
+});
+
+// --- mintInvite serialization ---
+
+// The test-loader transpiles TS imports. tauri.ts imports `invoke` from
+// @tauri-apps/api/core, which calls `window.__TAURI_INTERNALS__.invoke`.
+// We stub that here so getRelayHttpUrl() and signRelayEvent() work in node.
+
+function setupTauriStubs(
+  httpBase,
+  authEvent = {
+    id: "x",
+    sig: "y",
+    pubkey: "z",
+    kind: 27235,
+    created_at: 1,
+    tags: [],
+  },
+) {
+  const calls = { invokeArgs: [] };
+  globalThis.window = globalThis.window ?? {};
+  globalThis.window.__TAURI_INTERNALS__ = {
+    invoke: async (command, args) => {
+      calls.invokeArgs.push({ command, args });
+      if (command === "get_relay_http_url") return httpBase;
+      if (command === "sign_event") return JSON.stringify(authEvent);
+      throw new Error(`Unexpected Tauri command: ${command}`);
+    },
+  };
+  return calls;
+}
+
+function teardownTauriStubs() {
+  delete globalThis.window.__TAURI_INTERNALS__;
+}
+
+test("mintInvite serializes bounded max_uses in the request body", async () => {
+  setupTauriStubs("https://relay.example");
+  try {
+    const originalFetch = globalThis.fetch;
+    let capturedBody;
+    globalThis.fetch = async (_url, init) => {
+      capturedBody = JSON.parse(init.body);
+      return new Response(
+        JSON.stringify({
+          code: "v2.abc123",
+          expires_at: 1785100000,
+          url: "https://relay.example/invite/v2.abc123",
+          max_uses: 10,
+          uses_remaining: 10,
+        }),
+      );
+    };
+    try {
+      const result = await mintInvite({ ttlSecs: 259200, maxUses: 10 });
+      assert.equal(capturedBody.ttl_secs, 259200);
+      assert.equal(capturedBody.max_uses, 10);
+      assert.equal(result.code, "v2.abc123");
+      assert.equal(result.maxUses, 10);
+      assert.equal(result.usesRemaining, 10);
+      assert.equal(result.expiresAt, 1785100000);
+      assert.equal(result.url, "https://relay.example/invite/v2.abc123");
+    } finally {
+      globalThis.fetch = originalFetch;
+    }
+  } finally {
+    teardownTauriStubs();
+  }
+});
+
+test("mintInvite omits max_uses when null (unlimited)", async () => {
+  setupTauriStubs("https://relay.example");
+  try {
+    const originalFetch = globalThis.fetch;
+    let capturedBody;
+    globalThis.fetch = async (_url, init) => {
+      capturedBody = JSON.parse(init.body);
+      return new Response(
+        JSON.stringify({
+          code: "v2.abc123",
+          expires_at: 1785100000,
+          url: "https://relay.example/invite/v2.abc123",
+          max_uses: null,
+          uses_remaining: null,
+        }),
+      );
+    };
+    try {
+      const result = await mintInvite({ ttlSecs: 259200, maxUses: null });
+      assert.equal(capturedBody.ttl_secs, 259200);
+      assert.equal(Object.hasOwn(capturedBody, "max_uses"), false);
+      assert.equal(result.maxUses, null);
+      assert.equal(result.usesRemaining, null);
+    } finally {
+      globalThis.fetch = originalFetch;
+    }
+  } finally {
+    teardownTauriStubs();
+  }
+});
+
+test("mintInvite omits max_uses when not provided (unlimited default)", async () => {
+  setupTauriStubs("https://relay.example");
+  try {
+    const originalFetch = globalThis.fetch;
+    let capturedBody;
+    globalThis.fetch = async (_url, init) => {
+      capturedBody = JSON.parse(init.body);
+      return new Response(
+        JSON.stringify({
+          code: "v2.abc123",
+          expires_at: 1785100000,
+          url: "https://relay.example/invite/v2.abc123",
+          max_uses: null,
+          uses_remaining: null,
+        }),
+      );
+    };
+    try {
+      await mintInvite({ ttlSecs: 86400 });
+      assert.equal(capturedBody.ttl_secs, 86400);
+      assert.equal(Object.hasOwn(capturedBody, "max_uses"), false);
+    } finally {
+      globalThis.fetch = originalFetch;
+    }
+  } finally {
+    teardownTauriStubs();
+  }
+});
diff --git a/desktop/src/shared/api/invites.ts b/desktop/src/shared/api/invites.ts
index ae03c71ada5..d0a3c2ed2c6 100644
--- a/desktop/src/shared/api/invites.ts
+++ b/desktop/src/shared/api/invites.ts
@@ -1,5 +1,9 @@
 import { relayHttpFromWs } from "@/shared/api/inviteHelpers";
-import { getRelayHttpUrl, signRelayEvent } from "@/shared/api/tauri";
+import {
+  getRelayHttpUrl,
+  invokeTauri,
+  signRelayEvent,
+} from "@/shared/api/tauri";
 
 // Relay invite data layer. Both endpoints are NIP-98-authed HTTP POSTs
 // (mirrors the read path in moderation.ts, plus the payload tag the relay
@@ -21,6 +25,8 @@ export type MintedInvite = {
   code: string;
   expiresAt: number;
   url: string;
+  maxUses: number | null;
+  usesRemaining: number | null;
 };
 
 export type JoinPolicy = {
@@ -124,26 +130,38 @@ export function isJoinPolicyDiscoveryCandidate(relayWsUrl: string): boolean {
 /** Fetch relay-hosted policy content for any join surface. */
 export async function getJoinPolicy(
   relayWsUrl: string,
+  transport: "native" | "webview",
 ): Promise<JoinPolicy | null> {
-  const base = relayHttpFromWs(relayWsUrl);
-  const response = await fetch(`${base.replace(/\/+$/, "")}/api/join-policy`);
-  // Relays predating join-policy support have no configured policy.
-  if (response.status === 404) return null;
-  if (!response.ok) throw new Error(`HTTP ${response.status}`);
-  const raw = (await response.json()) as {
-    policy?: {
-      terms_markdown?: string;
-      privacy_markdown?: string;
-      age_attestation_required: boolean;
-      version: string;
-    };
+  type RawJoinPolicy = {
+    terms_markdown?: string;
+    privacy_markdown?: string;
+    age_attestation_required: boolean;
+    version: string;
   };
-  return raw.policy
+  let raw: RawJoinPolicy | null;
+  if (transport === "native") {
+    raw = await invokeTauri<RawJoinPolicy | null>("fetch_join_policy", {
+      relayUrl: relayWsUrl,
+    });
+  } else {
+    const base = relayHttpFromWs(relayWsUrl);
+    const response = await fetch(`${base.replace(/\/+$/, "")}/api/join-policy`);
+    // Relays predating join-policy support have no configured policy.
+    if (response.status === 404) return null;
+    if (!response.ok) throw new Error(`HTTP ${response.status}`);
+    raw =
+      (
+        (await response.json()) as {
+          policy?: RawJoinPolicy;
+        }
+      ).policy ?? null;
+  }
+  return raw
     ? {
-        termsMarkdown: raw.policy.terms_markdown,
-        privacyMarkdown: raw.policy.privacy_markdown,
-        ageAttestationRequired: raw.policy.age_attestation_required,
-        version: raw.policy.version,
+        termsMarkdown: raw.terms_markdown,
+        privacyMarkdown: raw.privacy_markdown,
+        ageAttestationRequired: raw.age_attestation_required,
+        version: raw.version,
       }
     : null;
 }
@@ -173,15 +191,29 @@ export async function acceptJoinPolicy(
 }
 
 /** Mint an invite code on the active community's relay (owner/admin only). */
-export async function mintInvite(ttlSecs?: number): Promise<MintedInvite> {
+export async function mintInvite(options?: {
+  ttlSecs?: number;
+  maxUses?: number | null;
+}): Promise<MintedInvite> {
   const base = await getRelayHttpUrl();
-  const body = JSON.stringify(ttlSecs ? { ttl_secs: ttlSecs } : {});
+  const payload: Record<string, unknown> = {};
+  if (options?.ttlSecs != null) payload.ttl_secs = options.ttlSecs;
+  if (options?.maxUses != null) payload.max_uses = options.maxUses;
+  const body = JSON.stringify(payload);
   const raw = await invitePost<{
     code: string;
     expires_at: number;
     url: string;
+    max_uses: number | null;
+    uses_remaining: number | null;
   }>(base, "/api/invites", body);
-  return { code: raw.code, expiresAt: raw.expires_at, url: raw.url };
+  return {
+    code: raw.code,
+    expiresAt: raw.expires_at,
+    url: raw.url,
+    maxUses: raw.max_uses,
+    usesRemaining: raw.uses_remaining,
+  };
 }
 
 /**
diff --git a/desktop/src/shared/api/parseInviteInput.test.mjs b/desktop/src/shared/api/parseInviteInput.test.mjs
index 858f7258808..a9988afd3fe 100644
--- a/desktop/src/shared/api/parseInviteInput.test.mjs
+++ b/desktop/src/shared/api/parseInviteInput.test.mjs
@@ -28,6 +28,51 @@ test("parseInviteInput_http_invite_url_returns_ws_relay_and_code", () => {
   });
 });
 
+// ---------------------------------------------------------------------------
+// Base-path deployments (BUZZ_BASE_PATH): the prefix must survive into the
+// derived relay URL, or the client dials a relay that isn't there.
+// ---------------------------------------------------------------------------
+
+test("parseInviteInput_base_path_invite_url_keeps_prefix_in_relay_url", () => {
+  const result = parseInviteInput(
+    "https://relay.example.com/relay/invite/abc123",
+  );
+  assert.deepEqual(result, {
+    relayWsUrl: "wss://relay.example.com/relay",
+    code: "abc123",
+  });
+});
+
+test("parseInviteInput_multi_segment_base_path_keeps_full_prefix", () => {
+  const result = parseInviteInput(
+    "https://relay.example.com/buzz/relay/invite/abc123",
+  );
+  assert.deepEqual(result, {
+    relayWsUrl: "wss://relay.example.com/buzz/relay",
+    code: "abc123",
+  });
+});
+
+test("parseInviteInput_base_path_invite_url_over_http_uses_ws", () => {
+  const result = parseInviteInput(
+    "http://relay.example.com:3000/relay/invite/abc123",
+  );
+  assert.deepEqual(result, {
+    relayWsUrl: "ws://relay.example.com:3000/relay",
+    code: "abc123",
+  });
+});
+
+test("parseInviteInput_base_path_invite_url_tolerates_trailing_slash", () => {
+  const result = parseInviteInput(
+    "https://relay.example.com/relay/invite/abc123/",
+  );
+  assert.deepEqual(result, {
+    relayWsUrl: "wss://relay.example.com/relay",
+    code: "abc123",
+  });
+});
+
 test("parseInviteInput_https_with_port_preserves_port", () => {
   const result = parseInviteInput(
     "https://relay.example.com:8443/invite/abc123",
diff --git a/desktop/src/shared/api/searchTypes.ts b/desktop/src/shared/api/searchTypes.ts
new file mode 100644
index 00000000000..cf6c531ac6d
--- /dev/null
+++ b/desktop/src/shared/api/searchTypes.ts
@@ -0,0 +1,28 @@
+export type SearchMessagesInput = {
+  q: string;
+  limit?: number;
+  channelId?: string;
+  /** Hex pubkeys for `from:` operator. */
+  authors?: string[];
+  /** Unix seconds (`after:YYYY-MM-DD`). */
+  since?: number;
+  /** Unix seconds (`before:YYYY-MM-DD`). */
+  until?: number;
+};
+
+export type SearchHit = {
+  eventId: string;
+  content: string;
+  kind: number;
+  pubkey: string;
+  channelId: string | null;
+  channelName: string | null;
+  createdAt: number;
+  score: number;
+  threadRootId?: string | null;
+};
+
+export type SearchMessagesResponse = {
+  hits: SearchHit[];
+  found: number;
+};
diff --git a/desktop/src/shared/api/tauri.ts b/desktop/src/shared/api/tauri.ts
index e8a8b885cf0..c57525480e1 100644
--- a/desktop/src/shared/api/tauri.ts
+++ b/desktop/src/shared/api/tauri.ts
@@ -469,6 +469,9 @@ export async function searchMessages(
     q: input.q,
     limit: input.limit,
     channelId: input.channelId,
+    authors: input.authors,
+    since: input.since,
+    until: input.until,
   });
 
   return {
diff --git a/desktop/src/shared/api/tauriPersonas.snapshotImport.test.mjs b/desktop/src/shared/api/tauriPersonas.snapshotImport.test.mjs
index 8503a793497..d4e0b1d5f3e 100644
--- a/desktop/src/shared/api/tauriPersonas.snapshotImport.test.mjs
+++ b/desktop/src/shared/api/tauriPersonas.snapshotImport.test.mjs
@@ -12,6 +12,9 @@ import test from "node:test";
 function makePreview(overrides = {}) {
   return {
     displayName: "Test Agent",
+    isBuiltIn: false,
+    model: null,
+    runtime: null,
     systemPrompt: "You are helpful.",
     avatarUrl: null,
     memoryLevel: "none",
diff --git a/desktop/src/shared/api/tauriPersonas.ts b/desktop/src/shared/api/tauriPersonas.ts
index bd3be924077..66e07f5e880 100644
--- a/desktop/src/shared/api/tauriPersonas.ts
+++ b/desktop/src/shared/api/tauriPersonas.ts
@@ -17,7 +17,14 @@ export type RawPersona = {
   name_pool?: string[];
   is_builtin: boolean;
   is_active?: boolean;
+  shared?: boolean;
   source_team?: string | null;
+  /**
+   * Provenance of a local copy of another owner's catalog entry. Serialized by
+   * the backend `CatalogSource` in snake_case; the create payload sends the
+   * camelCase aliases it accepts.
+   */
+  catalog_source?: { owner_pubkey: string; persona_id: string } | null;
   env_vars?: Record<string, string>;
   respond_to?: string | null;
   respond_to_allowlist?: string[];
@@ -40,7 +47,14 @@ export function fromRawPersona(persona: RawPersona): AgentPersona {
     namePool: persona.name_pool ?? [],
     isBuiltIn: persona.is_builtin,
     isActive: persona.is_active ?? true,
+    shared: persona.shared ?? false,
     sourceTeam: persona.source_team ?? null,
+    catalogSource: persona.catalog_source
+      ? {
+          ownerPubkey: persona.catalog_source.owner_pubkey,
+          personaId: persona.catalog_source.persona_id,
+        }
+      : null,
     envVars: persona.env_vars ?? {},
     respondTo: (persona.respond_to as RespondToMode | undefined) ?? null,
     respondToAllowlist: persona.respond_to_allowlist ?? [],
@@ -69,31 +83,37 @@ export async function createPersona(
         namePool: input.namePool ?? [],
         envVars: input.envVars ?? {},
         behavior: input.behavior,
+        catalogSource: input.catalogSource,
       },
     }),
   );
 }
 
+/** The `UpdatePersonaRequest` payload shared by both edit commands. */
+function updatePersonaPayload(input: UpdatePersonaInput) {
+  return {
+    id: input.id,
+    displayName: input.displayName,
+    avatarUrl: input.avatarUrl,
+    systemPrompt: input.systemPrompt,
+    runtime: input.runtime,
+    model: input.model,
+    provider: input.provider,
+    namePool: input.namePool ?? [],
+    // Send envVars only when caller explicitly provided it; omitting
+    // tells the backend "don't touch the stored env vars" so editing
+    // unrelated fields can't silently wipe saved credentials.
+    envVars: input.envVars,
+    // Same absent-vs-present contract as envVars for the behavioral quad.
+    behavior: input.behavior,
+  };
+}
+
 export async function updatePersona(
   input: UpdatePersonaInput,
 ): Promise<AgentPersona> {
   const raw = await invokeTauri<RawPersona>("update_persona", {
-    input: {
-      id: input.id,
-      displayName: input.displayName,
-      avatarUrl: input.avatarUrl,
-      systemPrompt: input.systemPrompt,
-      runtime: input.runtime,
-      model: input.model,
-      provider: input.provider,
-      namePool: input.namePool ?? [],
-      // Send envVars only when caller explicitly provided it; omitting
-      // tells the backend "don't touch the stored env vars" so editing
-      // unrelated fields can't silently wipe saved credentials.
-      envVars: input.envVars,
-      // Same absent-vs-present contract as envVars for the behavioral quad.
-      behavior: input.behavior,
-    },
+    input: updatePersonaPayload(input),
   });
   if (raw.writeback_warning) {
     console.warn(
@@ -103,6 +123,41 @@ export async function updatePersona(
   return fromRawPersona(raw);
 }
 
+/**
+ * Save an edit AND publish the persona's catalog head, reporting whether the
+ * relay accepted it.
+ *
+ * `updatePersona` only enqueues the head best-effort, so it cannot tell the UI
+ * whether the community catalog actually received the change. Use this for the
+ * "Save and publish" affordance, which promises exactly that.
+ */
+export async function updatePersonaAndPublish(
+  input: UpdatePersonaInput,
+): Promise<PersonaSharePublicationResult> {
+  return fromRawPublicationResult(
+    await invokeTauri<RawPersonaSharePublicationResult>(
+      "update_persona_and_publish",
+      { input: updatePersonaPayload(input) },
+    ),
+  );
+}
+
+type RawPersonaSharePublicationResult = {
+  persona: RawPersona;
+  publicationStatus: "published" | "queued";
+  relayMessage?: string;
+};
+
+function fromRawPublicationResult(
+  raw: RawPersonaSharePublicationResult,
+): PersonaSharePublicationResult {
+  return {
+    persona: fromRawPersona(raw.persona),
+    publicationStatus: raw.publicationStatus,
+    relayMessage: raw.relayMessage ?? null,
+  };
+}
+
 export async function deletePersona(id: string): Promise<void> {
   await invokeTauri("delete_persona", { id });
 }
@@ -116,6 +171,24 @@ export async function setPersonaActive(
   );
 }
 
+export async function setPersonaShared(
+  id: string,
+  shared: boolean,
+): Promise<PersonaSharePublicationResult> {
+  return fromRawPublicationResult(
+    await invokeTauri<RawPersonaSharePublicationResult>("set_persona_shared", {
+      id,
+      shared,
+    }),
+  );
+}
+
+export type PersonaSharePublicationResult = {
+  persona: AgentPersona;
+  publicationStatus: "published" | "queued";
+  relayMessage: string | null;
+};
+
 export type SnapshotMemoryLevel = "none" | "core" | "everything";
 export type SnapshotFormat = "json" | "png";
 
@@ -172,6 +245,10 @@ export async function encodeAgentSnapshotForSend(
 /** Preview returned by `preview_agent_snapshot_import` before any write. */
 export type AgentSnapshotImportPreview = {
   displayName: string;
+  /** Source classification shown in the preview; imports remain custom. */
+  isBuiltIn: boolean;
+  model: string | null;
+  runtime: string | null;
   systemPrompt: string | null;
   /** Effective avatar: data URL if present, source URL fallback otherwise. */
   avatarUrl: string | null;
@@ -235,9 +312,15 @@ export async function confirmAgentSnapshotImport(
 
 // Patches a single inbound persona/team/agent projection event into the local
 // store (personas.json). The backend resolves the match key and the
-// pending-edit race; the frontend only forwards the raw Nostr event JSON.
+// pending-edit race; the frontend forwards the raw Nostr event JSON plus the
+// relay it arrived on, so a workspace switch mid-flight cannot retain the event
+// into the newly active community's scoped store.
 export async function reconcileInboundPersonaEvent(
   eventJson: string,
+  arrivalRelayUrl: string,
 ): Promise<void> {
-  await invokeTauri("reconcile_inbound_persona_event", { eventJson });
+  await invokeTauri("reconcile_inbound_persona_event", {
+    eventJson,
+    arrivalRelayUrl,
+  });
 }
diff --git a/desktop/src/shared/api/types.ts b/desktop/src/shared/api/types.ts
index 50842d0d0a0..689c400b03c 100644
--- a/desktop/src/shared/api/types.ts
+++ b/desktop/src/shared/api/types.ts
@@ -268,28 +268,11 @@ export type GetHomeFeedInput = {
   types?: string;
 };
 
-export type SearchMessagesInput = {
-  q: string;
-  limit?: number;
-  channelId?: string;
-};
-
-export type SearchHit = {
-  eventId: string;
-  content: string;
-  kind: number;
-  pubkey: string;
-  channelId: string | null;
-  channelName: string | null;
-  createdAt: number;
-  score: number;
-  threadRootId?: string | null;
-};
-
-export type SearchMessagesResponse = {
-  hits: SearchHit[];
-  found: number;
-};
+export type {
+  SearchHit,
+  SearchMessagesInput,
+  SearchMessagesResponse,
+} from "./searchTypes";
 
 // ── Relay Members ────────────────────────────────────────────────────────────
 
@@ -770,10 +753,17 @@ export type AgentPersona = {
   namePool: string[];
   isBuiltIn: boolean;
   isActive: boolean;
+  /** Whether this persona is discoverable in the active community catalog. */
+  shared: boolean;
   /** Team ID if this persona was imported from a team directory. Team personas are non-editable. */
   sourceTeam?: string | null;
-  /** Environment variables injected for agents created from this persona.
-   * Layered as: desktop parent env < persona envVars < agent envVars. */
+  /**
+   * Set only on a local copy of another owner's shared catalog entry. A copy
+   * carries a fresh local `id`, so this coordinate is the only thing that can
+   * answer "is this catalog entry already added" without minting a duplicate.
+   */
+  catalogSource?: CatalogSourceCoordinate | null;
+  /** Agent environment variables, layered after desktop parent and persona values. */
   envVars: Record<string, string>;
   /** NIP-AP behavioral defaults (wire shape). Null/empty = unset. */
   respondTo: RespondToMode | null;
@@ -784,9 +774,18 @@ export type AgentPersona = {
 };
 
 /**
- * NIP-AP behavioral group for a definition, sent as one group: absent = don't
- * touch the stored behavior group (legacy callers), present = replace the fields as a
- * unit. Mirrors `PersonaBehaviorRequest`.
+ * A catalog publication's coordinate: the owner who published it and the
+ * `d`-tag identifying the persona within that owner's catalog. Mirrors the
+ * backend `CatalogSource`.
+ */
+export type CatalogSourceCoordinate = {
+  ownerPubkey: string;
+  personaId: string;
+};
+
+/**
+ * NIP-AP behavioral group for a definition: absent preserves the stored group
+ * for legacy callers; present replaces it as a unit. Mirrors `PersonaBehaviorRequest`.
  */
 export type PersonaBehaviorInput = {
   respondTo?: RespondToMode;
@@ -804,6 +803,11 @@ export type CreatePersonaInput = {
   namePool?: string[];
   envVars?: Record<string, string>;
   behavior?: PersonaBehaviorInput;
+  /**
+   * Set when this persona is a copy of another owner's shared catalog entry,
+   * so the catalog can tell an already-added foreign entry from a new one.
+   */
+  catalogSource?: CatalogSourceCoordinate;
 };
 
 export type UpdatePersonaInput = {
diff --git a/desktop/src/shared/lib/localStorageQuota.test.mjs b/desktop/src/shared/lib/localStorageQuota.test.mjs
index ae84cae15d1..64e351113ad 100644
--- a/desktop/src/shared/lib/localStorageQuota.test.mjs
+++ b/desktop/src/shared/lib/localStorageQuota.test.mjs
@@ -1,7 +1,10 @@
 import assert from "node:assert/strict";
 import test from "node:test";
 
-import { setLocalStorageItemWithRecovery } from "./localStorageQuota.ts";
+import {
+  recoverLocalStorageQuotaOnStartup,
+  setLocalStorageItemWithRecovery,
+} from "./localStorageQuota.ts";
 
 function makeQuotaLocalStorage({ maxEntries }) {
   const store = new Map();
@@ -30,6 +33,144 @@ function install(ls) {
   globalThis.localStorage = ls;
 }
 
+test("startup recovery removes disposable caches but preserves user state", () => {
+  const ls = makeQuotaLocalStorage({ maxEntries: 5 });
+  install(ls);
+  ls.store.set("buzz-channel-messages.v1:relay:chan", "big");
+  ls.store.set("buzz-channels.v1:relay", "big");
+  ls.store.set("buzz-timeline-skeleton-shape.v1:chan", "small");
+  ls.store.set("buzz-sidebar-skeleton-shape.v1:community:user", "small");
+  ls.store.set("buzz-communities", "keep");
+
+  recoverLocalStorageQuotaOnStartup();
+
+  assert.equal(ls.getItem("buzz-channel-messages.v1:relay:chan"), null);
+  assert.equal(ls.getItem("buzz-channels.v1:relay"), null);
+  assert.equal(ls.getItem("buzz-timeline-skeleton-shape.v1:chan"), null);
+  assert.equal(
+    ls.getItem("buzz-sidebar-skeleton-shape.v1:community:user"),
+    null,
+  );
+  assert.equal(ls.getItem("buzz-communities"), "keep");
+  assert.equal(ls.getItem("buzz-local-storage-quota-recovery.v1"), "1");
+});
+
+test("healthy startup preserves disposable caches", () => {
+  const ls = makeQuotaLocalStorage({ maxEntries: 10 });
+  install(ls);
+  ls.store.set("buzz-channel-messages.v1:relay:new", "snapshot");
+
+  recoverLocalStorageQuotaOnStartup();
+
+  assert.equal(ls.getItem("buzz-channel-messages.v1:relay:new"), "snapshot");
+  assert.equal(ls.getItem("buzz-local-storage-quota-recovery.v1"), "1");
+});
+
+test("startup recovery does not remove namespace near misses", () => {
+  const ls = makeQuotaLocalStorage({ maxEntries: 2 });
+  install(ls);
+  ls.store.set("buzz-channels.v10:durable", "keep");
+  ls.store.set("buzz-channel-messages.v1-durable", "keep");
+
+  recoverLocalStorageQuotaOnStartup();
+
+  assert.equal(ls.getItem("buzz-channels.v10:durable"), "keep");
+  assert.equal(ls.getItem("buzz-channel-messages.v1-durable"), "keep");
+  assert.equal(ls.getItem("buzz-local-storage-quota-recovery.v1"), null);
+});
+
+test("startup recovery runs only once", () => {
+  const ls = makeQuotaLocalStorage({ maxEntries: 10 });
+  install(ls);
+
+  recoverLocalStorageQuotaOnStartup();
+  ls.store.set("buzz-channel-messages.v1:relay:new", "new snapshot");
+  recoverLocalStorageQuotaOnStartup();
+
+  assert.equal(
+    ls.getItem("buzz-channel-messages.v1:relay:new"),
+    "new snapshot",
+  );
+});
+
+test("startup recovery retries after marker write fails", () => {
+  const ls = makeQuotaLocalStorage({ maxEntries: 1 });
+  install(ls);
+  ls.store.set("buzz-communities", "keep");
+
+  recoverLocalStorageQuotaOnStartup();
+  assert.equal(ls.getItem("buzz-local-storage-quota-recovery.v1"), null);
+
+  ls.store.delete("buzz-communities");
+  ls.store.set("buzz-channel-messages.v1:relay:chan", "big");
+  recoverLocalStorageQuotaOnStartup();
+
+  assert.equal(ls.getItem("buzz-channel-messages.v1:relay:chan"), null);
+  assert.equal(ls.getItem("buzz-local-storage-quota-recovery.v1"), "1");
+});
+
+test("global cache byte budget evicts only oldest entries needed", () => {
+  const ls = makeQuotaLocalStorage({ maxEntries: 20 });
+  install(ls);
+  ls.store.set("buzz-communities", "keep");
+  const snapshot = (updatedAt) =>
+    JSON.stringify({ updatedAt, payload: "x".repeat(400_000) });
+  const oldestKey = "buzz-channel-messages.v1:relay:oldest";
+  const newerKey = "buzz-channels.v1:relay-newer";
+  const newestKey = "buzz-channel-messages.v1:relay:newest";
+
+  assert.equal(setLocalStorageItemWithRecovery(oldestKey, snapshot(1)), true);
+  assert.equal(setLocalStorageItemWithRecovery(newerKey, snapshot(2)), true);
+  assert.equal(setLocalStorageItemWithRecovery(newestKey, snapshot(3)), true);
+
+  assert.equal(ls.getItem(oldestKey), null);
+  assert.notEqual(ls.getItem(newerKey), null);
+  assert.notEqual(ls.getItem(newestKey), null);
+  assert.equal(ls.getItem("buzz-communities"), "keep");
+});
+
+test("global cache byte budget spans relays and preserves durable state", () => {
+  const ls = makeQuotaLocalStorage({ maxEntries: 20 });
+  install(ls);
+  ls.store.set("buzz-communities", "keep");
+  const largeSnapshot = "x".repeat(600_000);
+
+  assert.equal(
+    setLocalStorageItemWithRecovery(
+      "buzz-channel-messages.v1:relay-one:chan",
+      largeSnapshot,
+    ),
+    true,
+  );
+  assert.equal(
+    setLocalStorageItemWithRecovery(
+      "buzz-channel-messages.v1:relay-two:chan",
+      largeSnapshot,
+    ),
+    true,
+  );
+
+  assert.equal(ls.getItem("buzz-channel-messages.v1:relay-one:chan"), null);
+  assert.equal(
+    ls.getItem("buzz-channel-messages.v1:relay-two:chan"),
+    largeSnapshot,
+  );
+  assert.equal(ls.getItem("buzz-communities"), "keep");
+});
+
+test("rejects a single cache entry larger than the global byte budget", () => {
+  const ls = makeQuotaLocalStorage({ maxEntries: 10 });
+  install(ls);
+  const key = "buzz-channel-messages.v1:relay:oversized";
+  ls.store.set(key, "previous snapshot");
+
+  assert.equal(
+    setLocalStorageItemWithRecovery(key, "x".repeat(1_100_000)),
+    false,
+  );
+  assert.equal(ls.getItem(key), null);
+});
+
 test("writes normally when under quota", () => {
   const ls = makeQuotaLocalStorage({ maxEntries: 10 });
   install(ls);
diff --git a/desktop/src/shared/lib/localStorageQuota.ts b/desktop/src/shared/lib/localStorageQuota.ts
index bf194a6cc8e..538003ef6f5 100644
--- a/desktop/src/shared/lib/localStorageQuota.ts
+++ b/desktop/src/shared/lib/localStorageQuota.ts
@@ -8,19 +8,32 @@
  */
 
 const PURE_CACHE_KEY_PREFIXES = [
-  "buzz-channel-messages.v1",
-  "buzz-channels.v1",
-  "buzz-timeline-skeleton-shape.v1",
+  "buzz-channel-messages.v1:",
+  "buzz-channels.v1:",
+  "buzz-sidebar-skeleton-shape.v1:",
+  "buzz-timeline-skeleton-shape.v1:",
 ];
 
+const QUOTA_RECOVERY_MARKER_KEY = "buzz-local-storage-quota-recovery.v1";
+
+// Keep disposable snapshots below 2 MiB, leaving roughly 3 MiB of WebKit's
+// observed ~5 MiB origin quota for identities, communities, preferences, and
+// read state. localStorage strings are UTF-16, so count two bytes per code unit.
+const PURE_CACHE_BYTE_BUDGET = 2 * 1024 * 1024;
+
+function isPureCacheKey(key: string): boolean {
+  return PURE_CACHE_KEY_PREFIXES.some((prefix) => key.startsWith(prefix));
+}
+
+function storageEntryBytes(key: string, value: string): number {
+  return (key.length + value.length) * 2;
+}
+
 function evictPureCacheEntries(): number {
   const toRemove: string[] = [];
   for (let i = 0; i < window.localStorage.length; i++) {
     const key = window.localStorage.key(i);
-    if (
-      key !== null &&
-      PURE_CACHE_KEY_PREFIXES.some((prefix) => key.startsWith(prefix))
-    ) {
+    if (key !== null && isPureCacheKey(key)) {
       toRemove.push(key);
     }
   }
@@ -30,6 +43,83 @@ function evictPureCacheEntries(): number {
   return toRemove.length;
 }
 
+function pureCacheEntriesExcluding(excludedKey: string): Array<{
+  bytes: number;
+  key: string;
+  updatedAt: number;
+}> {
+  const entries: Array<{ bytes: number; key: string; updatedAt: number }> = [];
+  for (let i = 0; i < window.localStorage.length; i++) {
+    const key = window.localStorage.key(i);
+    if (key === null || key === excludedKey || !isPureCacheKey(key)) continue;
+    const value = window.localStorage.getItem(key);
+    if (value === null) continue;
+
+    let updatedAt = 0;
+    try {
+      const parsed = JSON.parse(value) as { updatedAt?: unknown };
+      if (
+        typeof parsed.updatedAt === "number" &&
+        Number.isFinite(parsed.updatedAt)
+      ) {
+        updatedAt = parsed.updatedAt;
+      }
+    } catch {
+      // Legacy or malformed cache entries are safe to evict first.
+    }
+    entries.push({ bytes: storageEntryBytes(key, value), key, updatedAt });
+  }
+  return entries;
+}
+
+function trimPureCacheForWrite(key: string, writeBytes: number): void {
+  const entries = pureCacheEntriesExcluding(key);
+  let totalBytes = entries.reduce((total, entry) => total + entry.bytes, 0);
+  if (totalBytes + writeBytes <= PURE_CACHE_BYTE_BUDGET) return;
+
+  entries.sort((a, b) => a.updatedAt - b.updatedAt);
+  for (const entry of entries) {
+    window.localStorage.removeItem(entry.key);
+    totalBytes -= entry.bytes;
+    if (totalBytes + writeBytes <= PURE_CACHE_BYTE_BUDGET) return;
+  }
+}
+
+function preparePureCacheWrite(key: string, value: string): boolean {
+  if (!isPureCacheKey(key)) return true;
+
+  const writeBytes = storageEntryBytes(key, value);
+  if (writeBytes > PURE_CACHE_BYTE_BUDGET) {
+    window.localStorage.removeItem(key);
+    return false;
+  }
+
+  trimPureCacheForWrite(key, writeBytes);
+  return true;
+}
+
+/**
+ * Probes storage once at startup so installs that already filled WebKit
+ * localStorage recover before app initialization. Healthy installs keep their
+ * caches; only a failed marker write triggers disposable-cache eviction. The
+ * marker is written after recovery, so an interrupted/unavailable backend
+ * retries on the next launch. Load-bearing state is never touched.
+ */
+export function recoverLocalStorageQuotaOnStartup(): void {
+  try {
+    if (window.localStorage.getItem(QUOTA_RECOVERY_MARKER_KEY) === "1") return;
+    try {
+      window.localStorage.setItem(QUOTA_RECOVERY_MARKER_KEY, "1");
+      return;
+    } catch {
+      evictPureCacheEntries();
+    }
+    window.localStorage.setItem(QUOTA_RECOVERY_MARKER_KEY, "1");
+  } catch (error) {
+    console.warn("[localStorageQuota] startup cache cleanup failed:", error);
+  }
+}
+
 let warnedPersistentFailure = false;
 
 function notifyStorageFull(): void {
@@ -56,6 +146,7 @@ export function setLocalStorageItemWithRecovery(
   value: string,
 ): boolean {
   try {
+    if (!preparePureCacheWrite(key, value)) return false;
     window.localStorage.setItem(key, value);
     return true;
   } catch (error) {
diff --git a/desktop/src/shared/lib/mediaUrl.test.mjs b/desktop/src/shared/lib/mediaUrl.test.mjs
index 9a293e8b3e2..c9182443728 100644
--- a/desktop/src/shared/lib/mediaUrl.test.mjs
+++ b/desktop/src/shared/lib/mediaUrl.test.mjs
@@ -3,6 +3,7 @@ import { test } from "node:test";
 
 import {
   beginRelayOriginFetch,
+  rewriteRelayUrl,
   getCachedRelayOrigin,
   mediaProxyUrl,
   resetMediaCaches,
@@ -20,6 +21,32 @@ function deferred() {
   return { promise, resolve };
 }
 
+const PREFIX_HASH = "a".repeat(64);
+
+test("rewriteRelayUrl: recognises relay media under a base path", () => {
+  // BUZZ_BASE_PATH deployments serve media at <prefix>/media/<hash>. Without a
+  // proxy port cached, a recognised relay URL falls back to buzz-media://; an
+  // unrecognised one is returned unchanged, which is how we detect the match.
+  resetMediaCaches();
+  const prefixed = `https://relay.example.com/relay/media/${PREFIX_HASH}.png`;
+  assert.equal(rewriteRelayUrl(prefixed), `buzz-media://localhost/media/${PREFIX_HASH}.png`);
+
+  const multi = `https://relay.example.com/buzz/relay/media/${PREFIX_HASH}.png`;
+  assert.equal(rewriteRelayUrl(multi), `buzz-media://localhost/media/${PREFIX_HASH}.png`);
+});
+
+test("rewriteRelayUrl: root-hosted relay media still recognised", () => {
+  resetMediaCaches();
+  const root = `https://relay.example.com/media/${PREFIX_HASH}.png`;
+  assert.equal(rewriteRelayUrl(root), `buzz-media://localhost/media/${PREFIX_HASH}.png`);
+});
+
+test("rewriteRelayUrl: a media-lookalike segment is left alone", () => {
+  resetMediaCaches();
+  const evil = `https://relay.example.com/relay/media-evil/${PREFIX_HASH}.png`;
+  assert.equal(rewriteRelayUrl(evil), evil);
+});
+
 test("mediaProxyUrl: uses the IPv4 loopback literal for the localhost proxy", () => {
   assert.equal(
     mediaProxyUrl(54321, `${HASH}.png`),
diff --git a/desktop/src/shared/lib/mediaUrl.ts b/desktop/src/shared/lib/mediaUrl.ts
index 8875920ef28..de58251cf32 100644
--- a/desktop/src/shared/lib/mediaUrl.ts
+++ b/desktop/src/shared/lib/mediaUrl.ts
@@ -19,8 +19,11 @@ import { invoke } from "@tauri-apps/api/core";
 
 // Matches: https://anything.com/media/{64-hex}.{ext}
 // Also matches thumbnails: /media/{64-hex}.thumb.jpg
+// An optional path prefix before /media/ is allowed so relays served under
+// BUZZ_BASE_PATH (https://host/relay/media/...) are still recognised as relay
+// media; without it their URLs look external and skip the authenticated proxy.
 const RELAY_MEDIA_RE =
-  /^(?:https?:\/\/[^/]+)\/media\/([\da-f]{64}(?:\.thumb)?\.(?:jpg|png|gif|webp|mp4|webm|mov)(?:\?.*)?)$/;
+  /^(?:https?:\/\/[^/]+)(?:\/.*?)?\/media\/([\da-f]{64}(?:\.thumb)?\.(?:jpg|png|gif|webp|mp4|webm|mov)(?:\?.*)?)$/;
 
 /** Cached proxy port — fetched once from the Tauri backend. */
 let cachedPort: number | null = null;
diff --git a/desktop/src/shared/lib/remarkSpoilers.test.mjs b/desktop/src/shared/lib/remarkSpoilers.test.mjs
index 5ac848a1bbe..4fb12483573 100644
--- a/desktop/src/shared/lib/remarkSpoilers.test.mjs
+++ b/desktop/src/shared/lib/remarkSpoilers.test.mjs
@@ -137,6 +137,24 @@ test("remarkSpoilers: groups block nodes between delimiter paragraphs", () => {
   assert.equal(tree.children[1].children[0].children[0].type, "image");
 });
 
+test("remarkSpoilers: leaves collapsed GFM table separators as text", () => {
+  const value =
+    "| Time | Purpose ||---:|---|| 0:00 | Frame strategy || 3:30 | Orient the board |";
+  const tree = runPlugin({
+    type: "root",
+    children: [{ type: "paragraph", children: [{ type: "text", value }] }],
+  });
+
+  assert.equal(
+    tree.children[0].children.some((child) => child.type === "spoiler"),
+    false,
+  );
+  assert.equal(
+    tree.children[0].children.map((child) => child.value ?? "").join(""),
+    value,
+  );
+});
+
 test("remarkSpoilers: leaves unmatched delimiters as text", () => {
   const tree = runPlugin({
     type: "root",
diff --git a/desktop/src/shared/lib/remarkSpoilers.ts b/desktop/src/shared/lib/remarkSpoilers.ts
index 501d7c2d166..5b81d0f8cc4 100644
--- a/desktop/src/shared/lib/remarkSpoilers.ts
+++ b/desktop/src/shared/lib/remarkSpoilers.ts
@@ -37,17 +37,29 @@ function transformNode(node: Node) {
     transformNode(child);
   }
 
-  node.children = groupBlockSpoilers(groupSpoilers(node.children));
+  node.children = groupBlockSpoilers(
+    groupSpoilers(node.children, node.type === "paragraph"),
+  );
 }
 
-function groupSpoilers(children: Node[]): Node[] {
+function groupSpoilers(
+  children: Node[],
+  rejectTableDelimiterRow: boolean,
+): Node[] {
   const output: Node[] = [];
   let spoilerBuffer: Node[] | null = null;
 
   for (const part of splitDelimiterParts(children)) {
     if (part.type === "delimiter") {
       if (spoilerBuffer) {
-        output.push(buildSpoilerNode(spoilerBuffer));
+        if (rejectTableDelimiterRow && isTableDelimiterRow(spoilerBuffer)) {
+          output.push({ type: "text", value: "||" }, ...spoilerBuffer, {
+            type: "text",
+            value: "||",
+          });
+        } else {
+          output.push(buildSpoilerNode(spoilerBuffer));
+        }
         spoilerBuffer = null;
       } else {
         spoilerBuffer = [];
@@ -100,6 +112,13 @@ function splitDelimiterParts(children: Node[]): Part[] {
   return parts;
 }
 
+function isTableDelimiterRow(children: Node[]): boolean {
+  if (children.some((child) => child.type !== "text")) return false;
+
+  const value = children.map((child) => String(child.value ?? "")).join("");
+  return /^\s*:?-{3,}:?(?:\s*\|\s*:?-{3,}:?)+\s*$/.test(value);
+}
+
 function buildSpoilerNode(
   children: Node[],
   options: { block?: boolean } = {},
diff --git a/desktop/src/shared/styles/globals/animations.css b/desktop/src/shared/styles/globals/animations.css
index 59a5c9b4b44..77ae1573737 100644
--- a/desktop/src/shared/styles/globals/animations.css
+++ b/desktop/src/shared/styles/globals/animations.css
@@ -187,54 +187,58 @@
 }
 
 .buzz-shimmer {
-  --buzz-shimmer-duration: 2000ms;
-  --buzz-shimmer-band: 400%;
+  --buzz-shimmer-duration: 2600ms;
+  --buzz-shimmer-band: 250%;
   --buzz-shimmer-highlight: color-mix(
     in srgb,
-    hsl(var(--foreground)) 82%,
-    hsl(var(--muted-foreground)) 18%
+    hsl(var(--background)) 60%,
+    hsl(var(--muted-foreground)) 40%
   );
+  --buzz-shimmer-spread: 2rem;
 
-  color: hsl(var(--muted-foreground));
-  display: inline-block;
-  position: relative;
-}
-
-.buzz-shimmer::before {
   animation: buzz-shimmer var(--buzz-shimmer-duration) linear infinite;
   background-clip: text;
-  background-image: linear-gradient(
-    90deg,
-    transparent 0%,
-    transparent 40%,
-    var(--buzz-shimmer-highlight) 50%,
-    transparent 60%,
-    transparent 100%
-  );
+  background-image:
+    linear-gradient(
+      90deg,
+      transparent calc(50% - var(--buzz-shimmer-spread)),
+      var(--buzz-shimmer-highlight) 50%,
+      transparent calc(50% + var(--buzz-shimmer-spread))
+    ),
+    linear-gradient(hsl(var(--muted-foreground)), hsl(var(--muted-foreground)));
+  background-position:
+    100% 0,
+    0 0;
   background-repeat: no-repeat;
-  background-size: var(--buzz-shimmer-band) 100%;
+  background-size:
+    var(--buzz-shimmer-band) 100%,
+    100% 100%;
   color: transparent;
-  content: attr(data-shimmer-text);
-  inset: 0;
-  pointer-events: none;
-  position: absolute;
+  display: inline-block;
   -webkit-background-clip: text;
   -webkit-text-fill-color: transparent;
 }
 
 @keyframes buzz-shimmer {
   0% {
-    background-position: 100% 0;
+    background-position:
+      100% 0,
+      0 0;
   }
 
   100% {
-    background-position: 0% 0;
+    background-position:
+      0 0,
+      0 0;
   }
 }
 
 @media (prefers-reduced-motion: reduce) {
-  .buzz-shimmer::before {
+  .buzz-shimmer {
     animation: none;
+    background: none;
+    color: hsl(var(--muted-foreground));
+    -webkit-text-fill-color: currentcolor;
   }
 }
 
diff --git a/desktop/src/shared/styles/globals/composer.css b/desktop/src/shared/styles/globals/composer.css
index 912ed1c7992..0af4a59b4f1 100644
--- a/desktop/src/shared/styles/globals/composer.css
+++ b/desktop/src/shared/styles/globals/composer.css
@@ -1,12 +1,67 @@
+.composer-dock {
+  --composer-dock-active-rail: 2.125rem;
+  --composer-dock-activity-bottom: 0.5rem;
+  --composer-dock-quiet-inset: 1.25rem;
+  --composer-dock-release: calc(
+    var(--composer-dock-active-rail) -
+    var(--composer-dock-quiet-inset)
+  );
+
+  padding-bottom: var(--composer-dock-quiet-inset);
+  transition: padding-bottom 200ms cubic-bezier(0.23, 1, 0.32, 1);
+}
+
+.composer-dock--with-activity {
+  padding-bottom: var(--composer-dock-active-rail);
+}
+
+.composer-dock-quiet-spacer {
+  height: var(--composer-dock-release);
+  transition: height 200ms cubic-bezier(0.23, 1, 0.32, 1);
+}
+
+.composer-dock--with-activity .composer-dock-quiet-spacer {
+  height: 0;
+}
+
+.composer-dock-rail-mask {
+  height: var(--composer-dock-quiet-inset);
+  transition: height 200ms cubic-bezier(0.23, 1, 0.32, 1);
+}
+
+.composer-dock--with-activity .composer-dock-rail-mask {
+  height: var(--composer-dock-active-rail);
+}
+
+.composer-dock-activity {
+  bottom: var(--composer-dock-activity-bottom);
+}
+
 .composer-overlay-corner-masks::before,
 .composer-overlay-corner-masks::after {
   position: absolute;
-  bottom: 2.5rem;
+  bottom: var(--composer-dock-quiet-inset);
   z-index: 0;
   width: 1rem;
   height: 1rem;
   background: hsl(var(--background));
   content: "";
+  transition: bottom 200ms cubic-bezier(0.23, 1, 0.32, 1);
+}
+
+.composer-dock--with-activity.composer-overlay-corner-masks::before,
+.composer-dock--with-activity.composer-overlay-corner-masks::after {
+  bottom: var(--composer-dock-active-rail);
+}
+
+@media (prefers-reduced-motion: reduce) {
+  .composer-dock,
+  .composer-dock-quiet-spacer,
+  .composer-dock-rail-mask,
+  .composer-overlay-corner-masks::before,
+  .composer-overlay-corner-masks::after {
+    transition: none;
+  }
 }
 
 .composer-overlay-corner-masks::before {
diff --git a/desktop/src/shared/styles/globals/markdown.css b/desktop/src/shared/styles/globals/markdown.css
index fdc25d28738..6148ffeb7e8 100644
--- a/desktop/src/shared/styles/globals/markdown.css
+++ b/desktop/src/shared/styles/globals/markdown.css
@@ -118,6 +118,10 @@
   display: -webkit-box;
   -webkit-box-orient: vertical;
   -webkit-line-clamp: 2;
+  font-size: inherit;
+  font-weight: inherit;
+  letter-spacing: inherit;
+  line-height: inherit;
   overflow: hidden;
 }
 
diff --git a/desktop/src/shared/styles/globals/theme.css b/desktop/src/shared/styles/globals/theme.css
index 634dc78ffa1..0810a15f0a9 100644
--- a/desktop/src/shared/styles/globals/theme.css
+++ b/desktop/src/shared/styles/globals/theme.css
@@ -245,6 +245,28 @@
   --buzz-active-foreground: 0 0% 100%;
 }
 
+/*
+ * Use the Buzz primary color for the floating selection-formatting tray.
+ * Other themes retain the standard popover treatment.
+ */
+:root[data-buzz-sidebar] [data-buzz-selection-formatting-tray] {
+  border-color: hsl(var(--primary-foreground) / 0.18);
+  background-color: hsl(var(--primary));
+  color: hsl(var(--primary-foreground));
+}
+
+:root[data-buzz-sidebar] [data-buzz-selection-formatting-tray] button {
+  color: hsl(var(--primary-foreground));
+}
+
+:root[data-buzz-sidebar] [data-buzz-selection-formatting-tray] button:hover,
+:root[data-buzz-sidebar]
+  [data-buzz-selection-formatting-tray]
+  button[aria-pressed="true"] {
+  background-color: hsl(var(--primary-foreground) / 0.16);
+  color: hsl(var(--primary-foreground));
+}
+
 /* Keep the subtle content-card lift in Buzz Light only. */
 :root[data-buzz-sidebar]:not(.dark) [data-buzz-content-surface] {
   box-shadow:
diff --git a/desktop/src/shared/ui/Shimmer.tsx b/desktop/src/shared/ui/Shimmer.tsx
index f9b543ef091..0b26ed032f8 100644
--- a/desktop/src/shared/ui/Shimmer.tsx
+++ b/desktop/src/shared/ui/Shimmer.tsx
@@ -1,3 +1,5 @@
+import type { CSSProperties } from "react";
+
 import { cn } from "@/shared/lib/cn";
 
 type ShimmerProps = {
@@ -9,7 +11,9 @@ export function Shimmer({ children, className }: ShimmerProps) {
   return (
     <span
       className={cn("buzz-shimmer", className)}
-      data-shimmer-text={children}
+      style={
+        { "--buzz-shimmer-spread": `${children.length * 2}px` } as CSSProperties
+      }
     >
       {children}
     </span>
diff --git a/desktop/src/shared/ui/UserAvatar.tsx b/desktop/src/shared/ui/UserAvatar.tsx
index 1ef1a9b815a..dbe5eef27e5 100644
--- a/desktop/src/shared/ui/UserAvatar.tsx
+++ b/desktop/src/shared/ui/UserAvatar.tsx
@@ -20,6 +20,7 @@ type UserAvatarProps = {
   size?: UserAvatarSize;
   accent?: boolean;
   className?: string;
+  fallbackDelayMs?: number;
   testId?: string;
 };
 
@@ -29,6 +30,7 @@ export function UserAvatar({
   size = "md",
   accent = false,
   className,
+  fallbackDelayMs = 200,
   testId,
 }: UserAvatarProps) {
   const initials = getInitials(displayName);
@@ -67,7 +69,7 @@ export function UserAvatar({
             : "bg-secondary text-secondary-foreground",
         )}
         data-testid={testId ? `${testId}-fallback` : undefined}
-        delayMs={200}
+        delayMs={fallbackDelayMs}
       >
         {initials}
       </AvatarFallback>
diff --git a/desktop/src/shared/ui/config-nudge-attachment.tsx b/desktop/src/shared/ui/config-nudge-attachment.tsx
index 3f7b75ada3c..cc5931e23e3 100644
--- a/desktop/src/shared/ui/config-nudge-attachment.tsx
+++ b/desktop/src/shared/ui/config-nudge-attachment.tsx
@@ -282,7 +282,7 @@ export function ConfigNudgeCard({
         <AttachmentTrigger
           aria-label={
             opensDoctor
-              ? `Open Agent runtimes settings for ${nudge.agent_name}`
+              ? `Open Agent runtimes for ${nudge.agent_name}`
               : `Open Edit Agent for ${nudge.agent_name}`
           }
           onClick={handleOpen}
diff --git a/desktop/src/shared/ui/markdown/mediaEntry.test.mjs b/desktop/src/shared/ui/markdown/mediaEntry.test.mjs
index bbd10898be7..c8276a50a80 100644
--- a/desktop/src/shared/ui/markdown/mediaEntry.test.mjs
+++ b/desktop/src/shared/ui/markdown/mediaEntry.test.mjs
@@ -76,6 +76,21 @@ test("isRelayDownloadable: non-/media/ path on the relay is not eligible", () =>
   assert.equal(isRelayDownloadable(`${RELAY}/other/abc.mp4`, RELAY), false);
 });
 
+test("isRelayDownloadable: relay served under a base path is eligible", () => {
+  // BUZZ_BASE_PATH deployments host media at <prefix>/media/<hash>.
+  assert.equal(
+    isRelayDownloadable(`${RELAY}/relay/media/abc.mp4`, RELAY),
+    true,
+  );
+});
+
+test("isRelayDownloadable: near-miss segment under a base path is not eligible", () => {
+  assert.equal(
+    isRelayDownloadable(`${RELAY}/relay/media-evil/abc.mp4`, RELAY),
+    false,
+  );
+});
+
 test("isRelayDownloadable: malformed URL is not eligible", () => {
   assert.equal(isRelayDownloadable("not a url", RELAY), false);
 });
diff --git a/desktop/src/shared/ui/markdown/mediaEntry.ts b/desktop/src/shared/ui/markdown/mediaEntry.ts
index 8cc0160de7d..5f90e8909bf 100644
--- a/desktop/src/shared/ui/markdown/mediaEntry.ts
+++ b/desktop/src/shared/ui/markdown/mediaEntry.ts
@@ -60,6 +60,13 @@ export function isVideoMedia(src: string, imetaMime?: string): boolean {
  * it anyway). Callers must read `relayOrigin` from a reactive source
  * (`useRelayOrigin`) so eligibility recomputes — and Download appears for a
  * genuine relay URL — the moment the origin resolves.
+ *
+ * The `/media/` segment is matched anywhere in the path rather than only at the
+ * root, because a relay served under `BUZZ_BASE_PATH` hosts media at
+ * `<prefix>/media/<hash>`. `relayOrigin` is origin-only by design (it backs
+ * proxy decisions and is canonicalized for case-insensitive host comparison),
+ * so the prefix isn't available here to anchor against. Requiring a full
+ * `/media/` segment still rejects near-misses like `/media-evil/<hash>`.
  */
 export function isRelayDownloadable(
   src: string,
@@ -72,6 +79,6 @@ export function isRelayDownloadable(
   } catch {
     return false;
   }
-  if (!parsed.pathname.startsWith("/media/")) return false;
+  if (!parsed.pathname.includes("/media/")) return false;
   return parsed.origin === relayOrigin;
 }
diff --git a/desktop/src/testing/e2eBridge.ts b/desktop/src/testing/e2eBridge.ts
index eeeef495bf5..7b13273c602 100644
--- a/desktop/src/testing/e2eBridge.ts
+++ b/desktop/src/testing/e2eBridge.ts
@@ -40,6 +40,7 @@ import {
   KIND_HUDDLE_STARTED,
   KIND_MEMBER_ADDED_NOTIFICATION,
   KIND_MEMBER_REMOVED_NOTIFICATION,
+  KIND_PERSONA,
   KIND_REPO_ANNOUNCEMENT,
   KIND_REPO_STATE,
   KIND_STREAM_MESSAGE_EDIT,
@@ -112,13 +113,17 @@ type MockPersonaSeed = {
   displayName: string;
   avatarUrl?: string | null;
   systemPrompt: string;
+  updatedAt?: string;
   isActive?: boolean;
+  shared?: boolean;
   sourceTeam?: string | null;
   envVars?: Record<string, string>;
   runtime?: string | null;
   model?: string | null;
   provider?: string | null;
   namePool?: string[];
+  respondTo?: "owner-only" | "allowlist" | "anyone";
+  respondToAllowlist?: string[];
 };
 
 type MockTeamSeed = {
@@ -149,6 +154,13 @@ type E2eConfig = {
       name?: string;
       expiresAt: string;
     } | null;
+    /** Optional policy returned by the native join-policy discovery command. */
+    joinPolicy?: {
+      terms_markdown?: string;
+      privacy_markdown?: string;
+      age_attestation_required: boolean;
+      version: string;
+    } | null;
     /** Delay Builderlab login completion so cancellation/retry UI can be tested. */
     builderlabLoginDelayMs?: number;
     /** Bound Builderlab Nostr identity. Null/omitted = not linked yet. */
@@ -187,6 +199,8 @@ type E2eConfig = {
     connectAcpRuntimeResult?: RawConnectAcpRuntimeResult;
     connectAcpRuntimeDelayMs?: number;
     connectAcpRuntimeError?: string;
+    /** Catalog returned after a successful mocked connect (sign-in). */
+    acpRuntimesCatalogAfterConnect?: RawAcpRuntimeCatalogEntry[];
     activePersonaIds?: string[];
     installAcpRuntimeDelayMs?: number;
     installAcpRuntimeResult?: RawInstallRuntimeResult;
@@ -215,6 +229,10 @@ type E2eConfig = {
      *  (`list/start/stop/restart_managed_agent_runtime`). */
     managedAgentRuntimes?: MockManagedAgentRuntimeSeed[];
     personas?: MockPersonaSeed[];
+    /** Community catalog replaceable-event heads returned by relay queries. */
+    personaCatalogEvents?: RelayEvent[];
+    /** Outcomes for successive explicit persona share publications. */
+    personaSharePublicationStatuses?: Array<"published" | "queued">;
     teams?: MockTeamSeed[];
     relayAgents?: MockRelayAgentSeed[];
     agentListDelayMs?: number;
@@ -800,7 +818,9 @@ type RawPersona = {
   name_pool?: string[];
   is_builtin: boolean;
   is_active: boolean;
+  shared: boolean;
   source_team?: string | null;
+  catalog_source?: { owner_pubkey: string; persona_id: string } | null;
   env_vars?: Record<string, string>;
   respond_to?: string | null;
   respond_to_allowlist?: string[];
@@ -1013,7 +1033,9 @@ declare global {
     }) => RelayEvent[];
     __BUZZ_E2E_EMIT_MOCK_TYPING__?: (input: {
       channelName: string;
+      createdAt?: number;
       pubkey?: string;
+      threadHeadId?: string;
     }) => RelayEvent;
     __BUZZ_E2E_INVOKE_MOCK_COMMAND__?: (
       command: string,
@@ -2160,6 +2182,7 @@ function resetMockPersonas(config?: E2eConfig) {
     name_pool: [],
     is_builtin: true,
     is_active: activePersonaIds.has(persona.id),
+    shared: false,
     source_team: null,
     created_at: now,
     updated_at: now,
@@ -2175,12 +2198,18 @@ function resetMockPersonas(config?: E2eConfig) {
       model: persona.model ?? null,
       provider: persona.provider ?? null,
       name_pool: persona.namePool ?? [],
+      respond_to: persona.respondTo ?? null,
+      respond_to_allowlist:
+        persona.respondTo === "allowlist"
+          ? [...(persona.respondToAllowlist ?? [])]
+          : [],
       is_builtin: false,
       is_active: persona.isActive ?? true,
+      shared: persona.shared ?? false,
       source_team: persona.sourceTeam ?? null,
       env_vars: { ...(persona.envVars ?? {}) },
       created_at: now,
-      updated_at: now,
+      updated_at: persona.updatedAt ?? now,
     });
   }
 }
@@ -2775,6 +2804,7 @@ const mockChannels: MockChannel[] = [
 const mockMessages = new Map<string, RelayEvent[]>();
 const mockUserStatuses: RelayEvent[] = [];
 const mockReminderEvents: RelayEvent[] = [];
+const mockPersonaEvents: RelayEvent[] = [];
 let mockRelayMembers: RawRelayMember[] = [];
 const mockSockets = new Map<number, MockSocket>();
 let mockWebsocketSendMutexWedged = false;
@@ -2805,6 +2835,16 @@ function resetMockSaveSubscriptions(config: E2eConfig | undefined) {
   }));
 }
 
+function resetMockPersonaCatalogEvents(config: E2eConfig | undefined) {
+  mockPersonaEvents.length = 0;
+  for (const event of config?.mock?.personaCatalogEvents ?? []) {
+    mockPersonaEvents.push({
+      ...event,
+      tags: event.tags.map((tag) => [...tag]),
+    });
+  }
+}
+
 // Mesh-compute mock state — TEST-ONLY.
 //
 // This entire module (e2eBridge.ts) is loaded only when `window.__BUZZ_E2E__`
@@ -3835,6 +3875,13 @@ function emitMockLiveEvent(channelId: string, event: RelayEvent) {
 }
 
 function emitMockGlobalEvent(event: RelayEvent) {
+  if (
+    event.kind === KIND_PERSONA &&
+    event.pubkey.toLowerCase() !== MOCK_IDENTITY_PUBKEY.toLowerCase() &&
+    !personaHasExactSharedTag(event)
+  ) {
+    return;
+  }
   for (const socket of mockSockets.values()) {
     for (const [subId, subscription] of socket.subscriptions) {
       if (subscription.kinds && !subscription.kinds.includes(event.kind)) {
@@ -4021,13 +4068,21 @@ function emitMockChannelMessage(
   return event;
 }
 
-function emitMockTypingIndicator(channelId: string, pubkey: string) {
+function emitMockTypingIndicator(
+  channelId: string,
+  pubkey: string,
+  threadHeadId?: string,
+  createdAt?: number,
+) {
   const event: RelayEvent = {
     id: crypto.randomUUID().replace(/-/g, ""),
     pubkey,
-    created_at: Math.floor(Date.now() / 1000),
+    created_at: createdAt ?? Math.floor(Date.now() / 1000),
     kind: 20002,
-    tags: [["h", channelId]],
+    tags: [
+      ["h", channelId],
+      ...(threadHeadId ? [["e", threadHeadId, "", "reply"]] : []),
+    ],
     content: "",
     sig: "mocksig".repeat(20).slice(0, 128),
   };
@@ -6960,6 +7015,7 @@ function withMockRuntimeConfigMetadata(
 
 let runtimeCatalogDiscoveryCount = 0;
 let mockInstallCompleted = false;
+let mockConnectCompleted = false;
 
 async function handleDiscoverAcpRuntimes(
   config: E2eConfig | undefined,
@@ -6985,6 +7041,10 @@ async function handleDiscoverAcpRuntimes(
   if (mockInstallCompleted && afterInstall) {
     return afterInstall.map(withMockRuntimeConfigMetadata);
   }
+  const afterConnect = config?.mock?.acpRuntimesCatalogAfterConnect;
+  if (mockConnectCompleted && afterConnect) {
+    return afterConnect.map(withMockRuntimeConfigMetadata);
+  }
   const sequence = config?.mock?.acpRuntimesCatalogSequence;
   if (sequence && sequence.length > 0) {
     const index = Math.min(runtimeCatalogDiscoveryCount, sequence.length - 1);
@@ -7114,6 +7174,7 @@ async function handleConnectAcpRuntime(
   if (delayMs > 0) {
     await new Promise((resolve) => window.setTimeout(resolve, delayMs));
   }
+  mockConnectCompleted = true;
   return config?.mock?.connectAcpRuntimeResult ?? { launched: true };
 }
 
@@ -7133,6 +7194,9 @@ let mockGlobalAgentConfig: {
 // Per-page get_nsec call counter for sequenced error testing.
 let nsecCallCount = 0;
 
+// Per-page explicit catalog publication outcomes.
+let personaSharePublicationCallCount = 0;
+
 // Per-page confirm_team_snapshot_import call counter for sequenced error testing.
 let teamSnapshotConfirmCallCount = 0;
 
@@ -7326,6 +7390,7 @@ async function handleCreatePersona(args: {
     provider?: string;
     envVars?: Record<string, string>;
     behavior?: PersonaBehaviorInput;
+    catalogSource?: { ownerPubkey: string; personaId: string };
   };
 }): Promise<RawPersona> {
   const now = new Date().toISOString();
@@ -7339,49 +7404,78 @@ async function handleCreatePersona(args: {
     provider: args.input.provider?.trim() || null,
     is_builtin: false,
     is_active: true,
+    shared: false,
     source_team: null,
+    // Mirrors `CatalogSource::normalized`: the coordinate a catalog copy keeps
+    // so the catalog can tell an already-added foreign entry from a new one.
+    catalog_source: args.input.catalogSource
+      ? {
+          owner_pubkey: args.input.catalogSource.ownerPubkey
+            .trim()
+            .toLowerCase(),
+          persona_id: args.input.catalogSource.personaId.trim(),
+        }
+      : null,
     env_vars: { ...(args.input.envVars ?? {}) },
     created_at: now,
     updated_at: now,
   };
   applyMockPersonaBehavior(persona, args.input.behavior);
   mockPersonas.push(persona);
+  upsertMockPersonaEvent(persona);
   return { ...persona };
 }
 
+type MockUpdatePersonaInput = {
+  id: string;
+  displayName: string;
+  avatarUrl?: string;
+  systemPrompt: string;
+  runtime?: string;
+  model?: string;
+  provider?: string;
+  envVars?: Record<string, string>;
+  behavior?: PersonaBehaviorInput;
+};
+
 async function handleUpdatePersona(args: {
-  input: {
-    id: string;
-    displayName: string;
-    avatarUrl?: string;
-    systemPrompt: string;
-    runtime?: string;
-    model?: string;
-    provider?: string;
-    envVars?: Record<string, string>;
-    behavior?: PersonaBehaviorInput;
-  };
+  input: MockUpdatePersonaInput;
 }): Promise<RawPersona> {
-  const persona = mockPersonas.find(
-    (candidate) => candidate.id === args.input.id,
-  );
+  return { ...applyMockPersonaUpdate(args.input) };
+}
+
+/**
+ * Save an edit to the mock persona store, exactly like `update_persona_with`,
+ * and return the live record so a caller can publish it.
+ *
+ * Deliberately does NOT publish a catalog event: the real `update_persona`
+ * only enqueues a pending head for the out-of-band flush loop, so nothing has
+ * reached the relay by the time the command returns. Publishing here would
+ * make a UI that never calls `update_persona_and_publish` look like it kept
+ * the "Save and publish" promise.
+ */
+function applyMockPersonaUpdate(input: MockUpdatePersonaInput): RawPersona {
+  const persona = mockPersonas.find((candidate) => candidate.id === input.id);
   if (!persona) {
-    throw new Error(`agent ${args.input.id} not found`);
-  }
-  persona.display_name = args.input.displayName.trim();
-  persona.avatar_url = args.input.avatarUrl?.trim() || null;
-  persona.system_prompt = args.input.systemPrompt.trim();
-  persona.runtime = args.input.runtime?.trim() || null;
-  persona.model = args.input.model?.trim() || null;
-  persona.provider = args.input.provider?.trim() || null;
-  if (args.input.envVars !== undefined) {
+    throw new Error(`agent ${input.id} not found`);
+  }
+  persona.display_name = input.displayName.trim();
+  persona.avatar_url = input.avatarUrl?.trim() || null;
+  persona.system_prompt = input.systemPrompt.trim();
+  persona.runtime = input.runtime?.trim() || null;
+  persona.model = input.model?.trim() || null;
+  persona.provider = input.provider?.trim() || null;
+  if (input.envVars !== undefined) {
     // Absent = preserve; present = replace entirely (matches Rust handler).
-    persona.env_vars = { ...args.input.envVars };
+    persona.env_vars = { ...input.envVars };
   }
-  applyMockPersonaBehavior(persona, args.input.behavior);
+  applyMockPersonaBehavior(persona, input.behavior);
   persona.updated_at = new Date().toISOString();
 
-  return { ...persona };
+  for (const callback of tauriEventListeners.get("agents-data-changed") ?? []) {
+    callback();
+  }
+  return persona;
 }
 
 async function handleDeletePersona(args: { id: string }): Promise<void> {
@@ -7443,15 +7537,115 @@ async function handleSetPersonaActive(args: {
   return { ...persona };
 }
 
+function personaHasExactSharedTag(event: RelayEvent): boolean {
+  const tags = event.tags.filter((tag) => tag[0] === "shared");
+  return tags.length === 1 && tags[0]?.length === 2 && tags[0]?.[1] === "true";
+}
+
+function upsertMockPersonaRelayEvent(event: RelayEvent): void {
+  const sourceId = event.tags.find((tag) => tag[0] === "d")?.[1];
+  if (!sourceId) return;
+  const existingIndex = mockPersonaEvents.findIndex(
+    (candidate) =>
+      candidate.pubkey.toLowerCase() === event.pubkey.toLowerCase() &&
+      candidate.tags.some((tag) => tag[0] === "d" && tag[1] === sourceId),
+  );
+  if (existingIndex >= 0) {
+    mockPersonaEvents.splice(existingIndex, 1);
+  }
+  mockPersonaEvents.push(event);
+}
+
+function upsertMockPersonaEvent(persona: RawPersona): void {
+  const event: RelayEvent = {
+    id: mockEventId(),
+    pubkey: MOCK_IDENTITY_PUBKEY,
+    created_at: Math.floor(Date.now() / 1_000),
+    kind: KIND_PERSONA,
+    tags: [["d", persona.id], ...(persona.shared ? [["shared", "true"]] : [])],
+    content: JSON.stringify({
+      display_name: persona.display_name,
+      system_prompt: persona.system_prompt,
+      avatar_url: persona.avatar_url,
+      runtime: persona.runtime ?? null,
+      model: persona.model ?? null,
+      provider: persona.provider ?? null,
+      name_pool: persona.name_pool ?? [],
+      respond_to: persona.respond_to ?? null,
+      respond_to_allowlist: persona.respond_to_allowlist ?? [],
+      parallelism: persona.parallelism ?? null,
+    }),
+    sig: "0".repeat(128),
+  };
+  upsertMockPersonaRelayEvent(event);
+  emitMockGlobalEvent(event);
+}
+
+type MockPersonaPublicationResult = {
+  persona: RawPersona;
+  publicationStatus: "published" | "queued";
+  relayMessage?: string;
+};
+
+/**
+ * Publish a persona's catalog head and report the relay outcome, like
+ * `publish_prepared_persona`. A `queued` outcome must NOT make the event
+ * visible to catalog readers — that is the whole distinction the UI reports.
+ */
+function publishMockPersonaHead(
+  persona: RawPersona,
+  config: E2eConfig | undefined,
+): MockPersonaPublicationResult {
+  const publicationStatus =
+    config?.mock?.personaSharePublicationStatuses?.[
+      personaSharePublicationCallCount++
+    ] ?? "published";
+  if (publicationStatus === "published") {
+    upsertMockPersonaEvent(persona);
+  }
+  return {
+    persona: { ...persona },
+    publicationStatus,
+    ...(publicationStatus === "queued"
+      ? { relayMessage: "relay unreachable: could not connect to relay" }
+      : {}),
+  };
+}
+
+async function handleSetPersonaShared(
+  args: {
+    id: string;
+    shared: boolean;
+  },
+  config?: E2eConfig,
+): Promise<MockPersonaPublicationResult> {
+  const persona = mockPersonas.find((candidate) => candidate.id === args.id);
+  if (!persona) {
+    throw new Error(`agent ${args.id} not found`);
+  }
+  if (persona.is_builtin) {
+    throw new Error("Built-in agents cannot be shared to the catalog.");
+  }
+  persona.shared = args.shared;
+  persona.updated_at = new Date().toISOString();
+  return publishMockPersonaHead(persona, config);
+}
+
+/** Mirrors `update_persona_and_publish`: save the edit, then await the relay. */
+async function handleUpdatePersonaAndPublish(
+  args: { input: MockUpdatePersonaInput },
+  config?: E2eConfig,
+): Promise<MockPersonaPublicationResult> {
+  return publishMockPersonaHead(applyMockPersonaUpdate(args.input), config);
+}
+
 function ensureMockPersonaIsActive(personaId: string) {
   const persona = mockPersonas.find((candidate) => candidate.id === personaId);
   if (!persona) {
     throw new Error(`agent ${personaId} not found`);
   }
   if (!persona.is_active) {
-    throw new Error(
-      `${persona.display_name} is not in My Agents. Choose it from Agent Catalog first.`,
-    );
+    throw new Error(`${persona.display_name} is not in My Agents.`);
   }
 }
 
@@ -7985,10 +8179,60 @@ async function handleUpdateManagedAgent(args: {
   return { agent: cloneManagedAgent(agent), profile_sync_error: null };
 }
 
+/**
+ * Mock-mode `search_messages` predicate, mirroring the relay's filter contract.
+ *
+ * `since`/`until` are NIP-01 bounds and both inclusive — the relay keeps events
+ * where `since <= created_at <= until` (`crates/buzz-core/src/filter.rs`). The
+ * `before:` operator's exclusivity is encoded upstream in
+ * `parseSearchOperators`, which subtracts a second; the mock must not subtract
+ * it a second time.
+ *
+ * Exported so the boundary behavior is unit-testable without a browser.
+ */
+export function mockSearchHitMatches(
+  hit: Pick<
+    RawSearchHit,
+    "channel_id" | "pubkey" | "created_at" | "content" | "channel_name"
+  >,
+  filters: {
+    /** Lowercased FTS query; empty matches everything. */
+    query: string;
+    channelId?: string;
+    authorSet: Set<string> | null;
+    since?: number;
+    until?: number;
+  },
+): boolean {
+  if (filters.channelId && hit.channel_id !== filters.channelId) {
+    return false;
+  }
+  if (filters.authorSet && !filters.authorSet.has(hit.pubkey.toLowerCase())) {
+    return false;
+  }
+  if (filters.since != null && hit.created_at < filters.since) {
+    return false;
+  }
+  if (filters.until != null && hit.created_at > filters.until) {
+    return false;
+  }
+  if (!filters.query) {
+    return true;
+  }
+  return (
+    hit.content.toLowerCase().includes(filters.query) ||
+    (hit.channel_name?.toLowerCase().includes(filters.query) ?? false)
+  );
+}
+
 async function handleSearchMessages(
   args: {
     q: string;
     limit?: number;
+    channelId?: string;
+    authors?: string[];
+    since?: number;
+    until?: number;
   },
   config: E2eConfig | undefined,
 ): Promise<RawSearchResponse> {
@@ -8071,17 +8315,20 @@ async function handleSearchMessages(
       }
     }
 
-    const hits = mockHits
-      .filter((hit) => {
-        if (!query) {
-          return true;
-        }
+    const authorSet = args.authors?.length
+      ? new Set(args.authors.map((author) => author.toLowerCase()))
+      : null;
 
-        return (
-          hit.content.toLowerCase().includes(query) ||
-          (hit.channel_name?.toLowerCase().includes(query) ?? false)
-        );
-      })
+    const hits = mockHits
+      .filter((hit) =>
+        mockSearchHitMatches(hit, {
+          query,
+          channelId: args.channelId,
+          authorSet,
+          since: args.since,
+          until: args.until,
+        }),
+      )
       .slice(0, limit);
 
     return {
@@ -8090,11 +8337,26 @@ async function handleSearchMessages(
     };
   }
 
-  // NIP-50 search via POST /query
+  // NIP-50 search via POST /query — forward operator pushdown fields.
   const limit = args.limit ?? 20;
-  const events = await relayQuery(config, [
-    { kinds: [9, 40002], search: args.q, limit },
-  ]);
+  const filter: Record<string, unknown> = {
+    kinds: [9, 40002, 45001, 45003],
+    search: args.q,
+    limit,
+  };
+  if (args.channelId) {
+    filter["#h"] = [args.channelId];
+  }
+  if (args.authors?.length) {
+    filter.authors = args.authors;
+  }
+  if (args.since != null) {
+    filter.since = args.since;
+  }
+  if (args.until != null) {
+    filter.until = args.until;
+  }
+  const events = await relayQuery(config, [filter]);
   const hits = events.map((ev) => ({
     event_id: ev.id ?? "",
     pubkey: ev.pubkey ?? "",
@@ -8142,6 +8404,35 @@ async function resolveMockUploadDescriptors(
   ];
 }
 
+async function resolveMockUploadDescriptorForBytes(
+  args: { data: number[]; filename?: string | null },
+  config: E2eConfig | undefined,
+): Promise<RawBlobDescriptor> {
+  const configured = config?.mock?.uploadDescriptors;
+  if (configured !== undefined) {
+    const descriptors = await resolveMockUploadDescriptors(config);
+    const descriptor = descriptors[0];
+    if (!descriptor) throw new Error("mock upload returned no descriptor");
+    return descriptor;
+  }
+
+  const bytes = Uint8Array.from(args.data);
+  const digest = await crypto.subtle.digest("SHA-256", bytes);
+  const sha256 = Array.from(new Uint8Array(digest), (value) =>
+    value.toString(16).padStart(2, "0"),
+  ).join("");
+  const filename = args.filename ?? "upload.bin";
+  const isAgentJson = filename.toLowerCase().endsWith(".agent.json");
+  return {
+    url: `https://mock.relay/media/${sha256}${isAgentJson ? ".json" : ".bin"}`,
+    sha256,
+    size: bytes.length,
+    type: isAgentJson ? "application/json" : "application/octet-stream",
+    uploaded: Math.floor(Date.now() / 1000),
+    filename,
+  };
+}
+
 async function handleSendChannelMessage(
   args: {
     channelId: string;
@@ -8837,6 +9128,25 @@ function sendToMockSocket(args: {
       return;
     }
 
+    if (filter.kinds?.includes(KIND_PERSONA)) {
+      const authors = filter.authors?.map((author) => author.toLowerCase());
+      const sourceIds = filter["#d"];
+      for (const event of mockPersonaEvents) {
+        if (authors && !authors.includes(event.pubkey.toLowerCase())) continue;
+        if (
+          event.pubkey.toLowerCase() !== MOCK_IDENTITY_PUBKEY.toLowerCase() &&
+          !personaHasExactSharedTag(event)
+        ) {
+          continue;
+        }
+        const sourceId = event.tags.find((tag) => tag[0] === "d")?.[1];
+        if (sourceIds && (!sourceId || !sourceIds.includes(sourceId))) continue;
+        sendWsText(socket.handler, ["EVENT", subId, event]);
+      }
+      sendWsText(socket.handler, ["EOSE", subId]);
+      return;
+    }
+
     // Project queries: NIP-34 kinds, or kind:1 comments scoped by repo `a`
     // tag (PR/issue discussions, approvals, review requests).
     if (
@@ -8938,6 +9248,36 @@ function sendToMockSocket(args: {
       return;
     }
 
+    if (event.kind === KIND_PERSONA) {
+      const sourceId = event.tags.find((tag) => tag[0] === "d")?.[1];
+      if (!sourceId) {
+        sendWsText(socket.handler, [
+          "OK",
+          event.id,
+          false,
+          "invalid: persona event missing d tag.",
+        ]);
+        return;
+      }
+      const sharedTags = event.tags.filter((tag) => tag[0] === "shared");
+      if (
+        sharedTags.length > 1 ||
+        (sharedTags.length === 1 && !personaHasExactSharedTag(event))
+      ) {
+        sendWsText(socket.handler, [
+          "OK",
+          event.id,
+          false,
+          'invalid: shared tag must be exactly ["shared","true"].',
+        ]);
+        return;
+      }
+      upsertMockPersonaRelayEvent(event);
+      emitMockGlobalEvent(event);
+      sendWsText(socket.handler, ["OK", event.id, true, ""]);
+      return;
+    }
+
     if (event.kind === 20001) {
       const status = event.content;
       if (status === "online" || status === "away" || status === "offline") {
@@ -9056,6 +9396,7 @@ export function maybeInstallE2eTauriMocks() {
   resetMockWorkflows();
   resetMockMesh();
   resetMockUserStatuses();
+  resetMockPersonaCatalogEvents(config);
   resetMockSaveSubscriptions(config);
   resetMockPendingCommunityDeepLinks(config);
   mockWebsocketSendMutexWedged = false;
@@ -9096,7 +9437,12 @@ export function maybeInstallE2eTauriMocks() {
     );
   };
   window.__BUZZ_E2E_PREPEND_MOCK_HISTORY__ = prependMockHistory;
-  window.__BUZZ_E2E_EMIT_MOCK_TYPING__ = ({ channelName, pubkey }) => {
+  window.__BUZZ_E2E_EMIT_MOCK_TYPING__ = ({
+    channelName,
+    createdAt,
+    pubkey,
+    threadHeadId,
+  }) => {
     const channel = mockChannels.find(
       (candidate) => candidate.name === channelName,
     );
@@ -9104,7 +9450,12 @@ export function maybeInstallE2eTauriMocks() {
       throw new Error(`Mock channel ${channelName} not found.`);
     }
 
-    return emitMockTypingIndicator(channel.id, pubkey ?? CHARLIE_PUBKEY);
+    return emitMockTypingIndicator(
+      channel.id,
+      pubkey ?? CHARLIE_PUBKEY,
+      threadHeadId,
+      createdAt,
+    );
   };
   window.__BUZZ_E2E_HAS_MOCK_LIVE_SUBSCRIPTION__ = ({ channelName, kind }) => {
     const channel = mockChannels.find(
@@ -9503,6 +9854,8 @@ export function maybeInstallE2eTauriMocks() {
         // seeded empty/default path as valid so Add Community can continue to
         // relay-policy discovery.
         return;
+      case "fetch_join_policy":
+        return activeConfig?.mock?.joinPolicy ?? null;
       case "apply_workspace": {
         const applyDelayMs = activeConfig?.mock?.applyCommunityDelayMs ?? 0;
         if (applyDelayMs > 0) {
@@ -10117,6 +10470,11 @@ export function maybeInstallE2eTauriMocks() {
         return handleUpdatePersona(
           payload as Parameters<typeof handleUpdatePersona>[0],
         );
+      case "update_persona_and_publish":
+        return handleUpdatePersonaAndPublish(
+          payload as Parameters<typeof handleUpdatePersonaAndPublish>[0],
+          activeConfig,
+        );
       case "delete_persona":
         return handleDeletePersona(
           payload as Parameters<typeof handleDeletePersona>[0],
@@ -10140,11 +10498,16 @@ export function maybeInstallE2eTauriMocks() {
             };
             const now = new Date().toISOString();
             const existing = mockPersonas.find((p) => p.id === dTag);
+            const shared = nostrEvent.tags.some(
+              (tag) =>
+                tag.length === 2 && tag[0] === "shared" && tag[1] === "true",
+            );
             if (existing) {
               existing.display_name =
                 content.display_name ?? existing.display_name;
               existing.system_prompt =
                 content.system_prompt ?? existing.system_prompt;
+              existing.shared = shared;
               existing.updated_at = now;
             } else {
               mockPersonas.push({
@@ -10154,6 +10517,7 @@ export function maybeInstallE2eTauriMocks() {
                 system_prompt: content.system_prompt ?? "",
                 is_builtin: false,
                 is_active: true,
+                shared,
                 env_vars: {},
                 created_at: now,
                 updated_at: now,
@@ -10180,6 +10544,11 @@ export function maybeInstallE2eTauriMocks() {
         return handleSetPersonaActive(
           payload as Parameters<typeof handleSetPersonaActive>[0],
         );
+      case "set_persona_shared":
+        return handleSetPersonaShared(
+          payload as Parameters<typeof handleSetPersonaShared>[0],
+          activeConfig,
+        );
       case "list_teams":
         return handleListTeams();
       case "list_channel_templates":
@@ -10226,8 +10595,8 @@ export function maybeInstallE2eTauriMocks() {
         // Specs assert invocation via __BUZZ_E2E_COMMANDS__.
         return true;
       case "encode_agent_snapshot_for_send": {
-        // Return a minimal PNG-shaped payload so the send flow can proceed
-        // through upload_media_bytes without a real Rust encode step.
+        // Return the requested wire format so both message sharing (PNG) and
+        // community catalog publication (JSON) exercise their real branches.
         // Optional encodeDelayMs lets specs observe the "preparing" phase before
         // the upload begins.
         const encodeDelayMs = activeConfig?.mock?.encodeDelayMs ?? 0;
@@ -10236,6 +10605,46 @@ export function maybeInstallE2eTauriMocks() {
             window.setTimeout(resolve, encodeDelayMs),
           );
         }
+        const input = payload as {
+          id: string;
+          memoryLevel: "none" | "core" | "everything";
+          format: "json" | "png";
+        };
+        if (input.format === "json") {
+          const persona = mockPersonas.find(
+            (candidate) => candidate.id === input.id,
+          );
+          const snapshot = {
+            format: "buzz-agent-snapshot",
+            version: 1,
+            definition: {
+              name: persona?.display_name ?? "E2E Agent",
+              sourceIsBuiltIn: persona?.is_builtin ?? false,
+              systemPrompt: persona?.system_prompt ?? "",
+              runtime: persona?.runtime ?? null,
+              model: persona?.model ?? null,
+              provider: persona?.provider ?? null,
+              respondTo: persona?.respond_to ?? null,
+              respondToAllowlist: persona?.respond_to_allowlist ?? [],
+              namePool: persona?.name_pool ?? [],
+            },
+            profile: {
+              displayName: persona?.display_name ?? "E2E Agent",
+              avatarUrl: persona?.avatar_url ?? null,
+            },
+            memory: {
+              level: input.memoryLevel,
+              entries: [],
+            },
+          };
+          const fileBytes = Array.from(
+            new TextEncoder().encode(JSON.stringify(snapshot)),
+          );
+          return {
+            fileBytes,
+            fileName: "e2e-agent.agent.json",
+          };
+        }
         return {
           fileBytes: [0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a],
           fileName: "e2e-agent.agent.png",
@@ -10245,6 +10654,9 @@ export function maybeInstallE2eTauriMocks() {
         // Return a minimal preview — no writes performed.
         return {
           displayName: "Imported Agent",
+          isBuiltIn: true,
+          model: "claude-opus-4-5",
+          runtime: "goose",
           systemPrompt: null,
           avatarUrl: null,
           memoryLevel: "none",
@@ -10756,7 +11168,10 @@ export function maybeInstallE2eTauriMocks() {
       case "pick_and_upload_image":
         return (await resolveMockUploadDescriptors(activeConfig))[0] ?? null;
       case "upload_media_bytes":
-        return (await resolveMockUploadDescriptors(activeConfig))[0];
+        return resolveMockUploadDescriptorForBytes(
+          payload as { data: number[]; filename?: string | null },
+          activeConfig,
+        );
       case "fetch_media_bytes": {
         // The real command fetches relay media through Rust reqwest and
         // replies with raw bytes (`tauri::ipc::Response` → ArrayBuffer). In
diff --git a/desktop/src/testing/e2eBridgeSearch.test.mjs b/desktop/src/testing/e2eBridgeSearch.test.mjs
new file mode 100644
index 00000000000..21c1a83bbc9
--- /dev/null
+++ b/desktop/src/testing/e2eBridgeSearch.test.mjs
@@ -0,0 +1,81 @@
+/**
+ * Unit tests for the e2e bridge's mock `search_messages` predicate.
+ *
+ * The mock stands in for the relay in identity-less E2E runs, so its `since` /
+ * `until` comparators must match the relay's inclusive NIP-01 bounds
+ * (`crates/buzz-core/src/filter.rs` keeps `since <= created_at <= until`).
+ * `before:YYYY-MM-DD` gets its exclusivity from `parseSearchOperators`, which
+ * emits `localMidnight - 1`; a mock that also excluded its own bound would
+ * drop the last second of the range that production returns.
+ */
+import assert from "node:assert/strict";
+import test from "node:test";
+
+import { mockSearchHitMatches } from "./e2eBridge.ts";
+
+const NO_FILTERS = { query: "", authorSet: null };
+
+function hitAt(created_at) {
+  return {
+    event_id: "hit",
+    content: "deploy notes",
+    kind: 9,
+    pubkey: "a".repeat(64),
+    channel_id: "9a1657ac-f7aa-5db0-b632-d8bbeb6dfb50",
+    channel_name: "general",
+    created_at,
+    score: 1,
+  };
+}
+
+test("until is inclusive, so a before: bound keeps its own second", () => {
+  const localMidnight = Math.floor(new Date(2024, 1, 1).getTime() / 1000);
+  // What parseSearchOperators emits for `before:2024-02-01`.
+  const until = localMidnight - 1;
+
+  assert.equal(
+    mockSearchHitMatches(hitAt(until), { ...NO_FILTERS, until }),
+    true,
+  );
+  assert.equal(
+    mockSearchHitMatches(hitAt(localMidnight), { ...NO_FILTERS, until }),
+    false,
+  );
+});
+
+test("since is inclusive and excludes only earlier timestamps", () => {
+  const since = Math.floor(new Date(2024, 0, 15).getTime() / 1000);
+
+  assert.equal(
+    mockSearchHitMatches(hitAt(since), { ...NO_FILTERS, since }),
+    true,
+  );
+  assert.equal(
+    mockSearchHitMatches(hitAt(since - 1), { ...NO_FILTERS, since }),
+    false,
+  );
+});
+
+test("channel, author, and text filters still narrow results", () => {
+  const hit = hitAt(1_700_000_000);
+
+  assert.equal(
+    mockSearchHitMatches(hit, { ...NO_FILTERS, channelId: "other-channel" }),
+    false,
+  );
+  assert.equal(
+    mockSearchHitMatches(hit, {
+      ...NO_FILTERS,
+      authorSet: new Set(["b".repeat(64)]),
+    }),
+    false,
+  );
+  assert.equal(
+    mockSearchHitMatches(hit, { query: "zzz", authorSet: null }),
+    false,
+  );
+  assert.equal(
+    mockSearchHitMatches(hit, { query: "deploy", authorSet: null }),
+    true,
+  );
+});
diff --git a/desktop/test-loader-hooks.mjs b/desktop/test-loader-hooks.mjs
index dd6f3432741..0cc99158acd 100644
--- a/desktop/test-loader-hooks.mjs
+++ b/desktop/test-loader-hooks.mjs
@@ -1,4 +1,4 @@
-import { fileURLToPath } from "node:url";
+import { fileURLToPath, pathToFileURL } from "node:url";
 import fs from "node:fs";
 import path from "node:path";
 import ts from "typescript";
@@ -13,6 +13,17 @@ const repoRoot = path.resolve(
   "..",
 );
 
+// `nextResolve` requires specifiers to be URLs or relative paths. Passing an
+// absolute filesystem path happens to work on POSIX (node coerces it), but on
+// Windows an absolute path like `C:\...` parses as a URL with protocol `c:`
+// and every test run dies with ERR_UNSUPPORTED_ESM_URL_SCHEME. Hand absolute
+// paths to node as proper file:// URLs on all platforms.
+function toFileSpecifier(candidatePath) {
+  return path.isAbsolute(candidatePath)
+    ? pathToFileURL(candidatePath).href
+    : candidatePath;
+}
+
 function resolveSourcePath(basePath) {
   // Existence decides, not path.extname — a dotted basename like
   // `ProfileAvatarEditor.utils` (→ .utils.ts on disk) looks like an
@@ -76,7 +87,7 @@ export function resolve(specifier, context, nextResolve) {
   }
   if (specifier === "@features-manifest") {
     const resolved = path.join(repoRoot, "preview-features.json");
-    return nextResolve(resolved, context);
+    return nextResolve(toFileSpecifier(resolved), context);
   }
   if (specifier.startsWith("@/")) {
     const stripped = specifier.slice(2);
@@ -86,7 +97,10 @@ export function resolve(specifier, context, nextResolve) {
     // Otherwise paths like `@/.../foo.mjs` would be coerced into `foo.mjs.ts`
     // and fail to resolve.
     const resolved = resolveSourcePath(`${srcRoot}/${stripped}`);
-    return nextResolve(resolved ?? `${srcRoot}/${stripped}`, context);
+    return nextResolve(
+      toFileSpecifier(resolved ?? `${srcRoot}/${stripped}`),
+      context,
+    );
   }
   // Resolve extensionless relative TS imports (e.g. `./parseImeta`) — the app's
   // bundler adds the extension, but node's ESM resolver does not. Without this,
@@ -103,7 +117,7 @@ export function resolve(specifier, context, nextResolve) {
       path.resolve(path.dirname(parentPath), specifier),
     );
     if (resolved) {
-      return nextResolve(resolved, context);
+      return nextResolve(toFileSpecifier(resolved), context);
     }
     return nextResolve(specifier, context);
   }
diff --git a/desktop/tests/e2e/agent-readiness-screenshots.spec.ts b/desktop/tests/e2e/agent-readiness-screenshots.spec.ts
index 8f4c7d14786..a92efcd40a3 100644
--- a/desktop/tests/e2e/agent-readiness-screenshots.spec.ts
+++ b/desktop/tests/e2e/agent-readiness-screenshots.spec.ts
@@ -18,7 +18,7 @@ async function openCreateDialog(page: import("@playwright/test").Page) {
   await page.goto("/");
   await page.getByTestId("open-agents-view").click();
   await page.getByTestId("new-agent-card").click();
-  await page.getByRole("menuitem", { name: "Create from scratch" }).click();
+  await page.getByRole("menuitem", { name: "Create agent" }).click();
   await page.locator("#persona-display-name").fill("Test Agent");
 }
 
diff --git a/desktop/tests/e2e/agent-snapshot-recipient.spec.ts b/desktop/tests/e2e/agent-snapshot-recipient.spec.ts
index a20c649df4f..9ce80593f10 100644
--- a/desktop/tests/e2e/agent-snapshot-recipient.spec.ts
+++ b/desktop/tests/e2e/agent-snapshot-recipient.spec.ts
@@ -271,6 +271,13 @@ test("recipient_import_navigates_to_agents_and_opens_preview", async ({
 
   // Decoded display name must appear.
   await expect(dialog).toContainText("Imported Agent");
+  const metadata = dialog.getByTestId("agent-definition-metadata");
+  await expect(metadata).toContainText("Type");
+  await expect(metadata).toContainText("Built-in agent");
+  await expect(metadata).toContainText("Preferred model");
+  await expect(metadata).toContainText("claude-opus-4-5");
+  await expect(metadata).toContainText("Preferred runtime");
+  await expect(metadata).toContainText("goose");
 });
 
 // ── Confirm imports the agent ─────────────────────────────────────────────────
diff --git a/desktop/tests/e2e/agents.spec.ts b/desktop/tests/e2e/agents.spec.ts
index 3c0c60d935e..13eda788b1e 100644
--- a/desktop/tests/e2e/agents.spec.ts
+++ b/desktop/tests/e2e/agents.spec.ts
@@ -1,8 +1,43 @@
 import { expect, test } from "@playwright/test";
 
+import type { RelayEvent } from "@/shared/api/types";
+
+import { emojiAvatarDataUrl } from "@/features/profile/ui/ProfileAvatarEditor.utils";
+
 import { waitForAnimations } from "../helpers/animations";
 import { installMockBridge, TEST_IDENTITIES } from "../helpers/bridge";
 
+function createCatalogEvent(input: {
+  ownerPubkey: string;
+  sourcePersonaId: string;
+  displayName: string;
+  systemPrompt: string;
+  createdAt?: number;
+  shared?: boolean;
+  avatarUrl?: string;
+}): RelayEvent {
+  return {
+    id: "1".repeat(64),
+    pubkey: input.ownerPubkey,
+    created_at: input.createdAt ?? 1_721_750_400,
+    kind: 30175,
+    tags: [
+      ["d", input.sourcePersonaId],
+      ...(input.shared === false ? [] : [["shared", "true"]]),
+    ],
+    content: JSON.stringify({
+      display_name: input.displayName,
+      system_prompt: input.systemPrompt,
+      avatar_url: input.avatarUrl ?? null,
+      runtime: null,
+      model: null,
+      provider: null,
+      name_pool: [],
+    }),
+    sig: "2".repeat(128),
+  };
+}
+
 test.beforeEach(async ({ page }) => {
   await installMockBridge(page);
 });
@@ -32,7 +67,9 @@ async function gotoApp(page: import("@playwright/test").Page) {
 
 async function openPersonaCatalog(page: import("@playwright/test").Page) {
   await page.getByTestId("new-agent-card").click();
-  await page.getByRole("menuitem", { name: "Choose from catalog" }).click();
+  await page
+    .getByRole("menuitem", { exact: true, name: "Discover agents" })
+    .click();
 }
 
 async function getCatalogOrder(page: import("@playwright/test").Page) {
@@ -50,12 +87,19 @@ async function selectCatalogPersona(
   await page.getByTestId(`persona-catalog-list-item-${personaId}`).click();
 }
 
-async function useCatalogPersona(
+async function sharePersonaToCatalog(
   page: import("@playwright/test").Page,
-  personaId: string,
+  displayName: string,
 ) {
+  await page.getByLabel(`Open actions for ${displayName}`).click();
+  await page.getByRole("menuitem", { name: "Share" }).click();
+  await page.getByTestId("persona-share-catalog-access").click();
   await page
-    .getByTestId(`persona-catalog-use-agent-target-${personaId}`)
+    .getByRole("menuitemradio", { name: "Shared", exact: true })
+    .click();
+  await page
+    .getByTestId("persona-share-dialog")
+    .getByRole("button", { name: "Close" })
     .click();
 }
 
@@ -154,78 +198,86 @@ async function invokeTauriExpectError(
   );
 }
 
-test("built-in personas are used from the catalog dialog", async ({ page }) => {
+async function countCommandInvocations(
+  page: import("@playwright/test").Page,
+  command: string,
+): Promise<number> {
+  return page.evaluate(
+    (targetCommand) =>
+      (
+        window as Window & {
+          __BUZZ_E2E_COMMANDS__?: string[];
+        }
+      ).__BUZZ_E2E_COMMANDS__?.filter((invoked) => invoked === targetCommand)
+        .length ?? 0,
+    command,
+  );
+}
+
+test("catalog hides built-ins and shows the shared-agent empty state", async ({
+  page,
+}) => {
   await page.setViewportSize({ width: 1280, height: 420 });
+  await installMockBridge(page, {
+    activePersonaIds: ["builtin:fizz", "builtin:honey", "builtin:bumble"],
+  });
   await gotoApp(page);
   await page.getByTestId("open-agents-view").click();
 
   await expect(page.getByTestId("agents-library-personas")).toBeVisible();
-  await openPersonaCatalog(page);
-  await expect(page.getByTestId("persona-catalog-dialog")).toContainText(
-    "Fizz",
-  );
   for (const personaName of ["Fizz", "Honey", "Bumble"]) {
-    await expect(page.getByTestId("persona-catalog-dialog")).toContainText(
+    await expect(page.getByTestId("agents-library-personas")).toContainText(
       personaName,
     );
   }
-  for (const retiredPersonaName of [
-    "Product Strategist",
-    "Implementation Partner",
-    "QA Reviewer",
-    "Work Coordinator",
-    "Support Guide",
-    "Experiment Designer",
-  ]) {
+
+  await openPersonaCatalog(page);
+  for (const personaName of ["Fizz", "Honey", "Bumble"]) {
     await expect(page.getByTestId("persona-catalog-dialog")).not.toContainText(
-      retiredPersonaName,
+      personaName,
     );
   }
   await expect(page.getByTestId("persona-catalog-dialog-header")).toBeVisible();
-  await expect(
-    page.getByTestId("persona-catalog-dialog-scroll-area"),
-  ).toBeVisible();
-  await expect(
-    page.getByTestId("persona-catalog-dialog-scroll-area"),
-  ).toHaveCSS("overflow-y", "auto");
-  const catalogScrollAreaMetrics = await page
-    .getByTestId("persona-catalog-dialog-scroll-area")
-    .evaluate((element) => ({
-      clientHeight: element.clientHeight,
-      scrollHeight: element.scrollHeight,
-    }));
-  expect(catalogScrollAreaMetrics.clientHeight).toBeGreaterThan(0);
-  expect(catalogScrollAreaMetrics.scrollHeight).toBeGreaterThanOrEqual(
-    catalogScrollAreaMetrics.clientHeight,
-  );
   await expect(page.getByTestId("persona-catalog-dialog-body")).toBeVisible();
-  await expect(page.getByTestId("persona-catalog-dialog")).not.toContainText(
-    "Done",
-  );
-  await expect(page.getByRole("tooltip")).toHaveCount(0);
-  const initialCatalogOrder = await getCatalogOrder(page);
-
-  await selectCatalogPersona(page, "builtin:fizz");
-  await useCatalogPersona(page, "builtin:fizz");
+  const emptyState = page.getByTestId("persona-catalog-empty-state");
+  await expect(emptyState).toContainText("No agents are being shared");
   await expect(
-    page
-      .locator("[data-sonner-toast]")
-      .filter({ hasText: "Selected Fizz for My Agents." }),
+    emptyState.getByTestId("persona-catalog-empty-agent-artwork"),
   ).toBeVisible();
-
-  await expect(page.getByTestId("agents-library-personas")).toContainText(
-    "Fizz",
-  );
   await expect(
-    page.getByTestId("persona-catalog-use-agent-target-builtin:fizz"),
-  ).toHaveText("Added to My Agents");
+    page.locator('[data-testid^="persona-catalog-list-item-"]'),
+  ).toHaveCount(0);
   await expect(
-    page.getByTestId("persona-catalog-use-agent-target-builtin:fizz"),
-  ).toBeDisabled();
-  await expect(page.getByTestId("persona-catalog-dialog")).not.toContainText(
-    "Delete",
+    page.getByTestId("persona-catalog-use-agent-target"),
+  ).toHaveCount(0);
+
+  await page
+    .getByTestId("persona-catalog-dialog")
+    .getByRole("button", { name: "Close" })
+    .click();
+  await page.getByLabel("Open actions for Fizz").click();
+  await page.getByRole("menuitem", { name: "Share" }).click();
+  await expect(page.getByTestId("persona-share-catalog")).toHaveCount(0);
+  await expect(page.getByTestId("persona-share-catalog-access")).toHaveCount(0);
+});
+
+test("catalog empty state remains available after reopening", async ({
+  page,
+}) => {
+  await gotoApp(page);
+  await page.getByTestId("open-agents-view").click();
+  await openPersonaCatalog(page);
+  await expect(page.getByTestId("persona-catalog-empty-state")).toBeVisible();
+
+  await page
+    .getByTestId("persona-catalog-dialog")
+    .getByRole("button", { name: "Close" })
+    .click();
+  await expect(page.getByTestId("persona-catalog-dialog")).not.toBeVisible();
+  await openPersonaCatalog(page);
+  await expect(page.getByTestId("persona-catalog-empty-state")).toContainText(
+    "No agents are being shared",
   );
-  await expect.poll(() => getCatalogOrder(page)).toEqual(initialCatalogOrder);
 });
 
 test("built-in persona edits persist", async ({ page }) => {
@@ -263,13 +315,40 @@ test("built-in persona edits persist", async ({ page }) => {
   });
 });
 
+test("searches agent avatar emoji with focus on open", async ({ page }) => {
+  await gotoApp(page);
+  await page.getByTestId("open-agents-view").click();
+  await page.getByTestId("new-agent-card").click();
+  await page
+    .getByRole("menuitem", { exact: true, name: "Create agent" })
+    .click();
+
+  await expect(page.getByTestId("persona-dialog")).toBeVisible();
+  await page.getByLabel("Add avatar").click();
+  await page.getByRole("tab", { name: "Emoji" }).click();
+
+  const picker = page.locator("em-emoji-picker");
+  const searchInput = picker.locator("input[type='search']");
+  await expect(searchInput).toBeVisible();
+  await expect(searchInput).toBeFocused();
+
+  await searchInput.fill("rocket");
+  await picker.locator("button[aria-label='🚀']").first().click();
+
+  await expect(page.getByRole("img", { name: "Agent name avatar" })).toHaveText(
+    "🚀",
+  );
+});
+
 test("agent avatar emoji picker scrolls inside its popover", async ({
   page,
 }) => {
   await gotoApp(page);
   await page.getByTestId("open-agents-view").click();
   await page.getByTestId("new-agent-card").click();
-  await page.getByRole("menuitem", { name: "Create from scratch" }).click();
+  await page
+    .getByRole("menuitem", { exact: true, name: "Create agent" })
+    .click();
 
   await expect(page.getByTestId("persona-dialog")).toBeVisible();
   await page.getByLabel("Add avatar").click();
@@ -306,70 +385,315 @@ test("agent avatar emoji picker scrolls inside its popover", async ({
     .toBeGreaterThan(before);
 });
 
-test("agent catalog can reopen from the populated library header", async ({
+test("the new agent card offers create, discover, and import", async ({
   page,
 }) => {
+  await installMockBridge(page, {
+    activePersonaIds: ["builtin:fizz", "builtin:honey", "builtin:bumble"],
+    personas: [
+      {
+        id: "custom:code-reviewer",
+        displayName: "Code Reviewer",
+        systemPrompt: "Review code changes.",
+      },
+    ],
+  });
   await gotoApp(page);
   await page.getByTestId("open-agents-view").click();
-  await openPersonaCatalog(page);
 
-  await selectCatalogPersona(page, "builtin:fizz");
-  await useCatalogPersona(page, "builtin:fizz");
-  await expect(page.getByTestId("agents-library-personas")).toContainText(
-    "Fizz",
-  );
+  const newAgentCard = page.getByTestId("new-agent-card");
+  await expect(newAgentCard).toHaveText("");
+  await expect(newAgentCard.locator(".lucide-plus")).toBeVisible();
 
-  await page.keyboard.press("Escape");
-  await openPersonaCatalog(page);
+  const agentCards = page.locator(
+    '[data-testid^="persona-agent-row-"], [data-testid="new-agent-card"]',
+  );
+  await expect(agentCards.first()).toBeVisible();
+  const headerBox = await page
+    .getByRole("heading", { level: 1, name: "Agents" })
+    .locator("../..")
+    .boundingBox();
+  const cardBoxes = await agentCards.evaluateAll((cards) =>
+    cards.map((card) => {
+      const box = card.getBoundingClientRect();
+      return { right: box.right, top: box.top };
+    }),
+  );
+  const firstRowTop = Math.min(...cardBoxes.map(({ top }) => top));
+  const rightmostFirstRowCard = Math.max(
+    ...cardBoxes
+      .filter(({ top }) => Math.abs(top - firstRowTop) < 1)
+      .map(({ right }) => right),
+  );
+  expect(headerBox).not.toBeNull();
+  expect(
+    Math.abs(
+      (headerBox?.x ?? 0) + (headerBox?.width ?? 0) - rightmostFirstRowCard,
+    ),
+  ).toBeLessThan(1);
 
+  await newAgentCard.click();
+  await expect(
+    page.getByRole("menuitem", { exact: true, name: "Create agent" }),
+  ).toBeVisible();
+  await expect(
+    page.getByRole("menuitem", { exact: true, name: "Discover agents" }),
+  ).toBeVisible();
+  await expect(
+    page.getByRole("menuitem", { exact: true, name: "Import" }),
+  ).toBeVisible();
+  await page
+    .getByRole("menuitem", { exact: true, name: "Discover agents" })
+    .click();
   await expect(page.getByTestId("persona-catalog-dialog")).toBeVisible();
-  await selectCatalogPersona(page, "builtin:fizz");
+  await page
+    .getByTestId("persona-catalog-dialog")
+    .getByRole("button", { name: "Close" })
+    .click();
+  await newAgentCard.click();
+  await page
+    .getByRole("menuitem", { exact: true, name: "Create agent" })
+    .click();
+
+  const dialog = page.getByTestId("persona-dialog");
+  await expect(dialog).toBeVisible();
   await expect(
-    page.getByTestId("persona-catalog-use-agent-target-builtin:fizz"),
-  ).toBeDisabled();
+    dialog.getByTestId("import-agent-snapshot-dialog-action"),
+  ).toHaveCount(0);
+  await expect(dialog).not.toContainText("Enter a name for this agent.");
+
+  await dialog.getByRole("button", { name: "Cancel" }).click();
+  await newAgentCard.click();
+  const fileChooserPromise = page.waitForEvent("filechooser");
+  await page.getByRole("menuitem", { exact: true, name: "Import" }).click();
+  const fileChooser = await fileChooserPromise;
+  await fileChooser.setFiles({
+    buffer: Buffer.from("{}"),
+    mimeType: "application/json",
+    name: "imported.agent.json",
+  });
+  await expect(page.getByTestId("agent-snapshot-import-dialog")).toBeVisible();
 });
 
-test("agent catalog chooser order stays stable when selection changes", async ({
+test("the new team card offers create and import", async ({ page }) => {
+  await gotoApp(page);
+  await page.getByTestId("open-agents-view").click();
+
+  const newTeamCard = page.getByTestId("new-team-card");
+  await expect(newTeamCard).toHaveText("");
+  await expect(newTeamCard.locator(".lucide-plus")).toBeVisible();
+
+  await newTeamCard.click();
+  await expect(
+    page.getByRole("menuitem", { exact: true, name: "Create team" }),
+  ).toBeVisible();
+  await expect(
+    page.getByRole("menuitem", { exact: true, name: "Import" }),
+  ).toBeVisible();
+});
+
+test("team cards use the thread-style overlapping avatar stack", async ({
   page,
 }) => {
+  const personaIds = ["custom:design", "custom:build", "custom:ship"];
+  await installMockBridge(page, {
+    personas: [
+      {
+        avatarUrl: "/onboarding/starter-team/fizz.png",
+        id: personaIds[0],
+        displayName: "Design",
+        systemPrompt: "You design interfaces.",
+      },
+      {
+        id: personaIds[1],
+        displayName: "Build",
+        systemPrompt: "You build interfaces.",
+      },
+      {
+        id: personaIds[2],
+        displayName: "Ship",
+        systemPrompt: "You ship interfaces.",
+      },
+    ],
+    teams: [
+      {
+        name: "Product crew",
+        personaIds,
+      },
+    ],
+  });
   await gotoApp(page);
   await page.getByTestId("open-agents-view").click();
-  await openPersonaCatalog(page);
 
-  const before = await getCatalogOrder(page);
+  const stack = page.getByLabel("Product crew member avatars");
+  const avatars = stack.locator('[data-team-member-avatar="avatar"]');
+  await expect(avatars).toHaveCount(3);
+  await expect(avatars.nth(1)).toHaveClass(/-ml-5/);
+  await expect(avatars.nth(2)).toHaveClass(/-ml-5/);
+
+  const boxes = await avatars.evaluateAll((elements) =>
+    elements.map((element) => {
+      const box = element.getBoundingClientRect();
+      return { left: box.left, right: box.right };
+    }),
+  );
+  expect(boxes[1]?.left).toBeLessThan(boxes[0]?.right ?? 0);
+  expect(boxes[2]?.left).toBeLessThan(boxes[1]?.right ?? 0);
+  await expect(avatars.first()).not.toHaveCSS("mask-image", "none");
+  await expect(avatars.last()).toHaveCSS("mask-image", "none");
+  const avatarSurfaceStyles = await avatars
+    .locator(":scope > *")
+    .evaluateAll((elements) =>
+      elements.map((element) => {
+        const styles = getComputedStyle(element);
+        const hasVisibleShadow = [
+          ...styles.boxShadow.matchAll(/rgba?\(([^)]+)\)/g),
+        ].some((match) => {
+          if (match[0].startsWith("rgb(")) return true;
+          const channels = match[1]?.split(/[\s,/]+/).filter(Boolean) ?? [];
+          return Number(channels.at(-1)) > 0;
+        });
+        return {
+          borderWidth: styles.borderTopWidth,
+          hasVisibleShadow,
+        };
+      }),
+    );
+  expect(avatarSurfaceStyles).toEqual([
+    { borderWidth: "0px", hasVisibleShadow: false },
+    { borderWidth: "0px", hasVisibleShadow: false },
+    { borderWidth: "0px", hasVisibleShadow: false },
+  ]);
+});
 
-  await selectCatalogPersona(page, "builtin:fizz");
-  await useCatalogPersona(page, "builtin:fizz");
+test("agent defaults stays in the header without an actions menu", async ({
+  page,
+}) => {
+  await installMockBridge(page, {
+    acpRuntimesCatalog: [
+      {
+        auth_status: { status: "logged_in" },
+        availability: "available",
+        avatar_url: "",
+        binary_path: "/usr/local/bin/codex",
+        can_auto_install: false,
+        command: "codex",
+        default_args: [],
+        id: "codex",
+        install_hint: "",
+        install_instructions_url: "https://example.com",
+        label: "Codex",
+        login_hint: null,
+        mcp_command: null,
+        node_required: false,
+        underlying_cli_path: null,
+      },
+    ],
+    globalAgentConfig: {
+      env_vars: {},
+      model: "gpt-5.5[high]",
+      preferred_runtime: "codex",
+      provider: null,
+    },
+  });
+  await gotoApp(page);
+  await page.getByTestId("open-agents-view").click();
+
+  await expect(page.getByTestId("agent-header-actions-button")).toHaveCount(0);
   await expect(
-    page
-      .locator("[data-sonner-toast]")
-      .filter({ hasText: "Selected Fizz for My Agents." }),
-  ).toBeVisible();
+    page.getByRole("menuitem", { name: "Import agent" }),
+  ).toHaveCount(0);
+
+  const defaultsButton = page.getByTestId("agent-defaults-button");
+  await expect(defaultsButton).toHaveText("Agent defaults");
+  await defaultsButton.click();
+  const defaultsDialog = page.getByTestId("agent-ai-defaults-dialog");
+  await expect(defaultsDialog).toBeVisible();
+  await expect(
+    defaultsDialog.getByTestId("global-agent-default-harness"),
+  ).toHaveAttribute("data-value", "codex");
+  await expect(
+    defaultsDialog.getByTestId("global-agent-default-harness"),
+  ).toContainText("Codex");
+  await expect(
+    defaultsDialog.getByTestId("global-agent-model"),
+  ).toHaveAttribute("data-value", "gpt-5.5[high]");
+  await expect(defaultsDialog.getByTestId("global-agent-model")).toContainText(
+    "gpt-5.5[high]",
+  );
+  await page.keyboard.press("Escape");
+  await expect(defaultsDialog).toHaveCount(0);
+});
 
+test("unconfigured agent defaults use the setup label", async ({ page }) => {
+  await gotoApp(page);
+  await page.getByTestId("open-agents-view").click();
+
+  await expect(page.getByTestId("agent-defaults-button")).toHaveText(
+    "Set agent defaults",
+  );
+});
+
+test("agent catalog chooser order stays stable when selection changes", async ({
+  page,
+}) => {
+  await installMockBridge(page, {
+    personas: [
+      {
+        id: "custom:builder",
+        displayName: "Builder",
+        systemPrompt: "Build the requested change.",
+      },
+      {
+        id: "custom:reviewer",
+        displayName: "Reviewer",
+        systemPrompt: "Review the requested change.",
+      },
+    ],
+  });
+  await gotoApp(page);
+  await page.getByTestId("open-agents-view").click();
+  await sharePersonaToCatalog(page, "Builder");
+  await sharePersonaToCatalog(page, "Reviewer");
+  await openPersonaCatalog(page);
+
+  const before = await getCatalogOrder(page);
+  await selectCatalogPersona(page, "custom:reviewer");
   expect(await getCatalogOrder(page)).toEqual(before);
 });
 
 test("catalog detail pane shows the full persona details", async ({ page }) => {
+  const personaId = "custom:researcher";
+  await installMockBridge(page, {
+    personas: [
+      {
+        id: personaId,
+        displayName: "Researcher",
+        systemPrompt: "Research the question and cite the evidence.",
+      },
+    ],
+  });
   await gotoApp(page);
   await page.getByTestId("open-agents-view").click();
+  await sharePersonaToCatalog(page, "Researcher");
   await openPersonaCatalog(page);
 
-  await selectCatalogPersona(page, "builtin:fizz");
+  await selectCatalogPersona(page, personaId);
   const useAgentTarget = page.getByTestId(
-    "persona-catalog-use-agent-target-builtin:fizz",
+    `persona-catalog-use-agent-target-${personaId}`,
   );
 
   await expect(page.getByTestId("persona-catalog-detail-pane")).toContainText(
-    "Fizz",
+    "Researcher",
+  );
+  await expect(page.getByTestId("persona-catalog-detail-pane")).toContainText(
+    "Added by You",
   );
-  await expect(
-    page.getByTestId("persona-catalog-detail-pane"),
-  ).not.toContainText("Added by You");
   await expect(page.getByTestId("persona-catalog-detail-pane")).toContainText(
-    "You are Fizz.",
+    "Research the question and cite the evidence.",
   );
   await expect(page.getByTestId("persona-catalog-detail-pane")).toContainText(
-    "Built-in agent",
+    "Custom agent",
   );
   await expect(page.getByTestId("persona-catalog-detail-pane")).toContainText(
     "Preferred model",
@@ -382,14 +706,10 @@ test("catalog detail pane shows the full persona details", async ({ page }) => {
   );
   await expect(useAgentTarget).toHaveAttribute(
     "aria-label",
-    "Add Fizz from Agent Catalog",
-  );
-  await expect(useAgentTarget).toHaveText("Add agent");
-
-  await useAgentTarget.click();
-  await expect(page.getByTestId("agents-library-personas")).toContainText(
-    "Fizz",
+    "Researcher is already in My Agents",
   );
+  await expect(useAgentTarget).toHaveText("Added to My Agents");
+  await expect(useAgentTarget).toBeDisabled();
 });
 
 type AgentShareCommand = { command: string; payload: unknown };
@@ -563,80 +883,99 @@ test("custom personas share with people and keep export separate", async ({
   ).toHaveCount(0);
   await expect(shareDialog.getByText("Owner", { exact: true })).toHaveCount(0);
   await expect(shareDialog.getByText("(You)", { exact: true })).toHaveCount(0);
-  const copyLinkFooter = page.getByTestId("persona-share-copy-link-footer");
+  const linkRow = page.getByTestId("persona-share-link-row");
   await expect(
-    copyLinkFooter.getByRole("heading", { name: "Share with a link" }),
+    linkRow.getByRole("heading", { name: "Share with a link" }),
   ).toBeVisible();
   await expect(
-    copyLinkFooter.getByText("Anyone with the link can add and use a copy."),
+    linkRow.getByText("Anyone with the link can add and use a copy."),
   ).toHaveClass(/text-xs.*text-secondary-foreground\/75/);
   await expect(page.getByTestId("persona-share-send")).toHaveCount(0);
   const copyLinkButton = page.getByTestId("persona-share-copy-link");
-  const linkRow = page.getByTestId("persona-share-link-row");
   const linkIcon = page.getByTestId("persona-share-link-icon");
   const linkCopy = page.getByTestId("persona-share-link-copy");
-  const linkDivider = page.getByTestId("persona-share-link-divider");
-  const staticLinkAccess = page.getByTestId("persona-share-link-access");
+  const catalogSection = page.getByTestId("persona-share-catalog");
+  const staticShareLevel = page.getByTestId("persona-share-share-level");
+  const shareLevelRow = page.getByTestId("persona-share-share-level-row");
   await waitForAnimations(page);
   const [
     linkRowBox,
     initialCopyLinkButtonBox,
     linkIconBox,
     linkCopyBox,
-    linkDividerBox,
-    staticLinkAccessBox,
+    catalogSectionBox,
+    staticShareLevelBox,
+    shareLevelRowBox,
   ] = await Promise.all([
     linkRow.boundingBox(),
     copyLinkButton.boundingBox(),
     linkIcon.boundingBox(),
     linkCopy.boundingBox(),
-    linkDivider.boundingBox(),
-    staticLinkAccess.boundingBox(),
+    catalogSection.boundingBox(),
+    staticShareLevel.boundingBox(),
+    shareLevelRow.boundingBox(),
   ]);
   const sendDescriptionBox = await sendDescription.boundingBox();
-  expect((linkRowBox?.y ?? 0) - (sendDescriptionBox?.y ?? 0)).toBeGreaterThan(
-    (sendDescriptionBox?.height ?? 0) + 30,
+  const recipientFieldBox = await page
+    .getByTestId("persona-share-recipient-field")
+    .boundingBox();
+  // Reading order: who → how it goes out → what's included → catalog.
+  expect(sendDescriptionBox?.y ?? 0).toBeGreaterThanOrEqual(
+    (recipientFieldBox?.y ?? 0) + (recipientFieldBox?.height ?? 0),
+  );
+  expect(linkRowBox?.y ?? 0).toBeGreaterThanOrEqual(
+    (sendDescriptionBox?.y ?? 0) + (sendDescriptionBox?.height ?? 0),
+  );
+  expect(shareLevelRowBox?.y ?? 0).toBeGreaterThanOrEqual(
+    (linkRowBox?.y ?? 0) + (linkRowBox?.height ?? 0),
   );
+  expect(catalogSectionBox?.y ?? 0).toBeGreaterThanOrEqual(
+    (shareLevelRowBox?.y ?? 0) + (shareLevelRowBox?.height ?? 0),
+  );
+  // Copy link is the link row's own action, not a stranded footer button, so
+  // it rides on that row, vertically centred with the link icon and flush to
+  // the row's right edge.
   expect(initialCopyLinkButtonBox?.y ?? 0).toBeGreaterThanOrEqual(
-    (linkRowBox?.y ?? 0) + (linkRowBox?.height ?? 0) + 23,
+    linkRowBox?.y ?? 0,
   );
+  expect(
+    (initialCopyLinkButtonBox?.y ?? 0) +
+      (initialCopyLinkButtonBox?.height ?? 0),
+  ).toBeLessThanOrEqual((linkRowBox?.y ?? 0) + (linkRowBox?.height ?? 0) + 1);
   expect(
     Math.abs(
-      (linkCopyBox?.y ?? 0) +
-        (linkCopyBox?.height ?? 0) / 2 -
+      (initialCopyLinkButtonBox?.y ?? 0) +
+        (initialCopyLinkButtonBox?.height ?? 0) / 2 -
         ((linkIconBox?.y ?? 0) + (linkIconBox?.height ?? 0) / 2),
     ),
   ).toBeLessThanOrEqual(1);
-  expect(linkDividerBox?.y ?? 0).toBeGreaterThan(
-    (linkRowBox?.y ?? 0) + (linkRowBox?.height ?? 0),
-  );
-  expect(linkDividerBox?.y ?? 0).toBeLessThan(initialCopyLinkButtonBox?.y ?? 0);
   expect(
-    Math.abs((linkDividerBox?.width ?? 0) - (linkRowBox?.width ?? 0)),
+    Math.abs(
+      (linkRowBox?.x ?? 0) +
+        (linkRowBox?.width ?? 0) -
+        ((initialCopyLinkButtonBox?.x ?? 0) +
+          (initialCopyLinkButtonBox?.width ?? 0)),
+    ),
   ).toBeLessThanOrEqual(1);
-  await expect(linkDivider).toHaveClass(/my-4.*bg-input\/40/);
   expect(
     Math.abs(
       (linkCopyBox?.y ?? 0) +
         (linkCopyBox?.height ?? 0) / 2 -
-        ((staticLinkAccessBox?.y ?? 0) +
-          (staticLinkAccessBox?.height ?? 0) / 2),
+        ((linkIconBox?.y ?? 0) + (linkIconBox?.height ?? 0) / 2),
+    ),
+  ).toBeLessThanOrEqual(1);
+  await expect(page.getByTestId("persona-share-link-divider")).toHaveCount(0);
+  await expect(page.getByTestId("persona-share-copy-link-footer")).toHaveCount(
+    0,
+  );
+  expect(
+    Math.abs(
+      (shareLevelRowBox?.y ?? 0) +
+        (shareLevelRowBox?.height ?? 0) / 2 -
+        ((staticShareLevelBox?.y ?? 0) +
+          (staticShareLevelBox?.height ?? 0) / 2),
     ),
   ).toBeLessThanOrEqual(1);
-  const shareMainCardForLinkSpacing = page.getByTestId(
-    "persona-share-main-card",
-  );
-  const shareMainCardForLinkSpacingBox =
-    await shareMainCardForLinkSpacing.boundingBox();
-  const gapAboveCopyLink =
-    (initialCopyLinkButtonBox?.y ?? 0) -
-    ((linkDividerBox?.y ?? 0) + (linkDividerBox?.height ?? 0));
-  const gapBelowCopyLink =
-    (shareMainCardForLinkSpacingBox?.y ?? 0) +
-    (shareMainCardForLinkSpacingBox?.height ?? 0) -
-    ((initialCopyLinkButtonBox?.y ?? 0) +
-      (initialCopyLinkButtonBox?.height ?? 0));
-  expect(Math.abs(gapAboveCopyLink - gapBelowCopyLink)).toBeLessThanOrEqual(1);
   await expect(copyLinkButton).toHaveClass(
     /border.*bg-background.*border-border/,
   );
@@ -653,21 +992,28 @@ test("custom personas share with people and keep export separate", async ({
   await expect.poll(copyLinkHasVisibleShadow).toBe(false);
   await copyLinkButton.hover();
   await expect.poll(copyLinkHasVisibleShadow).toBe(false);
-  await expect(page.getByTestId("persona-share-link-access")).toHaveText(
-    "Agent only",
+  await expect(page.getByTestId("persona-share-share-level")).toHaveText(
+    "No memories included",
   );
+  await expect(
+    shareDialog.getByText("No memories included", { exact: true }),
+  ).toHaveCount(1);
   await expect(page.getByTestId("persona-share-recipient-access")).toHaveCount(
     0,
   );
+  await expect(page.getByTestId("persona-share-link-access")).toHaveCount(0);
   await expect(
     shareDialog.getByLabel("What to include in the link"),
   ).toHaveCount(0);
   await expect(
     shareDialog.getByLabel("What to include", { exact: true }),
   ).toHaveCount(0);
-  await expect(shareDialog.getByText("Memories")).toHaveCount(0);
-  await expect(shareDialog.getByText("File format")).toHaveCount(0);
-  await expect(page.getByText("Show in my catalog")).toHaveCount(0);
+  await expect(shareDialog.getByText("Memories", { exact: true })).toHaveCount(
+    0,
+  );
+  await expect(
+    shareDialog.getByText("File format", { exact: true }),
+  ).toHaveCount(0);
   const shareMainCard = page.getByTestId("persona-share-main-card");
   const exportAgentRow = page.getByTestId("persona-share-export");
   await expect(exportAgentRow).toHaveText("Export agent");
@@ -700,6 +1046,9 @@ test("custom personas share with people and keep export separate", async ({
   expect(exportAgentRowShadow).toBe(shareMainCardShadow);
   expect(exportAgentRowShadow).not.toBe("none");
   await expect(exportAgentRow).toHaveCSS("position", "relative");
+  expect(exportAgentRowBox?.y ?? 0).toBeGreaterThanOrEqual(
+    (shareMainCardBox?.y ?? 0) + (shareMainCardBox?.height ?? 0) + 12,
+  );
   await expect(page.getByTestId("agent-snapshot-export-dialog")).toHaveCount(0);
 
   await exportAgentRow.click();
@@ -911,29 +1260,7 @@ test("custom personas share with people and keep export separate", async ({
     page
       .getByTestId("persona-share-recipient-field")
       .getByTestId("persona-share-recipient-access"),
-  ).toHaveText("Agent only");
-  const staticRecipientAccess = page.getByTestId(
-    "persona-share-recipient-access",
-  );
-  const [
-    staticRecipientAccessBox,
-    recipientAccessPaddingRight,
-    recipientFieldBox,
-  ] = await Promise.all([
-    staticRecipientAccess.boundingBox(),
-    staticRecipientAccess.evaluate((element) =>
-      Number.parseFloat(getComputedStyle(element).paddingRight),
-    ),
-    recipientField.boundingBox(),
-  ]);
-  const staticRecipientTextInset =
-    (recipientFieldBox?.x ?? 0) +
-    (recipientFieldBox?.width ?? 0) -
-    ((staticRecipientAccessBox?.x ?? 0) +
-      (staticRecipientAccessBox?.width ?? 0) -
-      recipientAccessPaddingRight);
-  expect(staticRecipientTextInset).toBeGreaterThanOrEqual(8);
-  expect(staticRecipientTextInset).toBeLessThanOrEqual(10);
+  ).toHaveCount(0);
   await expect(page.getByTestId("persona-share-send")).toBeVisible();
 
   await recipientSearch.fill("bob");
@@ -1034,11 +1361,392 @@ test("custom personas share with people and keep export separate", async ({
   await expect(shareDialog).toHaveCount(0);
 });
 
-test("share access controls include the selected memories", async ({
+test("custom personas can be shared to the relay catalog", async ({ page }) => {
+  const personaId = "custom:catalog-analyst";
+  await installMockBridge(page, {
+    globalAgentConfig: {
+      env_vars: { ANTHROPIC_API_KEY: "sk-ant-test" },
+      provider: "anthropic",
+      model: "claude-opus-4-5",
+    },
+    personas: [
+      {
+        id: personaId,
+        displayName: "Catalog Analyst",
+        respondTo: "allowlist",
+        respondToAllowlist: [TEST_IDENTITIES.alice.pubkey],
+        systemPrompt: `## Design System And Styling
+
+- For design-system changes, check the local guidance in \`DESIGN.md\`, \`docs/color-token-mapping.md\`, \`src/shared/ui/AGENTS.md\`, and \`src/features/design-system/AGENTS.md\` before judging the implementation.
+- Check every changed visual surface in both light and dark mode. Missing dark-mode support is a review issue, not visual polish.
+- Review the selected changes and explain whether \`git diff --cached --name-only --some-extremely-long-inline-option-that-must-wrap\` stays inside the catalog detail column.
+
+\`\`\`text
+This deliberately long fenced-code example must not establish the minimum width of the full custom-agent instruction document or force earlier prose outside the catalog detail pane.
+\`\`\`
+
+| Before | After | Why |
+| --- | --- | --- |
+| \`transition: all 300ms\` | \`transition: transform 200ms ease-out\` | Specify exact properties so a wide instruction table stays independently scrollable without expanding the full catalog detail pane. |
+| \`transform: scale(0)\` | \`transform: scale(0.95); opacity: 0\` | Preserve physicality while keeping the shared agent instructions inside their container. |`,
+      },
+    ],
+  });
+  await gotoApp(page);
+  await page.evaluate(() => {
+    document.documentElement.style.fontSize = "24px";
+  });
+
+  await page.getByTestId("open-agents-view").click();
+  await openPersonaCatalog(page);
+  await expect(
+    page.getByTestId(`persona-catalog-list-item-${personaId}`),
+  ).toHaveCount(0);
+  await page.keyboard.press("Escape");
+
+  await page.getByLabel("Open actions for Catalog Analyst").click();
+  await page.getByRole("menuitem", { name: "Share" }).click();
+  const catalogAccess = page.getByTestId("persona-share-catalog-access");
+  const shareDialog = page.getByTestId("persona-share-dialog");
+  const shareMainCard = shareDialog.getByTestId("persona-share-main-card");
+  const copyLinkButton = shareDialog.getByTestId("persona-share-copy-link");
+  const catalogSection = shareDialog.getByTestId("persona-share-catalog");
+  await expect(
+    shareMainCard.getByTestId("persona-share-catalog"),
+  ).toBeVisible();
+  await expect(catalogSection).toContainText("Share to catalog");
+  await expect(catalogSection).toContainText(
+    "Anyone in this community can find and use a copy.",
+  );
+  await expect(catalogSection).toContainText(
+    "Your agent instruction is shared as plaintext. Memories and secrets aren’t included.",
+  );
+  const [copyLinkButtonBox, catalogSectionBox, shareMainCardBox] =
+    await Promise.all([
+      copyLinkButton.boundingBox(),
+      catalogSection.boundingBox(),
+      shareMainCard.boundingBox(),
+    ]);
+  // Copy link belongs to the link row above, so the catalog is the section
+  // that closes the card rather than trailing an orphaned button.
+  expect(
+    (copyLinkButtonBox?.y ?? 0) + (copyLinkButtonBox?.height ?? 0),
+  ).toBeLessThanOrEqual(catalogSectionBox?.y ?? 0);
+  expect(
+    (catalogSectionBox?.y ?? 0) + (catalogSectionBox?.height ?? 0),
+  ).toBeLessThanOrEqual(
+    (shareMainCardBox?.y ?? 0) + (shareMainCardBox?.height ?? 0),
+  );
+  await expect(catalogAccess).toHaveText("Not shared");
+  await catalogAccess.click();
+  await expect(page.getByRole("menuitemradio")).toHaveText([
+    "Not shared",
+    "Shared",
+  ]);
+  await page
+    .getByRole("menuitemradio", { name: "Shared", exact: true })
+    .click();
+  await expect(catalogAccess).toHaveText("Shared");
+  const storedPersonas = await invokeTauri<
+    Array<{ id: string; shared: boolean }>
+  >(page, "list_personas");
+  expect(
+    storedPersonas.find((persona) => persona.id === personaId)?.shared,
+  ).toBe(true);
+  await page
+    .getByTestId("persona-share-dialog")
+    .getByRole("button", { name: "Close" })
+    .click();
+
+  await openPersonaCatalog(page);
+  await expect(
+    page.getByTestId(`persona-catalog-list-item-${personaId}`),
+  ).toContainText("Catalog Analyst");
+  await selectCatalogPersona(page, personaId);
+  const catalogDialog = page.getByTestId("persona-catalog-dialog");
+  const catalogDetailPane = page.getByTestId("persona-catalog-detail-pane");
+  await expect(catalogDetailPane).toContainText("Design System And Styling");
+  await expect(catalogDialog).toBeVisible();
+  await expect(catalogDetailPane).toBeVisible();
+  await waitForAnimations(page);
+  const [catalogDialogRight, catalogDetailPaneRight] = await Promise.all([
+    catalogDialog.evaluate((element) => element.getBoundingClientRect().right),
+    catalogDetailPane.evaluate(
+      (element) => element.getBoundingClientRect().right,
+    ),
+  ]);
+  expect(catalogDetailPaneRight).toBeLessThanOrEqual(catalogDialogRight);
+  expect(
+    await catalogDetailPane.evaluate(
+      (element) => element.scrollWidth - element.clientWidth,
+    ),
+  ).toBeLessThanOrEqual(1);
+  const catalogInstruction = catalogDetailPane.locator(".message-markdown");
+  expect(
+    await catalogInstruction.evaluate(
+      (element) => element.scrollWidth - element.clientWidth,
+    ),
+  ).toBeLessThanOrEqual(1);
+  await page.keyboard.press("Escape");
+
+  await page.getByLabel("Open actions for Catalog Analyst").click();
+  await page.getByRole("menuitem", { name: "Edit" }).click();
+  const editDialog = page.getByTestId("persona-dialog");
+  const catalogPublishNotice = editDialog.getByTestId(
+    "persona-dialog-catalog-publish-notice",
+  );
+  await expect(catalogPublishNotice).toHaveCount(0);
+  await expect(
+    editDialog.getByRole("button", { name: "Save and publish" }),
+  ).toHaveCount(0);
+  await expect(
+    editDialog.getByRole("button", { name: "Save changes" }),
+  ).toBeVisible();
+  await editDialog
+    .getByLabel("Agent instructions")
+    .fill("Review the latest catalog changes.");
+  await expect(catalogPublishNotice).toHaveText(
+    "This agent is in the community catalog. Your changes will be published when you save.",
+  );
+  await expect(
+    editDialog.getByRole("button", { name: "Save changes" }),
+  ).toHaveCount(0);
+  await editDialog.getByRole("button", { name: "Save and publish" }).click();
+  await expect(editDialog).toHaveCount(0);
+  // The promise in the button label is only kept by the command that awaits the
+  // relay; a plain `update_persona` merely enqueues a head best-effort.
+  await expect
+    .poll(() => countCommandInvocations(page, "update_persona_and_publish"))
+    .toBe(1);
+  expect(await countCommandInvocations(page, "update_persona")).toBe(0);
+  await expect(
+    page.getByText(
+      "Updated Catalog Analyst and published it to the community catalog.",
+    ),
+  ).toBeVisible();
+
+  await openPersonaCatalog(page);
+  await selectCatalogPersona(page, personaId);
+  await expect(page.getByTestId("persona-catalog-detail-pane")).toContainText(
+    "Review the latest catalog changes.",
+  );
+  await page.keyboard.press("Escape");
+
+  await page.getByLabel("Open actions for Catalog Analyst").click();
+  await page.getByRole("menuitem", { name: "Share" }).click();
+  await expect(catalogAccess).toHaveText("Shared");
+  await catalogAccess.click();
+  await page
+    .getByRole("menuitemradio", { name: "Not shared", exact: true })
+    .click();
+  await page
+    .getByTestId("persona-share-dialog")
+    .getByRole("button", { name: "Close" })
+    .click();
+
+  await openPersonaCatalog(page);
+  await expect(
+    page.getByTestId(`persona-catalog-list-item-${personaId}`),
+  ).toHaveCount(0);
+});
+
+test("a queued catalog share is not presented as relay-published", async ({
+  page,
+}) => {
+  const personaId = "custom:queued-catalog-agent";
+  await installMockBridge(page, {
+    personas: [
+      {
+        id: personaId,
+        displayName: "Queued Catalog Agent",
+        systemPrompt: "Wait for relay acceptance.",
+      },
+    ],
+    personaSharePublicationStatuses: ["queued"],
+  });
+  await gotoApp(page);
+  await page.getByTestId("open-agents-view").click();
+
+  await page.getByLabel("Open actions for Queued Catalog Agent").click();
+  await page.getByRole("menuitem", { name: "Share" }).click();
+  await page.getByTestId("persona-share-catalog-access").click();
+  await page
+    .getByRole("menuitemradio", { name: "Shared", exact: true })
+    .click();
+
+  await expect(
+    page.getByText(
+      "Sharing Queued Catalog Agent is queued. It will appear after the relay accepts the update.",
+    ),
+  ).toBeVisible();
+  await page
+    .getByTestId("persona-share-dialog")
+    .getByRole("button", { name: "Close" })
+    .click();
+
+  await openPersonaCatalog(page);
+  await expect(
+    page.getByTestId(`persona-catalog-list-item-${personaId}`),
+  ).toHaveCount(0);
+});
+
+test("a foreign reader does not receive an unshared kind 30175 persona", async ({
+  page,
+}) => {
+  const personaId = "private-reviewer";
+  const remoteCatalogId = `catalog:${TEST_IDENTITIES.alice.pubkey}:${personaId}`;
+  await installMockBridge(page, {
+    personaCatalogEvents: [
+      createCatalogEvent({
+        ownerPubkey: TEST_IDENTITIES.alice.pubkey,
+        sourcePersonaId: personaId,
+        displayName: "Alice’s Private Reviewer",
+        systemPrompt: "This instruction must remain private.",
+        shared: false,
+      }),
+    ],
+  });
+  await gotoApp(page);
+  await page.getByTestId("open-agents-view").click();
+  await openPersonaCatalog(page);
+
+  await expect(
+    page.getByTestId(`persona-catalog-list-item-${remoteCatalogId}`),
+  ).toHaveCount(0);
+  await expect(page.getByTestId("persona-catalog-empty-state")).toBeVisible();
+});
+
+test("a catalog entry keeps the owner's emoji avatar", async ({ page }) => {
+  const personaId = "emoji-reviewer";
+  const remoteCatalogId = `catalog:${TEST_IDENTITIES.alice.pubkey}:${personaId}`;
+  // Emoji avatars persist as inline percent-encoded SVG rather than a hosted
+  // URL, so build the value with the same producer the editor uses — a
+  // hand-rolled data URL would pass even if the real shape stopped matching.
+  const avatarUrl = emojiAvatarDataUrl("🐝", "#FFCC00");
+  await installMockBridge(page, {
+    personaCatalogEvents: [
+      createCatalogEvent({
+        avatarUrl,
+        ownerPubkey: TEST_IDENTITIES.alice.pubkey,
+        sourcePersonaId: personaId,
+        displayName: "Alice’s Reviewer",
+        systemPrompt: "Review changes for the whole community.",
+      }),
+    ],
+  });
+  await gotoApp(page);
+  await page.getByTestId("open-agents-view").click();
+  await openPersonaCatalog(page);
+
+  // An `<img>` carrying the avatar — not the initials fallback — in both the
+  // list row and the detail header is what proves the projection kept it.
+  const remoteEntry = page.getByTestId(
+    `persona-catalog-list-item-${remoteCatalogId}`,
+  );
+  await expect(remoteEntry.locator("img")).toHaveAttribute("src", avatarUrl);
+  await remoteEntry.click();
+  await expect(
+    page.getByTestId("persona-catalog-detail-pane").locator("img").first(),
+  ).toHaveAttribute("src", avatarUrl);
+});
+
+test("a community member can discover and add another member's catalog agent", async ({
+  page,
+}) => {
+  const personaId = "shared-reviewer";
+  const remoteCatalogId = `catalog:${TEST_IDENTITIES.alice.pubkey}:${personaId}`;
+  await installMockBridge(page, {
+    personaCatalogEvents: [
+      createCatalogEvent({
+        ownerPubkey: TEST_IDENTITIES.alice.pubkey,
+        sourcePersonaId: personaId,
+        displayName: "Alice’s Reviewer",
+        systemPrompt: "Review changes for the whole community.",
+      }),
+    ],
+  });
+  await gotoApp(page);
+  await page.getByTestId("open-agents-view").click();
+  await openPersonaCatalog(page);
+
+  const remoteEntry = page.getByTestId(
+    `persona-catalog-list-item-${remoteCatalogId}`,
+  );
+  await expect(remoteEntry).toContainText("Alice’s Reviewer");
+  await remoteEntry.click();
+  await expect(page.getByTestId("persona-catalog-detail-pane")).toContainText(
+    "Added by Community member",
+  );
+
+  await page
+    .getByRole("button", {
+      name: "Add Alice’s Reviewer from Agent Catalog",
+    })
+    .click();
+  await expect
+    .poll(() => countCommandInvocations(page, "create_persona"))
+    .toBe(1);
+  const imported = await invokeTauri<
+    Array<{
+      display_name: string;
+      system_prompt: string;
+      shared: boolean;
+      catalog_source: { owner_pubkey: string; persona_id: string } | null;
+    }>
+  >(page, "list_personas");
+  expect(
+    imported.find((persona) => persona.display_name === "Alice’s Reviewer"),
+  ).toMatchObject({
+    system_prompt: "Review changes for the whole community.",
+    shared: false,
+    // Provenance is what lets the catalog recognise the copy on the next open.
+    catalog_source: {
+      owner_pubkey: TEST_IDENTITIES.alice.pubkey,
+      persona_id: personaId,
+    },
+  });
+
+  // Reopening must offer the entry as already added rather than minting a
+  // second copy — the copy has a fresh local id, so only the stored
+  // coordinate can link it back to Alice's publication.
+  await page.keyboard.press("Escape");
+  await openPersonaCatalog(page);
+  // The entry now projects onto the local copy, so its list-item testid is the
+  // local persona id rather than the catalog coordinate.
+  await expect(
+    page.getByTestId(`persona-catalog-list-item-${remoteCatalogId}`),
+  ).toHaveCount(0);
+  await page
+    .locator('[data-testid^="persona-catalog-list-item-"]')
+    .filter({ hasText: "Alice’s Reviewer" })
+    .click();
+  const addedTarget = page.getByRole("button", {
+    name: "Alice’s Reviewer is already in My Agents",
+  });
+  await expect(addedTarget).toBeDisabled();
+  await expect(addedTarget).toHaveText("Added to My Agents");
+  expect(await countCommandInvocations(page, "create_persona")).toBe(1);
+});
+
+test("one share level selector drives both the link and send paths", async ({
   page,
 }) => {
   await page.emulateMedia({ reducedMotion: "no-preference" });
   const linkedAgentPubkey = TEST_IDENTITIES.alice.pubkey;
+  const profileAvatarUrl = "https://mock.relay/media/profile-only-avatar.png";
+  const profileAvatarBytes = Uint8Array.from(
+    atob(
+      "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNk+A8AAQUBAScY42YAAAAASUVORK5CYII=",
+    ),
+    (character) => character.charCodeAt(0),
+  );
+  await page.route(profileAvatarUrl, async (route) => {
+    await route.fulfill({
+      body: Buffer.from(profileAvatarBytes),
+      contentType: "image/png",
+      status: 200,
+    });
+  });
   await page.context().grantPermissions(["clipboard-read", "clipboard-write"]);
   await installMockBridge(page, {
     personas: [
@@ -1057,6 +1765,12 @@ test("share access controls include the selected memories", async ({
       },
     ],
     searchProfiles: [
+      {
+        pubkey: linkedAgentPubkey,
+        displayName: "Animation Auditor",
+        avatarUrl: profileAvatarUrl,
+        isAgent: true,
+      },
       {
         pubkey: TEST_IDENTITIES.charlie.pubkey,
         displayName: "Charlie",
@@ -1084,34 +1798,60 @@ test("share access controls include the selected memories", async ({
   const initialShareCardHeight = await shareMainCard.evaluate(
     (element) => element.getBoundingClientRect().height,
   );
-  const linkAccess = shareDialog.getByLabel("What to include in the link");
+  const shareLevel = shareDialog.getByLabel("What to include", {
+    exact: true,
+  });
+  const catalogAccess = shareDialog.getByLabel("What to share in the catalog");
   const recipientField = page.getByTestId("persona-share-recipient-field");
   const emptyRecipientFieldBox = await recipientField.boundingBox();
   await expect(shareDialog.getByTestId("persona-share-send")).toHaveCount(0);
-  await expect(linkAccess).toHaveText("Agent only");
-  expect((await linkAccess.boundingBox())?.width).toBeLessThan(120);
-  expect(await linkAccess.evaluate((element) => element.tagName)).toBe(
+  await expect(shareLevel).toHaveText("Agent only");
+  expect((await shareLevel.boundingBox())?.width).toBeLessThan(140);
+  expect(await shareLevel.evaluate((element) => element.tagName)).toBe(
     "BUTTON",
   );
-  await expect(linkAccess).toHaveCSS("text-decoration-line", "none");
-  await expect(linkAccess).toHaveCSS("padding-left", "8px");
-  await expect(linkAccess).toHaveCSS("padding-right", "8px");
-  const copyLinkButton = shareDialog.getByTestId("persona-share-copy-link");
-  const [linkAccessBox, copyLinkButtonBox] = await Promise.all([
-    linkAccess.boundingBox(),
-    copyLinkButton.boundingBox(),
+  await expect(shareLevel).toHaveCSS("text-decoration-line", "none");
+  await expect(shareLevel).toHaveCSS("padding-left", "8px");
+  await expect(shareLevel).toHaveCSS("padding-right", "8px");
+  await expect(catalogAccess).toHaveText("Not shared");
+  await catalogAccess.click();
+  await expect(page.getByRole("menuitemradio")).toHaveText([
+    "Not shared",
+    "Shared",
   ]);
+  await page.keyboard.press("Escape");
+  const copyLinkButton = shareDialog.getByTestId("persona-share-copy-link");
+  const recipientFieldBox = await recipientField.boundingBox();
+  const [shareLevelBox, copyLinkButtonBox, catalogAccessBox] =
+    await Promise.all([
+      shareLevel.boundingBox(),
+      copyLinkButton.boundingBox(),
+      catalogAccess.boundingBox(),
+    ]);
+  // Reading order: who → how it goes out → what's included → catalog.
   expect(copyLinkButtonBox?.y ?? 0).toBeGreaterThanOrEqual(
-    (linkAccessBox?.y ?? 0) + (linkAccessBox?.height ?? 0) + 8,
+    (recipientFieldBox?.y ?? 0) + (recipientFieldBox?.height ?? 0),
+  );
+  expect(shareLevelBox?.y ?? 0).toBeGreaterThanOrEqual(
+    (copyLinkButtonBox?.y ?? 0) + (copyLinkButtonBox?.height ?? 0),
   );
+  expect(catalogAccessBox?.y ?? 0).toBeGreaterThanOrEqual(
+    (shareLevelBox?.y ?? 0) + (shareLevelBox?.height ?? 0),
+  );
+  // The memory choice is stated once, governing both delivery actions —
+  // neither the recipients row nor the link row carries its own copy.
   await expect(
-    shareDialog.getByLabel("What to include", { exact: true }),
+    shareDialog.getByTestId("persona-share-recipient-access"),
+  ).toHaveCount(0);
+  await expect(
+    shareDialog.getByTestId("persona-share-link-access"),
   ).toHaveCount(0);
+  await expect(shareLevel).toHaveCount(1);
   await expect(
     shareDialog.getByTestId("persona-share-memory-warning"),
   ).toHaveCount(0);
 
-  await linkAccess.click();
+  await shareLevel.click();
   await expect(page.getByRole("menuitemradio")).toHaveText([
     "Agent only",
     "Agent + core memory",
@@ -1120,7 +1860,7 @@ test("share access controls include the selected memories", async ({
   await page
     .getByRole("menuitemradio", { name: "Agent + core memory" })
     .click();
-  await expect(linkAccess).toHaveText("Agent + core memory");
+  await expect(shareLevel).toHaveText("Agent + core memory");
   await waitForAnimations(page);
   const expandedShareCardHeight = await shareMainCard.evaluate(
     (element) => element.getBoundingClientRect().height,
@@ -1128,6 +1868,9 @@ test("share access controls include the selected memories", async ({
   const inlineMemoryWarning = shareDialog.getByTestId(
     "persona-share-memory-warning",
   );
+  // No recipient is selected yet: the warning tracks the chosen contents, not
+  // whichever delivery button might be pressed.
+  await expect(shareDialog.getByTestId("persona-share-send")).toHaveCount(0);
   await expect(inlineMemoryWarning).toBeVisible();
   await expect(inlineMemoryWarning).toContainText(
     "Memory is stored as plaintext in the snapshot.",
@@ -1170,11 +1913,11 @@ test("share access controls include the selected memories", async ({
   await expect(page.getByTestId("persona-share-copy-link")).toContainText(
     "Copied",
   );
-  await linkAccess.click();
+  await shareLevel.click();
   await page
     .getByRole("menuitemradio", { name: "Agent only", exact: true })
     .click();
-  await expect(linkAccess).toHaveText("Agent only");
+  await expect(shareLevel).toHaveText("Agent only");
   await expect(inlineMemoryWarning).toHaveCount(0);
 
   const recipientSearch = page.getByTestId("persona-share-recipient-search");
@@ -1187,11 +1930,6 @@ test("share access controls include the selected memories", async ({
   const recipientInputRegion = recipientField.getByTestId(
     "persona-share-recipient-input-region",
   );
-  const recipientAccess = recipientField.getByLabel("What to include", {
-    exact: true,
-  });
-  await expect(recipientAccess).toHaveText("Agent only");
-  expect((await recipientAccess.boundingBox())?.width).toBeLessThan(140);
   await expect(recipientField).toHaveCSS("column-gap", "12px");
   await expect(recipientInputRegion).toHaveCSS("flex-wrap", "wrap");
   const sendButton = shareDialog.getByTestId("persona-share-send");
@@ -1215,42 +1953,17 @@ test("share access controls include the selected memories", async ({
       );
     })
     .toBeLessThanOrEqual(1);
-  const recipientInputRegionBox = await recipientInputRegion.boundingBox();
-  const recipientAccessBox = await recipientAccess.boundingBox();
-  expect(
-    (recipientAccessBox?.x ?? 0) -
-      ((recipientInputRegionBox?.x ?? 0) +
-        (recipientInputRegionBox?.width ?? 0)),
-  ).toBeGreaterThanOrEqual(12);
-  const recipientAccessRightEdge =
-    (recipientAccessBox?.x ?? 0) + (recipientAccessBox?.width ?? 0);
-  expect(
-    Math.abs(
-      (resizedRecipientFieldBox?.x ?? 0) +
-        (resizedRecipientFieldBox?.width ?? 0) -
-        8 -
-        recipientAccessRightEdge,
-    ),
-  ).toBeLessThanOrEqual(8);
-  await recipientAccess.click();
+  // Same single selector now drives the send path; picking a level here is
+  // what the send confirmation must report.
+  await shareLevel.click();
   await page
     .getByRole("menuitemradio", { name: "Agent + all memories" })
     .click();
-  await expect(recipientAccess).toHaveText("Agent + all memories");
+  await expect(shareLevel).toHaveText("Agent + all memories");
   await expect(inlineMemoryWarning).toBeVisible();
   await waitForAnimations(page);
-  await expect
-    .poll(async () => {
-      const expandedRecipientAccessBox = await recipientAccess.boundingBox();
-      return Math.abs(
-        (expandedRecipientAccessBox?.x ?? 0) +
-          (expandedRecipientAccessBox?.width ?? 0) -
-          recipientAccessRightEdge,
-      );
-    })
-    .toBeLessThanOrEqual(1);
   expect(
-    await recipientAccess
+    await shareLevel
       .locator("span")
       .evaluate((element) => element.scrollWidth <= element.clientWidth),
   ).toBe(true);
@@ -1306,6 +2019,9 @@ test("share access controls include the selected memories", async ({
       expect.objectContaining({
         memoryLevel: "core",
         memorySourcePubkey: linkedAgentPubkey,
+        avatarPngDataUrl: `data:image/png;base64,${Buffer.from(
+          profileAvatarBytes,
+        ).toString("base64")}`,
       }),
       expect.objectContaining({
         memoryLevel: "everything",
@@ -1571,19 +2287,16 @@ test("inactive built-ins cannot be used to create teams", async ({ page }) => {
     },
   });
 
-  expect(error).toBe(
-    "Honey is not in My Agents. Choose it from Agent Catalog first.",
-  );
+  expect(error).toBe("Honey is not in My Agents.");
 });
 
 test("built-in removal failures show up from My Agents", async ({ page }) => {
+  await installMockBridge(page, {
+    activePersonaIds: ["builtin:honey"],
+  });
   await gotoApp(page);
 
   await page.getByTestId("open-agents-view").click();
-  await openPersonaCatalog(page);
-  await selectCatalogPersona(page, "builtin:honey");
-  await useCatalogPersona(page, "builtin:honey");
-
   await invokeTauri(page, "create_team", {
     input: {
       name: "Honeys",
@@ -1591,7 +2304,6 @@ test("built-in removal failures show up from My Agents", async ({ page }) => {
     },
   });
 
-  await page.keyboard.press("Escape");
   await page.getByLabel("Open actions for Honey").click();
   await page.getByRole("menuitem", { name: "Delete" }).click();
 
diff --git a/desktop/tests/e2e/channel-composer-overflow.spec.ts b/desktop/tests/e2e/channel-composer-overflow.spec.ts
index 149a4247a6d..6ba13532a9d 100644
--- a/desktop/tests/e2e/channel-composer-overflow.spec.ts
+++ b/desktop/tests/e2e/channel-composer-overflow.spec.ts
@@ -1,7 +1,7 @@
 import { expect, test } from "@playwright/test";
 
 import { waitForAnimations } from "../helpers/animations";
-import { installMockBridge } from "../helpers/bridge";
+import { installMockBridge, TEST_IDENTITIES } from "../helpers/bridge";
 
 // The channel and thread composers float over their conversation scrollers.
 // When the conversation is scrolled up, later rows pass underneath the
@@ -10,19 +10,22 @@ import { installMockBridge } from "../helpers/bridge";
 // letting them bleed out below the composer box.
 
 const CHANNEL = "general";
+const TYPING_KIND = 20002;
 
 async function waitForMockLiveSubscription(
   page: import("@playwright/test").Page,
   channelName: string,
+  kind?: number,
 ) {
   await expect
     .poll(() =>
       page.evaluate(
-        (ch) =>
+        ({ channelName, kind }) =>
           window.__BUZZ_E2E_HAS_MOCK_LIVE_SUBSCRIPTION__?.({
-            channelName: ch,
+            channelName,
+            kind,
           }) ?? false,
-        channelName,
+        { channelName, kind },
       ),
     )
     .toBe(true);
@@ -43,7 +46,38 @@ async function emit(
     { channel: CHANNEL, content, parentEventId },
   );
   if (!event) throw new Error("mock message emitter is not installed");
-  return event as { id: string };
+  return event as { created_at: number; id: string };
+}
+
+type ComposerDockGeometry = {
+  composerBottom: number;
+  composerLeft: number;
+  composerRight: number;
+  composerTop: number;
+  dockHeight: number;
+  dockTop: number;
+};
+
+async function composerDockGeometry(
+  overlay: import("@playwright/test").Locator,
+): Promise<ComposerDockGeometry> {
+  return overlay.evaluate((element) => {
+    const composer = element.querySelector<HTMLElement>(
+      '[data-testid="message-composer"]',
+    );
+    const dock = element.querySelector<HTMLElement>(".composer-dock");
+    if (!composer || !dock) throw new Error("Missing composer dock geometry");
+    const composerRect = composer.getBoundingClientRect();
+    const dockRect = dock.getBoundingClientRect();
+    return {
+      composerBottom: composerRect.bottom,
+      composerLeft: composerRect.left,
+      composerRight: composerRect.right,
+      composerTop: composerRect.top,
+      dockHeight: dockRect.height,
+      dockTop: dockRect.top,
+    };
+  });
 }
 
 async function expectOverlayBottomMask(
@@ -130,6 +164,119 @@ test.describe("composer overlays mask scrolled content", () => {
     await expectOverlayBottomMask(page.getByTestId("channel-composer-overlay"));
   });
 
+  test("activity trades composer height without moving the dock", async ({
+    page,
+  }) => {
+    await installMockBridge(page);
+    await page.goto("/");
+    await page.getByTestId(`channel-${CHANNEL}`).click();
+    await waitForMockLiveSubscription(page, CHANNEL);
+    await waitForMockLiveSubscription(page, CHANNEL, TYPING_KIND);
+
+    const overlay = page.getByTestId("channel-composer-overlay");
+    const input = overlay.getByTestId("message-input");
+    await input.fill(
+      "A multiline draft that grows the composer.\nSecond line keeps the natural-height path active.",
+    );
+    await waitForAnimations(page);
+    const quiet = await composerDockGeometry(overlay);
+
+    await page.evaluate((channelName) => {
+      window.__BUZZ_E2E_EMIT_MOCK_TYPING__?.({ channelName });
+    }, CHANNEL);
+    await expect(
+      overlay.getByTestId("channel-composer-activity-row"),
+    ).toBeVisible();
+    await waitForAnimations(page);
+    const active = await composerDockGeometry(overlay);
+
+    expect(Math.abs(active.dockTop - quiet.dockTop)).toBeLessThanOrEqual(0.5);
+    expect(Math.abs(active.dockHeight - quiet.dockHeight)).toBeLessThanOrEqual(
+      0.5,
+    );
+    expect(
+      Math.abs(active.composerTop - quiet.composerTop),
+    ).toBeLessThanOrEqual(0.5);
+    expect(active.composerBottom).toBeLessThan(quiet.composerBottom - 8);
+  });
+
+  test("reduced motion removes dock geometry transitions", async ({ page }) => {
+    await page.emulateMedia({ reducedMotion: "reduce" });
+    await installMockBridge(page);
+    await page.goto("/");
+    await page.getByTestId(`channel-${CHANNEL}`).click();
+
+    const dock = page
+      .getByTestId("channel-composer-overlay")
+      .locator(".composer-dock");
+    const spacer = dock.locator(".composer-dock-quiet-spacer");
+    await expect(dock).toHaveCSS("transition-duration", "0s");
+    await expect(spacer).toHaveCSS("transition-duration", "0s");
+  });
+
+  test("bottom-pinned messages clear a growing composer", async ({ page }) => {
+    await installMockBridge(page);
+    await page.goto("/");
+    await page.getByTestId(`channel-${CHANNEL}`).click();
+    await expect(page.getByTestId("message-timeline")).toBeVisible();
+    await waitForMockLiveSubscription(page, CHANNEL);
+
+    let newestMessageId = "";
+    for (let i = 0; i < 20; i++) {
+      newestMessageId = (await emit(page, `Bottom-clearance message ${i}`)).id;
+    }
+    await page.waitForTimeout(300);
+    await page.evaluate(() => {
+      const scroller = document.querySelector<HTMLElement>(
+        '[data-buzz-conversation-scroll="true"]',
+      );
+      if (!scroller) throw new Error("Missing conversation scroll container");
+      scroller.scrollTop = scroller.scrollHeight;
+    });
+
+    await page
+      .getByTestId("message-input")
+      .fill(
+        "A long draft grows the composer and must keep the newest message above it.\nSecond line.\nThird line.",
+      );
+    await waitForAnimations(page);
+
+    const clearsComposer = await page.evaluate((messageId) => {
+      const composer = document.querySelector<HTMLElement>(
+        '[data-testid="channel-composer-overlay"] [data-testid="message-composer"]',
+      );
+      const newestRow = document.querySelector<HTMLElement>(
+        `[data-message-id="${CSS.escape(messageId)}"]`,
+      );
+      if (!composer || !newestRow) return false;
+      return (
+        newestRow.getBoundingClientRect().bottom <=
+        composer.getBoundingClientRect().top
+      );
+    }, newestMessageId);
+    expect(clearsComposer).toBe(true);
+
+    await page.setViewportSize({ width: 1280, height: 620 });
+    await expect
+      .poll(() =>
+        page.evaluate((messageId) => {
+          const composer = document.querySelector<HTMLElement>(
+            '[data-testid="channel-composer-overlay"] [data-testid="message-composer"]',
+          );
+          const newestRow = document.querySelector<HTMLElement>(
+            `[data-message-id="${CSS.escape(messageId)}"]`,
+          );
+          return Boolean(
+            composer &&
+              newestRow &&
+              newestRow.getBoundingClientRect().bottom <=
+                composer.getBoundingClientRect().top,
+          );
+        }, newestMessageId),
+      )
+      .toBe(true);
+  });
+
   test("thread panel replies fade out behind the reply composer", async ({
     page,
   }) => {
@@ -178,5 +325,41 @@ test.describe("composer overlays mask scrolled content", () => {
     });
 
     await expectOverlayBottomMask(page.getByTestId("thread-composer-overlay"));
+
+    await waitForMockLiveSubscription(page, CHANNEL, TYPING_KIND);
+    await page.evaluate(
+      ({ channelName, createdAt, pubkey, threadHeadId }) => {
+        window.__BUZZ_E2E_EMIT_MOCK_TYPING__?.({
+          channelName,
+          createdAt,
+          pubkey,
+          threadHeadId,
+        });
+      },
+      {
+        channelName: CHANNEL,
+        createdAt: root.created_at + 1,
+        pubkey: TEST_IDENTITIES.bob.pubkey,
+        threadHeadId: root.id,
+      },
+    );
+    const threadOverlay = page.getByTestId("thread-composer-overlay");
+    const activityRow = threadOverlay.getByTestId("message-typing-indicator");
+    await expect(activityRow).toBeVisible();
+    await waitForAnimations(page);
+    const [composerBounds, activityBounds] = await Promise.all([
+      threadOverlay.getByTestId("message-composer").boundingBox(),
+      activityRow.boundingBox(),
+    ]);
+    expect(composerBounds).not.toBeNull();
+    expect(activityBounds).not.toBeNull();
+    expect(activityBounds?.x ?? 0).toBeGreaterThanOrEqual(
+      (composerBounds?.x ?? 0) - 0.5,
+    );
+    expect(
+      (activityBounds?.x ?? 0) + (activityBounds?.width ?? 0),
+    ).toBeLessThanOrEqual(
+      (composerBounds?.x ?? 0) + (composerBounds?.width ?? 0) + 0.5,
+    );
   });
 });
diff --git a/desktop/tests/e2e/channels.spec.ts b/desktop/tests/e2e/channels.spec.ts
index c7dc7ecb5ac..9da40224205 100644
--- a/desktop/tests/e2e/channels.spec.ts
+++ b/desktop/tests/e2e/channels.spec.ts
@@ -26,6 +26,21 @@ const DM_RELAY_AGENT_PUBKEY =
   "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee";
 
 type MockFeedWindow = Window & {
+  __BUZZ_E2E_EMIT_MOCK_MESSAGE__?: (input: {
+    channelName: string;
+    content: string;
+    createdAt?: number;
+    id?: string;
+    parentEventId?: string;
+    pubkey?: string;
+  }) => {
+    content: string;
+    created_at: number;
+    id: string;
+    kind: number;
+    pubkey: string;
+    tags: string[][];
+  };
   __BUZZ_E2E_SEED_ACTIVE_TURNS__?: (input: {
     agentPubkey: string;
     channelId: string;
@@ -36,6 +51,7 @@ type MockFeedWindow = Window & {
     category: "mention" | "needs_action" | "activity" | "agent_activity";
     channel_id: string | null;
     channel_name: string;
+    channel_type?: string | null;
     content: string;
     created_at: number;
     id: string;
@@ -696,7 +712,6 @@ test("creates the DM before preparing a persona mention", async ({ page }) => {
     page.getByTestId(`new-dm-selected-${TEST_IDENTITIES.charlie.pubkey}`),
   ).toBeDisabled();
   await expect(page.getByTestId("new-dm-search")).toBeDisabled();
-  await expect(page.getByTestId("new-message-recipient-popover")).toBeHidden();
   await expect
     .poll(async () =>
       commandCount(await readCommandLog(page), "create_managed_agent"),
@@ -704,6 +719,9 @@ test("creates the DM before preparing a persona mention", async ({ page }) => {
     .toBeGreaterThan(baselineCreateCount);
   await expect(page.getByTestId("chat-title")).toContainText("charlie");
   await expect(page.getByTestId("chat-title")).toContainText("Fizz");
+  // Assert popover hidden after chat-title settles — by this point the send
+  // flow has completed and the UI has fully transitioned away from the popover.
+  await expect(page.getByTestId("new-message-recipient-popover")).toBeHidden();
 
   const sendCommands = (await readCommandLog(page)).slice(
     baselineCommands.length,
@@ -766,8 +784,11 @@ test("creates the DM before preparing a persona mention", async ({ page }) => {
 test("routes an agent mention from an existing DM to the expanded conversation", async ({
   page,
 }) => {
+  // Delay persona provisioning so the follow-up expanded-DM open/start sequence
+  // cannot collapse into the same fast CI tick before assertions observe it.
   await installMockBridge(page, {
     activePersonaIds: ["builtin:fizz"],
+    createManagedAgentDelayMs: 100,
   });
   await page.goto("/");
 
@@ -821,7 +842,10 @@ test("routes an agent mention from an existing DM to the expanded conversation",
 test("routes a managed relay-agent mention from an existing DM to the expanded conversation", async ({
   page,
 }) => {
+  // Delay the expanded open_dm call so routing/navigation settles
+  // deterministically under fast CI execution.
   await installMockBridge(page, {
+    openDmDelayMs: 100,
     managedAgents: [
       {
         pubkey: DM_RELAY_AGENT_PUBKEY,
@@ -951,8 +975,11 @@ test("does not reroute an expanded DM after the channel pane unmounts", async ({
 test("drops an expanded DM after the first message fails", async ({ page }) => {
   const retryMessage = "Retry without the agent";
   const sendError = "Mock first DM send failed.";
+  // Delay persona provisioning so the follow-up expanded-DM open/start sequence
+  // cannot collapse into the same fast CI tick before assertions observe it.
   await installMockBridge(page, {
     activePersonaIds: ["builtin:fizz"],
+    createManagedAgentDelayMs: 100,
     sendMessageErrors: [sendError],
   });
   await page.goto("/");
@@ -1803,15 +1830,18 @@ test("channel date divider keeps the date sticky while the separator rule scroll
     "background-color",
     "rgba(0, 0, 0, 0)",
   );
-  await expect(composerOverlay.getByTestId("message-composer")).not.toHaveCSS(
+  await expect(composerOverlay.getByTestId("message-composer")).toHaveCSS(
     "backdrop-filter",
     "none",
   );
-  const composerActivityRow = composerOverlay.getByTestId(
-    "channel-composer-activity-row",
+  await expect(
+    composerOverlay.getByTestId("composer-dock-backdrop").locator("div"),
+  ).not.toHaveCSS("backdrop-filter", "none");
+  const composerRailMask = composerOverlay.getByTestId(
+    "composer-dock-rail-mask",
   );
-  await expect(composerActivityRow).toHaveCSS("backdrop-filter", "none");
-  await expect(composerActivityRow).not.toHaveCSS(
+  await expect(composerRailMask).toHaveCSS("backdrop-filter", "none");
+  await expect(composerRailMask).not.toHaveCSS(
     "background-color",
     "rgba(0, 0, 0, 0)",
   );
@@ -2557,15 +2587,369 @@ async function seedHomeInboxMention(
   await page.getByTestId(`home-inbox-item-${itemId}`).click();
 }
 
-test("home inbox channel label navigates to the channel message", async ({
+test("Inbox All excludes generic channel traffic", async ({ page }) => {
+  await page.goto("/");
+  await page.waitForFunction(() => {
+    const win = window as MockFeedWindow;
+    return typeof win.__BUZZ_E2E_PUSH_MOCK_FEED_ITEM__ === "function";
+  });
+
+  await page.evaluate(
+    ({ channelId, currentPubkey, senderPubkey }) => {
+      const pushFeedItem = (window as MockFeedWindow)
+        .__BUZZ_E2E_PUSH_MOCK_FEED_ITEM__;
+      if (!pushFeedItem) throw new Error("Mock feed helper is not installed.");
+      const now = Math.floor(Date.now() / 1000);
+      pushFeedItem({
+        category: "activity",
+        channel_id: channelId,
+        channel_name: "general",
+        channel_type: "stream",
+        content: "Ordinary channel traffic",
+        created_at: now,
+        id: "inbox-generic-channel-message",
+        kind: 9,
+        pubkey: senderPubkey,
+        tags: [["h", channelId]],
+      });
+      pushFeedItem({
+        category: "mention",
+        channel_id: channelId,
+        channel_name: "general",
+        channel_type: "stream",
+        content: "A message that needs my attention",
+        created_at: now + 1,
+        id: "inbox-personal-mention",
+        kind: 9,
+        pubkey: senderPubkey,
+        tags: [
+          ["h", channelId],
+          ["p", currentPubkey],
+        ],
+      });
+    },
+    {
+      channelId: GENERAL_CHANNEL_ID,
+      currentPubkey: TEST_IDENTITIES.tyler.pubkey,
+      senderPubkey: TEST_IDENTITIES.alice.pubkey,
+    },
+  );
+
+  await expect(
+    page.getByTestId("home-inbox-item-inbox-personal-mention"),
+  ).toBeVisible();
+  await expect(
+    page.getByTestId("home-inbox-item-inbox-generic-channel-message"),
+  ).toHaveCount(0);
+});
+
+test("Inbox All never lists drafts and unread-only hides reminders", async ({
+  page,
+}) => {
+  const draftKey = `channel:${GENERAL_CHANNEL_ID}`;
+  await page.addInitScript(
+    ({ draftStoreKey, draftStorageKey }) => {
+      const timestamp = new Date().toISOString();
+      window.localStorage.setItem(
+        draftStoreKey,
+        JSON.stringify({
+          [draftStorageKey]: {
+            channelId: "9a1657ac-f7aa-5db0-b632-d8bbeb6dfb50",
+            content: "Finish the mixed Inbox test",
+            createdAt: timestamp,
+            pendingImeta: [],
+            selectionEnd: 30,
+            selectionStart: 30,
+            spoileredAttachmentUrls: [],
+            status: "active",
+            updatedAt: timestamp,
+          },
+        }),
+      );
+    },
+    {
+      draftStorageKey: draftKey,
+      draftStoreKey: `buzz-drafts.v2:ws://localhost:3000:${MOCK_IDENTITY_PUBKEY}`,
+    },
+  );
+  await page.goto("/");
+  await page.waitForFunction(() => {
+    const win = window as MockFeedWindow;
+    return typeof win.__BUZZ_E2E_PUSH_MOCK_FEED_ITEM__ === "function";
+  });
+
+  const reminderId = "inbox-unread-only-reminder";
+  const messageId = "inbox-unread-only-message";
+  await page.evaluate(
+    async ({
+      channelId,
+      currentPubkey,
+      messageId,
+      reminderId,
+      senderPubkey,
+    }) => {
+      const now = Math.floor(Date.now() / 1_000);
+      window.__BUZZ_E2E_SEED_MOCK_REMINDERS__?.([
+        {
+          id: reminderId,
+          pubkey: currentPubkey,
+          created_at: now - 120,
+          kind: 30300,
+          tags: [
+            ["d", reminderId],
+            ["not_before", String(now - 60)],
+          ],
+          content: JSON.stringify({
+            target: {
+              eventId: "mock-general-alice",
+              channelId,
+              preview: "Due reminder in mixed Inbox",
+              authorPubkey: senderPubkey,
+            },
+            status: "pending",
+          }),
+          sig: "mocksig".repeat(20).slice(0, 128),
+        },
+      ]);
+      await window.__BUZZ_E2E_QUERY_CLIENT__?.invalidateQueries({
+        queryKey: ["reminders"],
+      });
+
+      const pushFeedItem = (window as MockFeedWindow)
+        .__BUZZ_E2E_PUSH_MOCK_FEED_ITEM__;
+      if (!pushFeedItem) throw new Error("Mock feed helper is not installed.");
+      pushFeedItem({
+        category: "mention",
+        channel_id: channelId,
+        channel_name: "general",
+        channel_type: "stream",
+        content: "Unread message in mixed Inbox",
+        created_at: now,
+        id: messageId,
+        kind: 9,
+        pubkey: senderPubkey,
+        tags: [
+          ["h", channelId],
+          ["p", currentPubkey],
+        ],
+      });
+    },
+    {
+      channelId: GENERAL_CHANNEL_ID,
+      currentPubkey: MOCK_IDENTITY_PUBKEY,
+      messageId,
+      reminderId,
+      senderPubkey: TEST_IDENTITIES.alice.pubkey,
+    },
+  );
+
+  const messageRow = page.getByTestId(`home-inbox-item-${messageId}`);
+  const reminderRow = page.getByTestId(`home-all-reminders-${reminderId}`);
+  const draftRow = page.getByTestId(`home-all-drafts-${draftKey}`);
+  await expect(messageRow).toBeVisible();
+  await expect(reminderRow).toBeVisible();
+  // Drafts belong to the dedicated Drafts filter — never the mixed All view.
+  await expect(draftRow).toHaveCount(0);
+
+  await page.getByTestId("inbox-options-trigger").click();
+  await page.getByRole("switch", { name: "Show unread only" }).click();
+
+  await expect(messageRow).toBeVisible();
+  await expect(reminderRow).toHaveCount(0);
+  await expect(draftRow).toHaveCount(0);
+
+  // The draft is still reachable under the Drafts filter.
+  await page.keyboard.press("Escape");
+  await page.getByTestId("inbox-filter-trigger").click();
+  await page.getByRole("menuitemradio", { name: "Drafts" }).click();
+  await expect(page.getByTestId("home-inbox-drafts")).toBeVisible();
+});
+
+test("Inbox merges a due reminder into its represented conversation", async ({
+  page,
+}) => {
+  const messageId = "inbox-reminder-merge-message";
+  const reminderId = "inbox-reminder-merge";
+  await seedHomeInboxMention(page, messageId);
+
+  await page.evaluate(
+    async ({
+      authorPubkey,
+      channelId,
+      messageId: targetEventId,
+      pubkey,
+      reminderId: id,
+    }) => {
+      const now = Math.floor(Date.now() / 1_000);
+      window.__BUZZ_E2E_SEED_MOCK_REMINDERS__?.([
+        {
+          id,
+          pubkey,
+          created_at: now - 600,
+          kind: 30300,
+          tags: [
+            ["d", id],
+            ["not_before", String(now - 60)],
+          ],
+          content: JSON.stringify({
+            target: {
+              eventId: targetEventId,
+              channelId,
+              preview: "Please review the home panel routing.",
+              authorPubkey,
+            },
+            status: "pending",
+          }),
+          sig: "mocksig".repeat(20).slice(0, 128),
+        },
+      ]);
+      await window.__BUZZ_E2E_QUERY_CLIENT__?.invalidateQueries({
+        queryKey: ["reminders"],
+      });
+    },
+    {
+      authorPubkey: TEST_IDENTITIES.alice.pubkey,
+      channelId: GENERAL_CHANNEL_ID,
+      messageId,
+      pubkey: MOCK_IDENTITY_PUBKEY,
+      reminderId,
+    },
+  );
+
+  const conversationRow = page.getByTestId(`home-inbox-item-${messageId}`);
+  await expect(conversationRow.getByText("Reminder due")).toBeVisible();
+  await expect(
+    page.getByTestId(`home-all-reminders-${reminderId}`),
+  ).toHaveCount(0);
+
+  await page.getByTestId("inbox-filter-trigger").click();
+  await page.getByRole("menuitemradio", { name: "Mentions" }).click();
+  await expect(conversationRow.getByText("Reminder due")).toBeVisible();
+});
+
+test("Inbox All keeps its filter when opening a due reminder", async ({
+  page,
+}) => {
+  await page.goto("/");
+  await expect(page.getByTestId("home-inbox")).toBeVisible();
+
+  const reminderId = "inbox-stable-reminder";
+  await page.evaluate(
+    async ({ channelId, id, pubkey }) => {
+      const now = Math.floor(Date.now() / 1000);
+      window.__BUZZ_E2E_SEED_MOCK_REMINDERS__?.([
+        {
+          id,
+          pubkey,
+          created_at: now - 300,
+          kind: 30300,
+          tags: [
+            ["d", id],
+            ["not_before", String(now - 60)],
+          ],
+          content: JSON.stringify({
+            target: {
+              eventId: "mock-general-alice",
+              channelId,
+              preview: "Review the Inbox behavior",
+              authorPubkey: pubkey,
+            },
+            status: "pending",
+          }),
+          sig: "mocksig".repeat(20).slice(0, 128),
+        },
+      ]);
+      await window.__BUZZ_E2E_QUERY_CLIENT__?.invalidateQueries({
+        queryKey: ["reminders"],
+      });
+    },
+    {
+      channelId: GENERAL_CHANNEL_ID,
+      id: reminderId,
+      pubkey: MOCK_IDENTITY_PUBKEY,
+    },
+  );
+
+  const reminderRow = page.getByTestId(`home-all-reminders-${reminderId}`);
+  await expect(reminderRow).toBeVisible();
+  await reminderRow.click();
+
+  await expect(page.getByTestId("inbox-filter-trigger")).toContainText("All");
+  await expect(page.getByTestId("home-reminder-detail")).toBeVisible();
+  await expect(page.getByTestId("home-inbox-list")).toBeVisible();
+});
+
+test("Inbox reminder rows and detail identify DM context", async ({ page }) => {
+  await page.goto("/");
+  await expect(page.getByTestId("home-inbox")).toBeVisible();
+
+  const reminderId = "inbox-dm-reminder";
+  const dmChannelId = "f48efb06-0c93-5025-aac9-2e646bb6bfa8";
+  await page.evaluate(
+    async ({ authorPubkey, channelId, currentPubkey, reminderId }) => {
+      const now = Math.floor(Date.now() / 1_000);
+      window.__BUZZ_E2E_SEED_MOCK_REMINDERS__?.([
+        {
+          id: reminderId,
+          pubkey: currentPubkey,
+          created_at: now - 300,
+          kind: 30300,
+          tags: [
+            ["d", reminderId],
+            ["not_before", String(now - 60)],
+          ],
+          content: JSON.stringify({
+            target: {
+              eventId: "mock-dm-alice",
+              channelId,
+              preview: "Follow up with Alice",
+              authorPubkey,
+            },
+            status: "pending",
+          }),
+          sig: "mocksig".repeat(20).slice(0, 128),
+        },
+      ]);
+      await window.__BUZZ_E2E_QUERY_CLIENT__?.invalidateQueries({
+        queryKey: ["reminders"],
+      });
+    },
+    {
+      authorPubkey: TEST_IDENTITIES.alice.pubkey,
+      channelId: dmChannelId,
+      currentPubkey: MOCK_IDENTITY_PUBKEY,
+      reminderId,
+    },
+  );
+
+  await page.getByTestId("inbox-filter-trigger").click();
+  await page.getByRole("menuitemradio", { name: "Reminders" }).click();
+  const reminderRow = page.getByTestId(`home-reminder-item-${reminderId}`);
+  await expect(
+    reminderRow.getByText("DM with alice-tyler", { exact: true }),
+  ).toBeVisible();
+  await reminderRow.getByRole("button").click();
+
+  const detail = page.getByTestId("home-reminder-detail");
+  await expect(
+    detail.getByText("DM with alice-tyler", { exact: true }),
+  ).toBeVisible();
+  await expect(detail.getByText("#alice-tyler", { exact: true })).toHaveCount(
+    0,
+  );
+});
+
+test("Inbox detail title and source action navigate to the conversation", async ({
   page,
 }) => {
   await seedHomeInboxMention(page, "mock-feed-home-channel-navigate");
 
-  await page
-    .getByTestId("home-inbox-detail")
-    .getByRole("button", { exact: true, name: "general" })
-    .click();
+  const detail = page.getByTestId("home-inbox-detail");
+  await expect(detail.getByRole("heading")).toHaveText("Message in #general");
+  await expect(
+    detail.getByRole("button", { name: "Open in channel" }),
+  ).toBeVisible();
+  await detail.getByTestId("home-inbox-context-title").click();
 
   await expect(page).toHaveURL(
     new RegExp(`#/channels/${GENERAL_CHANNEL_ID}\\?`),
@@ -2586,10 +2970,10 @@ test("home inbox thread reply mention carries threadRootId to the channel", asyn
     ["p", TEST_IDENTITIES.tyler.pubkey],
   ]);
 
-  await page
-    .getByTestId("home-inbox-detail")
-    .getByRole("button", { exact: true, name: "general" })
-    .click();
+  const detail = page.getByTestId("home-inbox-detail");
+  await expect(detail.getByRole("heading")).toHaveText("Thread in #general");
+  await expect(detail.getByTestId("message-unread-divider")).toBeVisible();
+  await detail.getByRole("button", { name: "Open full thread" }).click();
 
   await expect(page).toHaveURL(
     new RegExp(`#/channels/${GENERAL_CHANNEL_ID}\\?`),
@@ -2600,6 +2984,236 @@ test("home inbox thread reply mention carries threadRootId to the channel", asyn
   await expect(page.getByTestId("home-inbox-list")).toHaveCount(0);
 });
 
+test("Inbox filter changes preserve valid detail and directly select a replacement", async ({
+  page,
+}) => {
+  const threadItemId = "inbox-filter-thread";
+  const actionItemId = "inbox-filter-action";
+  await seedHomeInboxMention(page, threadItemId, [
+    ["e", "inbox-filter-root", "", "root"],
+    ["e", "inbox-filter-parent", "", "reply"],
+    ["p", TEST_IDENTITIES.tyler.pubkey],
+  ]);
+
+  await page.evaluate(
+    ({ actionId, channelId, senderPubkey }) => {
+      const pushFeedItem = (window as MockFeedWindow)
+        .__BUZZ_E2E_PUSH_MOCK_FEED_ITEM__;
+      if (!pushFeedItem) throw new Error("Mock feed helper is not installed.");
+      pushFeedItem({
+        category: "needs_action",
+        channel_id: channelId,
+        channel_name: "general",
+        channel_type: "stream",
+        content: "Approve the replacement selection",
+        created_at: Math.floor(Date.now() / 1_000) + 120,
+        id: actionId,
+        kind: 46010,
+        pubkey: senderPubkey,
+        tags: [["h", channelId]],
+      });
+    },
+    {
+      actionId: actionItemId,
+      channelId: GENERAL_CHANNEL_ID,
+      senderPubkey: TEST_IDENTITIES.alice.pubkey,
+    },
+  );
+
+  await page.getByTestId("inbox-filter-trigger").click();
+  await page.getByRole("menuitemradio", { name: "Threads" }).click();
+  await expect(
+    page.getByTestId(`home-inbox-item-${threadItemId}`),
+  ).toHaveAttribute("aria-current", "true");
+  await expect(page.getByTestId("home-inbox-detail")).toContainText(
+    "Please review the home panel routing.",
+  );
+
+  await expect(
+    page.getByRole("menuitemradio", { name: "Threads" }),
+  ).toHaveCount(0);
+  await page.getByTestId("inbox-filter-trigger").click();
+  await page.getByRole("menuitemradio", { name: "Needs action" }).click();
+  await expect(
+    page.getByTestId(`home-inbox-item-${actionItemId}`),
+  ).toHaveAttribute("aria-current", "true");
+  await expect(page.getByTestId("home-inbox-detail")).toContainText(
+    "Approve the replacement selection",
+  );
+});
+
+test("Inbox keeps the unread boundary for replies from multiple agents", async ({
+  page,
+}) => {
+  await page.goto("/");
+  await expect(page.getByTestId("home-inbox-list")).toBeVisible();
+  await page.waitForFunction(() => {
+    const win = window as MockFeedWindow;
+    return (
+      typeof win.__BUZZ_E2E_EMIT_MOCK_MESSAGE__ === "function" &&
+      typeof win.__BUZZ_E2E_PUSH_MOCK_FEED_ITEM__ === "function"
+    );
+  });
+
+  const replyIds = [
+    "inbox-agent-reply-first",
+    "inbox-agent-reply-second",
+    "inbox-agent-reply-third",
+  ];
+  await page.evaluate(
+    ({ agentPubkeys, channelId, currentPubkey, ids }) => {
+      const win = window as MockFeedWindow;
+      const emitMessage = win.__BUZZ_E2E_EMIT_MOCK_MESSAGE__;
+      const pushFeedItem = win.__BUZZ_E2E_PUSH_MOCK_FEED_ITEM__;
+      if (!emitMessage || !pushFeedItem) {
+        throw new Error("Mock bridge helpers are not installed.");
+      }
+
+      const createdAt = Math.floor(Date.now() / 1000) + 60;
+      const root = emitMessage({
+        channelName: "general",
+        content: "Agent collaboration thread",
+        createdAt: createdAt - 10,
+        id: "inbox-agent-thread-root",
+        pubkey: currentPubkey,
+      });
+      const contents = [
+        "First unread agent reply",
+        "Second unread agent reply",
+        "Third unread agent reply",
+      ];
+
+      contents.forEach((content, index) => {
+        const event = emitMessage({
+          channelName: "general",
+          content,
+          createdAt: createdAt + index,
+          id: ids[index],
+          parentEventId: root.id,
+          pubkey: agentPubkeys[index % agentPubkeys.length],
+        });
+        pushFeedItem({
+          category: "activity",
+          channel_id: channelId,
+          channel_name: "general",
+          channel_type: "stream",
+          content: event.content,
+          created_at: event.created_at,
+          id: event.id,
+          kind: event.kind,
+          pubkey: event.pubkey,
+          tags: event.tags,
+        });
+      });
+    },
+    {
+      agentPubkeys: [
+        TEST_IDENTITIES.alice.pubkey,
+        TEST_IDENTITIES.charlie.pubkey,
+      ],
+      channelId: GENERAL_CHANNEL_ID,
+      currentPubkey: MOCK_IDENTITY_PUBKEY,
+      ids: replyIds,
+    },
+  );
+
+  const firstUnreadRow = page.getByTestId(`home-inbox-item-${replyIds[0]}`);
+  await expect(firstUnreadRow).toBeVisible();
+  await firstUnreadRow.click();
+
+  const detail = page.getByTestId("home-inbox-detail");
+  await expect(detail).toContainText("Agent collaboration thread");
+  await expect(detail).toContainText("First unread agent reply");
+  await expect(detail).toContainText("Second unread agent reply");
+  await expect(detail).toContainText("Third unread agent reply");
+  await expect(detail.getByTestId("message-unread-divider")).toBeVisible();
+  await expect(page.getByTestId("home-inbox-selected-message")).toContainText(
+    "First unread agent reply",
+  );
+});
+
+test("home inbox groups consecutive DMs and opens the full conversation", async ({
+  page,
+}) => {
+  const dmChannelId = "f48efb06-0c93-5025-aac9-2e646bb6bfa8";
+  const dmIds = ["inbox-dm-first", "inbox-dm-second", "inbox-dm-third"];
+
+  await page.goto("/");
+  await expect(page.getByTestId("home-inbox-list")).toBeVisible();
+  await page.waitForFunction(() => {
+    const win = window as MockFeedWindow;
+    return (
+      typeof win.__BUZZ_E2E_EMIT_MOCK_MESSAGE__ === "function" &&
+      typeof win.__BUZZ_E2E_PUSH_MOCK_FEED_ITEM__ === "function"
+    );
+  });
+
+  await page.evaluate(
+    ({ channelId, createdAt, ids, senderPubkey }) => {
+      const win = window as MockFeedWindow;
+      const emitMessage = win.__BUZZ_E2E_EMIT_MOCK_MESSAGE__;
+      const pushFeedItem = win.__BUZZ_E2E_PUSH_MOCK_FEED_ITEM__;
+      if (!emitMessage || !pushFeedItem) {
+        throw new Error("Mock bridge helpers are not installed.");
+      }
+
+      ["First unread DM", "Second unread DM", "Third unread DM"].forEach(
+        (content, index) => {
+          const event = emitMessage({
+            channelName: "alice-tyler",
+            content,
+            createdAt: createdAt + index,
+            id: ids[index],
+            pubkey: senderPubkey,
+          });
+          pushFeedItem({
+            category: "activity",
+            channel_id: channelId,
+            channel_name: "alice-tyler",
+            channel_type: null,
+            content: event.content,
+            created_at: event.created_at,
+            id: event.id,
+            kind: event.kind,
+            pubkey: event.pubkey,
+            tags: event.tags,
+          });
+        },
+      );
+    },
+    {
+      channelId: dmChannelId,
+      createdAt: Math.floor(Date.now() / 1000),
+      ids: dmIds,
+      senderPubkey: TEST_IDENTITIES.alice.pubkey,
+    },
+  );
+
+  const firstDmRow = page.getByTestId(`home-inbox-item-${dmIds[0]}`);
+  await expect(firstDmRow).toBeVisible();
+  await expect(page.getByTestId(`home-inbox-item-${dmIds[1]}`)).toHaveCount(0);
+  await expect(page.getByTestId(`home-inbox-item-${dmIds[2]}`)).toHaveCount(0);
+  await expect(firstDmRow.getByTestId("home-inbox-unread-count")).toHaveText(
+    "3 unread",
+  );
+
+  await firstDmRow.click();
+  const detail = page.getByTestId("home-inbox-detail");
+  await expect(detail.getByRole("heading")).toHaveText("DM with alice");
+  await expect(detail).toContainText("First unread DM");
+  await expect(detail).toContainText("Second unread DM");
+  await expect(detail).toContainText("Third unread DM");
+  await expect(page.getByTestId("home-inbox-selected-message")).toContainText(
+    "First unread DM",
+  );
+  const unreadBoundary = page.getByTestId("message-unread-divider");
+  await expect(unreadBoundary).toBeVisible();
+  await expect(unreadBoundary).toContainText("New");
+  await expect(
+    detail.getByRole("button", { name: "Open conversation" }),
+  ).toBeVisible();
+});
+
 test("home inbox manage affordance opens management without leaving home", async ({
   page,
 }) => {
diff --git a/desktop/tests/e2e/community-rail.spec.ts b/desktop/tests/e2e/community-rail.spec.ts
index 68c12f69df3..0c78108190e 100644
--- a/desktop/tests/e2e/community-rail.spec.ts
+++ b/desktop/tests/e2e/community-rail.spec.ts
@@ -662,6 +662,9 @@ test.describe("community rail", () => {
     const buttonBox = await firstButton.boundingBox();
     const railBox = await page.getByTestId("community-rail").boundingBox();
     const searchBox = await page.getByTestId("open-search").boundingBox();
+    const appSurfaceBox = await page
+      .locator(".buzz-huddle-app-surface")
+      .boundingBox();
     const contentBox = await page
       .locator("[data-buzz-content-surface]")
       .first()
@@ -669,11 +672,22 @@ test.describe("community rail", () => {
     expect(buttonBox).not.toBeNull();
     expect(railBox).not.toBeNull();
     expect(searchBox).not.toBeNull();
+    expect(appSurfaceBox).not.toBeNull();
     expect(contentBox).not.toBeNull();
     expect(buttonBox?.y ?? 0).toBeGreaterThanOrEqual(32);
-    expect(Math.abs((railBox?.y ?? 0) - (contentBox?.y ?? 0))).toBeLessThan(
+    expect(
+      Math.abs((buttonBox?.y ?? 0) - (contentBox?.y ?? 0) - 6),
+    ).toBeLessThan(0.5);
+    expect(Math.abs((railBox?.y ?? 0) - (appSurfaceBox?.y ?? 0))).toBeLessThan(
       0.5,
     );
+    expect(
+      Math.abs(
+        (railBox?.y ?? 0) +
+          (railBox?.height ?? 0) -
+          ((appSurfaceBox?.y ?? 0) + (appSurfaceBox?.height ?? 0)),
+      ),
+    ).toBeLessThan(0.5);
 
     const leftInset = (buttonBox?.x ?? 0) - (railBox?.x ?? 0);
     const rightInset =
diff --git a/desktop/tests/e2e/composer-selection-formatting.spec.ts b/desktop/tests/e2e/composer-selection-formatting.spec.ts
new file mode 100644
index 00000000000..b8ab46503d5
--- /dev/null
+++ b/desktop/tests/e2e/composer-selection-formatting.spec.ts
@@ -0,0 +1,592 @@
+import { expect, test, type Locator, type Page } from "@playwright/test";
+
+import { installMockBridge } from "../helpers/bridge";
+
+async function openGeneral(page: Page) {
+  await page.goto("/");
+  await page.getByTestId("channel-general").click();
+  await expect(page.getByTestId("chat-title")).toHaveText("general");
+}
+
+async function selectText(input: Locator, selectedText: string) {
+  await input.evaluate((element, text) => {
+    const walker = document.createTreeWalker(element, NodeFilter.SHOW_TEXT);
+    let offset = 0;
+
+    while (walker.nextNode()) {
+      const node = walker.currentNode;
+      const value = node.textContent ?? "";
+      const index = value.indexOf(text);
+      if (index >= 0) {
+        const range = document.createRange();
+        range.setStart(node, index);
+        range.setEnd(node, index + text.length);
+
+        const selection = window.getSelection();
+        selection?.removeAllRanges();
+        selection?.addRange(range);
+        (element as HTMLElement).focus();
+        document.dispatchEvent(new Event("selectionchange"));
+        return;
+      }
+      offset += value.length;
+    }
+
+    throw new Error(
+      `Could not select "${text}" in composer after ${offset} characters`,
+    );
+  }, selectedText);
+}
+
+async function selectTextRange(
+  input: Locator,
+  firstText: string,
+  lastText: string,
+) {
+  await input.evaluate(
+    (element, texts) => {
+      const walker = document.createTreeWalker(element, NodeFilter.SHOW_TEXT);
+      let first: Text | null = null;
+      let last: Text | null = null;
+      while (walker.nextNode()) {
+        const node = walker.currentNode as Text;
+        if (!first && node.data.includes(texts.firstText)) first = node;
+        if (node.data.includes(texts.lastText)) last = node;
+      }
+      if (!(first && last))
+        throw new Error("Could not find selection endpoints");
+      const range = document.createRange();
+      range.setStart(first, first.data.indexOf(texts.firstText));
+      range.setEnd(
+        last,
+        last.data.indexOf(texts.lastText) + texts.lastText.length,
+      );
+      const selection = window.getSelection();
+      selection?.removeAllRanges();
+      selection?.addRange(range);
+      (element as HTMLElement).focus();
+      document.dispatchEvent(new Event("selectionchange"));
+    },
+    { firstText, lastText },
+  );
+}
+
+async function dragSelectText(
+  page: Page,
+  input: Locator,
+  selectedText: string,
+  backward = false,
+) {
+  const points = await input.evaluate((element, text) => {
+    const walker = document.createTreeWalker(element, NodeFilter.SHOW_TEXT);
+
+    while (walker.nextNode()) {
+      const node = walker.currentNode;
+      const value = node.textContent ?? "";
+      const index = value.indexOf(text);
+      if (index < 0) continue;
+
+      const startRange = document.createRange();
+      startRange.setStart(node, index);
+      startRange.setEnd(node, index + 1);
+      const startRect = startRange.getBoundingClientRect();
+
+      const endRange = document.createRange();
+      endRange.setStart(node, index + text.length - 1);
+      endRange.setEnd(node, index + text.length);
+      const endRect = endRange.getBoundingClientRect();
+
+      return {
+        start: {
+          x: startRect.left + 1,
+          y: startRect.top + startRect.height / 2,
+        },
+        end: {
+          x: endRect.right - 1,
+          y: endRect.top + endRect.height / 2,
+        },
+      };
+    }
+
+    throw new Error(`Could not locate "${text}" for mouse selection`);
+  }, selectedText);
+
+  const dragStart = backward ? points.end : points.start;
+  const dragEnd = backward ? points.start : points.end;
+  await page.mouse.move(dragStart.x, dragStart.y);
+  await page.mouse.down();
+  await page.mouse.move(dragEnd.x, dragEnd.y, { steps: 12 });
+  await page.mouse.up();
+
+  await expect
+    .poll(() => page.evaluate(() => window.getSelection()?.toString()))
+    .toBe(selectedText);
+}
+
+async function applySelectionFormat(
+  page: Page,
+  input: Locator,
+  label: "Bullet list" | "Code block" | "Ordered list" | "Quote",
+  collapseAfterMouseDown = false,
+  useMouseSelection = false,
+) {
+  if (useMouseSelection) {
+    await dragSelectText(page, input, "selected");
+  } else {
+    await selectText(input, "selected");
+  }
+  const tray = page.getByTestId("selection-formatting-tray");
+  await expect(tray).toBeVisible();
+  const button = tray.getByRole("button", { name: label });
+
+  if (collapseAfterMouseDown) {
+    await button.evaluate((element, inputTestId) => {
+      element.addEventListener(
+        "mouseup",
+        () => {
+          const input = document.querySelector(
+            `[data-testid="${inputTestId}"]`,
+          );
+          if (!input) throw new Error("Composer input not found");
+
+          const range = document.createRange();
+          range.selectNodeContents(input);
+          range.collapse(false);
+          const selection = window.getSelection();
+          selection?.removeAllRanges();
+          selection?.addRange(range);
+          document.dispatchEvent(new Event("selectionchange"));
+        },
+        { once: true },
+      );
+    }, "message-input");
+  }
+
+  await button.click();
+}
+
+test.beforeEach(async ({ page }) => {
+  await installMockBridge(page);
+});
+
+async function applyCaretFormat(
+  page: Page,
+  label: "Bullet list" | "Code block" | "Ordered list" | "Quote",
+) {
+  await page.getByRole("button", { name: "Toggle formatting" }).first().click();
+  await page.getByRole("button", { name: label, exact: true }).click();
+}
+
+for (const format of [
+  { label: "Code block", selector: "pre" },
+  { label: "Bullet list", selector: "ul" },
+  { label: "Ordered list", selector: "ol" },
+  { label: "Quote", selector: "blockquote" },
+] as const) {
+  test(`${format.label} applies only to the selected composer text`, async ({
+    page,
+  }) => {
+    await openGeneral(page);
+
+    const input = page.getByTestId("message-input");
+    await input.fill("before selected after");
+    await applySelectionFormat(page, input, format.label);
+
+    await expect(input.locator(":scope > p").first()).toHaveText("before ");
+    await expect(input.locator(`:scope > ${format.selector}`)).toHaveText(
+      "selected",
+    );
+    await expect(input.locator(":scope > p").last()).toHaveText(" after");
+    await expect(input).toHaveText("before selected after");
+  });
+
+  test(`${format.label} starts at a collapsed caret on a new line`, async ({
+    page,
+  }) => {
+    await openGeneral(page);
+
+    const input = page.getByTestId("message-input");
+    await input.click();
+    await input.pressSequentially("before");
+    await input.press("Shift+Enter");
+    await applyCaretFormat(page, format.label);
+    await input.pressSequentially("inside");
+
+    await expect(input.locator(":scope > p").first()).toHaveText("before");
+    await expect(input.locator(`:scope > ${format.selector}`)).toHaveText(
+      "inside",
+    );
+  });
+
+  test(`${format.label} at a collapsed caret formats only the caret's line`, async ({
+    page,
+  }) => {
+    await openGeneral(page);
+
+    const input = page.getByTestId("message-input");
+    await input.click();
+    await input.pressSequentially("before");
+    await input.press("Shift+Enter");
+    await input.pressSequentially("target");
+    await input.press("Shift+Enter");
+    await input.pressSequentially("after");
+    // Collapse the caret into the middle line.
+    await selectText(input, "target");
+    await input.press("ArrowRight");
+    await applyCaretFormat(page, format.label);
+
+    await expect(input.locator(":scope > p").first()).toHaveText("before");
+    await expect(input.locator(`:scope > ${format.selector}`)).toHaveText(
+      "target",
+    );
+    await expect(input.locator(":scope > p").last()).toHaveText("after");
+  });
+}
+
+test("Code block uses the restored multiline selection after mouseup collapse", async ({
+  page,
+}) => {
+  await openGeneral(page);
+
+  const input = page.getByTestId("message-input");
+  await input.click();
+  await input.pressSequentially("before");
+  await input.press("Shift+Enter");
+  await input.pressSequentially("selected");
+  await input.press("Shift+Enter");
+  await input.pressSequentially("after");
+  await applySelectionFormat(page, input, "Code block", true);
+
+  await expect(input.locator(":scope > p").first()).toHaveText("before");
+  await expect(input.locator(":scope > pre")).toHaveText("selected");
+  await expect(input.locator(":scope > p").last()).toHaveText("after");
+});
+
+for (const list of [
+  { label: "Bullet list", selector: "ul" },
+  { label: "Ordered list", selector: "ol" },
+] as const) {
+  test(`selected hard-break lines become separate ${list.label.toLowerCase()} items`, async ({
+    page,
+  }) => {
+    await openGeneral(page);
+    const input = page.getByTestId("message-input");
+    await input.click();
+    await input.pressSequentially("one");
+    await input.press("Shift+Enter");
+    await input.pressSequentially("two");
+    await input.press("Shift+Enter");
+    await input.pressSequentially("three");
+    await selectTextRange(input, "one", "three");
+    await page
+      .getByTestId("selection-formatting-tray")
+      .getByRole("button", { name: list.label })
+      .click();
+
+    const items = input.locator(`:scope > ${list.selector} > li`);
+    await expect(items).toHaveCount(3);
+    await expect(items).toHaveText(["one", "two", "three"]);
+  });
+}
+
+test("partial list-item selections snap to whole items for block formats", async ({
+  page,
+}) => {
+  for (const format of [
+    "Code block",
+    "Bullet list",
+    "Ordered list",
+    "Quote",
+  ] as const) {
+    await openGeneral(page);
+    const input = page.getByTestId("message-input");
+    await input.click();
+    await input.pressSequentially("before");
+    await input.press("Shift+Enter");
+    await input.pressSequentially("first");
+    await input.press("Shift+Enter");
+    await input.pressSequentially("second");
+    await input.press("Shift+Enter");
+    await input.pressSequentially("after");
+    await selectTextRange(input, "before", "after");
+    await page
+      .getByTestId("selection-formatting-tray")
+      .getByRole("button", { name: "Bullet list" })
+      .click();
+
+    await selectTextRange(input, "irst", "seco");
+    await page
+      .getByTestId("selection-formatting-tray")
+      .getByRole("button", { name: format })
+      .click();
+
+    const structure = await input.locator(":scope > *").evaluateAll((nodes) =>
+      nodes.map((node) => ({
+        tag: node.tagName.toLowerCase(),
+        text: node.textContent,
+        items: Array.from(
+          node.querySelectorAll(":scope > li"),
+          (item) => item.textContent,
+        ),
+      })),
+    );
+    const expected = {
+      "Code block": [
+        { tag: "ul", text: "before", items: ["before"] },
+        { tag: "pre", text: "first\nsecond", items: [] },
+        { tag: "ul", text: "after", items: ["after"] },
+      ],
+      "Bullet list": [
+        {
+          tag: "ul",
+          text: "beforefirstsecondafter",
+          items: ["before", "first", "second", "after"],
+        },
+      ],
+      "Ordered list": [
+        { tag: "ul", text: "before", items: ["before"] },
+        { tag: "ol", text: "firstsecond", items: ["first", "second"] },
+        { tag: "ul", text: "after", items: ["after"] },
+      ],
+      Quote: [
+        { tag: "ul", text: "before", items: ["before"] },
+        { tag: "blockquote", text: "firstsecond", items: [] },
+        { tag: "ul", text: "after", items: ["after"] },
+      ],
+    }[format];
+    expect(structure).toEqual(expected);
+    await page.reload();
+  }
+});
+
+test("selected hard-break lines stay newline-separated in one code block", async ({
+  page,
+}) => {
+  await openGeneral(page);
+  const input = page.getByTestId("message-input");
+  await input.click();
+  await input.pressSequentially("one");
+  await input.press("Shift+Enter");
+  await input.pressSequentially("two");
+  await input.press("Shift+Enter");
+  await input.pressSequentially("three");
+  await selectTextRange(input, "one", "three");
+  await page
+    .getByTestId("selection-formatting-tray")
+    .getByRole("button", { name: "Code block" })
+    .click();
+
+  await expect(input.locator(":scope > pre")).toHaveCount(1);
+  await expect(input.locator(":scope > pre")).toHaveText("one\ntwo\nthree");
+
+  await page.getByTestId("send-message").click();
+  await expect
+    .poll(() =>
+      page.evaluate(
+        () =>
+          (
+            window as Window & {
+              __BUZZ_E2E_SIGNED_EVENTS__?: Array<{ content: string }>;
+            }
+          ).__BUZZ_E2E_SIGNED_EVENTS__?.at(-1)?.content,
+      ),
+    )
+    .toBe("```\none\ntwo\nthree\n```");
+});
+
+test("selected list items become one multiline code block and keep neighbors", async ({
+  page,
+}) => {
+  await openGeneral(page);
+  const input = page.getByTestId("message-input");
+  await input.click();
+  await input.pressSequentially("before");
+  await input.press("Shift+Enter");
+  await input.pressSequentially("one");
+  await input.press("Shift+Enter");
+  await input.pressSequentially("two");
+  await input.press("Shift+Enter");
+  await input.pressSequentially("after");
+  await selectTextRange(input, "before", "after");
+  await page
+    .getByTestId("selection-formatting-tray")
+    .getByRole("button", { name: "Bullet list" })
+    .click();
+  await selectTextRange(input, "one", "two");
+  await page
+    .getByTestId("selection-formatting-tray")
+    .getByRole("button", { name: "Code block" })
+    .click();
+
+  await expect(input.locator(":scope > pre")).toHaveCount(1);
+  await expect(input.locator(":scope > pre")).toHaveText("one\ntwo");
+  await expect(input.locator(":scope > ul li")).toHaveText(["before", "after"]);
+
+  await page.getByTestId("send-message").click();
+  await expect
+    .poll(() =>
+      page.evaluate(
+        () =>
+          (
+            window as Window & {
+              __BUZZ_E2E_SIGNED_EVENTS__?: Array<{ content: string }>;
+            }
+          ).__BUZZ_E2E_SIGNED_EVENTS__?.at(-1)?.content,
+      ),
+    )
+    .toBe("- before\n\n```\none\ntwo\n```\n\n- after");
+});
+
+test("caret-only block formatting serializes the prior draft unchanged", async ({
+  page,
+}) => {
+  await openGeneral(page);
+
+  const input = page.getByTestId("message-input");
+  await input.click();
+  await input.pressSequentially("before");
+  await input.press("Shift+Enter");
+  await applyCaretFormat(page, "Bullet list");
+  await input.pressSequentially("item");
+
+  await page.getByTestId("send-message").click();
+  await expect
+    .poll(() =>
+      page.evaluate(
+        () =>
+          (
+            window as Window & {
+              __BUZZ_E2E_SIGNED_EVENTS__?: Array<{ content: string }>;
+            }
+          ).__BUZZ_E2E_SIGNED_EVENTS__?.at(-1)?.content,
+      ),
+    )
+    .toBe("before\n\n- item");
+});
+
+test("block formatting preserves the lines around a selected composer line", async ({
+  page,
+}) => {
+  await openGeneral(page);
+
+  const input = page.getByTestId("message-input");
+  await input.click();
+  await input.pressSequentially("before");
+  await input.press("Shift+Enter");
+  await input.pressSequentially("selected");
+  await input.press("Shift+Enter");
+  await input.pressSequentially("after");
+  await applySelectionFormat(page, input, "Bullet list");
+
+  await expect(input.locator(":scope > p").first()).toHaveText("before");
+  await expect(input.locator(":scope > ul")).toHaveText("selected");
+  await expect(input.locator(":scope > p").last()).toHaveText("after");
+
+  await page.getByTestId("send-message").click();
+  await expect
+    .poll(() =>
+      page.evaluate(
+        () =>
+          (
+            window as Window & {
+              __BUZZ_E2E_SIGNED_EVENTS__?: Array<{ content: string }>;
+            }
+          ).__BUZZ_E2E_SIGNED_EVENTS__?.at(-1)?.content,
+      ),
+    )
+    .toBe("before\n\n- selected\n\nafter");
+});
+
+test("block formatting restores a selection collapsed by the toolbar interaction", async ({
+  page,
+}) => {
+  await openGeneral(page);
+
+  const input = page.getByTestId("message-input");
+  await input.fill("before selected after");
+  await applySelectionFormat(page, input, "Bullet list", true);
+
+  await expect(input.locator(":scope > p").first()).toHaveText("before ");
+  await expect(input.locator(":scope > ul")).toHaveText("selected");
+  await expect(input.locator(":scope > p").last()).toHaveText(" after");
+});
+
+test("block formatting only changes text selected with a native mouse drag", async ({
+  page,
+}) => {
+  await openGeneral(page);
+
+  const input = page.getByTestId("message-input");
+  await input.fill("before selected after");
+  await applySelectionFormat(page, input, "Bullet list", false, true);
+
+  await expect(input.locator(":scope > p").first()).toHaveText("before ");
+  await expect(input.locator(":scope > ul")).toHaveText("selected");
+  await expect(input.locator(":scope > p").last()).toHaveText(" after");
+});
+
+test("block formatting preserves a backward native selection", async ({
+  page,
+}) => {
+  await openGeneral(page);
+
+  const input = page.getByTestId("message-input");
+  await input.fill("before selected after");
+  await dragSelectText(page, input, "selected", true);
+
+  const tray = page.getByTestId("selection-formatting-tray");
+  await expect(tray).toBeVisible();
+  await tray.getByRole("button", { name: "Bullet list" }).click();
+
+  await expect(input.locator(":scope > ul")).toHaveText("selected");
+  await expect
+    .poll(() =>
+      page.evaluate(() => {
+        const selection = window.getSelection();
+        if (!(selection?.anchorNode && selection.focusNode)) return false;
+        const anchorRange = document.createRange();
+        anchorRange.setStart(selection.anchorNode, selection.anchorOffset);
+        anchorRange.collapse(true);
+        const focusRange = document.createRange();
+        focusRange.setStart(selection.focusNode, selection.focusOffset);
+        focusRange.collapse(true);
+        return (
+          anchorRange.compareBoundaryPoints(Range.START_TO_START, focusRange) >
+          0
+        );
+      }),
+    )
+    .toBe(true);
+});
+
+test("Buzz theme uses the primary color for the selection formatter", async ({
+  page,
+}) => {
+  await openGeneral(page);
+
+  const input = page.getByTestId("message-input");
+  await input.fill("before selected after");
+  await selectText(input, "selected");
+  const tray = page.getByTestId("selection-formatting-tray");
+  await expect(tray).toBeVisible();
+
+  const colors = await tray.evaluate((element) => {
+    const probe = document.createElement("span");
+    probe.style.backgroundColor = "hsl(var(--primary))";
+    probe.style.color = "hsl(var(--primary-foreground))";
+    document.body.appendChild(probe);
+    const probeStyles = getComputedStyle(probe);
+    const trayStyles = getComputedStyle(element);
+    const result = {
+      primaryBackground: probeStyles.backgroundColor,
+      primaryForeground: probeStyles.color,
+      trayBackground: trayStyles.backgroundColor,
+      trayForeground: trayStyles.color,
+    };
+    probe.remove();
+    return result;
+  });
+
+  expect(colors.trayBackground).toBe(colors.primaryBackground);
+  expect(colors.trayForeground).toBe(colors.primaryForeground);
+});
diff --git a/desktop/tests/e2e/doctor-states.spec.ts b/desktop/tests/e2e/doctor-states.spec.ts
index 0f356fd9bae..77d0fbcb450 100644
--- a/desktop/tests/e2e/doctor-states.spec.ts
+++ b/desktop/tests/e2e/doctor-states.spec.ts
@@ -83,8 +83,7 @@ const CODEX_NOT_INSTALLED = {
   binary_path: null,
   default_args: [],
   mcp_command: null,
-  install_hint:
-    "Buzz requires the Codex CLI; the desktop app alone is not enough.",
+  install_hint: "Buzz talks to Codex through the Codex CLI.",
   install_instructions_url: "https://developers.openai.com/codex/cli/",
   can_auto_install: true,
   underlying_cli_path: null,
@@ -177,7 +176,7 @@ test.describe("Doctor panel state screenshots", () => {
     expect(codexColors).toEqual(gooseColors);
     await expect(
       page
-        .getByRole("heading", { name: "Agent runtimes" })
+        .getByRole("heading", { name: "Agent runtimes", exact: true })
         .locator("..")
         .locator(".."),
     ).toHaveCSS("align-items", "center");
@@ -186,15 +185,9 @@ test.describe("Doctor panel state screenshots", () => {
         page.getByTestId(`doctor-runtime-menu-${runtimeId}`),
       ).toHaveCount(0);
     }
-    await expect(
-      page.getByTestId("doctor-runtime-toggle-codex"),
-    ).not.toBeChecked();
-    await expect(page.getByTestId("doctor-runtime-toggle-codex")).toBeEnabled();
-    for (const runtimeId of ["goose", "codex"]) {
-      const toggle = page.getByTestId(`doctor-runtime-toggle-${runtimeId}`);
-      await expect(toggle).toHaveClass(/shadow-none/);
-      await expect(toggle.locator("span")).toHaveClass(/shadow-none/);
-    }
+    const codexInstallButton = page.getByTestId("doctor-runtime-install-codex");
+    await expect(codexInstallButton).toBeEnabled();
+    await expect(codexInstallButton).toHaveText("Install");
     await expect(
       page.getByRole("menuitem", { name: "CLI setup guide" }),
     ).toHaveCount(0);
@@ -207,10 +200,12 @@ test.describe("Doctor panel state screenshots", () => {
       path: `${SHOTS}/00-runtime-overflow-menu.png`,
     });
     await page.keyboard.press("Escape");
-    await expect(page.getByTestId("doctor-runtime-toggle-goose")).toBeChecked();
-    await expect(
-      page.getByTestId("doctor-runtime-toggle-goose"),
-    ).toBeDisabled();
+    await expect(page.getByTestId("doctor-runtime-ready-goose")).toHaveText(
+      "Ready",
+    );
+    await expect(page.getByTestId("doctor-runtime-install-goose")).toHaveCount(
+      0,
+    );
     await expect(page.getByTestId("doctor-runtime-codex")).not.toContainText(
       "Not installed",
     );
@@ -219,7 +214,7 @@ test.describe("Doctor panel state screenshots", () => {
     );
     await expect(
       page.getByTestId("doctor-runtime-guidance-codex"),
-    ).toContainText("desktop app alone is not enough");
+    ).toContainText("Buzz talks to Codex through the Codex CLI.");
     await expect(
       page
         .getByTestId("doctor-runtime-guidance-codex")
@@ -249,9 +244,9 @@ test.describe("Doctor panel state screenshots", () => {
 
     const row = page.getByTestId("doctor-runtime-claude");
     await expect(row).toBeVisible({ timeout: 10_000 });
-    await expect(
-      page.getByTestId("doctor-runtime-toggle-claude"),
-    ).toBeChecked();
+    await expect(page.getByTestId("doctor-runtime-ready-claude")).toHaveText(
+      "Ready",
+    );
     await expect(row).not.toContainText("Authenticated");
     await expect(row).not.toContainText("Available");
     await expect(row).not.toContainText("claude-agent-acp");
@@ -264,8 +259,10 @@ test.describe("Doctor panel state screenshots", () => {
   });
 
   /**
-   * 02 — an available runtime that needs authentication stays the same height
-   * as the others and moves setup instructions into its overflow menu.
+   * 02 — an available runtime that needs authentication shows an explicit
+   * "Sign-in needed" chip on the row face (never a green Ready chip), stays
+   * the same height as the others, and keeps setup instructions in its
+   * overflow menu.
    */
   test("02-auth-logged-out", async ({ page }) => {
     await installMockBridge(page, {
@@ -290,6 +287,12 @@ test.describe("Doctor panel state screenshots", () => {
 
     const row = page.getByTestId("doctor-runtime-codex");
     await expect(row).toBeVisible({ timeout: 10_000 });
+    // Auth-required is an explicit row-face state: amber "Sign-in needed"
+    // chip (single source: entryStatusLabel), no green Ready chip.
+    await expect(page.getByTestId("doctor-runtime-status-codex")).toHaveText(
+      "Sign-in needed",
+    );
+    await expect(page.getByTestId("doctor-runtime-ready-codex")).toHaveCount(0);
     await expect(row).not.toContainText("Not authenticated");
     await expect(row).not.toContainText("Run `codex login` to authenticate.");
     await expect(row).toHaveCSS(
@@ -354,8 +357,10 @@ test.describe("Doctor panel state screenshots", () => {
   });
 
   /**
-   * 04 — adapter_missing runtime with node_required: true: the off toggle is
-   * disabled, and the Node.js action moves into the overflow menu.
+   * 04 — adapter_missing runtime with node_required: true is NOT a
+   * one-click-ready row: it must be catalog-only (no Install button), and its
+   * catalog detail must offer the setup guide instead of a one-click Install
+   * that would fail without Node.
    */
   test("04-node-required", async ({ page }) => {
     await installMockBridge(page, {
@@ -378,44 +383,50 @@ test.describe("Doctor panel state screenshots", () => {
     await page.goto("/", { waitUntil: "domcontentloaded" });
     await openSettings(page, "agents");
 
-    const row = page.getByTestId("doctor-runtime-codex");
-    await expect(row).toBeVisible({ timeout: 10_000 });
-    const toggle = page.getByTestId("doctor-runtime-toggle-codex");
-    await expect(toggle).not.toBeChecked();
-    await expect(toggle).toBeDisabled();
-    await expect(page.getByTestId("doctor-runtime-status-codex")).toHaveText(
+    // Node-gated entries never get a Your-harnesses row (and thus never an
+    // Install button) — setup happens in the catalog.
+    await expect(page.getByTestId("doctor-runtime-goose")).toBeVisible({
+      timeout: 10_000,
+    });
+    await expect(page.getByTestId("doctor-runtime-codex")).toHaveCount(0);
+    await expect(page.getByTestId("doctor-runtime-install-codex")).toHaveCount(
+      0,
+    );
+    await expect(page.getByTestId("doctor-runtime-ready-codex")).toHaveCount(0);
+
+    await page.getByTestId("harness-add-button").click();
+    await expect(page.getByTestId("harness-catalog-dialog")).toBeVisible();
+    await page.getByTestId("harness-catalog-list-item-codex").click();
+    await expect(page.getByTestId("harness-catalog-status-codex")).toHaveText(
       "Adapter needed",
     );
-    await expect(row).not.toContainText("Node.js is required");
-    expect(
-      await row.evaluate((element) => element.getBoundingClientRect().height),
-    ).toBeGreaterThan(
-      await page
-        .getByTestId("doctor-runtime-goose")
-        .evaluate((element) => element.getBoundingClientRect().height),
+    // Node gate blocks one-click install; the primary action is the vendor
+    // setup guide instead — a single pinned bottom-bar CTA
+    // (harness-catalog-setup-*), not a separate docs button.
+    await expect(page.getByTestId("harness-catalog-install-codex")).toHaveCount(
+      0,
     );
-    await page.getByTestId("doctor-runtime-menu-codex").click();
-    await expect(
-      page.getByRole("menuitem", { name: "Install Node.js" }),
-    ).toBeVisible();
-    await expect(
-      page.getByRole("menuitem", { name: "Adapter install guide" }),
-    ).toBeVisible();
-    await page.keyboard.press("Escape");
+    await expect(page.getByTestId("harness-catalog-setup-codex")).toBeVisible();
+    await expect(page.getByTestId("harness-catalog-setup-codex")).toHaveText(
+      /Setup guide/,
+    );
+    await expect(page.getByTestId("harness-catalog-docs-codex")).toHaveCount(0);
 
-    await row.scrollIntoViewIfNeeded();
+    const detail = page.getByTestId("harness-catalog-detail-pane");
+    await expect(detail).toContainText("Install the Codex ACP adapter");
     await waitForAnimations(page);
-    await row.screenshot({ path: `${SHOTS}/04-node-required.png` });
+    await detail.screenshot({ path: `${SHOTS}/04-node-required.png` });
   });
 
   /**
-   * 05 — a failed toggle install returns to off; toggling again retries.
+   * 05 — a failed install brings the Install button back; clicking it again
+   * retries.
    *
    * The mock is configured with a two-call sequence:
    *   call 1 → failure (E404)
    *   call 2 → installer exit 0, but post-install discovery still cannot find
    *            the runtime
-   * This exercises the full retry path: fail state → toggle on again →
+   * This exercises the full retry path: fail state → Install again →
    * verified failure without a false installed state.
    */
   test("05-retry-after-failure", async ({ page }) => {
@@ -479,19 +490,19 @@ test.describe("Doctor panel state screenshots", () => {
     await expect(row).not.toContainText("Not installed");
 
     // Trigger the first install — the mock returns a failure.
-    const toggle = page.getByTestId("doctor-runtime-toggle-codex");
-    await expect(toggle).not.toBeChecked();
-    await expect(toggle).toBeEnabled();
-    await toggle.click();
+    const installButton = page.getByTestId("doctor-runtime-install-codex");
+    await expect(installButton).toBeEnabled();
+    await expect(installButton).toHaveText("Install");
+    await installButton.click();
     const loading = page.getByTestId("doctor-runtime-loading-codex");
     await expect(loading).toBeVisible();
     await expect(loading).toContainText("Codex installing");
-    await expect(toggle).toHaveCount(0);
+    await expect(installButton).toHaveCount(0);
 
-    // After failure: the toggle returns to off and the error is visible.
+    // After failure: the Install button returns and the error is visible.
     await expect(loading).toHaveCount(0, { timeout: 5_000 });
-    await expect(toggle).not.toBeChecked({ timeout: 5_000 });
-    await expect(toggle).toBeEnabled();
+    await expect(installButton).toBeVisible({ timeout: 5_000 });
+    await expect(installButton).toBeEnabled();
     await expect(row).toContainText("Step");
     await expect(row).toContainText("failed");
 
@@ -499,18 +510,18 @@ test.describe("Doctor panel state screenshots", () => {
     await waitForAnimations(page);
     await row.screenshot({ path: `${SHOTS}/05-retry-after-failure.png` });
 
-    // Toggle on again — the install command exits 0, but verification fails.
-    await toggle.click();
+    // Install again — the install command exits 0, but verification fails.
+    await installButton.click();
     await expect(loading).toBeVisible();
-    await expect(toggle).toHaveCount(0);
+    await expect(installButton).toHaveCount(0);
 
     // The runtime remains retryable and never renders a false success state.
     await expect(loading).toHaveCount(0, { timeout: 5_000 });
     await expect(row).toContainText("desktop app", { timeout: 5_000 });
     await expect(row).toContainText('Step "verify" failed');
     await expect(row.getByText(/installed\. Checking/)).toHaveCount(0);
-    await expect(toggle).not.toBeChecked();
-    await expect(toggle).toBeEnabled();
+    await expect(installButton).toBeVisible();
+    await expect(installButton).toBeEnabled();
 
     await row.scrollIntoViewIfNeeded();
     await waitForAnimations(page);
@@ -556,11 +567,13 @@ test.describe("Doctor panel state screenshots", () => {
     await page.goto("/", { waitUntil: "domcontentloaded" });
     await openSettings(page, "agents");
 
-    const toggle = page.getByTestId("doctor-runtime-toggle-codex");
-    await expect(toggle).toBeEnabled();
-    await toggle.click();
-    await expect(toggle).toBeChecked({ timeout: 5_000 });
-    await expect(toggle).toBeDisabled();
+    const installButton = page.getByTestId("doctor-runtime-install-codex");
+    await expect(installButton).toBeEnabled();
+    await installButton.click();
+    await expect(page.getByTestId("doctor-runtime-ready-codex")).toBeVisible({
+      timeout: 5_000,
+    });
+    await expect(installButton).toHaveCount(0);
     await expect(page.getByTestId("doctor-runtime-guidance-codex")).toHaveCount(
       0,
     );
@@ -568,7 +581,9 @@ test.describe("Doctor panel state screenshots", () => {
 
   /**
    * 06 — adapter-provided account methods appear in the overflow menu and
-   * launch the vendor-owned flow without expanding the runtime row.
+   * launch the vendor-owned flow without expanding the runtime row. The
+   * row face flips "Sign-in needed" → Ready once the connect settles and
+   * discovery reports logged_in.
    */
   test("06-connect-account-methods", async ({ page }) => {
     await installMockBridge(page, {
@@ -586,6 +601,21 @@ test.describe("Doctor panel state screenshots", () => {
         },
         BUZZ_AGENT_AVAILABLE,
       ],
+      // After the mocked connect succeeds, discovery reports logged_in so
+      // the row face can flip from "Sign-in needed" to Ready.
+      acpRuntimesCatalogAfterConnect: [
+        GOOSE_AVAILABLE,
+        CLAUDE_AVAILABLE_LOGGED_IN,
+        {
+          ...CODEX_NOT_INSTALLED,
+          availability: "available",
+          command: "codex-acp",
+          binary_path: "/usr/local/bin/codex-acp",
+          underlying_cli_path: "/usr/local/bin/codex",
+          auth_status: { status: "logged_in" },
+        },
+        BUZZ_AGENT_AVAILABLE,
+      ],
       connectAcpRuntimeDelayMs: 250,
       acpAuthMethods: {
         codex: {
@@ -606,6 +636,11 @@ test.describe("Doctor panel state screenshots", () => {
 
     const row = page.getByTestId("doctor-runtime-codex");
     await expect(row).toBeVisible({ timeout: 10_000 });
+    // Signed-out row face: explicit auth chip, no green Ready chip.
+    await expect(page.getByTestId("doctor-runtime-status-codex")).toHaveText(
+      "Sign-in needed",
+    );
+    await expect(page.getByTestId("doctor-runtime-ready-codex")).toHaveCount(0);
     await expect(row).not.toContainText("Not authenticated");
     await expect(row).toHaveCSS(
       "height",
@@ -623,11 +658,14 @@ test.describe("Doctor panel state screenshots", () => {
     const loading = page.getByTestId("doctor-runtime-loading-codex");
     await expect(loading).toBeVisible();
     await expect(loading).toContainText("Codex connecting");
-    await expect(page.getByTestId("doctor-runtime-toggle-codex")).toHaveCount(
+    await expect(page.getByTestId("doctor-runtime-ready-codex")).toHaveCount(0);
+    await expect(loading).toHaveCount(0, { timeout: 5_000 });
+    // Connect settled and discovery reports logged_in — sign-in chip gone,
+    // Ready chip on.
+    await expect(page.getByTestId("doctor-runtime-ready-codex")).toBeVisible();
+    await expect(page.getByTestId("doctor-runtime-status-codex")).toHaveCount(
       0,
     );
-    await expect(loading).toHaveCount(0, { timeout: 5_000 });
-    await expect(page.getByTestId("doctor-runtime-toggle-codex")).toBeChecked();
   });
 
   /**
@@ -794,7 +832,9 @@ test.describe("Doctor panel state screenshots", () => {
     await expect(page.getByTestId("doctor-runtime-status-codex")).toHaveText(
       "Update needed",
     );
-    await page.getByTestId("doctor-runtime-toggle-codex").click();
+    const updateButton = page.getByTestId("doctor-runtime-install-codex");
+    await expect(updateButton).toHaveText("Update");
+    await updateButton.click();
 
     const dialog = page.getByRole("alertdialog");
     await expect(dialog).toContainText("Update Codex adapter?");
@@ -903,35 +943,39 @@ test.describe("Doctor panel state screenshots", () => {
     await expect(claudeRow).toBeVisible({ timeout: 10_000 });
     await expect(codexRow).toBeVisible();
 
-    const claudeToggle = page.getByTestId("doctor-runtime-toggle-claude");
-    const codexToggle = page.getByTestId("doctor-runtime-toggle-codex");
+    const claudeInstallButton = page.getByTestId(
+      "doctor-runtime-install-claude",
+    );
+    const codexInstallButton = page.getByTestId("doctor-runtime-install-codex");
+    const codexReadyChip = page.getByTestId("doctor-runtime-ready-codex");
 
     // Start both installs before either settles.
-    await claudeToggle.click();
-    await codexToggle.click();
-
-    // Codex settles first (shorter delay): toggle flips on, no error on codex.
-    // The catalog refresh triggered by codex's success immediately returns
-    // availability === "available", so the transient "installed. Checking..."
-    // banner is replaced by the stable isOn state — assert the toggle instead.
-    await expect(codexToggle).toBeChecked({ timeout: 3_000 });
+    await claudeInstallButton.click();
+    await codexInstallButton.click();
+
+    // Codex settles first (shorter delay): Ready chip appears, no error on
+    // codex. The catalog refresh triggered by codex's success immediately
+    // returns availability === "available", so the transient "installed.
+    // Checking..." banner is replaced by the stable ready state — assert the
+    // Ready chip instead.
+    await expect(codexReadyChip).toBeVisible({ timeout: 3_000 });
     await expect(
       page.getByTestId("doctor-runtime-install-error-codex"),
     ).toHaveCount(0);
 
     // Claude settles (after its longer delay): failure error visible with
-    // multiline stderr. Codex toggle must still be on — unaffected by claude.
+    // multiline stderr. Codex must still be ready — unaffected by claude.
     const claudeError = page.getByTestId("doctor-runtime-install-error-claude");
     await expect(claudeError).toBeVisible({ timeout: 3_000 });
     await expect(claudeError).toContainText("npm ERR!");
-    await expect(codexToggle).toBeChecked();
+    await expect(codexReadyChip).toBeVisible();
 
     // Click Check again — epoch increments, RuntimeRow useEffect clears
     // local installResult state, so the stale claude error disappears.
     await page.getByRole("button", { name: "Check again" }).click();
     await expect(claudeError).toHaveCount(0, { timeout: 5_000 });
-    // Codex toggle stays on (catalog still reports available after refresh).
-    await expect(codexToggle).toBeChecked({ timeout: 5_000 });
+    // Codex stays ready (catalog still reports available after refresh).
+    await expect(codexReadyChip).toBeVisible({ timeout: 5_000 });
 
     await claudeRow.scrollIntoViewIfNeeded();
     await waitForAnimations(page);
diff --git a/desktop/tests/e2e/drafts-all-fix-screenshots.spec.ts b/desktop/tests/e2e/drafts-all-fix-screenshots.spec.ts
new file mode 100644
index 00000000000..82a7df1cc10
--- /dev/null
+++ b/desktop/tests/e2e/drafts-all-fix-screenshots.spec.ts
@@ -0,0 +1,105 @@
+import { expect, test } from "@playwright/test";
+
+import { waitForAnimations } from "../helpers/animations";
+import { TEST_IDENTITIES, installMockBridge } from "../helpers/bridge";
+
+const SHOTS = "test-results/drafts-all-fix";
+
+const GENERAL_CHANNEL_ID = "9a1657ac-f7aa-5db0-b632-d8bbeb6dfb50";
+const MOCK_IDENTITY_PUBKEY = "deadbeef".repeat(8);
+
+type MockFeedWindow = Window & {
+  __BUZZ_E2E_PUSH_MOCK_FEED_ITEM__?: (item: Record<string, unknown>) => void;
+};
+
+test.use({ viewport: { width: 1280, height: 720 } });
+
+test("Inbox All hides drafts while the Drafts filter keeps them", async ({
+  page,
+}) => {
+  const draftKey = `channel:${GENERAL_CHANNEL_ID}`;
+  await page.addInitScript(
+    ({ draftStoreKey, draftStorageKey, channelId }) => {
+      const timestamp = new Date().toISOString();
+      window.localStorage.setItem(
+        draftStoreKey,
+        JSON.stringify({
+          [draftStorageKey]: {
+            channelId,
+            content: "Draft that must stay out of the All view",
+            createdAt: timestamp,
+            pendingImeta: [],
+            selectionEnd: 41,
+            selectionStart: 41,
+            spoileredAttachmentUrls: [],
+            status: "active",
+            updatedAt: timestamp,
+          },
+        }),
+      );
+    },
+    {
+      channelId: GENERAL_CHANNEL_ID,
+      draftStorageKey: draftKey,
+      draftStoreKey: `buzz-drafts.v2:ws://localhost:3000:${MOCK_IDENTITY_PUBKEY}`,
+    },
+  );
+  await installMockBridge(page);
+  await page.goto("/");
+  await page.waitForFunction(() => {
+    const win = window as MockFeedWindow;
+    return typeof win.__BUZZ_E2E_PUSH_MOCK_FEED_ITEM__ === "function";
+  });
+
+  const messageId = "drafts-all-fix-message";
+  await page.evaluate(
+    ({ channelId, currentPubkey, messageId: id, senderPubkey }) => {
+      const pushFeedItem = (window as MockFeedWindow)
+        .__BUZZ_E2E_PUSH_MOCK_FEED_ITEM__;
+      if (!pushFeedItem) throw new Error("Mock feed helper is not installed.");
+      pushFeedItem({
+        category: "mention",
+        channel_id: channelId,
+        channel_name: "general",
+        channel_type: "stream",
+        content: "Regular message that belongs in All",
+        created_at: Math.floor(Date.now() / 1_000),
+        id,
+        kind: 9,
+        pubkey: senderPubkey,
+        tags: [
+          ["h", channelId],
+          ["p", currentPubkey],
+        ],
+      });
+    },
+    {
+      channelId: GENERAL_CHANNEL_ID,
+      currentPubkey: MOCK_IDENTITY_PUBKEY,
+      messageId,
+      senderPubkey: TEST_IDENTITIES.alice.pubkey,
+    },
+  );
+
+  // All view: the message is present, the draft row is not.
+  await expect(page.getByTestId(`home-inbox-item-${messageId}`)).toBeVisible();
+  await expect(page.getByTestId(`home-all-drafts-${draftKey}`)).toHaveCount(0);
+  await waitForAnimations(page);
+  await page
+    .getByTestId("home-inbox")
+    .screenshot({ path: `${SHOTS}/01-all-view-no-drafts.png` });
+
+  // Drafts filter: the draft is still listed.
+  await page.getByTestId("inbox-filter-trigger").click();
+  await page.getByRole("menuitemradio", { name: "Drafts" }).click();
+  await page.keyboard.press("Escape");
+  const panel = page.getByTestId("home-inbox-drafts");
+  await expect(panel).toBeVisible();
+  await expect(
+    panel.getByText("Draft that must stay out of the All view"),
+  ).toBeVisible();
+  await waitForAnimations(page);
+  await page
+    .getByTestId("home-inbox")
+    .screenshot({ path: `${SHOTS}/02-drafts-filter-still-lists.png` });
+});
diff --git a/desktop/tests/e2e/drafts-screenshots.spec.ts b/desktop/tests/e2e/drafts-screenshots.spec.ts
index ccf8dc35cbe..a3fb2ce1952 100644
--- a/desktop/tests/e2e/drafts-screenshots.spec.ts
+++ b/desktop/tests/e2e/drafts-screenshots.spec.ts
@@ -345,13 +345,11 @@ test.describe("drafts screenshots", () => {
     );
   });
 
-  test("06 — active-draft badge on inbox trigger and filter option", async ({
+  test("06 — active-draft count appears only on the Drafts filter", async ({
     page,
   }) => {
-    // Captures both badge placements for the PR screenshot:
-    //   1. The status dot on the inbox filter trigger button.
-    //   2. The badge next to "Drafts" in the filter dropdown.
-    // Two active drafts are seeded so the count is 2.
+    // Draft counts stay beside the Drafts option instead of decorating the
+    // overall Inbox filter trigger. Two drafts make the count explicit.
     await installMockBridge(page);
     await patchCommunityPubkey(page);
     await seedDraftStore(page, ACTIVE_DRAFTS);
@@ -361,10 +359,7 @@ test.describe("drafts screenshots", () => {
       timeout: 10_000,
     });
 
-    // The trigger uses a compact dot while retaining the count accessibly.
-    const triggerBadge = page.getByTestId("inbox-draft-badge");
-    await expect(triggerBadge).toBeVisible({ timeout: 6_000 });
-    await expect(triggerBadge).toBeEmpty();
+    await expect(page.getByTestId("inbox-draft-badge")).toHaveCount(0);
     await expect(page.getByTestId("inbox-filter-trigger")).toHaveAttribute(
       "aria-label",
       "Filter inbox: All. 2 active drafts",
@@ -378,7 +373,7 @@ test.describe("drafts screenshots", () => {
 
     await waitForAnimations(page);
 
-    // Capture the full inbox header area including the open dropdown.
+    // Capture the Inbox header and the dropdown-only count.
     await page.getByTestId("home-inbox").screenshot({
       path: `${SHOTS}/06-draft-badge.png`,
     });
diff --git a/desktop/tests/e2e/file-attachment.spec.ts b/desktop/tests/e2e/file-attachment.spec.ts
index 41eb55e521d..403d26c1367 100644
--- a/desktop/tests/e2e/file-attachment.spec.ts
+++ b/desktop/tests/e2e/file-attachment.spec.ts
@@ -82,7 +82,53 @@ test("dropping a file on the channel column attaches it to the composer", async
 
   const dropZone = page.getByTestId("channel-drop-zone");
   await dropZone.dispatchEvent("dragenter", { dataTransfer });
-  await expect(dropZone.getByText("Drop files to upload")).toBeVisible();
+  const overlay = dropZone.getByTestId("drop-zone-overlay");
+  const label = dropZone.getByTestId("drop-zone-label");
+  await expect(overlay).toBeVisible();
+  await expect(label).toContainText("Drop files to upload");
+
+  const [dropZoneBox, overlayBox, overlayStyles, stacking] = await Promise.all([
+    dropZone.boundingBox(),
+    overlay.boundingBox(),
+    page.evaluate(() => {
+      const overlayElement = document.querySelector<HTMLElement>(
+        '[data-testid="drop-zone-overlay"]',
+      );
+      const contentSurface = document.querySelector<HTMLElement>(
+        "[data-buzz-content-surface]",
+      );
+      if (!(overlayElement && contentSurface)) return null;
+      const overlayStyle = getComputedStyle(overlayElement);
+      return {
+        backdropFilter: overlayStyle.backdropFilter,
+        containerRadius: getComputedStyle(contentSurface).borderRadius,
+        overlayRadius: overlayStyle.borderRadius,
+      };
+    }),
+    page.evaluate(() => {
+      const overlayElement = document.querySelector<HTMLElement>(
+        '[data-testid="drop-zone-overlay"]',
+      );
+      const composerOverlayElement = document.querySelector<HTMLElement>(
+        '[data-testid="channel-composer-overlay"]',
+      );
+      if (!(overlayElement && composerOverlayElement)) return null;
+      return {
+        composer: Number.parseInt(
+          getComputedStyle(composerOverlayElement).zIndex,
+          10,
+        ),
+        dropZone: Number.parseInt(getComputedStyle(overlayElement).zIndex, 10),
+      };
+    }),
+  ]);
+
+  expect(overlayBox).toEqual(dropZoneBox);
+  expect(overlayStyles).not.toBeNull();
+  expect(overlayStyles?.overlayRadius).toBe(overlayStyles?.containerRadius);
+  expect(overlayStyles?.backdropFilter).toContain("blur");
+  expect(stacking).not.toBeNull();
+  expect(stacking?.dropZone).toBeGreaterThan(stacking?.composer ?? 0);
 
   await dropZone.dispatchEvent("drop", { dataTransfer });
   await expect(page.getByTestId("message-composer")).toContainText(
@@ -90,6 +136,60 @@ test("dropping a file on the channel column attaches it to the composer", async
   );
 });
 
+for (const theme of ["buzz", "buzz-dark", "github-light", "github-dark"]) {
+  test(`drop prompt has accessible text contrast in ${theme}`, async ({
+    page,
+  }) => {
+    await page.goto("/");
+    await page.evaluate((selectedTheme) => {
+      window.localStorage.setItem("buzz-theme", selectedTheme);
+    }, theme);
+    await page.reload();
+    await page.getByTestId("channel-general").click();
+
+    const dataTransfer = await page.evaluateHandle(() => {
+      const transfer = new DataTransfer();
+      transfer.items.add(
+        new File(["contrast check"], "contrast-check.txt", {
+          type: "text/plain",
+        }),
+      );
+      return transfer;
+    });
+    const dropZone = page.getByTestId("channel-drop-zone");
+    await dropZone.dispatchEvent("dragenter", { dataTransfer });
+
+    const contrastRatio = await dropZone
+      .getByTestId("drop-zone-label")
+      .evaluate((element) => {
+        const parseRgb = (value: string) =>
+          (value.match(/[\d.]+/g) ?? []).slice(0, 3).map(Number);
+        const luminance = (color: number[]) =>
+          color
+            .map((channel) => {
+              const value = channel / 255;
+              return value <= 0.04045
+                ? value / 12.92
+                : ((value + 0.055) / 1.055) ** 2.4;
+            })
+            .reduce(
+              (sum, channel, index) =>
+                sum + channel * [0.2126, 0.7152, 0.0722][index],
+              0,
+            );
+        const style = getComputedStyle(element);
+        const foreground = luminance(parseRgb(style.color));
+        const background = luminance(parseRgb(style.backgroundColor));
+        return (
+          (Math.max(foreground, background) + 0.05) /
+          (Math.min(foreground, background) + 0.05)
+        );
+      });
+
+    expect(contrastRatio).toBeGreaterThanOrEqual(4.5);
+  });
+}
+
 test("forum posts emit a FileCard for generic attachments, not a broken image", async ({
   page,
 }) => {
diff --git a/desktop/tests/e2e/global-agent-config-screenshots.spec.ts b/desktop/tests/e2e/global-agent-config-screenshots.spec.ts
index 099c2cb752a..7ec1daa2366 100644
--- a/desktop/tests/e2e/global-agent-config-screenshots.spec.ts
+++ b/desktop/tests/e2e/global-agent-config-screenshots.spec.ts
@@ -32,7 +32,7 @@ async function openCreateDialog(page: import("@playwright/test").Page) {
   await page.goto("/");
   await page.getByTestId("open-agents-view").click();
   await page.getByTestId("new-agent-card").click();
-  await page.getByRole("menuitem", { name: "Create from scratch" }).click();
+  await page.getByRole("menuitem", { name: "Create agent" }).click();
   await page.locator("#persona-display-name").fill("Test Agent");
 }
 
@@ -712,7 +712,7 @@ test.describe("global agent config screenshots", () => {
     await page.goto("/");
     await page.getByTestId("open-agents-view").click();
     await page.getByTestId("new-agent-card").click();
-    await page.getByRole("menuitem", { name: "Create from scratch" }).click();
+    await page.getByRole("menuitem", { name: "Create agent" }).click();
 
     await expect(page.getByTestId("persona-dialog-submit")).toBeDisabled({
       timeout: 10_000,
diff --git a/desktop/tests/e2e/harness-catalog-screenshots.spec.ts b/desktop/tests/e2e/harness-catalog-screenshots.spec.ts
new file mode 100644
index 00000000000..c5613f41f2a
--- /dev/null
+++ b/desktop/tests/e2e/harness-catalog-screenshots.spec.ts
@@ -0,0 +1,179 @@
+import { test, expect } from "@playwright/test";
+
+import { installMockBridge } from "../helpers/bridge";
+import { openSettings } from "../helpers/settings";
+
+const SHOTS = "test-results/byoh-after";
+
+/**
+ * AFTER screenshots for the consolidated Harnesses surface — same catalog
+ * fixture as byoh-before-screenshots.spec.ts so the before/after pair is a
+ * true apples-to-apples comparison.
+ */
+const CATALOG = [
+  {
+    id: "buzz-agent",
+    label: "Buzz Agent",
+    avatar_url: "",
+    availability: "available",
+    command: "buzz-agent",
+    binary_path: "/usr/local/bin/buzz-agent",
+    default_args: [],
+    mcp_command: "buzz-dev-mcp",
+    install_hint: "",
+    install_instructions_url: "https://github.com/block/buzz",
+    can_auto_install: false,
+    underlying_cli_path: null,
+    node_required: false,
+    auth_status: { status: "not_applicable" },
+  },
+  {
+    id: "claude",
+    label: "Claude Code",
+    avatar_url: "",
+    availability: "available",
+    command: "claude-agent-acp",
+    binary_path: "/usr/local/bin/claude-agent-acp",
+    default_args: [],
+    mcp_command: null,
+    install_hint: "",
+    install_instructions_url:
+      "https://github.com/agentclientprotocol/claude-agent-acp",
+    can_auto_install: true,
+    underlying_cli_path: "/usr/local/bin/claude",
+    node_required: false,
+    auth_status: { status: "logged_in" },
+  },
+  {
+    id: "codex",
+    label: "Codex",
+    avatar_url: "",
+    availability: "adapter_missing",
+    command: null,
+    binary_path: null,
+    default_args: [],
+    mcp_command: null,
+    install_hint: "Install the Codex ACP adapter via npm.",
+    install_instructions_url:
+      "https://github.com/agentclientprotocol/codex-acp",
+    can_auto_install: true,
+    underlying_cli_path: "/usr/local/bin/codex",
+    node_required: false,
+    auth_status: { status: "unknown" },
+  },
+  {
+    id: "cursor",
+    label: "Cursor",
+    avatar_url: "",
+    availability: "available",
+    command: "cursor-agent",
+    binary_path: "/usr/local/bin/cursor-agent",
+    default_args: ["acp"],
+    mcp_command: null,
+    install_hint:
+      "Buzz talks to Cursor through the cursor-agent CLI's ACP mode.",
+    install_instructions_url: "https://cursor.com/downloads",
+    can_auto_install: false,
+    underlying_cli_path: null,
+    node_required: false,
+    auth_status: { status: "not_applicable" },
+    source: "preset",
+  },
+  {
+    id: "omp",
+    label: "Oh My Pi",
+    avatar_url: "",
+    availability: "not_installed",
+    command: null,
+    binary_path: null,
+    default_args: ["acp"],
+    mcp_command: null,
+    install_hint:
+      "Buzz talks to Oh My Pi through its CLI's ACP mode (omp acp).",
+    install_instructions_url: "https://github.com/can1357/oh-my-pi",
+    can_auto_install: false,
+    underlying_cli_path: null,
+    node_required: false,
+    auth_status: { status: "not_applicable" },
+    source: "preset",
+  },
+  {
+    id: "opencode",
+    label: "OpenCode",
+    avatar_url: "",
+    availability: "not_installed",
+    command: null,
+    binary_path: null,
+    default_args: ["acp"],
+    mcp_command: null,
+    install_hint:
+      "Buzz talks to OpenCode through its CLI's ACP mode (opencode acp).",
+    install_instructions_url: "https://opencode.ai/docs",
+    can_auto_install: false,
+    underlying_cli_path: null,
+    node_required: false,
+    auth_status: { status: "not_applicable" },
+    source: "preset",
+  },
+  {
+    id: "my-custom",
+    label: "My Custom Harness",
+    avatar_url: "",
+    availability: "available",
+    command: "my-acp",
+    binary_path: "/usr/local/bin/my-acp",
+    default_args: [],
+    mcp_command: null,
+    install_hint: "",
+    install_instructions_url: "",
+    can_auto_install: false,
+    underlying_cli_path: null,
+    node_required: false,
+    auth_status: { status: "not_applicable" },
+    source: "custom",
+  },
+];
+
+test("after: consolidated harnesses panel + catalog dialog", async ({
+  page,
+}) => {
+  test.setTimeout(60_000);
+  await page.setViewportSize({ width: 1280, height: 2400 });
+  await installMockBridge(page, { acpRuntimesCatalog: CATALOG });
+  await page.goto("/", { waitUntil: "domcontentloaded" });
+  await openSettings(page, "agents");
+  await expect(page.getByTestId("settings-harnesses")).toBeVisible({
+    timeout: 10_000,
+  });
+  await page.waitForTimeout(700);
+
+  // 1. The consolidated panel — ready rows only, no inert controls.
+  await page.getByTestId("settings-harnesses").screenshot({
+    path: `${SHOTS}/after-harnesses-panel.png`,
+  });
+
+  // 2. Add-harnesses catalog — needs-setup entry auto-selected in detail.
+  await page.getByTestId("harness-add-button").click();
+  await expect(page.getByTestId("harness-catalog-dialog")).toBeVisible();
+  await page.waitForTimeout(500);
+  await page.getByTestId("harness-catalog-dialog").screenshot({
+    path: `${SHOTS}/after-catalog-needs-setup.png`,
+  });
+
+  // 3. Ready entry detail (Ready state, no install action). Ready entries
+  // sit in the "Installed" accordion, collapsed by default — expand it.
+  await page.getByTestId("harness-catalog-section-installed").click();
+  await page.getByTestId("harness-catalog-list-item-claude").click();
+  await page.waitForTimeout(300);
+  await page.getByTestId("harness-catalog-dialog").screenshot({
+    path: `${SHOTS}/after-catalog-ready-detail.png`,
+  });
+
+  // 4. Custom harness form — all fields inline.
+  await page.getByTestId("harness-catalog-list-item-custom").click();
+  await expect(page.getByTestId("custom-harness-form")).toBeVisible();
+  await page.waitForTimeout(300);
+  await page.getByTestId("harness-catalog-dialog").screenshot({
+    path: `${SHOTS}/after-catalog-custom-form.png`,
+  });
+});
diff --git a/desktop/tests/e2e/harness-management.spec.ts b/desktop/tests/e2e/harness-management.spec.ts
index e66a85fac96..50047f8f81e 100644
--- a/desktop/tests/e2e/harness-management.spec.ts
+++ b/desktop/tests/e2e/harness-management.spec.ts
@@ -1,16 +1,21 @@
 /**
- * E2E spec for the Bring-Your-Own-Harness management UI.
+ * E2E spec for the consolidated Harnesses settings surface + Add-harnesses
+ * catalog dialog.
  *
  * Covers:
- *  - Preset gallery renders with Detected badge for an available preset
- *  - Preset gallery renders without badge / with install link for a missing preset
- *  - Add custom harness (form → save → row appears in list)
+ *  - Ready preset gets a row in "Your harnesses"; needs-setup preset does NOT
+ *  - Needs-setup preset appears in the Add-harnesses catalog with status,
+ *    curated description, docs link, and setup action
+ *  - Catalog search filters the list
+ *  - Toggling install does not reorder rows (stable order)
+ *  - Add custom harness via catalog (name+command → save → row appears)
+ *  - Advanced disclosure hides ID/args/env/docs/hint until opened
  *  - Edit preserves env vars (round-trip through definitionEnv boundary)
  *  - Same-ID edit replaces entry (no duplicate row)
  *  - Rename removes old row and shows new row
- *  - Delete success removes row
- *  - Delete failure shows error inline (error-injection knob)
- *  - PATH badge: custom harness row shows Detected when availability === "available"
+ *  - Delete success removes row; delete failure shows inline error
+ *  - PATH badge: custom harness row shows Detected when available
+ *  - Preset rows render bundled logos, never initials
  *  - Onboarding navigate: setup-page "More harnesses" click → Settings → Agents (F8)
  */
 import { expect, test } from "@playwright/test";
@@ -19,7 +24,7 @@ import { installMockBridge } from "../helpers/bridge";
 
 // ── Shared catalog fixtures ───────────────────────────────────────────────────
 
-/** Hermes preset with availability "available" — renders the Detected badge. */
+/** Hermes preset with availability "available" — earns a Your-harnesses row. */
 const HERMES_AVAILABLE = {
   id: "hermes",
   label: "Hermes",
@@ -29,7 +34,7 @@ const HERMES_AVAILABLE = {
   binary_path: "/usr/local/bin/hermes-acp",
   default_args: [],
   mcp_command: null,
-  install_hint: "Install Hermes Agent from hermes-agent.nousresearch.com.",
+  install_hint: "Buzz talks to Hermes Agent through its hermes-acp command.",
   install_instructions_url: "https://hermes-agent.nousresearch.com",
   can_auto_install: false,
   requires_external_cli: true,
@@ -39,7 +44,7 @@ const HERMES_AVAILABLE = {
   source: "preset",
 } as const;
 
-/** OpenClaw preset with availability "not_installed" — renders install link. */
+/** OpenClaw preset "not_installed" + no auto-install — catalog-only. */
 const OPENCLAW_NOT_INSTALLED = {
   id: "openclaw",
   label: "OpenClaw",
@@ -49,7 +54,8 @@ const OPENCLAW_NOT_INSTALLED = {
   binary_path: null,
   default_args: ["acp"],
   mcp_command: null,
-  install_hint: "Install OpenClaw: npm install -g openclaw@latest.",
+  install_hint:
+    "Buzz talks to OpenClaw through its ACP mode (openclaw acp), which relies on the OpenClaw Gateway daemon. Follow the setup guide to install both.",
   install_instructions_url: "https://docs.openclaw.ai/start/getting-started",
   can_auto_install: false,
   requires_external_cli: true,
@@ -60,8 +66,8 @@ const OPENCLAW_NOT_INSTALLED = {
 } as const;
 
 /** Cursor preset — deliberately has NO bundled logo (brand assets not
- * licensed for redistribution; see FALLBACK_ONLY_PRESETS). Must render the
- * terminal glyph, never initials. */
+ * licensed for redistribution). Must render the terminal glyph, never
+ * initials. */
 const CURSOR_AVAILABLE = {
   id: "cursor",
   label: "Cursor",
@@ -71,7 +77,7 @@ const CURSOR_AVAILABLE = {
   binary_path: "/usr/local/bin/cursor-agent",
   default_args: [],
   mcp_command: null,
-  install_hint: "Install Cursor CLI from cursor.com.",
+  install_hint: "Buzz talks to Cursor through the cursor-agent CLI's ACP mode.",
   install_instructions_url: "https://cursor.com/cli",
   can_auto_install: false,
   requires_external_cli: true,
@@ -81,7 +87,7 @@ const CURSOR_AVAILABLE = {
   source: "preset",
 } as const;
 
-/** Custom harness entry already persisted — shown in the custom list. */
+/** Custom harness entry already persisted — always gets a row. */
 function makeCustomEntry(
   overrides: {
     id?: string;
@@ -128,28 +134,32 @@ async function openHarnessSettings(page: import("@playwright/test").Page) {
   await page.getByTestId("profile-popover-settings").click();
   await expect(page.getByTestId("settings-view")).toBeVisible();
   await page.getByTestId("settings-nav-agents").click();
-  await expect(page.getByTestId("settings-harness-management")).toBeVisible({
+  await expect(page.getByTestId("settings-harnesses")).toBeVisible({
     timeout: 10_000,
   });
 }
 
-/**
- * Fill and submit the custom harness add/edit form.
- * Caller must have the form visible before calling.
- */
+/** Open the Add-harnesses catalog dialog from the settings surface. */
+async function openCatalog(page: import("@playwright/test").Page) {
+  await page.getByTestId("harness-add-button").click();
+  await expect(page.getByTestId("harness-catalog-dialog")).toBeVisible();
+}
+
+/** Fill the custom harness form (all fields render inline). */
 async function fillHarnessForm(
   page: import("@playwright/test").Page,
   values: {
     label: string;
-    id: string;
+    id?: string;
     command: string;
     env?: Array<{ key: string; value: string }>;
   },
 ) {
   await page.fill("#ch-label", values.label);
-  // ID may auto-derive; overwrite it.
-  await page.fill("#ch-id", values.id);
   await page.fill("#ch-command", values.command);
+  if (values.id !== undefined) {
+    await page.fill("#ch-id", values.id);
+  }
   for (const pair of values.env ?? []) {
     await page.getByRole("button", { name: "Add env var" }).click();
     // Fill last appended row.
@@ -160,67 +170,206 @@ async function fillHarnessForm(
   }
 }
 
-// ── Preset gallery ────────────────────────────────────────────────────────────
+// ── Your harnesses vs catalog split ──────────────────────────────────────────
 
-test.describe("preset gallery", () => {
-  test("detected preset shows Detected badge", async ({ page }) => {
+test.describe("your harnesses split", () => {
+  test("ready preset gets a row; needs-setup preset is catalog-only", async ({
+    page,
+  }) => {
     await installMockBridge(page, {
       acpRuntimesCatalog: [HERMES_AVAILABLE, OPENCLAW_NOT_INSTALLED],
     });
     await openHarnessSettings(page);
 
-    const hermesCard = page.getByTestId("harness-preset-hermes");
-    await expect(hermesCard).toBeVisible();
-    await expect(hermesCard.getByText("Detected")).toBeVisible();
-    // Not-installed preset must NOT show Detected badge.
-    const openclawCard = page.getByTestId("harness-preset-openclaw");
-    await expect(openclawCard).toBeVisible();
-    await expect(openclawCard.getByText("Detected")).not.toBeVisible();
+    // Ready preset row with a Ready status chip.
+    const hermesRow = page.getByTestId("doctor-runtime-hermes");
+    await expect(hermesRow).toBeVisible();
+    await expect(page.getByTestId("doctor-runtime-ready-hermes")).toHaveText(
+      "Ready",
+    );
+
+    // Needs-setup preset must NOT render a row (and thus no Install button).
+    await expect(page.getByTestId("doctor-runtime-openclaw")).toHaveCount(0);
+    await expect(
+      page.getByTestId("doctor-runtime-install-openclaw"),
+    ).toHaveCount(0);
   });
 
-  test("not-installed preset shows Install link, not Detected badge", async ({
+  test("needs-setup preset appears in catalog with status, description, docs and setup action", async ({
     page,
   }) => {
     await installMockBridge(page, {
       acpRuntimesCatalog: [HERMES_AVAILABLE, OPENCLAW_NOT_INSTALLED],
     });
     await openHarnessSettings(page);
+    await openCatalog(page);
+
+    // Needs-setup entries sort first, so OpenClaw is auto-selected.
+    await expect(
+      page.getByTestId("harness-catalog-list-item-openclaw"),
+    ).toBeVisible();
+    const detail = page.getByTestId("harness-catalog-detail-pane");
+    await expect(detail).toContainText("OpenClaw");
+    // Status chip.
+    await expect(
+      page.getByTestId("harness-catalog-status-openclaw"),
+    ).toHaveText("CLI needed");
+    // Curated one-liner (first-party-sourced category sentence).
+    await expect(detail).toContainText(
+      "A personal AI assistant that runs on your own devices.",
+    );
+    // Operational setup hint from runtime state.
+    await expect(detail).toContainText("OpenClaw Gateway daemon");
+    // Primary setup action under the header (no auto-install → setup guide).
+    await expect(
+      page.getByTestId("harness-catalog-setup-openclaw"),
+    ).toBeVisible();
+
+    // Technical details are visible by default.
+    const technical = page.getByTestId("harness-catalog-technical-openclaw");
+    await expect(technical).toBeVisible();
+    await expect(technical).toContainText("openclaw");
+    await expect(technical).toContainText("acp");
+  });
+
+  test("ready preset shows in catalog as Ready with no install action", async ({
+    page,
+  }) => {
+    await installMockBridge(page, {
+      acpRuntimesCatalog: [HERMES_AVAILABLE, OPENCLAW_NOT_INSTALLED],
+    });
+    await openHarnessSettings(page);
+    await openCatalog(page);
+
+    // Ready entries live in the "Installed" accordion, collapsed by default.
+    await expect(
+      page.getByTestId("harness-catalog-list-item-hermes"),
+    ).toHaveCount(0);
+    await expect(
+      page.getByTestId("harness-catalog-section-installed-count"),
+    ).toHaveText("1");
+    await page.getByTestId("harness-catalog-section-installed").click();
+
+    await page.getByTestId("harness-catalog-list-item-hermes").click();
+    const detail = page.getByTestId("harness-catalog-detail-pane");
+    await expect(detail).toContainText("Ready");
+    await expect(
+      page.getByTestId("harness-catalog-install-hermes"),
+    ).toHaveCount(0);
+    await expect(page.getByTestId("harness-catalog-setup-hermes")).toHaveCount(
+      0,
+    );
+  });
+
+  test("catalog Update for an outdated adapter requires confirmation before installing", async ({
+    page,
+  }) => {
+    // Wes's review blocker: Add runtimes → Setup → Update must honor the
+    // same machine-wide replacement confirmation the runtime row shows —
+    // never mutate straight from the catalog CTA.
+    await installMockBridge(page, {
+      acpRuntimesCatalog: [
+        HERMES_AVAILABLE,
+        {
+          ...OPENCLAW_NOT_INSTALLED,
+          availability: "adapter_outdated",
+          binary_path: "/usr/local/bin/openclaw",
+          can_auto_install: true,
+        },
+      ],
+    });
+    await openHarnessSettings(page);
+    await openCatalog(page);
+
+    const installCalls = () =>
+      page.evaluate(
+        () =>
+          (
+            (window as Window & { __BUZZ_E2E_COMMANDS__?: string[] })
+              .__BUZZ_E2E_COMMANDS__ ?? []
+          ).filter((command) => command === "install_acp_runtime").length,
+      );
+
+    await page.getByTestId("harness-catalog-list-item-openclaw").click();
+    await expect(
+      page.getByTestId("harness-catalog-status-openclaw"),
+    ).toHaveText("Update needed");
+    const updateButton = page.getByTestId("harness-catalog-install-openclaw");
+    await expect(updateButton).toHaveText("Update");
+
+    // Cancel path: clicking Update opens the warning, no mutation fires.
+    await updateButton.click();
+    const dialog = page.getByRole("alertdialog");
+    await expect(dialog).toContainText("Update OpenClaw adapter?");
+    await expect(dialog).toContainText(
+      "This replaces the machine-wide openclaw adapter.",
+    );
+    // Generic runtimes must never get Codex's package copy.
+    await expect(dialog).not.toContainText("codex-acp");
+    expect(await installCalls()).toBe(0);
+    await dialog.getByRole("button", { name: "Cancel" }).click();
+    await expect(dialog).toHaveCount(0);
+    expect(await installCalls()).toBe(0);
+
+    // Confirm path: exactly one install fires after confirmation.
+    await updateButton.click();
+    await page.getByTestId("harness-catalog-confirm-update-openclaw").click();
+    await expect(page.getByRole("alertdialog")).toHaveCount(0);
+    await expect.poll(installCalls).toBe(1);
+    // No duplicate mutation after the flow settles.
+    expect(await installCalls()).toBe(1);
+  });
+
+  test("catalog search filters the list", async ({ page }) => {
+    await installMockBridge(page, {
+      acpRuntimesCatalog: [
+        HERMES_AVAILABLE,
+        OPENCLAW_NOT_INSTALLED,
+        CURSOR_AVAILABLE,
+      ],
+    });
+    await openHarnessSettings(page);
+    await openCatalog(page);
 
-    const openclawCard = page.getByTestId("harness-preset-openclaw");
-    await expect(openclawCard).toBeVisible();
-    await expect(openclawCard.getByText("Install")).toBeVisible();
-    await expect(openclawCard.getByText("Detected")).not.toBeVisible();
+    await page.getByTestId("harness-catalog-search").fill("claw");
+    await expect(
+      page.getByTestId("harness-catalog-list-item-openclaw"),
+    ).toBeVisible();
+    await expect(
+      page.getByTestId("harness-catalog-list-item-hermes"),
+    ).toHaveCount(0);
+    await expect(
+      page.getByTestId("harness-catalog-list-item-cursor"),
+    ).toHaveCount(0);
+    // The custom-harness entry stays available regardless of the filter.
+    await expect(
+      page.getByTestId("harness-catalog-list-item-custom"),
+    ).toBeVisible();
   });
 });
 
-// ── Preset logos in the Agent runtimes list ──────────────────────────────────
+// ── Preset logos in Your harnesses rows ──────────────────────────────────────
 
-test("Agent runtimes rows render bundled preset logos, not initials", async ({
+test("harness rows render bundled preset logos, not initials", async ({
   page,
 }) => {
   await installMockBridge(page, {
-    acpRuntimesCatalog: [
-      HERMES_AVAILABLE,
-      OPENCLAW_NOT_INSTALLED,
-      CURSOR_AVAILABLE,
-    ],
+    acpRuntimesCatalog: [HERMES_AVAILABLE, CURSOR_AVAILABLE],
   });
   await openHarnessSettings(page);
 
-  // Preset rows in "Agent runtimes" must show the same bundled logo the
-  // preset gallery uses (PRESET_LOGOS via RuntimeIcon), even though presets
-  // emit an empty avatar_url (the no-remote-icon security line).
-  for (const [id, file] of [
-    ["hermes", "/harness-logos/hermes.png"],
-    ["openclaw", "/harness-logos/openclaw.svg"],
-  ] as const) {
-    const logo = page.getByTestId(`doctor-runtime-logo-${id}`);
-    await expect(logo).toBeVisible();
-    await expect(logo.locator("img")).toHaveAttribute("src", file);
-  }
-
-  // Cursor has no bundled logo (licensing) — it must fall through to
-  // RuntimeIcon's terminal glyph like the preset gallery, not initials.
+  // Preset rows must show the same bundled logo the catalog uses
+  // (PRESET_LOGOS via RuntimeIcon), even though presets emit an empty
+  // avatar_url (the no-remote-icon security line).
+  const hermesLogo = page.getByTestId("doctor-runtime-logo-hermes");
+  await expect(hermesLogo).toBeVisible();
+  await expect(hermesLogo.locator("img")).toHaveAttribute(
+    "src",
+    "/harness-logos/hermes.png",
+  );
+
+  // Cursor renders its inline SVG mark (RUNTIME_MARKS, CC0 simple-icons
+  // path) — an svg, never an img or initials.
   const cursorLogo = page.getByTestId("doctor-runtime-logo-cursor");
   await expect(cursorLogo).toBeVisible();
   await expect(cursorLogo.locator("svg")).toBeVisible();
@@ -228,40 +377,48 @@ test("Agent runtimes rows render bundled preset logos, not initials", async ({
   await expect(cursorLogo).not.toContainText("C");
 });
 
-// ── Custom harness add ────────────────────────────────────────────────────────
+// ── Custom harness add (via catalog) ─────────────────────────────────────────
 
 test.describe("add custom harness", () => {
-  test("form saves and row appears in list", async ({ page }) => {
+  test("catalog custom form saves and row appears in Your harnesses", async ({
+    page,
+  }) => {
     await installMockBridge(page, {
       acpRuntimesCatalog: [HERMES_AVAILABLE, OPENCLAW_NOT_INSTALLED],
     });
     await openHarnessSettings(page);
 
     // No custom rows yet.
-    // The list container may exist but have no row children.
     await expect(
-      page.getByTestId("custom-harness-row-my-custom-agent"),
+      page.getByTestId("doctor-runtime-my-custom-agent"),
     ).not.toBeVisible();
 
-    // Open the add form.
-    await page.getByTestId("harness-add-custom-button").click();
+    await openCatalog(page);
+    await page.getByTestId("harness-catalog-list-item-custom").click();
     await expect(page.getByTestId("custom-harness-form")).toBeVisible();
 
+    // All fields render inline.
+    await expect(page.locator("#ch-label")).toBeVisible();
+    await expect(page.locator("#ch-command")).toBeVisible();
+    await expect(page.locator("#ch-id")).toBeVisible();
+
     await fillHarnessForm(page, {
       label: "My Custom Agent",
-      id: "my-custom-agent",
       command: "my-custom-acp",
     });
 
-    // Submit.
+    // ID auto-derives from the label.
+    await expect(page.locator("#ch-id")).toHaveValue("my-custom-agent");
+
     await page
       .getByTestId("custom-harness-form")
       .getByRole("button", { name: "Save", exact: true })
       .click();
 
-    // Row must appear in the list after save.
+    // Dialog closes; row appears in Your harnesses.
+    await expect(page.getByTestId("harness-catalog-dialog")).not.toBeVisible();
     await expect(
-      page.getByTestId("custom-harness-row-my-custom-agent"),
+      page.getByTestId("doctor-runtime-my-custom-agent"),
     ).toBeVisible({ timeout: 5_000 });
   });
 
@@ -277,14 +434,15 @@ test.describe("add custom harness", () => {
     });
     await openHarnessSettings(page);
 
-    // Open edit form for the existing custom entry.
+    // Open edit form for the existing custom entry via the ••• menu.
     await expect(
-      page.getByTestId("custom-harness-row-my-custom-agent"),
+      page.getByTestId("doctor-runtime-my-custom-agent"),
     ).toBeVisible();
+    await page.getByTestId("doctor-runtime-menu-my-custom-agent").click();
     await page.getByTestId("custom-harness-edit-my-custom-agent").click();
     await expect(page.getByTestId("custom-harness-form")).toBeVisible();
 
-    // Env KEY and value must be pre-populated.
+    // Existing env vars must be pre-populated.
     await expect(page.locator('input[placeholder="KEY"]').first()).toHaveValue(
       "MY_API_KEY",
     );
@@ -304,6 +462,7 @@ test.describe("add custom harness", () => {
     await openHarnessSettings(page);
 
     // Edit, keep same ID, change label.
+    await page.getByTestId("doctor-runtime-menu-my-custom-agent").click();
     await page.getByTestId("custom-harness-edit-my-custom-agent").click();
     await expect(page.getByTestId("custom-harness-form")).toBeVisible();
     await page.fill("#ch-label", "V2 Label");
@@ -313,9 +472,7 @@ test.describe("add custom harness", () => {
       .click();
 
     // Exactly one row with the same ID; label updated.
-    const rows = page.locator(
-      '[data-testid^="custom-harness-row-my-custom-agent"]',
-    );
+    const rows = page.locator('[data-testid="doctor-runtime-my-custom-agent"]');
     await expect(rows).toHaveCount(1);
     await expect(rows.first()).toContainText("V2 Label");
   });
@@ -330,10 +487,14 @@ test.describe("add custom harness", () => {
     });
     await openHarnessSettings(page);
 
+    await page.getByTestId("doctor-runtime-menu-old-harness").click();
     await page.getByTestId("custom-harness-edit-old-harness").click();
     await expect(page.getByTestId("custom-harness-form")).toBeVisible();
-    await page.fill("#ch-label", "New Harness");
-    await page.fill("#ch-id", "new-harness");
+    await fillHarnessForm(page, {
+      label: "New Harness",
+      id: "new-harness",
+      command: "my-custom-acp",
+    });
     await page
       .getByTestId("custom-harness-form")
       .getByRole("button", { name: "Save", exact: true })
@@ -341,11 +502,11 @@ test.describe("add custom harness", () => {
 
     // Old row gone; new row present.
     await expect(
-      page.getByTestId("custom-harness-row-old-harness"),
+      page.getByTestId("doctor-runtime-old-harness"),
     ).not.toBeVisible({ timeout: 5_000 });
-    await expect(
-      page.getByTestId("custom-harness-row-new-harness"),
-    ).toBeVisible({ timeout: 5_000 });
+    await expect(page.getByTestId("doctor-runtime-new-harness")).toBeVisible({
+      timeout: 5_000,
+    });
   });
 });
 
@@ -362,9 +523,13 @@ test.describe("delete custom harness", () => {
     });
     await openHarnessSettings(page);
 
-    // Enter confirm-delete mode.
+    // Enter confirm-delete mode via the ••• menu.
+    await page.getByTestId("doctor-runtime-menu-my-custom-agent").click();
     await page.getByTestId("custom-harness-delete-my-custom-agent").click();
-    // The confirm button must appear.
+    // Blast-radius warning + confirm button must appear.
+    await expect(
+      page.getByTestId("custom-harness-delete-warning-my-custom-agent"),
+    ).toBeVisible();
     await expect(
       page.getByTestId("custom-harness-delete-confirm-my-custom-agent"),
     ).toBeVisible();
@@ -374,7 +539,7 @@ test.describe("delete custom harness", () => {
 
     // Row disappears after successful delete.
     await expect(
-      page.getByTestId("custom-harness-row-my-custom-agent"),
+      page.getByTestId("doctor-runtime-my-custom-agent"),
     ).not.toBeVisible({ timeout: 5_000 });
   });
 
@@ -391,6 +556,7 @@ test.describe("delete custom harness", () => {
     });
     await openHarnessSettings(page);
 
+    await page.getByTestId("doctor-runtime-menu-my-custom-agent").click();
     await page.getByTestId("custom-harness-delete-my-custom-agent").click();
     await page
       .getByTestId("custom-harness-delete-confirm-my-custom-agent")
@@ -401,28 +567,55 @@ test.describe("delete custom harness", () => {
       page.getByText("permission denied: could not remove file"),
     ).toBeVisible({ timeout: 5_000 });
     await expect(
-      page.getByTestId("custom-harness-row-my-custom-agent"),
+      page.getByTestId("doctor-runtime-my-custom-agent"),
     ).toBeVisible();
   });
 });
 
-// ── PATH badge on custom harness row ─────────────────────────────────────────
+// ── Custom harness row readiness ─────────────────────────────────────────────
+
+test("available custom harness row shows a Ready chip", async ({ page }) => {
+  await installMockBridge(page, {
+    acpRuntimesCatalog: [
+      HERMES_AVAILABLE,
+      OPENCLAW_NOT_INSTALLED,
+      makeCustomEntry({ availability: "available" }),
+    ],
+  });
+  await openHarnessSettings(page);
+
+  const row = page.getByTestId("doctor-runtime-my-custom-agent");
+  await expect(row).toBeVisible();
+  await expect(
+    page.getByTestId("doctor-runtime-ready-my-custom-agent"),
+  ).toHaveText("Ready");
+});
 
-test("custom harness row shows Detected badge when command is on PATH", async ({
+test("not-ready custom harness row shows status, no install action", async ({
   page,
 }) => {
   await installMockBridge(page, {
     acpRuntimesCatalog: [
       HERMES_AVAILABLE,
       OPENCLAW_NOT_INSTALLED,
-      makeCustomEntry({ availability: "available" }),
+      makeCustomEntry(),
     ],
   });
   await openHarnessSettings(page);
 
-  const row = page.getByTestId("custom-harness-row-my-custom-agent");
+  const row = page.getByTestId("doctor-runtime-my-custom-agent");
   await expect(row).toBeVisible();
-  await expect(row.getByText("Detected")).toBeVisible();
+  await expect(
+    page.getByTestId("doctor-runtime-status-my-custom-agent"),
+  ).toHaveText("CLI needed");
+  // A row that setup can't fix with one click renders no Install button (and
+  // is not ready).
+  await expect(
+    page.getByTestId("doctor-runtime-install-my-custom-agent"),
+  ).toHaveCount(0);
+  await expect(
+    page.getByTestId("doctor-runtime-ready-my-custom-agent"),
+  ).toHaveCount(0);
 });
 
 // ── F8: onboarding navigate-after-complete ────────────────────────────────────
@@ -491,8 +684,8 @@ test("onboarding setup More-harnesses click navigates to Settings → Agents", a
   await page.getByTestId("onboarding-setup-more-harnesses").click();
 
   // After onboarding completes + router mounts, the app must land on
-  // Settings → Agents (harness management section visible).
-  await expect(page.getByTestId("settings-harness-management")).toBeVisible({
+  // Settings → Agents (consolidated harnesses section visible).
+  await expect(page.getByTestId("settings-harnesses")).toBeVisible({
     timeout: 15_000,
   });
 });
diff --git a/desktop/tests/e2e/identity-key-help.spec.ts b/desktop/tests/e2e/identity-key-help.spec.ts
index 2e8967a43ba..d204d556041 100644
--- a/desktop/tests/e2e/identity-key-help.spec.ts
+++ b/desktop/tests/e2e/identity-key-help.spec.ts
@@ -56,3 +56,38 @@ test("identity key help explains the first-run choice", async ({ page }) => {
     "1",
   );
 });
+
+test("identity key help stays readable when the app resolves dark mode", async ({
+  page,
+}) => {
+  await page.emulateMedia({ colorScheme: "dark" });
+  await installMockBridge(page, undefined, {
+    skipCommunitySeed: true,
+    skipOnboardingSeed: true,
+  });
+  await page.goto("/");
+
+  // Fresh profiles follow the system scheme, so the emulated dark scheme is
+  // the first-run repro: the app resolves the dark theme while onboarding.
+  await expect
+    .poll(() =>
+      page.evaluate(() => document.documentElement.classList.contains("dark")),
+    )
+    .toBe(true);
+
+  const trigger = page.getByTestId("identity-key-help-trigger");
+  await expect(trigger).toHaveCSS("opacity", "1", { timeout: 5000 });
+  await trigger.click();
+
+  const dialog = page.getByTestId("identity-key-help-dialog");
+  await expect(dialog).toBeVisible();
+  await waitForAnimations(page);
+
+  // The textured powder card is baked light in both themes, so the dialog pins
+  // the neutral onboarding theme to its light variant. Without the pin the
+  // dark theme flips --foreground to near-white and the title disappears
+  // against the white card.
+  await expect(
+    dialog.getByRole("heading", { name: "What’s an identity key?" }),
+  ).toHaveCSS("color", "rgb(23, 23, 23)");
+});
diff --git a/desktop/tests/e2e/inbox-refactor-screenshots.spec.ts b/desktop/tests/e2e/inbox-refactor-screenshots.spec.ts
new file mode 100644
index 00000000000..15a804d71f6
--- /dev/null
+++ b/desktop/tests/e2e/inbox-refactor-screenshots.spec.ts
@@ -0,0 +1,359 @@
+/**
+ * Screenshots documenting the focused Inbox behavior for PR #2045.
+ *
+ * These replace the hand-generated shots posted earlier in that PR, which went
+ * stale twice: once when the surface was briefly renamed to "Activity", and
+ * again when the Projects filter landed. Keeping them in a spec means the next
+ * round regenerates instead of drifting.
+ *
+ * Run: pnpm build:e2e && pnpm exec playwright test --project=smoke \
+ *        tests/e2e/inbox-refactor-screenshots.spec.ts
+ * Output: test-results/inbox-refactor/
+ */
+import { expect, test } from "@playwright/test";
+
+import { waitForAnimations } from "../helpers/animations";
+import { installMockBridge, TEST_IDENTITIES } from "../helpers/bridge";
+
+const SHOTS = "test-results/inbox-refactor";
+
+const GENERAL_CHANNEL_ID = "9a1657ac-f7aa-5db0-b632-d8bbeb6dfb50";
+const AGENTS_CHANNEL_ID = "94a444a4-c0a3-5966-ab05-530c6ddc2301";
+const DM_CHANNEL_ID = "f48efb06-0c93-5025-aac9-2e646bb6bfa8";
+
+// Mock bridge default pubkey — must match DEFAULT_MOCK_PUBKEY in bridge.ts.
+const MOCK_PUBKEY = "deadbeef".repeat(8);
+const DRAFT_STORE_KEY = `buzz-drafts.v1:${MOCK_PUBKEY}`;
+
+// Fixed timestamps so draft ordering renders deterministically.
+const DRAFT_CREATED_AT_1 = "2026-07-01T10:00:00.000Z";
+const DRAFT_CREATED_AT_2 = "2026-07-02T14:30:00.000Z";
+
+type MockFeedWindow = Window & {
+  __BUZZ_E2E_EMIT_MOCK_MESSAGE__?: (input: {
+    channelName: string;
+    content: string;
+    createdAt?: number;
+    id?: string;
+    parentEventId?: string;
+    pubkey?: string;
+  }) => {
+    content: string;
+    created_at: number;
+    id: string;
+    kind: number;
+    pubkey: string;
+    tags: string[][];
+  };
+  __BUZZ_E2E_PUSH_MOCK_FEED_ITEM__?: (item: {
+    category: "mention" | "needs_action" | "activity" | "agent_activity";
+    channel_id: string | null;
+    channel_name: string;
+    channel_type?: string | null;
+    content: string;
+    created_at: number;
+    id: string;
+    kind: number;
+    pubkey: string;
+    tags: string[][];
+  }) => void;
+};
+
+/**
+ * The mock community is seeded without a pubkey, which initDraftStore needs on
+ * startup. Init scripts run in registration order, so this patches the seed
+ * installMockBridge already wrote.
+ */
+async function patchCommunityPubkey(page: import("@playwright/test").Page) {
+  await page.addInitScript(
+    ({ pubkey }) => {
+      const raw = window.localStorage.getItem("buzz-communities");
+      const communities = raw
+        ? (JSON.parse(raw) as Array<Record<string, unknown>>)
+        : [];
+      if (communities[0]) {
+        communities[0].pubkey = pubkey;
+        window.localStorage.setItem(
+          "buzz-communities",
+          JSON.stringify(communities),
+        );
+      }
+    },
+    { pubkey: MOCK_PUBKEY },
+  );
+}
+
+/** Two active drafts so the Drafts filter renders its count badge. */
+async function seedTwoDrafts(page: import("@playwright/test").Page) {
+  await page.addInitScript(
+    ({ storeKey, channelId, agentsChannelId, createdAt1, createdAt2 }) => {
+      const draft = (content: string, channel: string, timestamp: string) => ({
+        content,
+        selectionStart: content.length,
+        selectionEnd: content.length,
+        channelId: channel,
+        createdAt: timestamp,
+        updatedAt: timestamp,
+        pendingImeta: [],
+        spoileredAttachmentUrls: [],
+        status: "active" as const,
+      });
+
+      window.localStorage.setItem(
+        storeKey,
+        JSON.stringify({
+          [`channel:${channelId}`]: draft(
+            "Drafting the release notes — will post once the checklist is signed off.",
+            channelId,
+            createdAt1,
+          ),
+          [`channel:${agentsChannelId}`]: draft(
+            "Following up on the harness rollout.",
+            agentsChannelId,
+            createdAt2,
+          ),
+        }),
+      );
+    },
+    {
+      storeKey: DRAFT_STORE_KEY,
+      channelId: GENERAL_CHANNEL_ID,
+      agentsChannelId: AGENTS_CHANNEL_ID,
+      createdAt1: DRAFT_CREATED_AT_1,
+      createdAt2: DRAFT_CREATED_AT_2,
+    },
+  );
+}
+
+/** Wait for the live mock-feed helpers the seeding below depends on. */
+async function waitForMockFeedHelpers(page: import("@playwright/test").Page) {
+  await expect(page.getByTestId("home-inbox-list")).toBeVisible({
+    timeout: 10_000,
+  });
+  await page.waitForFunction(() => {
+    const win = window as MockFeedWindow;
+    return (
+      typeof win.__BUZZ_E2E_EMIT_MOCK_MESSAGE__ === "function" &&
+      typeof win.__BUZZ_E2E_PUSH_MOCK_FEED_ITEM__ === "function"
+    );
+  });
+}
+
+test.describe("inbox refactor screenshots", () => {
+  test.use({ viewport: { width: 1280, height: 900 } });
+
+  test.beforeEach(async ({ page }) => {
+    page.on("pageerror", (err) => console.error("PAGE ERROR:", err.message));
+    page.on("console", (msg) => {
+      if (msg.type() === "error") {
+        console.error("CONSOLE ERROR:", msg.text().slice(0, 300));
+      }
+    });
+  });
+
+  test("01 — filter menu with Reminders/Drafts divider and counts", async ({
+    page,
+  }) => {
+    await patchCommunityPubkey(page);
+    await seedTwoDrafts(page);
+    await installMockBridge(page, { mode: "mock" });
+
+    await page.goto("/", { waitUntil: "domcontentloaded" });
+    await expect(page.getByTestId("home-inbox")).toBeVisible({
+      timeout: 10_000,
+    });
+
+    await page.getByTestId("inbox-filter-trigger").click();
+    const menu = page.getByRole("menu");
+    await expect(menu).toBeVisible();
+    await expect(
+      menu.getByRole("menuitemradio", { name: "Projects" }),
+    ).toBeVisible();
+    await waitForAnimations(page);
+
+    await page.screenshot({ path: `${SHOTS}/01-current-filters.png` });
+  });
+
+  test("02 — Inbox label, inbox icon, and overflow controls", async ({
+    page,
+  }) => {
+    await installMockBridge(page, { mode: "mock" });
+
+    await page.goto("/", { waitUntil: "domcontentloaded" });
+    await expect(page.getByTestId("home-inbox")).toBeVisible({
+      timeout: 10_000,
+    });
+
+    // The sidebar must be in frame — the label is the point of this shot.
+    const inboxButton = page
+      .getByTestId("sidebar-primary-menu")
+      .getByRole("button", { name: "Inbox", exact: true });
+    await expect(inboxButton).toBeVisible();
+    // Inbox is a destination, not a notification tray, so it carries the inbox
+    // glyph rather than a bell. Asserted because nothing else pins the icon.
+    await expect(inboxButton.locator("svg.lucide-inbox")).toHaveCount(1);
+
+    await page.getByTestId("inbox-options-trigger").click();
+    await expect(page.getByText("Show unread only")).toBeVisible();
+    await expect(page.getByText("Mark all as read")).toBeVisible();
+    await waitForAnimations(page);
+
+    await page.screenshot({ path: `${SHOTS}/02-current-controls.png` });
+  });
+
+  test("03 — consecutive DMs group into one conversation row", async ({
+    page,
+  }) => {
+    await installMockBridge(page, { mode: "mock" });
+
+    await page.goto("/", { waitUntil: "domcontentloaded" });
+    await waitForMockFeedHelpers(page);
+
+    const dmIds = ["shot-dm-first", "shot-dm-second", "shot-dm-third"];
+    await page.evaluate(
+      ({ channelId, createdAt, ids, senderPubkey }) => {
+        const win = window as MockFeedWindow;
+        const emitMessage = win.__BUZZ_E2E_EMIT_MOCK_MESSAGE__;
+        const pushFeedItem = win.__BUZZ_E2E_PUSH_MOCK_FEED_ITEM__;
+        if (!emitMessage || !pushFeedItem) {
+          throw new Error("Mock bridge helpers are not installed.");
+        }
+
+        [
+          "Quick update: the staging deploy is ready.",
+          "I ran the smoke tests and everything passed.",
+          "Can you take a final look before we release?",
+        ].forEach((content, index) => {
+          const event = emitMessage({
+            channelName: "alice-tyler",
+            content,
+            createdAt: createdAt + index,
+            id: ids[index],
+            pubkey: senderPubkey,
+          });
+          pushFeedItem({
+            category: "activity",
+            channel_id: channelId,
+            channel_name: "alice-tyler",
+            channel_type: null,
+            content: event.content,
+            created_at: event.created_at,
+            id: event.id,
+            kind: event.kind,
+            pubkey: event.pubkey,
+            tags: event.tags,
+          });
+        });
+      },
+      {
+        channelId: DM_CHANNEL_ID,
+        createdAt: Math.floor(Date.now() / 1000),
+        ids: dmIds,
+        senderPubkey: TEST_IDENTITIES.alice.pubkey,
+      },
+    );
+
+    const firstDmRow = page.getByTestId(`home-inbox-item-${dmIds[0]}`);
+    await expect(firstDmRow).toBeVisible();
+    // The grouping claim: three DMs, one row.
+    await expect(page.getByTestId(`home-inbox-item-${dmIds[1]}`)).toHaveCount(
+      0,
+    );
+    await expect(page.getByTestId(`home-inbox-item-${dmIds[2]}`)).toHaveCount(
+      0,
+    );
+
+    await firstDmRow.click();
+    const detail = page.getByTestId("home-inbox-detail");
+    await expect(detail.getByRole("heading")).toHaveText("DM with alice");
+    await expect(detail.getByTestId("message-unread-divider")).toBeVisible();
+    await waitForAnimations(page);
+
+    await page.screenshot({ path: `${SHOTS}/03-grouped-dms.png` });
+  });
+
+  test("04 — thread opens at the oldest unread reply", async ({ page }) => {
+    await installMockBridge(page, { mode: "mock" });
+
+    await page.goto("/", { waitUntil: "domcontentloaded" });
+    await waitForMockFeedHelpers(page);
+
+    const replyIds = [
+      "shot-reply-first",
+      "shot-reply-second",
+      "shot-reply-third",
+    ];
+    await page.evaluate(
+      ({ agentPubkeys, channelId, currentPubkey, ids }) => {
+        const win = window as MockFeedWindow;
+        const emitMessage = win.__BUZZ_E2E_EMIT_MOCK_MESSAGE__;
+        const pushFeedItem = win.__BUZZ_E2E_PUSH_MOCK_FEED_ITEM__;
+        if (!emitMessage || !pushFeedItem) {
+          throw new Error("Mock bridge helpers are not installed.");
+        }
+
+        const createdAt = Math.floor(Date.now() / 1000) + 60;
+        const root = emitMessage({
+          channelName: "general",
+          content: "Release checklist for the desktop build",
+          createdAt: createdAt - 10,
+          id: "shot-thread-root",
+          pubkey: currentPubkey,
+        });
+
+        [
+          "Started on the changelog — first pass is up.",
+          "Verified the signed build on macOS.",
+          "One open question on the version suffix.",
+        ].forEach((content, index) => {
+          const event = emitMessage({
+            channelName: "general",
+            content,
+            createdAt: createdAt + index,
+            id: ids[index],
+            parentEventId: root.id,
+            pubkey: agentPubkeys[index % agentPubkeys.length],
+          });
+          pushFeedItem({
+            category: "activity",
+            channel_id: channelId,
+            channel_name: "general",
+            channel_type: "stream",
+            content: event.content,
+            created_at: event.created_at,
+            id: event.id,
+            kind: event.kind,
+            pubkey: event.pubkey,
+            tags: event.tags,
+          });
+        });
+      },
+      {
+        agentPubkeys: [
+          TEST_IDENTITIES.alice.pubkey,
+          TEST_IDENTITIES.charlie.pubkey,
+        ],
+        channelId: GENERAL_CHANNEL_ID,
+        currentPubkey: MOCK_PUBKEY,
+        ids: replyIds,
+      },
+    );
+
+    const firstUnreadRow = page.getByTestId(`home-inbox-item-${replyIds[0]}`);
+    await expect(firstUnreadRow).toBeVisible();
+    await firstUnreadRow.click();
+
+    const detail = page.getByTestId("home-inbox-detail");
+    // The anchoring claim: full thread present, selection on the oldest unread.
+    await expect(detail).toContainText(
+      "Release checklist for the desktop build",
+    );
+    await expect(detail.getByTestId("message-unread-divider")).toBeVisible();
+    await expect(page.getByTestId("home-inbox-selected-message")).toContainText(
+      "Started on the changelog — first pass is up.",
+    );
+    await waitForAnimations(page);
+
+    await page.screenshot({ path: `${SHOTS}/04-thread-context.png` });
+  });
+});
diff --git a/desktop/tests/e2e/inline-custom-harness.spec.ts b/desktop/tests/e2e/inline-custom-harness.spec.ts
new file mode 100644
index 00000000000..6b3845d65a9
--- /dev/null
+++ b/desktop/tests/e2e/inline-custom-harness.spec.ts
@@ -0,0 +1,194 @@
+/**
+ * E2E spec for the inline "Add custom harness…" entry in the agent dialogs.
+ *
+ * Registering a custom harness used to be reachable only from Settings →
+ * Agents, so anyone whose first touchpoint was "New agent" never learned the
+ * path existed. The harness dropdowns now carry the entry directly.
+ *
+ * Covers, on all three surfaces (create, edit definition, edit instance):
+ *  - choosing the entry opens the registration form
+ *  - saving registers the harness and selects it in the dropdown
+ *
+ * Create and instance edit additionally assert the sentinel never becomes the
+ * selection; create alone covers dismissing the form leaving the previous
+ * selection untouched. The three surfaces share the same routing, so those
+ * checks are not repeated on every one.
+ */
+import { expect, test } from "@playwright/test";
+
+import { installMockBridge } from "../helpers/bridge";
+
+const ADD_ENTRY = "Add custom harness…";
+const HARNESS_LABEL = "My Weird Agent";
+const HARNESS_COMMAND = "my-weird-acp";
+
+type Page = import("@playwright/test").Page;
+type Locator = import("@playwright/test").Locator;
+
+/** Open a PersonaDropdownField (button trigger + menuitemradio options). */
+async function openDropdown(trigger: Locator) {
+  await expect(trigger).toBeVisible({ timeout: 10_000 });
+  await trigger.click();
+}
+
+/** Register a harness through the inline form and wait for it to close. */
+async function registerHarness(page: Page) {
+  const form = page.getByTestId("custom-harness-form");
+  await expect(form).toBeVisible({ timeout: 8_000 });
+  await page.fill("#ch-label", HARNESS_LABEL);
+  await page.fill("#ch-command", HARNESS_COMMAND);
+  // The id auto-derives from the label; it is what the dropdown selects on.
+  await expect(page.locator("#ch-id")).toHaveValue("my-weird-agent");
+  await form.getByRole("button", { name: "Save", exact: true }).click();
+  await expect(page.getByTestId("add-custom-harness-dialog")).not.toBeVisible({
+    timeout: 8_000,
+  });
+}
+
+/** Open the create-agent dialog (AgentDefinitionDialog, create mode). */
+async function openCreateDialog(page: Page) {
+  await page.goto("/", { waitUntil: "domcontentloaded" });
+  await page.getByTestId("open-agents-view").click();
+  await page.getByTestId("new-agent-card").click();
+  await page.getByRole("menuitem", { name: "Create agent" }).click();
+  const dialog = page.getByTestId("persona-dialog");
+  await expect(dialog).toBeVisible({ timeout: 10_000 });
+  await dialog.getByRole("tab", { name: "Customize for this agent" }).click();
+  return dialog;
+}
+
+/** Open the edit dialog for a saved definition (same dialog, edit mode). */
+async function openDefinitionEditDialog(page: Page, name: string) {
+  await page.goto("/", { waitUntil: "domcontentloaded" });
+  await page.getByTestId("open-agents-view").click();
+  await expect(page.getByTestId("agents-library-personas")).toBeVisible({
+    timeout: 10_000,
+  });
+  await page.getByRole("button", { name: `Open actions for ${name}` }).click();
+  await page.getByRole("menuitem", { name: "Edit" }).click();
+  const dialog = page.getByTestId("persona-dialog");
+  await expect(dialog).toBeVisible({ timeout: 10_000 });
+  await dialog.getByRole("tab", { name: "Customize for this agent" }).click();
+  return dialog;
+}
+
+test.describe("inline add custom harness", () => {
+  test("create dialog registers a harness inline and selects it", async ({
+    page,
+  }) => {
+    await installMockBridge(page);
+    const dialog = await openCreateDialog(page);
+
+    const harness = dialog.locator("#persona-runtime");
+    await openDropdown(harness);
+    await page.getByRole("menuitemradio", { name: ADD_ENTRY }).click();
+
+    // The sentinel opens the form; it must never become the selection.
+    await expect(page.getByTestId("add-custom-harness-dialog")).toBeVisible({
+      timeout: 8_000,
+    });
+    await expect(harness).not.toContainText(ADD_ENTRY);
+
+    await registerHarness(page);
+
+    // The saved harness is now the selected harness.
+    await expect(harness).toContainText(HARNESS_LABEL, { timeout: 8_000 });
+  });
+
+  test("dismissing the form leaves the create dialog's harness unchanged", async ({
+    page,
+  }) => {
+    await installMockBridge(page);
+    const dialog = await openCreateDialog(page);
+
+    const harness = dialog.locator("#persona-runtime");
+    await expect(harness).toBeVisible({ timeout: 10_000 });
+    const before = await harness.textContent();
+
+    await openDropdown(harness);
+    await page.getByRole("menuitemradio", { name: ADD_ENTRY }).click();
+    await expect(page.getByTestId("add-custom-harness-dialog")).toBeVisible({
+      timeout: 8_000,
+    });
+
+    await page.keyboard.press("Escape");
+    await expect(
+      page.getByTestId("add-custom-harness-dialog"),
+    ).not.toBeVisible();
+
+    // No harness was registered, so the prior selection must survive.
+    await expect(harness).toHaveText(before ?? "");
+  });
+
+  test("definition edit dialog registers a harness inline and selects it", async ({
+    page,
+  }) => {
+    await installMockBridge(page, {
+      personas: [
+        {
+          displayName: "Editable Agent",
+          systemPrompt: "An agent whose harness gets replaced.",
+        },
+      ],
+    });
+    const dialog = await openDefinitionEditDialog(page, "Editable Agent");
+
+    const harness = dialog.locator("#persona-runtime");
+    await openDropdown(harness);
+    await page.getByRole("menuitemradio", { name: ADD_ENTRY }).click();
+    await expect(page.getByTestId("add-custom-harness-dialog")).toBeVisible({
+      timeout: 8_000,
+    });
+
+    await registerHarness(page);
+
+    await expect(harness).toContainText(HARNESS_LABEL, { timeout: 8_000 });
+  });
+
+  test("instance edit dialog registers a harness inline and keeps Custom command", async ({
+    page,
+  }) => {
+    await installMockBridge(page, {
+      managedAgents: [
+        {
+          pubkey:
+            "npub1e2e00000000000000000000000000000000000000000000000000000000",
+          name: "Instance Agent",
+          status: "stopped",
+          channelNames: ["agents"],
+        },
+      ],
+    });
+
+    await page.goto("/", { waitUntil: "domcontentloaded" });
+    await page.getByTestId("open-agents-view").click();
+    await page
+      .getByRole("button", { name: "Instance Agent agent profile" })
+      .click();
+    await expect(page.getByTestId("user-profile-panel")).toBeVisible({
+      timeout: 10_000,
+    });
+    await page.getByTestId("user-profile-edit-agent").click();
+    await expect(page.getByTestId("edit-agent-dialog")).toBeVisible({
+      timeout: 10_000,
+    });
+
+    const provider = page.locator("#edit-agent-runtime");
+    await openDropdown(provider);
+
+    // "Custom command" is a different feature (ad-hoc command override) and
+    // must survive alongside the new entry.
+    await expect(
+      page.getByRole("menuitemradio", { name: "Custom command" }),
+    ).toBeVisible();
+    await page.getByRole("menuitemradio", { name: ADD_ENTRY }).click();
+    await expect(page.getByTestId("add-custom-harness-dialog")).toBeVisible({
+      timeout: 8_000,
+    });
+    await expect(provider).not.toContainText(ADD_ENTRY);
+
+    await registerHarness(page);
+
+    await expect(provider).toContainText(HARNESS_LABEL, { timeout: 8_000 });
+  });
+});
diff --git a/desktop/tests/e2e/integration.spec.ts b/desktop/tests/e2e/integration.spec.ts
index b0ee57e02d9..a2a92a8d394 100644
--- a/desktop/tests/e2e/integration.spec.ts
+++ b/desktop/tests/e2e/integration.spec.ts
@@ -303,11 +303,11 @@ test("live mentions refetch the home feed without waiting for polling", async ({
       },
     ]);
 
-    // The inbox feed should have been refetched live (the original purpose
+    // The Inbox feed should have been refetched live (the original purpose
     // of this test). The home badge stays at 0 while the user is actively
     // reading #general — reading in-channel advances the NIP-RS marker past
     // the new mention — so the assertion that the refetch happened is the
-    // inbox-list content, not the badge.
+    // Inbox-list content, not the badge.
     await targetPage
       .getByTestId("app-sidebar")
       .getByRole("button", { name: "Inbox" })
diff --git a/desktop/tests/e2e/invite-link-copy.spec.ts b/desktop/tests/e2e/invite-link-copy.spec.ts
index 94bc8e26b09..015abd848fd 100644
--- a/desktop/tests/e2e/invite-link-copy.spec.ts
+++ b/desktop/tests/e2e/invite-link-copy.spec.ts
@@ -3,7 +3,10 @@ import { expect, test } from "@playwright/test";
 import { installMockBridge } from "../helpers/bridge";
 import { openSettings } from "../helpers/settings";
 
+let invitePayloads: Record<string, unknown>[];
+
 test.beforeEach(async ({ page }) => {
+  invitePayloads = [];
   await page.context().grantPermissions(["clipboard-read", "clipboard-write"], {
     origin: "http://127.0.0.1:4173",
   });
@@ -11,6 +14,7 @@ test.beforeEach(async ({ page }) => {
     relayRequiresMembership: true,
   });
   await page.route("**/api/invites", async (route) => {
+    invitePayloads.push(route.request().postDataJSON());
     await route.fulfill({
       contentType: "application/json",
       json: {
@@ -33,8 +37,12 @@ test("copies a freshly minted invite link without showing a URL or QR code", asy
   await page.getByTestId("community-invite-dialog-trigger").click();
   await expect(page.getByTestId("invite-link-url")).toHaveCount(0);
   await expect(page.getByTestId("invite-link-qr-code")).toHaveCount(0);
+  await expect(page.getByTestId("invite-link-max-uses-trigger")).toHaveText(
+    "No limit",
+  );
   await page.getByTestId("copy-invite-link").click();
   await expect(page.getByTestId("copy-invite-link")).toContainText("Copied");
+  expect(invitePayloads).toEqual([{ ttl_secs: 3 * 24 * 60 * 60 }]);
 
   const payload = await page.evaluate(() => {
     const log = (
@@ -53,3 +61,25 @@ test("copies a freshly minted invite link without showing a URL or QR code", asy
     text: "buzz://join?relay=wss%3A%2F%2Frelay.example.com&code=qr-download-test",
   });
 });
+
+test("sets a selected invite-use limit", async ({ page }) => {
+  await page.goto("/");
+  await openSettings(page, "community-members");
+  await page.getByTestId("community-invite-dialog-trigger").click();
+
+  const maxUsesTrigger = page.getByTestId("invite-link-max-uses-trigger");
+  await maxUsesTrigger.click();
+  await expect(
+    page.getByRole("menuitemradio", { name: "No limit" }),
+  ).toBeVisible();
+  await expect(
+    page.getByRole("menuitemradio", { name: "25 uses" }),
+  ).toBeVisible();
+  await page.getByTestId("invite-link-max-uses-10").click();
+  await expect(maxUsesTrigger).toHaveText("10 uses");
+  await page.getByTestId("copy-invite-link").click();
+  await expect(page.getByTestId("copy-invite-link")).toContainText("Copied");
+  expect(invitePayloads).toEqual([
+    { max_uses: 10, ttl_secs: 3 * 24 * 60 * 60 },
+  ]);
+});
diff --git a/desktop/tests/e2e/invites-settings-screenshots.spec.ts b/desktop/tests/e2e/invites-settings-screenshots.spec.ts
index 654aec56fe7..c56e33bcd57 100644
--- a/desktop/tests/e2e/invites-settings-screenshots.spec.ts
+++ b/desktop/tests/e2e/invites-settings-screenshots.spec.ts
@@ -78,15 +78,25 @@ test("capture: share-style community invite dialog", async ({ page }) => {
   await expect(page.getByTestId("community-invite-email-field")).toHaveCount(0);
   await expect(page.getByPlaceholder("Type an email address")).toHaveCount(0);
   await expect(
-    dialog.getByRole("heading", { name: "Share with a link" }),
+    dialog.getByText("Anyone with this link can join this community."),
   ).toBeVisible();
+  await expect(dialog.getByText("Expires after")).toBeVisible();
+  await expect(dialog.getByText("Limit number of uses")).toBeVisible();
+  await expect(page.getByTestId("invite-link-max-uses-trigger")).toHaveText(
+    "No limit",
+  );
   await expect(page.getByTestId("copy-invite-link")).toHaveText("Copy link");
   await expect(page.getByTestId("invite-link-qr-code")).toHaveCount(0);
   await expect(page.getByTestId("invite-link-url")).toHaveCount(0);
 
   const expiryTrigger = page.getByTestId("invite-link-ttl-trigger");
   await expect(expiryTrigger).toHaveText("3 days");
+  await expect(expiryTrigger).toHaveCSS("font-size", "14px");
+  await expect(
+    dialog.getByText("Limit number of uses", { exact: true }),
+  ).toHaveCSS("font-size", "14px");
   await expiryTrigger.click();
+  await expect(page.getByRole("menu")).not.toContainText("Expires after");
   await expect(
     page.getByRole("menuitemradio", { name: "1 day" }),
   ).toBeVisible();
diff --git a/desktop/tests/e2e/navigation.spec.ts b/desktop/tests/e2e/navigation.spec.ts
index 57d8c5f3b22..f7a96cd568b 100644
--- a/desktop/tests/e2e/navigation.spec.ts
+++ b/desktop/tests/e2e/navigation.spec.ts
@@ -210,21 +210,21 @@ test("home inbox selection survives reload and back restores it", async ({
   expect(page.url()).not.toContain("item=");
   const defaultUrl = page.url();
 
-  const secondItem = items.nth(1);
-  const secondTestId = await secondItem.getAttribute("data-testid");
-  const secondItemId = secondTestId?.replace("home-inbox-item-", "");
-  expect(secondItemId).toBeTruthy();
-  await secondItem.click();
+  const selectedItem = items.first();
+  const selectedTestId = await selectedItem.getAttribute("data-testid");
+  const selectedItemId = selectedTestId?.replace("home-inbox-item-", "");
+  expect(selectedItemId).toBeTruthy();
+  await selectedItem.click();
   await expect
     .poll(() => page.url())
-    .toContain(`item=${encodeURIComponent(secondItemId ?? "")}`);
+    .toContain(`item=${encodeURIComponent(selectedItemId ?? "")}`);
 
   await page.reload();
 
   await expect(inboxList).toBeVisible();
   await expect(page.getByTestId("home-inbox-detail")).toBeVisible();
   expect(page.url()).toContain(
-    `item=${encodeURIComponent(secondItemId ?? "")}`,
+    `item=${encodeURIComponent(selectedItemId ?? "")}`,
   );
 
   await page.getByTestId("global-back").click();
diff --git a/desktop/tests/e2e/onboarding-agent-defaults.spec.ts b/desktop/tests/e2e/onboarding-agent-defaults.spec.ts
index 1c3e86f1335..dbd726d1792 100644
--- a/desktop/tests/e2e/onboarding-agent-defaults.spec.ts
+++ b/desktop/tests/e2e/onboarding-agent-defaults.spec.ts
@@ -92,8 +92,7 @@ test("setup distinguishes a missing CLI from an installed desktop app", async ({
           "not_installed",
           { status: "unknown" },
           {
-            install_hint:
-              "Buzz requires the Codex CLI; the desktop app alone is not enough.",
+            install_hint: "Buzz talks to Codex through the Codex CLI.",
             install_instructions_url:
               "https://developers.openai.com/codex/cli/",
           },
@@ -106,9 +105,7 @@ test("setup distinguishes a missing CLI from an installed desktop app", async ({
   await navigateToSetupPage(page);
 
   const card = page.getByTestId("onboarding-runtime-codex");
-  await expect(card).toContainText(
-    "CLI not detected; the desktop app alone isn’t enough.",
-  );
+  await expect(card).toContainText("CLI not detected.");
   await expect(card.getByTestId("onboarding-runtime-install-codex")).toHaveText(
     "INSTALL",
   );
diff --git a/desktop/tests/e2e/onboarding.spec.ts b/desktop/tests/e2e/onboarding.spec.ts
index bfbfc6f0638..0c4d6309947 100644
--- a/desktop/tests/e2e/onboarding.spec.ts
+++ b/desktop/tests/e2e/onboarding.spec.ts
@@ -1231,12 +1231,6 @@ test("first-community shows the scenario cards for localhost", async ({
 });
 
 test("first-community direct join reaches profile", async ({ page }) => {
-  await page.route(
-    "https://onboarding.communities.buzz.xyz/api/join-policy",
-    async (route) => {
-      await route.fulfill({ status: 404 });
-    },
-  );
   await seedActiveIdentity(page, BLANK_TYLER_IDENTITY);
   await page.addInitScript((pubkey) => {
     window.localStorage.setItem(
@@ -1289,12 +1283,6 @@ test("first-community direct join reaches profile", async ({ page }) => {
 test("first-community direct join cancel returns to request access", async ({
   page,
 }) => {
-  await page.route(
-    "https://onboarding.communities.buzz.xyz/api/join-policy",
-    async (route) => {
-      await route.fulfill({ status: 404 });
-    },
-  );
   await seedActiveIdentity(page, BLANK_TYLER_IDENTITY);
   await page.addInitScript((pubkey) => {
     window.localStorage.setItem(
diff --git a/desktop/tests/e2e/persona-env-vars.spec.ts b/desktop/tests/e2e/persona-env-vars.spec.ts
index 53efa09a0e1..1e9b077a82a 100644
--- a/desktop/tests/e2e/persona-env-vars.spec.ts
+++ b/desktop/tests/e2e/persona-env-vars.spec.ts
@@ -267,10 +267,10 @@ test("env vars editor renders in PersonaDialog new-persona form", async ({
 }) => {
   await gotoApp(page);
 
-  // Open the Agents view, click New > New agent to open the persona dialog.
+  // Open the Agents view, then choose Create agent from the new-agent menu.
   await page.getByTestId("open-agents-view").click();
   await page.getByTestId("new-agent-card").click();
-  await page.getByRole("menuitem", { name: "Create from scratch" }).click();
+  await page.getByRole("menuitem", { name: "Create agent" }).click();
 
   // Scope all env-vars queries to the dialog: AgentDefaultsSettingsCard
   // also renders an EnvVarsEditor in the background settings pane (introduced
@@ -315,7 +315,7 @@ test("persona model options follow the selected LLM provider", async ({
 
   await page.getByTestId("open-agents-view").click();
   await page.getByTestId("new-agent-card").click();
-  await page.getByRole("menuitem", { name: "Create from scratch" }).click();
+  await page.getByRole("menuitem", { name: "Create agent" }).click();
 
   const provider = page.locator("#persona-runtime");
   await page.getByRole("tab", { name: "Customize for this agent" }).click();
diff --git a/desktop/tests/e2e/persona-model-combobox-screenshots.spec.ts b/desktop/tests/e2e/persona-model-combobox-screenshots.spec.ts
index 38d1df09141..508b123d7f1 100644
--- a/desktop/tests/e2e/persona-model-combobox-screenshots.spec.ts
+++ b/desktop/tests/e2e/persona-model-combobox-screenshots.spec.ts
@@ -36,7 +36,7 @@ async function openNewPersonaDialog(page: import("@playwright/test").Page) {
   });
 
   await page.getByTestId("new-agent-card").click();
-  await page.getByRole("menuitem", { name: "Create from scratch" }).click();
+  await page.getByRole("menuitem", { name: "Create agent" }).click();
 
   const dialog = page.getByTestId("persona-dialog");
   await expect(dialog).toBeVisible({ timeout: 8_000 });
diff --git a/desktop/tests/e2e/persona-sync.spec.ts b/desktop/tests/e2e/persona-sync.spec.ts
index 5dfa7e1a16c..84b24f7eb79 100644
--- a/desktop/tests/e2e/persona-sync.spec.ts
+++ b/desktop/tests/e2e/persona-sync.spec.ts
@@ -14,6 +14,10 @@ const TYLER_PUBKEY =
 const D_TAG = "sync-test-persona";
 const KIND_PERSONA = 30175;
 const KIND_DELETION = 5;
+// The command scopes an inbound event to the community it arrived on. Under the
+// mock bridge the app subscribes on e2eBridge's DEFAULT_RELAY_WS_URL, so that is
+// the arrival relay these direct invocations stand in for.
+const ARRIVAL_RELAY_URL = "ws://localhost:3000";
 
 test.beforeEach(async ({ page }) => {
   await installMockBridge(page);
@@ -139,6 +143,7 @@ test("upsert round-trip: reconcile_inbound_persona_event writes record and emits
   // Drive the inbound reconcile path.
   await invokeTauri(page, "reconcile_inbound_persona_event", {
     eventJson: JSON.stringify(personaEvent),
+    arrivalRelayUrl: ARRIVAL_RELAY_URL,
   });
 
   // Assert the record landed on disk.
@@ -176,6 +181,7 @@ test("tombstone round-trip: reconcile_inbound_persona_event removes record and e
 
   await invokeTauri(page, "reconcile_inbound_persona_event", {
     eventJson: JSON.stringify(personaEvent),
+    arrivalRelayUrl: ARRIVAL_RELAY_URL,
   });
 
   // Step 2: confirm it landed.
@@ -202,6 +208,7 @@ test("tombstone round-trip: reconcile_inbound_persona_event removes record and e
 
   await invokeTauri(page, "reconcile_inbound_persona_event", {
     eventJson: JSON.stringify(tombstoneEvent),
+    arrivalRelayUrl: ARRIVAL_RELAY_URL,
   });
 
   // Step 4: assert the record is gone.
diff --git a/desktop/tests/e2e/profile.spec.ts b/desktop/tests/e2e/profile.spec.ts
index a945d159b2c..596f9b0d40d 100644
--- a/desktop/tests/e2e/profile.spec.ts
+++ b/desktop/tests/e2e/profile.spec.ts
@@ -936,10 +936,10 @@ test("renders agent profile ingress subviews from the Playwright mock bridge", a
   await expect(page.getByTestId("agent-memory-list")).toContainText("orphan");
 });
 
-test("restored activity deep link hides the back arrow", async ({ page }) => {
+test("restored Inbox deep link hides the back arrow", async ({ page }) => {
   // Charlie is a `bot` member of #agents and authors a seeded message there;
   // seeding a managed agent with the same pubkey makes that message's avatar
-  // open a managed-agent profile panel with the Activity ingress. Unlike an
+  // open a managed-agent profile panel with the Inbox ingress. Unlike an
   // agent created at runtime through the bridge, this seed survives
   // `page.reload()` because init scripts re-run on navigation.
   const agentPubkey = TEST_IDENTITIES.charlie.pubkey;
@@ -1542,6 +1542,6 @@ test("shows agent runtimes in agent settings", async ({ page }) => {
 
   await openSettings(page, "agents");
 
-  await expect(page.getByTestId("settings-agent-runtimes")).toBeVisible();
+  await expect(page.getByTestId("settings-harnesses")).toBeVisible();
   await expect(page.getByTestId("doctor-runtime-goose")).toContainText("Goose");
 });
diff --git a/desktop/tests/e2e/project-inbox.spec.ts b/desktop/tests/e2e/project-inbox.spec.ts
index c3768a1f59c..bab417af6ee 100644
--- a/desktop/tests/e2e/project-inbox.spec.ts
+++ b/desktop/tests/e2e/project-inbox.spec.ts
@@ -46,7 +46,7 @@ test("Buzz Git pull request renders and stays actionable in Inbox", async ({
         id,
         kind: 1618,
         pubkey: author,
-        content: "Inbox rendering verification",
+        content: "# Inbox rendering verification",
         created_at: Math.floor(Date.now() / 1000) + 1,
         channel_id: null,
         channel_name: "",
@@ -69,6 +69,35 @@ test("Buzz Git pull request renders and stays actionable in Inbox", async ({
 
   const inboxRow = page.getByTestId(`home-inbox-item-${pullRequestId}`);
   await expect(inboxRow).toBeVisible({ timeout: 10_000 });
+  const previewTypography = await inboxRow
+    .locator(".inbox-preview-markdown")
+    .evaluate((preview) => {
+      const firstBlock = preview.firstElementChild;
+      if (!firstBlock) {
+        throw new Error("Expected the Inbox preview to render a first block.");
+      }
+      const previewStyle = getComputedStyle(preview);
+      const firstBlockStyle = getComputedStyle(firstBlock);
+      return {
+        firstBlockTag: firstBlock.tagName,
+        fontSizeMatches: firstBlockStyle.fontSize === previewStyle.fontSize,
+        fontWeightMatches:
+          firstBlockStyle.fontWeight === previewStyle.fontWeight,
+        letterSpacingMatches:
+          firstBlockStyle.letterSpacing === previewStyle.letterSpacing,
+        lineHeightMatches:
+          firstBlockStyle.lineHeight === previewStyle.lineHeight,
+        lineClamp: firstBlockStyle.webkitLineClamp,
+      };
+    });
+  expect(previewTypography).toEqual({
+    firstBlockTag: "H1",
+    fontSizeMatches: true,
+    fontWeightMatches: true,
+    letterSpacingMatches: true,
+    lineHeightMatches: true,
+    lineClamp: "2",
+  });
   await inboxRow.locator(":scope > div").first().click();
 
   const detail = page.getByTestId("home-project-inbox-detail");
diff --git a/desktop/tests/e2e/reminders.spec.ts b/desktop/tests/e2e/reminders.spec.ts
index e6a5a55744b..f60e2243897 100644
--- a/desktop/tests/e2e/reminders.spec.ts
+++ b/desktop/tests/e2e/reminders.spec.ts
@@ -162,7 +162,11 @@ test.describe("reminders", () => {
     ]);
 
     await openRemindersFilter(page);
-    await expect(page.getByText("Follow up on this message")).toBeVisible();
+    await expect(
+      page
+        .getByTestId("home-reminder-item-rem-active-01")
+        .getByText("Follow up on this message"),
+    ).toBeVisible();
     await waitForAnimations(page);
   });
 
@@ -211,8 +215,16 @@ test.describe("reminders", () => {
     ]);
 
     await openRemindersFilter(page);
-    await expect(page.getByText("Reply to Alice")).toBeVisible();
-    await expect(page.getByRole("heading", { name: "Overdue" })).toBeVisible();
+    await expect(
+      page
+        .getByTestId("home-reminder-item-rem-overdue-01")
+        .getByText("Reply to Alice"),
+    ).toBeVisible();
+    await expect(
+      page
+        .getByTestId("home-reminder-item-rem-overdue-01")
+        .getByText("2h overdue"),
+    ).toBeVisible();
     await waitForAnimations(page);
   });
 });
@@ -306,7 +318,7 @@ test.describe("reminders phase 2 — author, source, navigation", () => {
       remindersPanel.getByText("alice", { exact: true }),
     ).toBeVisible();
     await expect(
-      remindersPanel.getByText("general", { exact: true }),
+      remindersPanel.getByText("#general", { exact: true }),
     ).toBeVisible();
     await expect(remindersPanel.getByText("Reply to Alice")).toBeVisible();
     await waitForAnimations(page);
@@ -328,9 +340,17 @@ test.describe("reminders phase 2 — author, source, navigation", () => {
     ]);
 
     await openRemindersFilter(page);
-    // The reminder row body is a button whose preview text is the target
-    // message preview; clicking it navigates to the message in its channel.
-    await page.getByText("Reply to Alice").click();
+    // Selecting a reminder keeps the list visible and opens its detail pane.
+    // Navigation is an explicit action from that detail.
+    await page
+      .getByTestId("home-reminder-item-rem-phase2-nav-01")
+      .getByRole("button")
+      .first()
+      .click();
+    await page
+      .getByTestId("home-reminder-detail")
+      .getByRole("button", { name: "Open message" })
+      .click();
 
     // Lands in the #general chat view with the target message in context.
     await expect(page.getByTestId("chat-title")).toHaveText("general");
diff --git a/desktop/tests/e2e/sidebar.spec.ts b/desktop/tests/e2e/sidebar.spec.ts
index 6ff62a214ac..f56c9575b7a 100644
--- a/desktop/tests/e2e/sidebar.spec.ts
+++ b/desktop/tests/e2e/sidebar.spec.ts
@@ -111,24 +111,15 @@ test("add community starts with create and join choices", async ({ page }) => {
 test("automatically shows community join requirements near the community URL", async ({
   page,
 }) => {
-  await installMockBridge(page, { applyCommunityDelayMs: 1_000 });
-  await page.route(
-    "https://policy.example.com/api/join-policy",
-    async (route) => {
-      await route.fulfill({
-        status: 200,
-        contentType: "application/json",
-        body: JSON.stringify({
-          policy: {
-            terms_markdown: "# Terms",
-            privacy_markdown: "# Privacy",
-            age_attestation_required: true,
-            version: "policy-v1",
-          },
-        }),
-      });
+  await installMockBridge(page, {
+    applyCommunityDelayMs: 1_000,
+    joinPolicy: {
+      terms_markdown: "# Terms",
+      privacy_markdown: "# Privacy",
+      age_attestation_required: true,
+      version: "policy-v1",
     },
-  );
+  });
   await page.goto("/");
 
   await openAddCommunityDialog(page);
@@ -180,12 +171,6 @@ test("supports API tokens without cluttering the default join form", async ({
   page,
 }) => {
   await installMockBridge(page, { applyCommunityDelayMs: 1_000 });
-  await page.route(
-    "https://token.example.com/api/join-policy",
-    async (route) => {
-      await route.fulfill({ status: 404 });
-    },
-  );
   await page.goto("/");
 
   await openAddCommunityDialog(page);
diff --git a/desktop/tests/e2e/smoke.spec.ts b/desktop/tests/e2e/smoke.spec.ts
index ff38d554158..0f61de0f7c4 100644
--- a/desktop/tests/e2e/smoke.spec.ts
+++ b/desktop/tests/e2e/smoke.spec.ts
@@ -2,9 +2,6 @@ import { expect, test } from "@playwright/test";
 
 import { installMockBridge, openCreateChannelDialog } from "../helpers/bridge";
 
-const DEFAULT_AGENT_ACTIVITY_PUBKEY =
-  "db0b028cd36f4d3e36c8300cce87252c1f7fc9495ffecc53f393fcac341ffd36";
-
 async function getTimelineMetrics(page: import("@playwright/test").Page) {
   return page.getByTestId("message-timeline").evaluate((element) => {
     const timeline = element as HTMLDivElement;
@@ -72,7 +69,7 @@ async function expectHomeView(page: import("@playwright/test").Page) {
 
 async function selectHomeInboxFilter(
   page: import("@playwright/test").Page,
-  label: "Activity" | "Agents",
+  label: "Agents",
 ) {
   await page
     .getByTestId("home-inbox")
@@ -141,7 +138,7 @@ test("Buzz shared compute explains automatic model selection", async ({
   });
   await page.getByTestId("open-agents-view").click();
   await page.getByTestId("new-agent-card").click();
-  await page.getByRole("menuitem", { name: "Create from scratch" }).click();
+  await page.getByRole("menuitem", { name: "Create agent" }).click();
   await chooseSharedComputeProvider(page);
 
   await expect
@@ -170,7 +167,7 @@ test("create agent persists Buzz shared compute with auto model", async ({
   await page.goto("/");
   await page.getByTestId("open-agents-view").click();
   await page.getByTestId("new-agent-card").click();
-  await page.getByRole("menuitem", { name: "Create from scratch" }).click();
+  await page.getByRole("menuitem", { name: "Create agent" }).click();
   await page.locator("#persona-display-name").fill(agentName);
 
   await chooseSharedComputeProvider(page);
@@ -214,7 +211,7 @@ test("create agent supports parallelism and system prompt overrides", async ({
   await page.goto("/");
   await page.getByTestId("open-agents-view").click();
   await page.getByTestId("new-agent-card").click();
-  await page.getByRole("menuitem", { name: "Create from scratch" }).click();
+  await page.getByRole("menuitem", { name: "Create agent" }).click();
 
   await page.locator("#persona-display-name").fill(agentName);
   await page
@@ -298,77 +295,23 @@ test("opens a mocked channel from the inbox feed", async ({ page }) => {
   await expect(page.getByTestId("chat-title")).toHaveText("general");
 });
 
-test("inbox feed shows channel and agent activity sections", async ({
+test("Inbox excludes generic channel and unowned agent traffic", async ({
   page,
 }) => {
   const inboxList = page.getByTestId("home-inbox-list");
 
   await page.goto("/");
+  await expectHomeView(page);
 
-  await selectHomeInboxFilter(page, "Activity");
-  await expect(inboxList).toContainText(
+  await expect(inboxList).not.toContainText(
     "Engineering shipped the desktop build.",
   );
-
-  await selectHomeInboxFilter(page, "Agents");
-  await expect(inboxList).toContainText(
+  await expect(inboxList).not.toContainText(
     "Agent progress: channel index complete.",
   );
-  await inboxList.getByText("Agent progress: channel index complete.").click();
-  await expect(page.getByTestId("home-inbox-detail")).toContainText(
-    "Agent progress: channel index complete.",
-  );
-});
-
-test("inbox agent hover hides actions without agent access", async ({
-  page,
-}) => {
-  await page.goto("/");
 
   await selectHomeInboxFilter(page, "Agents");
-  const agentRow = page.getByTestId("home-inbox-item-mock-feed-agent");
-  await expect(agentRow).toContainText(
-    "Agent progress: channel index complete.",
-  );
-
-  await agentRow.getByTestId("home-inbox-avatar-mock-feed-agent").hover();
-  const profilePopover = page.locator(
-    '[data-testid="user-profile-popover"][data-state="open"]',
-  );
-  await expect(profilePopover).toBeVisible();
-  await expect(
-    profilePopover.getByTestId(
-      `user-profile-popover-message-${DEFAULT_AGENT_ACTIVITY_PUBKEY}`,
-    ),
-  ).toHaveCount(0);
-  await expect(
-    profilePopover.getByTestId(
-      `user-profile-popover-wave-${DEFAULT_AGENT_ACTIVITY_PUBKEY}`,
-    ),
-  ).toHaveCount(0);
-  await expect(
-    profilePopover.getByTestId(
-      `user-profile-popover-huddle-${DEFAULT_AGENT_ACTIVITY_PUBKEY}`,
-    ),
-  ).toHaveCount(0);
-});
-
-test("opens a mocked forum activity item from the inbox feed", async ({
-  page,
-}) => {
-  await page.goto("/");
-
-  await selectHomeInboxFilter(page, "Activity");
-  await expect(page.getByTestId("home-inbox-list")).toContainText(
-    "Engineering shipped the desktop build.",
-  );
-  await page
-    .getByTestId("home-inbox-list")
-    .getByText("Engineering shipped the desktop build.")
-    .click();
-  await expect(page.getByTestId("home-inbox-detail")).toContainText(
-    "Engineering shipped the desktop build.",
-  );
+  await expect(inboxList).toContainText("No agent updates found");
 });
 
 test("inbox feed renders resolved author labels", async ({ page }) => {
diff --git a/desktop/tests/e2e/team-snapshot.spec.ts b/desktop/tests/e2e/team-snapshot.spec.ts
index c04a0400474..6246c7ac8c0 100644
--- a/desktop/tests/e2e/team-snapshot.spec.ts
+++ b/desktop/tests/e2e/team-snapshot.spec.ts
@@ -271,7 +271,7 @@ test("team sharing uses the people picker and gates memory before sending", asyn
       `team-share-recipient-option-${TEST_IDENTITIES.charlie.pubkey}`,
     )
     .click();
-  await shareDialog.getByTestId("team-share-recipient-access").click();
+  await shareDialog.getByTestId("team-share-share-level").click();
   await page.getByRole("menuitemradio", { name: "Team + core memory" }).click();
   await shareDialog.getByTestId("team-share-send").click();
 
@@ -311,6 +311,73 @@ test("team sharing uses the people picker and gates memory before sending", asyn
   expect(sendPayload?.content).not.toContain("![image](");
 });
 
+test("team share level carries memories onto the link path too", async ({
+  page,
+}) => {
+  await page.context().grantPermissions(["clipboard-read", "clipboard-write"]);
+  await installMockBridge(page, {
+    personas: [
+      {
+        id: ANALYST_PERSONA_ID,
+        displayName: "Analyst",
+        systemPrompt: "You are an analyst.",
+      },
+    ],
+    managedAgents: [
+      {
+        pubkey: ANALYST_PUBKEY,
+        name: "Analyst",
+        personaId: ANALYST_PERSONA_ID,
+        status: "running",
+      },
+    ],
+    agentMemory: createMockAgentMemoryListing(),
+    uploadDescriptors: [MOCK_UPLOAD_DESCRIPTOR],
+  });
+  await gotoAgentsPage(page);
+
+  await page.getByLabel("Engineering team actions").click();
+  await page.getByRole("menuitem", { name: "Share" }).click();
+  const shareDialog = page.getByTestId("team-share-dialog");
+  await expect(shareDialog).toBeVisible();
+
+  // No recipient selected — the copy-link path alone must still honour the
+  // shared selector and gate plaintext memories behind the confirmation.
+  await shareDialog.getByTestId("team-share-share-level").click();
+  await page.getByRole("menuitemradio", { name: "Team + core memory" }).click();
+  await expect(
+    shareDialog.getByTestId("team-share-memory-warning"),
+  ).toBeVisible();
+  await shareDialog.getByTestId("team-share-copy-link").click();
+
+  const memoryConfirmation = page.getByTestId("team-share-memory-confirmation");
+  await expect(memoryConfirmation).toBeVisible();
+  await expect(memoryConfirmation).toContainText("plaintext core memory");
+  await expect(memoryConfirmation).toContainText(
+    "Anyone with the link can view it.",
+  );
+  const encodeLevelsBeforeConfirmation = (await readCommandLog(page))
+    .filter((entry) => entry.command === "encode_team_snapshot_for_send")
+    .map(
+      (entry) =>
+        (entry.payload as { memoryLevel?: string } | undefined)?.memoryLevel,
+    );
+  expect(encodeLevelsBeforeConfirmation).toEqual([]);
+
+  await memoryConfirmation.getByTestId("team-share-memory-confirm").click();
+  await expect(shareDialog.getByTestId("team-share-copy-link")).toContainText(
+    "Copied",
+  );
+  expect(
+    (await readCommandLog(page)).filter(
+      (entry) =>
+        entry.command === "encode_team_snapshot_for_send" &&
+        (entry.payload as { memoryLevel?: string } | undefined)?.memoryLevel ===
+          "core",
+    ),
+  ).toHaveLength(1);
+});
+
 test("team sharing keeps link copy and export in the shared surface", async ({
   page,
 }) => {
@@ -343,7 +410,7 @@ test("team sharing keeps link copy and export in the shared surface", async ({
   await menu.getByRole("menuitem", { name: "Share" }).click();
 
   const shareDialog = page.getByTestId("team-share-dialog");
-  await expect(shareDialog.getByTestId("team-share-link-access")).toHaveText(
+  await expect(shareDialog.getByTestId("team-share-share-level")).toHaveText(
     "Team only",
   );
   const exportTeamRow = shareDialog.getByTestId("team-share-export");
@@ -351,7 +418,7 @@ test("team sharing keeps link copy and export in the shared surface", async ({
   const recipientSearch = shareDialog.getByTestId(
     "team-share-recipient-search",
   );
-  const linkAccess = shareDialog.getByTestId("team-share-link-access");
+  const shareLevel = shareDialog.getByTestId("team-share-share-level");
   const closeButton = shareDialog.getByRole("button", { name: "Close" });
   await waitForAnimations(page);
   await expect(
@@ -363,7 +430,7 @@ test("team sharing keeps link copy and export in the shared surface", async ({
   await expect(copyLinkButton).toContainText("Copying…");
   await expect(copyLinkButton).toHaveCSS("opacity", "1");
   await expect(recipientSearch).toBeEnabled();
-  await expect(linkAccess).toBeEnabled();
+  await expect(shareLevel).toBeEnabled();
   await expect(closeButton).toBeDisabled();
   await expect(exportTeamRow).toBeDisabled();
   await expect(exportTeamRow).toHaveCSS("opacity", "1");
diff --git a/desktop/tests/helpers/bridge.ts b/desktop/tests/helpers/bridge.ts
index d5bd6ae0ddd..ca4d62ddd62 100644
--- a/desktop/tests/helpers/bridge.ts
+++ b/desktop/tests/helpers/bridge.ts
@@ -1,5 +1,5 @@
 import type { Page } from "@playwright/test";
-import type { ChannelTemplate } from "../../src/shared/api/types";
+import type { ChannelTemplate, RelayEvent } from "../../src/shared/api/types";
 import { FEATURE_OVERRIDES_STORAGE_KEY, PREVIEW_FEATURE_IDS } from "./features";
 
 export const TEST_IDENTITIES = {
@@ -88,7 +88,9 @@ type MockPersonaSeed = {
   displayName: string;
   avatarUrl?: string | null;
   systemPrompt: string;
+  updatedAt?: string;
   isActive?: boolean;
+  shared?: boolean;
   sourceTeam?: string | null;
   envVars?: Record<string, string>;
   /**
@@ -103,6 +105,8 @@ type MockPersonaSeed = {
   /** Provider pinned on the persona. Leave empty for Codex/Claude runtimes. */
   provider?: string | null;
   namePool?: string[];
+  respondTo?: "owner-only" | "allowlist" | "anyone";
+  respondToAllowlist?: string[];
 };
 
 type MockTeamSeed = {
@@ -134,6 +138,13 @@ type MockBridgeOptions = {
   relaySelf?: string | null;
   /** Builderlab account returned by hosted-community onboarding. Null/omitted = signed out. */
   builderlabAuth?: { email?: string; name?: string; expiresAt: string } | null;
+  /** Optional policy returned by the native join-policy discovery command. */
+  joinPolicy?: {
+    terms_markdown?: string;
+    privacy_markdown?: string;
+    age_attestation_required: boolean;
+    version: string;
+  } | null;
   /** Bound Builderlab Nostr identity. Null/omitted = not linked yet. */
   builderlabIdentity?: { npub?: string; pubkey_hex?: string } | null;
   /** Communities owned by the mocked Builderlab account. */
@@ -213,6 +224,10 @@ type MockBridgeOptions = {
       | "stopped";
   }>;
   personas?: MockPersonaSeed[];
+  /** Community catalog replaceable-event heads returned by relay queries. */
+  personaCatalogEvents?: RelayEvent[];
+  /** Outcomes for successive explicit persona share publications. */
+  personaSharePublicationStatuses?: Array<"published" | "queued">;
   teams?: MockTeamSeed[];
   relayAgents?: MockRelayAgentSeed[];
   agentListDelayMs?: number;
diff --git a/lefthook.yml b/lefthook.yml
index 87eaa87c21b..75d205722f5 100644
--- a/lefthook.yml
+++ b/lefthook.yml
@@ -61,12 +61,12 @@ pre-push:
       glob: ["desktop/**", "pnpm-lock.yaml"]
       exclude: ["desktop/src-tauri/**"]
       run: just desktop-test
-    desktop-tauri-test:
-      # ci.yml:113 — Desktop Core triggers on `rust` OR `desktop-rust`;
-      # desktop/src-tauri path-depends on crates/buzz-core, buzz-persona,
-      # buzz-sdk, buzz-agent (desktop/src-tauri/Cargo.toml:88-91).
+    desktop-tauri-checks:
+      # Keep local lint parity with Desktop Core CI for every path that can
+      # affect the Tauri crate or its path dependencies. Run clippy and tests
+      # serially so parallel pre-push hooks do not contend for Cargo's lock.
       glob: ["desktop/src-tauri/**", "crates/**", "migrations/**", "schema/**", "Cargo.toml", "Cargo.lock", "rust-toolchain.toml", "deny.toml", "scripts/run-tests.sh", "justfile"]
-      run: just desktop-tauri-test
+      run: just desktop-tauri-clippy && just desktop-tauri-test
     mobile-test:
       glob: ["mobile/**"]
       run: just mobile-test
diff --git a/migrations/0025_relay_invites.sql b/migrations/0025_relay_invites.sql
new file mode 100644
index 00000000000..618c0c84d3c
--- /dev/null
+++ b/migrations/0025_relay_invites.sql
@@ -0,0 +1,33 @@
+-- Use-limited invite links: durable invite records for atomic redemption.
+--
+-- Stateless HMAC bearer tokens (v1) cannot enforce use limits: their signed
+-- payload is immutable and no invite row exists to record consumption. This
+-- migration introduces a durable `relay_invites` table that stores only the
+-- SHA-256 hash of an opaque v2 code, never the reusable bearer secret itself.
+--
+-- Every lookup binds both (community_id, token_hash) so a code presented on
+-- the wrong tenant host returns Invalid — there is no cross-tenant lookup by
+-- hash alone. `FOR UPDATE` during claim serializes concurrent claims for one
+-- invite across relay processes; membership insertion, join-policy evidence,
+-- and use_count increment share a single commit so exactly one claimant can
+-- win the final slot.
+--
+-- max_uses is optional: NULL means unlimited (preserving current behavior).
+-- use_count is always incremented for new members, even when unlimited, for
+-- observability. role is pinned to 'member' — invite links never grant admin.
+CREATE TABLE relay_invites (
+    community_id  UUID        NOT NULL REFERENCES communities(id),
+    id           UUID        NOT NULL DEFAULT gen_random_uuid(),
+    token_hash   BYTEA       NOT NULL CHECK (length(token_hash) = 32),
+    role         TEXT        NOT NULL DEFAULT 'member' CHECK (role = 'member'),
+    max_uses     INTEGER     CHECK (max_uses BETWEEN 1 AND 10000),
+    use_count    INTEGER     NOT NULL DEFAULT 0 CHECK (use_count >= 0),
+    expires_at   TIMESTAMPTZ NOT NULL,
+    created_by   TEXT        NOT NULL,
+    created_at   TIMESTAMPTZ NOT NULL DEFAULT now(),
+    PRIMARY KEY (community_id, id),
+    UNIQUE (community_id, token_hash),
+    CHECK (max_uses IS NULL OR use_count <= max_uses)
+);
+
+CREATE INDEX relay_invites_expires_at_idx ON relay_invites (expires_at);
diff --git a/mobile/android/app/src/main/AndroidManifest.xml b/mobile/android/app/src/main/AndroidManifest.xml
index 17a16742aff..5e607ad2ea7 100644
--- a/mobile/android/app/src/main/AndroidManifest.xml
+++ b/mobile/android/app/src/main/AndroidManifest.xml
@@ -1,6 +1,18 @@
-<manifest xmlns:android="http://schemas.android.com/apk/res/android">
+<manifest
+    xmlns:android="http://schemas.android.com/apk/res/android"
+    xmlns:tools="http://schemas.android.com/tools">
     <uses-permission android:name="android.permission.INTERNET" />
     <uses-permission android:name="android.permission.CAMERA" />
+    <uses-permission
+        android:name="android.permission.READ_EXTERNAL_STORAGE"
+        android:maxSdkVersion="32"
+        tools:replace="android:maxSdkVersion" />
+    <uses-permission
+        android:name="android.permission.WRITE_EXTERNAL_STORAGE"
+        android:maxSdkVersion="28" />
+    <uses-permission android:name="android.permission.READ_MEDIA_IMAGES" />
+    <uses-permission android:name="android.permission.READ_MEDIA_VIDEO" />
+    <uses-permission android:name="android.permission.READ_MEDIA_VISUAL_USER_SELECTED" />
     <application
         android:label="@string/app_name"
         android:name="${applicationName}"
diff --git a/mobile/android/app/src/main/kotlin/xyz/block/buzz/mobile/MainActivity.kt b/mobile/android/app/src/main/kotlin/xyz/block/buzz/mobile/MainActivity.kt
index 47582fc08ce..8718ffd8e2d 100644
--- a/mobile/android/app/src/main/kotlin/xyz/block/buzz/mobile/MainActivity.kt
+++ b/mobile/android/app/src/main/kotlin/xyz/block/buzz/mobile/MainActivity.kt
@@ -97,6 +97,9 @@ class MainActivity : FlutterActivity() {
                     TRANSCODE_VIDEO_TO_MP4_METHOD -> {
                         handleTranscodeVideoToMp4(call.arguments, result)
                     }
+                    REQUIRES_LEGACY_MEDIA_STORAGE_PERMISSION_METHOD -> {
+                        result.success(Build.VERSION.SDK_INT <= Build.VERSION_CODES.P)
+                    }
                     else -> result.notImplemented()
                 }
             }
@@ -284,5 +287,7 @@ class MainActivity : FlutterActivity() {
         private const val SANITIZE_IMAGE_FOR_UPLOAD_METHOD = "sanitizeImageForUpload"
         private const val TRANSCODE_IMAGE_TO_JPEG_METHOD = "transcodeImageToJpeg"
         private const val TRANSCODE_VIDEO_TO_MP4_METHOD = "transcodeVideoToMp4"
+        private const val REQUIRES_LEGACY_MEDIA_STORAGE_PERMISSION_METHOD =
+            "requiresLegacyMediaStoragePermission"
     }
 }
diff --git a/mobile/android/settings.gradle.kts b/mobile/android/settings.gradle.kts
index 1047f1a60e3..6d15bcfeea2 100644
--- a/mobile/android/settings.gradle.kts
+++ b/mobile/android/settings.gradle.kts
@@ -20,7 +20,7 @@ pluginManagement {
 plugins {
     id("dev.flutter.flutter-plugin-loader") version "1.0.0"
     id("com.android.application") version "8.11.2" apply false
-    id("org.jetbrains.kotlin.android") version "2.2.20" apply false
+    id("org.jetbrains.kotlin.android") version "2.2.21" apply false
 }
 
 include(":app")
diff --git a/mobile/ios/Podfile.lock b/mobile/ios/Podfile.lock
index ba8c828d25f..c1a2b9e13c0 100644
--- a/mobile/ios/Podfile.lock
+++ b/mobile/ios/Podfile.lock
@@ -22,6 +22,11 @@ PODS:
     - Flutter
   - package_info_plus (0.4.5):
     - Flutter
+  - photo_manager (3.11.0):
+    - Flutter
+    - FlutterMacOS
+  - share_plus (0.0.1):
+    - Flutter
   - shared_preferences_foundation (0.0.1):
     - Flutter
     - FlutterMacOS
@@ -43,6 +48,8 @@ DEPENDENCIES:
   - mobile_scanner (from `.symlinks/plugins/mobile_scanner/darwin`)
   - open_filex (from `.symlinks/plugins/open_filex/ios`)
   - package_info_plus (from `.symlinks/plugins/package_info_plus/ios`)
+  - photo_manager (from `.symlinks/plugins/photo_manager/darwin`)
+  - share_plus (from `.symlinks/plugins/share_plus/ios`)
   - shared_preferences_foundation (from `.symlinks/plugins/shared_preferences_foundation/darwin`)
   - url_launcher_ios (from `.symlinks/plugins/url_launcher_ios/ios`)
   - video_player_avfoundation (from `.symlinks/plugins/video_player_avfoundation/darwin`)
@@ -70,6 +77,10 @@ EXTERNAL SOURCES:
     :path: ".symlinks/plugins/open_filex/ios"
   package_info_plus:
     :path: ".symlinks/plugins/package_info_plus/ios"
+  photo_manager:
+    :path: ".symlinks/plugins/photo_manager/darwin"
+  share_plus:
+    :path: ".symlinks/plugins/share_plus/ios"
   shared_preferences_foundation:
     :path: ".symlinks/plugins/shared_preferences_foundation/darwin"
   url_launcher_ios:
@@ -89,6 +100,8 @@ SPEC CHECKSUMS:
   mobile_scanner: 9157936403f5a0644ca3779a38ff8404c5434a93
   open_filex: 432f3cd11432da3e39f47fcc0df2b1603854eff1
   package_info_plus: af8e2ca6888548050f16fa2f1938db7b5a5df499
+  photo_manager: 6ab48c2ce7ec21aa06d59e6cc049f0b6d9ba7f94
+  share_plus: 50da8cb520a8f0f65671c6c6a99b3617ed10a58a
   shared_preferences_foundation: 7036424c3d8ec98dfe75ff1667cb0cd531ec82bb
   url_launcher_ios: 7a95fa5b60cc718a708b8f2966718e93db0cef1b
   video_player_avfoundation: dd410b52df6d2466a42d28550e33e4146928280a
diff --git a/mobile/ios/Runner.xcodeproj/project.pbxproj b/mobile/ios/Runner.xcodeproj/project.pbxproj
index 46c61ce2fc9..d965f446991 100644
--- a/mobile/ios/Runner.xcodeproj/project.pbxproj
+++ b/mobile/ios/Runner.xcodeproj/project.pbxproj
@@ -10,6 +10,9 @@
 		1498D2341E8E89220040F4C2 /* GeneratedPluginRegistrant.m in Sources */ = {isa = PBXBuildFile; fileRef = 1498D2331E8E89220040F4C2 /* GeneratedPluginRegistrant.m */; };
 		331C808B294A63AB00263BE5 /* RunnerTests.swift in Sources */ = {isa = PBXBuildFile; fileRef = 331C807B294A618700263BE5 /* RunnerTests.swift */; };
 		331C809B294A63AB00263BE5 /* MediaSanitizer.swift in Sources */ = {isa = PBXBuildFile; fileRef = 331C809A294A618700263BE5 /* MediaSanitizer.swift */; };
+		4A71C0012F40100100A17E01 /* InlinePhotoPicker.swift in Sources */ = {isa = PBXBuildFile; fileRef = 4A71C0022F40100100A17E01 /* InlinePhotoPicker.swift */; };
+		4A71C0032F40200100A17E01 /* NativeAttachmentPopover.swift in Sources */ = {isa = PBXBuildFile; fileRef = 4A71C0042F40200100A17E01 /* NativeAttachmentPopover.swift */; };
+		4A71C0052F40300100A17E01 /* NativeAttachmentPopoverCoordinator.swift in Sources */ = {isa = PBXBuildFile; fileRef = 4A71C0062F40300100A17E01 /* NativeAttachmentPopoverCoordinator.swift */; };
 		331C809D294A63AB00263BE5 /* UIKitEncoded.png in Resources */ = {isa = PBXBuildFile; fileRef = 331C809C294A618700263BE5 /* UIKitEncoded.png */; };
 		331C809F294A63AB00263BE5 /* UIKitEncoded.jpg in Resources */ = {isa = PBXBuildFile; fileRef = 331C809E294A618700263BE5 /* UIKitEncoded.jpg */; };
 		33ADD70AB275E0EC81295559 /* Pods_Runner.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 8906419FB4E98B4B12B7A56F /* Pods_Runner.framework */; };
@@ -51,6 +54,9 @@
 		30CE81D3D1E0B195EF2A6390 /* Pods-Runner.release.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; name = "Pods-Runner.release.xcconfig"; path = "Target Support Files/Pods-Runner/Pods-Runner.release.xcconfig"; sourceTree = "<group>"; };
 		331C807B294A618700263BE5 /* RunnerTests.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = RunnerTests.swift; sourceTree = "<group>"; };
 		331C809A294A618700263BE5 /* MediaSanitizer.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = MediaSanitizer.swift; sourceTree = "<group>"; };
+		4A71C0022F40100100A17E01 /* InlinePhotoPicker.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = InlinePhotoPicker.swift; sourceTree = "<group>"; };
+		4A71C0042F40200100A17E01 /* NativeAttachmentPopover.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = NativeAttachmentPopover.swift; sourceTree = "<group>"; };
+		4A71C0062F40300100A17E01 /* NativeAttachmentPopoverCoordinator.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = NativeAttachmentPopoverCoordinator.swift; sourceTree = "<group>"; };
 		331C809C294A618700263BE5 /* UIKitEncoded.png */ = {isa = PBXFileReference; lastKnownFileType = image.png; path = UIKitEncoded.png; sourceTree = "<group>"; };
 		331C809E294A618700263BE5 /* UIKitEncoded.jpg */ = {isa = PBXFileReference; lastKnownFileType = image.jpeg; path = UIKitEncoded.jpg; sourceTree = "<group>"; };
 		331C8081294A63A400263BE5 /* RunnerTests.xctest */ = {isa = PBXFileReference; explicitFileType = wrapper.cfbundle; includeInIndex = 0; path = RunnerTests.xctest; sourceTree = BUILT_PRODUCTS_DIR; };
@@ -170,6 +176,9 @@
 				1498D2331E8E89220040F4C2 /* GeneratedPluginRegistrant.m */,
 				74858FAE1ED2DC5600515810 /* AppDelegate.swift */,
 				331C809A294A618700263BE5 /* MediaSanitizer.swift */,
+				4A71C0022F40100100A17E01 /* InlinePhotoPicker.swift */,
+				4A71C0042F40200100A17E01 /* NativeAttachmentPopover.swift */,
+				4A71C0062F40300100A17E01 /* NativeAttachmentPopoverCoordinator.swift */,
 				7884E8672EC3CC0400C636F2 /* SceneDelegate.swift */,
 				74858FAD1ED2DC5600515810 /* Runner-Bridging-Header.h */,
 			);
@@ -401,6 +410,9 @@
 			files = (
 				74858FAF1ED2DC5600515810 /* AppDelegate.swift in Sources */,
 				331C809B294A63AB00263BE5 /* MediaSanitizer.swift in Sources */,
+				4A71C0012F40100100A17E01 /* InlinePhotoPicker.swift in Sources */,
+				4A71C0032F40200100A17E01 /* NativeAttachmentPopover.swift in Sources */,
+				4A71C0052F40300100A17E01 /* NativeAttachmentPopoverCoordinator.swift in Sources */,
 				1498D2341E8E89220040F4C2 /* GeneratedPluginRegistrant.m in Sources */,
 				7884E8682EC3CC0700C636F2 /* SceneDelegate.swift in Sources */,
 			);
diff --git a/mobile/ios/Runner/AppDelegate.swift b/mobile/ios/Runner/AppDelegate.swift
index 5edb4b6aaf6..f6fe3aaf489 100644
--- a/mobile/ios/Runner/AppDelegate.swift
+++ b/mobile/ios/Runner/AppDelegate.swift
@@ -7,6 +7,8 @@ import UserNotifications
 @objc class AppDelegate: FlutterAppDelegate, FlutterImplicitEngineDelegate {
   private var mediaUploadChannel: FlutterMethodChannel?
   private var qrScannerChannel: FlutterMethodChannel?
+  private var inlinePhotoPickerSupportChannel: FlutterMethodChannel?
+  private var nativeAttachmentPopoverCoordinator: NativeAttachmentPopoverCoordinator?
 
   override func application(
     _ application: UIApplication,
@@ -18,20 +20,56 @@ import UserNotifications
 
   func didInitializeImplicitFlutterEngine(_ engineBridge: FlutterImplicitEngineBridge) {
     GeneratedPluginRegistrant.register(with: engineBridge.pluginRegistry)
+    let messenger = engineBridge.applicationRegistrar.messenger()
     mediaUploadChannel = FlutterMethodChannel(
       name: "buzz/media_upload",
-      binaryMessenger: engineBridge.applicationRegistrar.messenger()
+      binaryMessenger: messenger
     )
     mediaUploadChannel?.setMethodCallHandler { [weak self] call, result in
       self?.handleMediaUploadMethodCall(call, result: result)
     }
     qrScannerChannel = FlutterMethodChannel(
       name: "buzz/qr_scanner",
-      binaryMessenger: engineBridge.applicationRegistrar.messenger()
+      binaryMessenger: messenger
     )
     qrScannerChannel?.setMethodCallHandler { call, result in
       Self.handleQrScannerMethodCall(call, result: result)
     }
+    inlinePhotoPickerSupportChannel = FlutterMethodChannel(
+      name: "buzz/inline_photo_picker",
+      binaryMessenger: messenger
+    )
+    inlinePhotoPickerSupportChannel?.setMethodCallHandler { call, result in
+      guard call.method == "isSupported" else {
+        result(FlutterMethodNotImplemented)
+        return
+      }
+      if #available(iOS 17.0, *) {
+        result(true)
+      } else {
+        result(false)
+      }
+    }
+
+    if let inlinePhotoPickerRegistrar = engineBridge.pluginRegistry.registrar(
+      forPlugin: "BuzzInlinePhotoPicker"
+    ) {
+      inlinePhotoPickerRegistrar.register(
+        InlinePhotoPickerFactory(
+          messenger: messenger,
+          parentViewController: inlinePhotoPickerRegistrar.viewController
+        ),
+        withId: "buzz/inline_photo_picker"
+      )
+    }
+
+    let nativeAttachmentRegistrar = engineBridge.pluginRegistry.registrar(
+      forPlugin: "BuzzNativeAttachmentPopover"
+    )
+    nativeAttachmentPopoverCoordinator = NativeAttachmentPopoverCoordinator(
+      messenger: messenger,
+      parentViewController: nativeAttachmentRegistrar?.viewController
+    )
   }
 
   private static func handleQrScannerMethodCall(
@@ -231,10 +269,12 @@ import UserNotifications
     let sourceURL = URL(fileURLWithPath: sourcePath)
     let asset = AVURLAsset(url: sourceURL)
 
-    guard let exportSession = AVAssetExportSession(
-      asset: asset,
-      presetName: AVAssetExportPresetPassthrough
-    ) else {
+    guard
+      let exportSession = AVAssetExportSession(
+        asset: asset,
+        presetName: AVAssetExportPresetPassthrough
+      )
+    else {
       result(
         FlutterError(
           code: "transcode_failed",
@@ -259,7 +299,8 @@ import UserNotifications
       case .completed:
         result(outputURL.path)
       default:
-        let errorMessage = exportSession.error?.localizedDescription
+        let errorMessage =
+          exportSession.error?.localizedDescription
           ?? "Video transcoding failed with status \(exportSession.status.rawValue)."
         result(
           FlutterError(
diff --git a/mobile/ios/Runner/Info.plist b/mobile/ios/Runner/Info.plist
index 70ba34a11ff..81227c202bd 100644
--- a/mobile/ios/Runner/Info.plist
+++ b/mobile/ios/Runner/Info.plist
@@ -47,6 +47,10 @@
 	<string>Buzz needs camera access so you can take photos to attach to messages and scan QR codes for device pairing.</string>
 	<key>NSPhotoLibraryUsageDescription</key>
 	<string>Buzz needs photo library access so you can attach images to messages.</string>
+	<key>NSPhotoLibraryAddUsageDescription</key>
+	<string>Buzz needs permission to save images to your photo library.</string>
+	<key>PHPhotoLibraryPreventAutomaticLimitedAccessAlert</key>
+	<true/>
 	<key>UIApplicationSceneManifest</key>
 	<dict>
 		<key>UIApplicationSupportsMultipleScenes</key>
diff --git a/mobile/ios/Runner/InlinePhotoPicker.swift b/mobile/ios/Runner/InlinePhotoPicker.swift
new file mode 100644
index 00000000000..05a576323f9
--- /dev/null
+++ b/mobile/ios/Runner/InlinePhotoPicker.swift
@@ -0,0 +1,248 @@
+import Flutter
+import PhotosUI
+import UIKit
+import UniformTypeIdentifiers
+
+enum EmbeddedPhotoPickerLayout {
+  static func applyPreferredScale(_ zoomIn: () -> Void) {
+    UIView.performWithoutAnimation {
+      zoomIn()
+    }
+  }
+}
+
+final class InlinePhotoPickerFactory: NSObject, FlutterPlatformViewFactory {
+  private let messenger: FlutterBinaryMessenger
+  private weak var parentViewController: UIViewController?
+
+  init(
+    messenger: FlutterBinaryMessenger,
+    parentViewController: UIViewController?
+  ) {
+    self.messenger = messenger
+    self.parentViewController = parentViewController
+    super.init()
+  }
+
+  func create(
+    withFrame frame: CGRect,
+    viewIdentifier viewId: Int64,
+    arguments args: Any?
+  ) -> FlutterPlatformView {
+    InlinePhotoPickerPlatformView(
+      frame: frame,
+      viewIdentifier: viewId,
+      messenger: messenger,
+      parentViewController: parentViewController
+    )
+  }
+}
+
+final class InlinePhotoPickerPlatformView: NSObject, FlutterPlatformView {
+  private let containerView: UIView
+  private let channel: FlutterMethodChannel
+  private weak var parentViewController: UIViewController?
+  private var pickerViewController: PHPickerViewController?
+  private var selectionGeneration = 0
+  private var selectionTask: Task<Void, Never>?
+  private var selectedTemporaryPaths: [String] = []
+
+  init(
+    frame: CGRect,
+    viewIdentifier viewId: Int64,
+    messenger: FlutterBinaryMessenger,
+    parentViewController: UIViewController?
+  ) {
+    containerView = UIView(frame: frame)
+    channel = FlutterMethodChannel(
+      name: "buzz/inline_photo_picker/\(viewId)",
+      binaryMessenger: messenger
+    )
+    self.parentViewController = parentViewController
+    super.init()
+
+    channel.setMethodCallHandler { [weak self] call, result in
+      guard call.method == "claimSelection" else {
+        result(FlutterMethodNotImplemented)
+        return
+      }
+      let paths = call.arguments as? [String] ?? []
+      guard let self, paths == self.selectedTemporaryPaths else {
+        result(false)
+        return
+      }
+      self.selectedTemporaryPaths = []
+      result(true)
+    }
+
+    containerView.backgroundColor = .clear
+    containerView.clipsToBounds = true
+    if #available(iOS 17.0, *) {
+      installPicker()
+    }
+  }
+
+  deinit {
+    selectionTask?.cancel()
+    Self.removeTemporaryFiles(selectedTemporaryPaths)
+    channel.setMethodCallHandler(nil)
+    pickerViewController?.willMove(toParent: nil)
+    pickerViewController?.view.removeFromSuperview()
+    pickerViewController?.removeFromParent()
+  }
+
+  func view() -> UIView {
+    containerView
+  }
+
+  @available(iOS 17.0, *)
+  private func installPicker() {
+    var configuration = PHPickerConfiguration(photoLibrary: .shared())
+    configuration.filter = .images
+    configuration.selectionLimit = 0
+    configuration.selection = .continuousAndOrdered
+    configuration.preferredAssetRepresentationMode = .compatible
+    configuration.disabledCapabilities = [
+      .search,
+      .stagingArea,
+      .collectionNavigation,
+      .selectionActions,
+    ]
+    configuration.edgesWithoutContentMargins = .all
+
+    let picker = PHPickerViewController(configuration: configuration)
+    picker.delegate = self
+    picker.view.backgroundColor = .clear
+    picker.view.translatesAutoresizingMaskIntoConstraints = false
+
+    if let parentViewController {
+      parentViewController.addChild(picker)
+    }
+    containerView.addSubview(picker.view)
+    NSLayoutConstraint.activate([
+      picker.view.leadingAnchor.constraint(equalTo: containerView.leadingAnchor),
+      picker.view.trailingAnchor.constraint(equalTo: containerView.trailingAnchor),
+      picker.view.topAnchor.constraint(equalTo: containerView.topAnchor),
+      picker.view.bottomAnchor.constraint(equalTo: containerView.bottomAnchor),
+    ])
+    if parentViewController != nil {
+      picker.didMove(toParent: parentViewController)
+    }
+    pickerViewController = picker
+    containerView.layoutIfNeeded()
+    EmbeddedPhotoPickerLayout.applyPreferredScale {
+      picker.zoomIn()
+    }
+  }
+
+  private func exportPickerResult(_ result: PHPickerResult) async throws -> String {
+    let provider = result.itemProvider
+    guard
+      let typeIdentifier = provider.registeredTypeIdentifiers.first(where: {
+        guard let type = UTType($0) else { return false }
+        return type.conforms(to: .image)
+      })
+    else {
+      throw InlinePhotoPickerError.unsupportedImage
+    }
+
+    return try await withCheckedThrowingContinuation { continuation in
+      provider.loadFileRepresentation(forTypeIdentifier: typeIdentifier) {
+        sourceURL,
+        error in
+        if let error {
+          continuation.resume(throwing: error)
+          return
+        }
+        guard let sourceURL else {
+          continuation.resume(throwing: InlinePhotoPickerError.missingFile)
+          return
+        }
+
+        do {
+          let fileExtension =
+            sourceURL.pathExtension.isEmpty
+            ? (UTType(typeIdentifier)?.preferredFilenameExtension ?? "jpg")
+            : sourceURL.pathExtension
+          let destinationURL = FileManager.default.temporaryDirectory
+            .appendingPathComponent(UUID().uuidString)
+            .appendingPathExtension(fileExtension)
+          try FileManager.default.copyItem(
+            at: sourceURL,
+            to: destinationURL
+          )
+          continuation.resume(returning: destinationURL.path)
+        } catch {
+          continuation.resume(throwing: error)
+        }
+      }
+    }
+  }
+
+  private static func removeTemporaryFiles(_ paths: [String]) {
+    for path in paths where !path.isEmpty {
+      try? FileManager.default.removeItem(atPath: path)
+    }
+  }
+}
+
+extension InlinePhotoPickerPlatformView: PHPickerViewControllerDelegate {
+  func picker(
+    _ picker: PHPickerViewController,
+    didFinishPicking results: [PHPickerResult]
+  ) {
+    selectionGeneration += 1
+    let generation = selectionGeneration
+    selectionTask?.cancel()
+    selectionTask = nil
+    Self.removeTemporaryFiles(selectedTemporaryPaths)
+    selectedTemporaryPaths = []
+    channel.invokeMethod(
+      "selectionCountChanged",
+      arguments: results.count
+    )
+
+    guard !results.isEmpty else {
+      channel.invokeMethod("selectionDidChange", arguments: [String]())
+      return
+    }
+
+    selectionTask = Task { [weak self] in
+      guard let self else { return }
+      var paths: [String] = []
+      do {
+        for result in results {
+          try Task.checkCancellation()
+          paths.append(try await self.exportPickerResult(result))
+        }
+        try Task.checkCancellation()
+        await MainActor.run {
+          guard generation == self.selectionGeneration else {
+            Self.removeTemporaryFiles(paths)
+            return
+          }
+          self.selectedTemporaryPaths = paths
+          self.selectionTask = nil
+          self.channel.invokeMethod("selectionDidChange", arguments: paths)
+        }
+      } catch is CancellationError {
+        Self.removeTemporaryFiles(paths)
+      } catch {
+        Self.removeTemporaryFiles(paths)
+        await MainActor.run {
+          guard generation == self.selectionGeneration else { return }
+          self.selectionTask = nil
+          self.channel.invokeMethod(
+            "didFail",
+            arguments: "Unable to prepare the selected photos."
+          )
+        }
+      }
+    }
+  }
+}
+
+private enum InlinePhotoPickerError: Error {
+  case missingFile
+  case unsupportedImage
+}
diff --git a/mobile/ios/Runner/NativeAttachmentPopover.swift b/mobile/ios/Runner/NativeAttachmentPopover.swift
new file mode 100644
index 00000000000..f2f6c01df83
--- /dev/null
+++ b/mobile/ios/Runner/NativeAttachmentPopover.swift
@@ -0,0 +1,1089 @@
+import AVFoundation
+import Flutter
+import PhotosUI
+import UIKit
+import UniformTypeIdentifiers
+
+@available(iOS 26.0, *)
+final class NativeAttachmentPopoverViewController:
+  UIViewController,
+  PHPickerViewControllerDelegate,
+  UIPopoverPresentationControllerDelegate,
+  AVCapturePhotoCaptureDelegate
+{
+  private enum Surface {
+    case menu
+    case photos
+    case camera
+  }
+
+  private typealias ContentPreparation = (@escaping () -> Void) -> Void
+
+  private let channel: FlutterMethodChannel
+  private let expandedWidth: CGFloat
+  private let maximumMenuHeight: CGFloat
+  private let expandedHeight = NativeAttachmentMenuLayout.maximumHeight
+  private let contentHost = UIView()
+  private let cameraSession = AVCaptureSession()
+  private let cameraOutput = AVCapturePhotoOutput()
+  private let cameraQueue = DispatchQueue(
+    label: "buzz.native-attachment-camera"
+  )
+
+  private var surface = Surface.menu
+  private var visibleContentView: UIView?
+  private var photoPickerViewController: PHPickerViewController?
+  private var cameraPreviewLayer: AVCaptureVideoPreviewLayer?
+  private weak var cameraPreviewView: UIView?
+  private weak var photoActionButton: UIButton?
+  private weak var cameraCaptureButton: UIButton?
+  private var cameraDevice: AVCaptureDevice?
+  private var cameraRotationCoordinator: AVCaptureDevice.RotationCoordinator?
+  private var cameraRotationObservation: NSKeyValueObservation?
+  private var selectionGeneration = 0
+  private var selectionTask: Task<Void, Never>?
+  private var selectedPhotoPaths: [String] = []
+  private var cameraConfigured = false
+  private var cameraIsStarting = false
+  private var cameraStartupGeneration = 0
+  private var cameraIsCapturing = false
+  private var activeCameraCaptureID: Int64?
+  private var isFinishing = false
+  private var didNotifyDismissal = false
+  private var keyboardDismissalOffset: CGFloat = 0
+  private var menuStackHeightConstraint: NSLayoutConstraint?
+
+  var onDismiss: (() -> Void)?
+
+  private var menuSize: CGSize {
+    NativeAttachmentMenuLayout.size(
+      compatibleWith: traitCollection,
+      maximumHeight: maximumMenuHeight
+    )
+  }
+
+  init(
+    channel: FlutterMethodChannel,
+    expandedWidth: CGFloat,
+    maximumMenuHeight: CGFloat = NativeAttachmentMenuLayout.maximumHeight
+  ) {
+    self.channel = channel
+    self.expandedWidth = expandedWidth
+    self.maximumMenuHeight = maximumMenuHeight
+    super.init(nibName: nil, bundle: nil)
+    preferredContentSize = NativeAttachmentMenuLayout.size(
+      compatibleWith: .current,
+      maximumHeight: maximumMenuHeight
+    )
+  }
+
+  @available(*, unavailable)
+  required init?(coder: NSCoder) {
+    fatalError("init(coder:) has not been implemented")
+  }
+
+  override func viewDidLoad() {
+    super.viewDidLoad()
+    view.backgroundColor = .clear
+    view.layer.cornerRadius = 22
+    view.layer.cornerCurve = .continuous
+    view.clipsToBounds = true
+
+    let glassEffect = UIGlassEffect(style: .regular)
+    glassEffect.isInteractive = true
+    let glassView = UIVisualEffectView(effect: glassEffect)
+    glassView.translatesAutoresizingMaskIntoConstraints = false
+    view.addSubview(glassView)
+
+    contentHost.translatesAutoresizingMaskIntoConstraints = false
+    view.addSubview(contentHost)
+    NSLayoutConstraint.activate([
+      glassView.leadingAnchor.constraint(equalTo: view.leadingAnchor),
+      glassView.trailingAnchor.constraint(equalTo: view.trailingAnchor),
+      glassView.topAnchor.constraint(equalTo: view.topAnchor),
+      glassView.bottomAnchor.constraint(equalTo: view.bottomAnchor),
+      contentHost.leadingAnchor.constraint(equalTo: view.leadingAnchor),
+      contentHost.trailingAnchor.constraint(equalTo: view.trailingAnchor),
+      contentHost.topAnchor.constraint(equalTo: view.topAnchor),
+      contentHost.bottomAnchor.constraint(equalTo: view.bottomAnchor),
+    ])
+
+    let menu = makeMenuView()
+    installContent(menu)
+  }
+
+  override func viewDidLayoutSubviews() {
+    super.viewDidLayoutSubviews()
+    cameraPreviewLayer?.frame = cameraPreviewView?.bounds ?? .zero
+  }
+
+  override func viewWillDisappear(_ animated: Bool) {
+    super.viewWillDisappear(animated)
+    invalidateCameraCapture()
+    stopCamera()
+  }
+
+  override func traitCollectionDidChange(
+    _ previousTraitCollection: UITraitCollection?
+  ) {
+    super.traitCollectionDidChange(previousTraitCollection)
+    guard
+      previousTraitCollection?.preferredContentSizeCategory
+        != traitCollection.preferredContentSizeCategory
+    else {
+      return
+    }
+
+    updateMenuLayout()
+  }
+
+  func adaptivePresentationStyle(
+    for controller: UIPresentationController
+  ) -> UIModalPresentationStyle {
+    .none
+  }
+
+  func presentationControllerDidDismiss(
+    _ presentationController: UIPresentationController
+  ) {
+    notifyDismissalIfNeeded()
+  }
+
+  private func makeMenuView() -> UIView {
+    let container = UIView()
+    container.translatesAutoresizingMaskIntoConstraints = false
+
+    let scrollView = UIScrollView()
+    scrollView.alwaysBounceVertical = false
+    scrollView.translatesAutoresizingMaskIntoConstraints = false
+    container.addSubview(scrollView)
+
+    let stack = UIStackView()
+    stack.axis = .vertical
+    stack.distribution = .fillEqually
+    stack.spacing = NativeAttachmentMenuLayout.itemSpacing
+    stack.translatesAutoresizingMaskIntoConstraints = false
+    scrollView.addSubview(stack)
+    let stackHeightConstraint = stack.heightAnchor.constraint(
+      equalToConstant: NativeAttachmentMenuLayout.itemsHeight(
+        compatibleWith: traitCollection
+      )
+    )
+    menuStackHeightConstraint = stackHeightConstraint
+    NSLayoutConstraint.activate([
+      scrollView.leadingAnchor.constraint(equalTo: container.leadingAnchor),
+      scrollView.trailingAnchor.constraint(equalTo: container.trailingAnchor),
+      scrollView.topAnchor.constraint(equalTo: container.topAnchor),
+      scrollView.bottomAnchor.constraint(equalTo: container.bottomAnchor),
+      stack.leadingAnchor.constraint(
+        equalTo: scrollView.frameLayoutGuide.leadingAnchor,
+        constant: NativeAttachmentMenuLayout.contentPadding
+      ),
+      stack.trailingAnchor.constraint(
+        equalTo: scrollView.frameLayoutGuide.trailingAnchor,
+        constant: -NativeAttachmentMenuLayout.contentPadding
+      ),
+      stack.topAnchor.constraint(
+        equalTo: scrollView.contentLayoutGuide.topAnchor,
+        constant: NativeAttachmentMenuLayout.contentPadding
+      ),
+      stack.bottomAnchor.constraint(
+        equalTo: scrollView.contentLayoutGuide.bottomAnchor,
+        constant: -NativeAttachmentMenuLayout.contentPadding
+      ),
+      stackHeightConstraint,
+    ])
+
+    stack.addArrangedSubview(
+      makeNativeAttachmentMenuButton(
+        title: "Camera",
+        symbol: "camera",
+        action: UIAction { [weak self] _ in self?.showCamera() }
+      )
+    )
+    stack.addArrangedSubview(
+      makeNativeAttachmentMenuButton(
+        title: "Photos",
+        symbol: "photo.on.rectangle.angled",
+        action: UIAction { [weak self] _ in self?.showPhotos() }
+      )
+    )
+    stack.addArrangedSubview(
+      makeNativeAttachmentMenuButton(
+        title: "Video",
+        symbol: "video",
+        action: UIAction { [weak self] _ in
+          self?.finish(method: "pickVideo")
+        }
+      )
+    )
+    stack.addArrangedSubview(
+      makeNativeAttachmentMenuButton(
+        title: "Files",
+        symbol: "doc",
+        action: UIAction { [weak self] _ in
+          self?.finish(method: "pickFiles")
+        }
+      )
+    )
+    return container
+  }
+
+  private func updateMenuLayout() {
+    menuStackHeightConstraint?.constant =
+      NativeAttachmentMenuLayout.itemsHeight(
+        compatibleWith: traitCollection
+      )
+    if surface == .menu {
+      preferredContentSize = menuSize
+    }
+  }
+
+  private func showPhotos() {
+    guard surface != .photos else { return }
+    prepareForExpandedSurface()
+    stopCamera()
+
+    var configuration = PHPickerConfiguration(photoLibrary: .shared())
+    configuration.filter = .images
+    configuration.selectionLimit = 0
+    configuration.selection = .continuousAndOrdered
+    configuration.preferredAssetRepresentationMode = .compatible
+    configuration.disabledCapabilities = [
+      .search,
+      .stagingArea,
+      .collectionNavigation,
+      .selectionActions,
+    ]
+    configuration.edgesWithoutContentMargins = .all
+
+    let picker = PHPickerViewController(configuration: configuration)
+    picker.delegate = self
+    picker.view.backgroundColor = .clear
+
+    let container = UIView()
+    container.backgroundColor = .clear
+    container.clipsToBounds = true
+    addChild(picker)
+    picker.view.translatesAutoresizingMaskIntoConstraints = false
+    container.addSubview(picker.view)
+    NSLayoutConstraint.activate([
+      picker.view.leadingAnchor.constraint(equalTo: container.leadingAnchor),
+      picker.view.trailingAnchor.constraint(equalTo: container.trailingAnchor),
+      picker.view.topAnchor.constraint(equalTo: container.topAnchor),
+      picker.view.bottomAnchor.constraint(equalTo: container.bottomAnchor),
+    ])
+    picker.didMove(toParent: self)
+    photoPickerViewController = picker
+
+    let backButton = makeGlassControl(
+      title: nil,
+      symbol: "chevron.left",
+      accessibilityLabel: "Back to attachment options",
+      action: UIAction { [weak self] _ in self?.showMenu() }
+    )
+    let actionButton = makeGlassControl(
+      title: "All Photos",
+      symbol: nil,
+      accessibilityLabel: "All Photos",
+      prominent: true,
+      action: UIAction { [weak self] _ in self?.performPhotoAction() }
+    )
+    photoActionButton = actionButton
+    addBottomControls(
+      to: container,
+      leading: backButton,
+      trailing: actionButton
+    )
+
+    transition(
+      to: .photos,
+      content: container,
+      preparation: { [weak picker] reveal in
+        guard let picker else {
+          reveal()
+          return
+        }
+        // PHPicker ignores scale changes while its remote grid is still
+        // adapting to the compact menu bounds. Give it one main-loop turn at
+        // the final popover size, apply the scale offscreen, then reveal it.
+        DispatchQueue.main.async {
+          picker.view.layoutIfNeeded()
+          EmbeddedPhotoPickerLayout.applyPreferredScale {
+            picker.zoomIn()
+            picker.view.layoutIfNeeded()
+          }
+          DispatchQueue.main.async(execute: reveal)
+        }
+      }
+    )
+  }
+
+  private func showCamera() {
+    guard surface != .camera else { return }
+    prepareForExpandedSurface()
+    removePhotoPicker()
+
+    let container = UIView()
+    container.backgroundColor = .black
+    let preview = UIView()
+    preview.backgroundColor = .black
+    preview.translatesAutoresizingMaskIntoConstraints = false
+    container.addSubview(preview)
+    NSLayoutConstraint.activate([
+      preview.leadingAnchor.constraint(equalTo: container.leadingAnchor),
+      preview.trailingAnchor.constraint(equalTo: container.trailingAnchor),
+      preview.topAnchor.constraint(equalTo: container.topAnchor),
+      preview.bottomAnchor.constraint(equalTo: container.bottomAnchor),
+    ])
+    cameraPreviewView = preview
+
+    let placeholder = UIActivityIndicatorView(style: .large)
+    placeholder.color = .white
+    placeholder.startAnimating()
+    placeholder.translatesAutoresizingMaskIntoConstraints = false
+    preview.addSubview(placeholder)
+    NSLayoutConstraint.activate([
+      placeholder.centerXAnchor.constraint(equalTo: preview.centerXAnchor),
+      placeholder.centerYAnchor.constraint(equalTo: preview.centerYAnchor),
+    ])
+    placeholder.tag = 7001
+
+    let backButton = makeGlassControl(
+      title: nil,
+      symbol: "chevron.left",
+      accessibilityLabel: "Back to attachment options",
+      action: UIAction { [weak self] _ in self?.showMenu() }
+    )
+    let captureButton = makeCameraCaptureButton()
+    cameraCaptureButton = captureButton
+    addBottomControls(
+      to: container,
+      leading: backButton,
+      center: captureButton
+    )
+
+    transition(to: .camera, content: container)
+    startCamera()
+  }
+
+  private func showMenu() {
+    guard surface != .menu else { return }
+    invalidateCameraCapture()
+    selectionGeneration += 1
+    selectionTask?.cancel()
+    selectionTask = nil
+    Self.removeTemporaryFiles(selectedPhotoPaths)
+    selectedPhotoPaths = []
+    stopCamera()
+
+    let menu = makeMenuView()
+    transition(
+      to: .menu,
+      content: menu,
+      completion: { [weak self] in
+        self?.removePhotoPicker()
+      }
+    )
+  }
+
+  private func prepareForExpandedSurface() {
+    if let sourceHost = popoverPresentationController?.sourceView?.superview {
+      keyboardDismissalOffset = max(
+        keyboardDismissalOffset,
+        NativeAttachmentExpandedSurfaceBehavior.keyboardOverlap(
+          containerBounds: sourceHost.bounds,
+          keyboardLayoutFrame: sourceHost.keyboardLayoutGuide.layoutFrame
+        )
+      )
+    }
+    NativeAttachmentExpandedSurfaceBehavior.dismissKeyboard(in: view.window)
+  }
+
+  private func installContent(_ content: UIView) {
+    content.translatesAutoresizingMaskIntoConstraints = false
+    contentHost.addSubview(content)
+    NSLayoutConstraint.activate([
+      content.leadingAnchor.constraint(equalTo: contentHost.leadingAnchor),
+      content.trailingAnchor.constraint(equalTo: contentHost.trailingAnchor),
+      content.topAnchor.constraint(equalTo: contentHost.topAnchor),
+      content.bottomAnchor.constraint(equalTo: contentHost.bottomAnchor),
+    ])
+    visibleContentView = content
+  }
+
+  private func transition(
+    to nextSurface: Surface,
+    content nextView: UIView,
+    preparation: ContentPreparation? = nil,
+    completion: (() -> Void)? = nil
+  ) {
+    let previousView = visibleContentView
+    let isExpanding = nextSurface != .menu
+    let targetSize =
+      isExpanding
+      ? CGSize(width: expandedWidth, height: expandedHeight)
+      : menuSize
+
+    nextView.translatesAutoresizingMaskIntoConstraints = false
+    contentHost.addSubview(nextView)
+    NSLayoutConstraint.activate([
+      nextView.leadingAnchor.constraint(equalTo: contentHost.leadingAnchor),
+      nextView.trailingAnchor.constraint(equalTo: contentHost.trailingAnchor),
+      nextView.topAnchor.constraint(equalTo: contentHost.topAnchor),
+      nextView.bottomAnchor.constraint(equalTo: contentHost.bottomAnchor),
+    ])
+    contentHost.layoutIfNeeded()
+
+    let shouldAnimate = !UIAccessibility.isReduceMotionEnabled
+    // Do not expose embedded surfaces while the popover changes size. In
+    // particular, PHPicker visibly reflows its grid from the compact menu
+    // width to the expanded width if it is allowed to paint during this step.
+    nextView.alpha = 0
+    visibleContentView = nextView
+    surface = nextSurface
+
+    let duration = shouldAnimate ? (isExpanding ? 0.24 : 0.2) : 0
+    UIView.animate(
+      withDuration: duration,
+      delay: 0,
+      options: [
+        .beginFromCurrentState,
+        .allowUserInteraction,
+        .curveEaseInOut,
+      ]
+    ) {
+      self.preferredContentSize = targetSize
+      if let popover = self.popoverPresentationController,
+        let sourceView = popover.sourceView
+      {
+        popover.sourceRect = NativeAttachmentPopoverAnchorLayout.sourceRect(
+          anchorBounds: sourceView.bounds,
+          keyboardDismissalOffset: self.keyboardDismissalOffset,
+          isExpanded: isExpanding
+        )
+      }
+      previousView?.alpha = 0
+      self.view.layoutIfNeeded()
+    } completion: { _ in
+      previousView?.removeFromSuperview()
+      self.view.layoutIfNeeded()
+
+      let reveal = {
+        UIView.animate(
+          withDuration: shouldAnimate ? 0.14 : 0,
+          delay: 0,
+          options: [
+            .beginFromCurrentState,
+            .allowUserInteraction,
+            .curveEaseOut,
+          ]
+        ) {
+          nextView.alpha = 1
+        } completion: { _ in
+          completion?()
+        }
+      }
+
+      if let preparation {
+        preparation(reveal)
+      } else {
+        reveal()
+      }
+    }
+  }
+
+  private func makeGlassControl(
+    title: String?,
+    symbol: String?,
+    accessibilityLabel: String,
+    prominent: Bool = false,
+    action: UIAction
+  ) -> UIButton {
+    var configuration =
+      prominent
+      ? UIButton.Configuration.prominentGlass()
+      : UIButton.Configuration.glass()
+    configuration.title = title
+    if prominent {
+      configuration.baseBackgroundColor = .black
+    }
+    if let symbol {
+      configuration.image = UIImage(systemName: symbol)
+    }
+    configuration.imagePadding = 8
+    configuration.baseForegroundColor = .white
+    configuration.contentInsets = NSDirectionalEdgeInsets(
+      top: 11,
+      leading: 15,
+      bottom: 11,
+      trailing: 15
+    )
+    let button = UIButton(configuration: configuration, primaryAction: action)
+    button.accessibilityLabel = accessibilityLabel
+    return button
+  }
+
+  private func makeCameraCaptureButton() -> UIButton {
+    let button = UIButton(
+      primaryAction: UIAction { [weak self] _ in self?.capturePhoto() }
+    )
+    button.accessibilityLabel = "Take photo"
+    button.translatesAutoresizingMaskIntoConstraints = false
+    button.backgroundColor = UIColor.white.withAlphaComponent(0.22)
+    button.layer.cornerRadius = 34
+    button.layer.borderColor = UIColor.white.cgColor
+    button.layer.borderWidth = 3
+    let inner = UIView()
+    inner.isUserInteractionEnabled = false
+    inner.translatesAutoresizingMaskIntoConstraints = false
+    inner.backgroundColor = .white
+    inner.layer.cornerRadius = 25
+    button.addSubview(inner)
+    NSLayoutConstraint.activate([
+      button.widthAnchor.constraint(equalToConstant: 68),
+      button.heightAnchor.constraint(equalToConstant: 68),
+      inner.widthAnchor.constraint(equalToConstant: 50),
+      inner.heightAnchor.constraint(equalToConstant: 50),
+      inner.centerXAnchor.constraint(equalTo: button.centerXAnchor),
+      inner.centerYAnchor.constraint(equalTo: button.centerYAnchor),
+    ])
+    return button
+  }
+
+  private func addBottomControls(
+    to container: UIView,
+    leading: UIButton,
+    center: UIButton? = nil,
+    trailing: UIButton? = nil
+  ) {
+    leading.translatesAutoresizingMaskIntoConstraints = false
+    container.addSubview(leading)
+    var constraints = [
+      leading.leadingAnchor.constraint(
+        equalTo: container.leadingAnchor,
+        constant: 12
+      ),
+      leading.bottomAnchor.constraint(
+        equalTo: container.bottomAnchor,
+        constant: -12
+      ),
+      leading.heightAnchor.constraint(greaterThanOrEqualToConstant: 44),
+    ]
+
+    if let center {
+      center.translatesAutoresizingMaskIntoConstraints = false
+      container.addSubview(center)
+      constraints.append(
+        center.centerXAnchor.constraint(equalTo: container.centerXAnchor)
+      )
+      constraints.append(
+        center.bottomAnchor.constraint(
+          equalTo: container.bottomAnchor,
+          constant: -12
+        )
+      )
+    }
+    if let trailing {
+      trailing.translatesAutoresizingMaskIntoConstraints = false
+      container.addSubview(trailing)
+      constraints.append(
+        trailing.trailingAnchor.constraint(
+          equalTo: container.trailingAnchor,
+          constant: -12
+        )
+      )
+      constraints.append(
+        trailing.bottomAnchor.constraint(
+          equalTo: container.bottomAnchor,
+          constant: -12
+        )
+      )
+      constraints.append(
+        trailing.heightAnchor.constraint(greaterThanOrEqualToConstant: 44)
+      )
+    }
+    NSLayoutConstraint.activate(constraints)
+  }
+
+  func picker(
+    _ picker: PHPickerViewController,
+    didFinishPicking results: [PHPickerResult]
+  ) {
+    selectionGeneration += 1
+    let generation = selectionGeneration
+    selectionTask?.cancel()
+    selectionTask = nil
+    Self.removeTemporaryFiles(selectedPhotoPaths)
+    selectedPhotoPaths = []
+    updatePhotoAction(count: results.count, preparing: !results.isEmpty)
+
+    guard !results.isEmpty else { return }
+    selectionTask = Task { [weak self] in
+      guard let self else { return }
+      var paths: [String] = []
+      do {
+        for result in results {
+          try Task.checkCancellation()
+          paths.append(try await self.exportPickerResult(result))
+        }
+        try Task.checkCancellation()
+        await MainActor.run {
+          guard generation == self.selectionGeneration else {
+            Self.removeTemporaryFiles(paths)
+            return
+          }
+          self.selectedPhotoPaths = paths
+          self.selectionTask = nil
+          self.updatePhotoAction(count: paths.count, preparing: false)
+        }
+      } catch is CancellationError {
+        Self.removeTemporaryFiles(paths)
+      } catch {
+        Self.removeTemporaryFiles(paths)
+        await MainActor.run {
+          guard generation == self.selectionGeneration else { return }
+          self.selectionTask = nil
+          self.selectedPhotoPaths = []
+          self.updatePhotoAction(count: 0, preparing: false)
+          self.showError("Unable to prepare the selected photos.")
+        }
+      }
+    }
+  }
+
+  private func updatePhotoAction(count: Int, preparing: Bool) {
+    let title: String
+    if preparing {
+      title = "Preparing…"
+    } else if count == 0 {
+      title = "All Photos"
+    } else {
+      title = "Add \(count) \(count == 1 ? "photo" : "photos")"
+    }
+    guard let button = photoActionButton else { return }
+    let canInteract = !preparing
+    button.configuration?.title = title
+    button.accessibilityLabel = title
+    button.isUserInteractionEnabled = canInteract
+    if canInteract {
+      button.accessibilityTraits.remove(.notEnabled)
+    } else {
+      button.accessibilityTraits.insert(.notEnabled)
+    }
+  }
+
+  private func performPhotoAction() {
+    if selectedPhotoPaths.isEmpty {
+      finish(method: "pickAllPhotos")
+    } else {
+      let paths = selectedPhotoPaths
+      selectedPhotoPaths = []
+      finish(
+        method: "photosSelected",
+        arguments: paths,
+        temporaryPaths: paths
+      )
+    }
+  }
+
+  private func exportPickerResult(_ result: PHPickerResult) async throws
+    -> String
+  {
+    let provider = result.itemProvider
+    guard
+      let typeIdentifier = provider.registeredTypeIdentifiers.first(where: {
+        guard let type = UTType($0) else { return false }
+        return type.conforms(to: .image)
+      })
+    else {
+      throw NativeAttachmentPopoverError.unsupportedImage
+    }
+
+    return try await withCheckedThrowingContinuation { continuation in
+      provider.loadFileRepresentation(forTypeIdentifier: typeIdentifier) {
+        sourceURL,
+        error in
+        if let error {
+          continuation.resume(throwing: error)
+          return
+        }
+        guard let sourceURL else {
+          continuation.resume(
+            throwing: NativeAttachmentPopoverError.missingFile
+          )
+          return
+        }
+
+        do {
+          let fileExtension =
+            sourceURL.pathExtension.isEmpty
+            ? (UTType(typeIdentifier)?.preferredFilenameExtension ?? "jpg")
+            : sourceURL.pathExtension
+          let destinationURL = FileManager.default.temporaryDirectory
+            .appendingPathComponent(UUID().uuidString)
+            .appendingPathExtension(fileExtension)
+          try FileManager.default.copyItem(
+            at: sourceURL,
+            to: destinationURL
+          )
+          continuation.resume(returning: destinationURL.path)
+        } catch {
+          continuation.resume(throwing: error)
+        }
+      }
+    }
+  }
+
+  private static func removeTemporaryFiles(_ paths: [String]) {
+    for path in paths where !path.isEmpty {
+      try? FileManager.default.removeItem(atPath: path)
+    }
+  }
+
+  private func startCamera() {
+    guard !cameraIsStarting else { return }
+    cameraIsStarting = true
+    cameraStartupGeneration += 1
+    let startupGeneration = cameraStartupGeneration
+
+    switch AVCaptureDevice.authorizationStatus(for: .video) {
+    case .authorized:
+      configureAndStartCamera(startupGeneration: startupGeneration)
+    case .notDetermined:
+      AVCaptureDevice.requestAccess(for: .video) { [weak self] granted in
+        DispatchQueue.main.async {
+          guard
+            let self,
+            self.cameraStartupIsCurrent(startupGeneration)
+          else { return }
+          if granted {
+            self.configureAndStartCamera(
+              startupGeneration: startupGeneration
+            )
+          } else {
+            self.cameraIsStarting = false
+            self.showCameraUnavailable(
+              "Camera access is needed to take a photo."
+            )
+          }
+        }
+      }
+    default:
+      cameraIsStarting = false
+      showCameraUnavailable("Camera access is needed to take a photo.")
+    }
+  }
+
+  private func configureAndStartCamera(startupGeneration: Int) {
+    cameraQueue.async { [weak self] in
+      guard let self else { return }
+      do {
+        if !self.cameraConfigured {
+          self.cameraSession.beginConfiguration()
+          defer { self.cameraSession.commitConfiguration() }
+          self.cameraSession.sessionPreset = .photo
+          guard
+            let device = AVCaptureDevice.default(
+              .builtInWideAngleCamera,
+              for: .video,
+              position: .back
+            )
+          else {
+            throw NativeAttachmentPopoverError.cameraUnavailable
+          }
+          let input = try AVCaptureDeviceInput(device: device)
+          guard self.cameraSession.canAddInput(input) else {
+            throw NativeAttachmentPopoverError.cameraUnavailable
+          }
+          self.cameraSession.addInput(input)
+          self.cameraDevice = device
+          guard self.cameraSession.canAddOutput(self.cameraOutput) else {
+            throw NativeAttachmentPopoverError.cameraUnavailable
+          }
+          self.cameraSession.addOutput(self.cameraOutput)
+          self.cameraConfigured = true
+        }
+
+        if !self.cameraSession.isRunning {
+          self.cameraSession.startRunning()
+        }
+        DispatchQueue.main.async { [weak self] in
+          guard
+            let self,
+            self.cameraStartupIsCurrent(startupGeneration)
+          else { return }
+          self.cameraIsStarting = false
+          self.installCameraPreview()
+        }
+      } catch {
+        if self.cameraSession.isRunning {
+          self.cameraSession.stopRunning()
+        }
+        DispatchQueue.main.async { [weak self] in
+          guard
+            let self,
+            self.cameraStartupIsCurrent(startupGeneration)
+          else { return }
+          self.cameraIsStarting = false
+          self.showCameraUnavailable("Camera isn’t available here.")
+        }
+      }
+    }
+  }
+
+  private func cameraStartupIsCurrent(_ generation: Int) -> Bool {
+    generation == cameraStartupGeneration && surface == .camera && !isFinishing
+  }
+
+  private func installCameraPreview() {
+    guard surface == .camera, let previewView = cameraPreviewView else { return }
+    previewView.viewWithTag(7001)?.removeFromSuperview()
+    cameraPreviewLayer?.removeFromSuperlayer()
+
+    let layer = AVCaptureVideoPreviewLayer(session: cameraSession)
+    layer.videoGravity = .resizeAspectFill
+    layer.frame = previewView.bounds
+    previewView.layer.insertSublayer(layer, at: 0)
+    cameraPreviewLayer = layer
+
+    if let cameraDevice {
+      let coordinator = AVCaptureDevice.RotationCoordinator(
+        device: cameraDevice,
+        previewLayer: layer
+      )
+      cameraRotationCoordinator = coordinator
+      cameraRotationObservation = coordinator.observe(
+        \.videoRotationAngleForHorizonLevelPreview,
+        options: [.initial, .new]
+      ) { [weak layer] coordinator, _ in
+        guard let connection = layer?.connection else { return }
+        let angle = coordinator.videoRotationAngleForHorizonLevelPreview
+        guard connection.isVideoRotationAngleSupported(angle) else { return }
+        connection.videoRotationAngle = angle
+      }
+    }
+  }
+
+  private func stopCamera() {
+    cameraStartupGeneration += 1
+    cameraIsStarting = false
+    cameraRotationObservation?.invalidate()
+    cameraRotationObservation = nil
+    cameraRotationCoordinator = nil
+    cameraPreviewLayer?.removeFromSuperlayer()
+    cameraPreviewLayer = nil
+    cameraQueue.async { [weak self] in
+      guard let self, self.cameraSession.isRunning else { return }
+      self.cameraSession.stopRunning()
+    }
+  }
+
+  private func capturePhoto() {
+    guard !cameraIsCapturing, cameraSession.isRunning else { return }
+    cameraIsCapturing = true
+    cameraCaptureButton?.isEnabled = false
+    cameraCaptureButton?.transform = CGAffineTransform(
+      scaleX: 0.92,
+      y: 0.92
+    )
+    UIView.animate(
+      withDuration: 0.12,
+      delay: 0,
+      options: [.beginFromCurrentState, .allowUserInteraction]
+    ) {
+      self.cameraCaptureButton?.transform = .identity
+    }
+    if let connection = cameraOutput.connection(with: .video),
+      let cameraRotationCoordinator
+    {
+      let angle =
+        cameraRotationCoordinator.videoRotationAngleForHorizonLevelCapture
+      if connection.isVideoRotationAngleSupported(angle) {
+        connection.videoRotationAngle = angle
+      }
+    }
+    let settings = AVCapturePhotoSettings()
+    activeCameraCaptureID = settings.uniqueID
+    cameraOutput.capturePhoto(with: settings, delegate: self)
+  }
+
+  func photoOutput(
+    _ output: AVCapturePhotoOutput,
+    didFinishProcessingPhoto photo: AVCapturePhoto,
+    error: Error?
+  ) {
+    guard error == nil, let data = photo.fileDataRepresentation() else {
+      DispatchQueue.main.async { [weak self] in
+        self?.completeCameraCapture(
+          captureID: photo.resolvedSettings.uniqueID,
+          path: nil,
+          errorMessage: "Unable to capture the photo."
+        )
+      }
+      return
+    }
+
+    DispatchQueue.global(qos: .userInitiated).async {
+      do {
+        let destinationURL = FileManager.default.temporaryDirectory
+          .appendingPathComponent(UUID().uuidString)
+          .appendingPathExtension("jpg")
+        try data.write(to: destinationURL, options: .atomic)
+        DispatchQueue.main.async { [weak self] in
+          guard let self else {
+            Self.removeTemporaryFiles([destinationURL.path])
+            return
+          }
+          self.completeCameraCapture(
+            captureID: photo.resolvedSettings.uniqueID,
+            path: destinationURL.path,
+            errorMessage: nil
+          )
+        }
+      } catch {
+        DispatchQueue.main.async { [weak self] in
+          self?.completeCameraCapture(
+            captureID: photo.resolvedSettings.uniqueID,
+            path: nil,
+            errorMessage: "Unable to prepare the captured photo."
+          )
+        }
+      }
+    }
+  }
+
+  @MainActor
+  private func completeCameraCapture(
+    captureID: Int64,
+    path: String?,
+    errorMessage: String?
+  ) {
+    guard
+      captureID == activeCameraCaptureID, surface == .camera, !isFinishing
+    else {
+      if let path { Self.removeTemporaryFiles([path]) }
+      return
+    }
+    activeCameraCaptureID = nil
+    cameraIsCapturing = false
+    cameraCaptureButton?.isEnabled = true
+    if let path {
+      finish(
+        method: "cameraCaptured",
+        arguments: path,
+        temporaryPaths: [path]
+      )
+    } else if !isFinishing, let errorMessage {
+      showError(errorMessage)
+    }
+  }
+
+  private func invalidateCameraCapture() {
+    activeCameraCaptureID = nil
+    cameraIsCapturing = false
+    cameraCaptureButton?.isEnabled = true
+  }
+
+  private func showCameraUnavailable(_ message: String) {
+    guard let previewView = cameraPreviewView else { return }
+    previewView.viewWithTag(7001)?.removeFromSuperview()
+    let label = UILabel()
+    label.text = message
+    label.textColor = .white
+    label.textAlignment = .center
+    label.numberOfLines = 0
+    label.translatesAutoresizingMaskIntoConstraints = false
+    previewView.addSubview(label)
+    NSLayoutConstraint.activate([
+      label.centerXAnchor.constraint(equalTo: previewView.centerXAnchor),
+      label.centerYAnchor.constraint(equalTo: previewView.centerYAnchor),
+      label.leadingAnchor.constraint(
+        greaterThanOrEqualTo: previewView.leadingAnchor,
+        constant: 28
+      ),
+      label.trailingAnchor.constraint(
+        lessThanOrEqualTo: previewView.trailingAnchor,
+        constant: -28
+      ),
+    ])
+  }
+
+  private func showError(_ message: String) {
+    let alert = UIAlertController(
+      title: nil,
+      message: message,
+      preferredStyle: .alert
+    )
+    alert.addAction(UIAlertAction(title: "OK", style: .default))
+    present(alert, animated: true)
+  }
+
+  private func removePhotoPicker() {
+    guard let picker = photoPickerViewController else { return }
+    picker.willMove(toParent: nil)
+    picker.view.removeFromSuperview()
+    picker.removeFromParent()
+    photoPickerViewController = nil
+  }
+
+  private func finish(
+    method: String,
+    arguments: Any? = nil,
+    temporaryPaths: [String] = []
+  ) {
+    guard !isFinishing else {
+      Self.removeTemporaryFiles(temporaryPaths)
+      return
+    }
+    NativeAttachmentExpandedSurfaceBehavior.dismissKeyboard(in: view.window)
+    isFinishing = true
+    view.isUserInteractionEnabled = false
+    selectionGeneration += 1
+    selectionTask?.cancel()
+    selectionTask = nil
+    stopCamera()
+    dismiss(animated: true) { [weak self] in
+      guard let self else {
+        Self.removeTemporaryFiles(temporaryPaths)
+        return
+      }
+      self.channel.invokeMethod(method, arguments: arguments) { _ in
+        Self.removeTemporaryFiles(temporaryPaths)
+      }
+      self.notifyDismissalIfNeeded()
+    }
+  }
+
+  func dismissAndNotify() {
+    guard !isFinishing else { return }
+    isFinishing = true
+    view.isUserInteractionEnabled = false
+    selectionGeneration += 1
+    selectionTask?.cancel()
+    selectionTask = nil
+    Self.removeTemporaryFiles(selectedPhotoPaths)
+    selectedPhotoPaths = []
+    stopCamera()
+    dismiss(animated: true) { [weak self] in
+      self?.notifyDismissalIfNeeded()
+    }
+  }
+
+  private func notifyDismissalIfNeeded() {
+    selectionGeneration += 1
+    selectionTask?.cancel()
+    selectionTask = nil
+    Self.removeTemporaryFiles(selectedPhotoPaths)
+    selectedPhotoPaths = []
+    guard !didNotifyDismissal else { return }
+    didNotifyDismissal = true
+    onDismiss?()
+  }
+}
+
+private enum NativeAttachmentPopoverError: Error {
+  case cameraUnavailable
+  case missingFile
+  case unsupportedImage
+}
diff --git a/mobile/ios/Runner/NativeAttachmentPopoverCoordinator.swift b/mobile/ios/Runner/NativeAttachmentPopoverCoordinator.swift
new file mode 100644
index 00000000000..73559d7c2b6
--- /dev/null
+++ b/mobile/ios/Runner/NativeAttachmentPopoverCoordinator.swift
@@ -0,0 +1,371 @@
+import Flutter
+import UIKit
+
+enum NativeAttachmentExpandedSurfaceBehavior {
+  @MainActor
+  static func dismissKeyboard(in window: UIWindow?) {
+    window?.endEditing(true)
+  }
+
+  static func keyboardOverlap(
+    containerBounds: CGRect,
+    keyboardLayoutFrame: CGRect
+  ) -> CGFloat {
+    guard
+      !keyboardLayoutFrame.isNull,
+      !keyboardLayoutFrame.isInfinite,
+      keyboardLayoutFrame.minY < containerBounds.maxY
+    else {
+      return 0
+    }
+    return max(0, containerBounds.maxY - keyboardLayoutFrame.minY)
+  }
+}
+
+enum NativeAttachmentPopoverAnchorLayout {
+  static let expandedVerticalOffset: CGFloat = 40
+
+  static func sourceRect(
+    anchorBounds: CGRect,
+    keyboardDismissalOffset: CGFloat,
+    isExpanded: Bool
+  ) -> CGRect {
+    anchorBounds.offsetBy(
+      dx: 0,
+      dy: keyboardDismissalOffset
+        + (isExpanded ? expandedVerticalOffset : 0)
+    )
+  }
+}
+
+enum NativeAttachmentPopoverPresentationLayout {
+  static func keyboardDismissalOffset(
+    sourceRect: CGRect,
+    containerBounds: CGRect,
+    safeAreaInsets: UIEdgeInsets,
+    keyboardLayoutFrame: CGRect,
+    menuHeight: CGFloat
+  ) -> CGFloat {
+    let keyboardOverlap =
+      NativeAttachmentExpandedSurfaceBehavior.keyboardOverlap(
+        containerBounds: containerBounds,
+        keyboardLayoutFrame: keyboardLayoutFrame
+      )
+    guard keyboardOverlap > 0 else { return 0 }
+
+    let availableHeight =
+      sourceRect.minY - (containerBounds.minY + safeAreaInsets.top)
+    return availableHeight >= menuHeight ? 0 : keyboardOverlap
+  }
+
+  static func sourceRect(
+    _ sourceRect: CGRect,
+    keyboardDismissalOffset: CGFloat
+  ) -> CGRect {
+    sourceRect.offsetBy(dx: 0, dy: keyboardDismissalOffset)
+  }
+}
+
+final class NativeAttachmentPopoverCoordinator: NSObject {
+  private let channel: FlutterMethodChannel
+  private weak var parentViewController: UIViewController?
+  private weak var presentedController: UIViewController?
+  private weak var sourceAnchorView: UIView?
+
+  init(
+    messenger: FlutterBinaryMessenger,
+    parentViewController: UIViewController?
+  ) {
+    channel = FlutterMethodChannel(
+      name: "buzz/native_attachment_popover",
+      binaryMessenger: messenger
+    )
+    self.parentViewController = parentViewController
+    super.init()
+
+    channel.setMethodCallHandler { [weak self] call, result in
+      self?.handle(call, result: result)
+    }
+  }
+
+  private func handle(
+    _ call: FlutterMethodCall,
+    result: @escaping FlutterResult
+  ) {
+    switch call.method {
+    case "isSupported":
+      if #available(iOS 26.0, *) {
+        result(true)
+      } else {
+        result(false)
+      }
+    case "present":
+      guard
+        let arguments = call.arguments as? [String: Any],
+        let x = arguments["x"] as? NSNumber,
+        let y = arguments["y"] as? NSNumber,
+        let width = arguments["width"] as? NSNumber,
+        let height = arguments["height"] as? NSNumber
+      else {
+        result(
+          FlutterError(
+            code: "invalid_arguments",
+            message: "Expected the attachment trigger bounds.",
+            details: nil
+          )
+        )
+        return
+      }
+
+      let sourceRect = CGRect(
+        x: CGFloat(truncating: x),
+        y: CGFloat(truncating: y),
+        width: CGFloat(truncating: width),
+        height: CGFloat(truncating: height)
+      )
+      DispatchQueue.main.async { [weak self] in
+        result(self?.presentPopover(sourceRect: sourceRect) ?? false)
+      }
+    case "dismiss":
+      DispatchQueue.main.async { [weak self] in
+        if #available(iOS 26.0, *),
+          let controller =
+            self?.presentedController
+            as? NativeAttachmentPopoverViewController
+        {
+          controller.dismissAndNotify()
+        } else {
+          self?.presentedController?.dismiss(animated: true)
+        }
+        result(nil)
+      }
+    default:
+      result(FlutterMethodNotImplemented)
+    }
+  }
+
+  @MainActor
+  private func presentPopover(sourceRect: CGRect) -> Bool {
+    guard #available(iOS 26.0, *) else { return false }
+    guard presentedController == nil else { return true }
+    let rootViewController =
+      parentViewController ?? activeWindowRootViewController()
+    guard let presenter = topViewController(from: rootViewController) else {
+      return false
+    }
+
+    let sourceView = presenter.view
+    var convertedRect: CGRect
+    if let window = sourceView?.window {
+      convertedRect = sourceView?.convert(sourceRect, from: window) ?? sourceRect
+    } else {
+      convertedRect = sourceRect
+    }
+
+    if let sourceView {
+      let keyboardDismissalOffset =
+        NativeAttachmentPopoverPresentationLayout.keyboardDismissalOffset(
+          sourceRect: convertedRect,
+          containerBounds: sourceView.bounds,
+          safeAreaInsets: sourceView.safeAreaInsets,
+          keyboardLayoutFrame: sourceView.keyboardLayoutGuide.layoutFrame,
+          menuHeight: NativeAttachmentMenuLayout.size(
+            compatibleWith: sourceView.traitCollection
+          ).height
+        )
+      if keyboardDismissalOffset > 0 {
+        NativeAttachmentExpandedSurfaceBehavior.dismissKeyboard(
+          in: sourceView.window
+        )
+        convertedRect =
+          NativeAttachmentPopoverPresentationLayout.sourceRect(
+            convertedRect,
+            keyboardDismissalOffset: keyboardDismissalOffset
+          )
+      }
+    }
+
+    let anchorView = makeSourceAnchor(frame: convertedRect)
+    sourceView?.addSubview(anchorView)
+    sourceAnchorView = anchorView
+
+    let availableWidth = max(
+      320,
+      min(
+        (sourceView?.bounds.width ?? UIScreen.main.bounds.width) - 24,
+        430
+      )
+    )
+    let controller = NativeAttachmentPopoverViewController(
+      channel: channel,
+      expandedWidth: availableWidth
+    )
+    controller.modalPresentationStyle = .popover
+    controller.preferredTransition = .zoom { [weak anchorView] _ in
+      anchorView
+    }
+    controller.onDismiss = { [weak self] in
+      self?.presentedController = nil
+      self?.sourceAnchorView?.removeFromSuperview()
+      self?.channel.invokeMethod("dismissed", arguments: nil)
+    }
+
+    guard let popover = controller.popoverPresentationController else {
+      anchorView.removeFromSuperview()
+      return false
+    }
+    popover.sourceView = anchorView
+    popover.sourceRect = anchorView.bounds
+    popover.permittedArrowDirections = [.down]
+    popover.backgroundColor = .clear
+    popover.delegate = controller
+
+    presentedController = controller
+    presenter.present(controller, animated: true)
+    return true
+  }
+
+  @MainActor
+  private func makeSourceAnchor(frame: CGRect) -> UIView {
+    let anchor = UIView(frame: frame)
+    anchor.isUserInteractionEnabled = false
+    anchor.accessibilityElementsHidden = true
+    anchor.backgroundColor = .clear
+    anchor.layer.cornerRadius = min(frame.width, frame.height) / 2
+    anchor.layer.cornerCurve = .continuous
+    return anchor
+  }
+
+  @MainActor
+  private func activeWindowRootViewController() -> UIViewController? {
+    UIApplication.shared.connectedScenes
+      .compactMap { $0 as? UIWindowScene }
+      .filter { $0.activationState == .foregroundActive }
+      .flatMap(\.windows)
+      .first(where: \.isKeyWindow)?
+      .rootViewController
+  }
+
+  @MainActor
+  private func topViewController(
+    from viewController: UIViewController?
+  ) -> UIViewController? {
+    if let presented = viewController?.presentedViewController {
+      return topViewController(from: presented)
+    }
+    if let navigation = viewController as? UINavigationController {
+      return topViewController(from: navigation.visibleViewController)
+    }
+    if let tab = viewController as? UITabBarController {
+      return topViewController(from: tab.selectedViewController)
+    }
+    return viewController
+  }
+}
+
+enum NativeAttachmentMenuLayout {
+  static let itemCount: CGFloat = 4
+  static let contentPadding: CGFloat = 16
+  static let minimumItemHeight: CGFloat = 52
+  static let itemSpacing: CGFloat = 8
+  static let itemVerticalPadding: CGFloat = 8
+  static let maximumHeight: CGFloat = 372
+  static let width: CGFloat = 216
+  static let labelTextStyle: UIFont.TextStyle = .title3
+
+  static func itemHeight(
+    compatibleWith traitCollection: UITraitCollection
+  ) -> CGFloat {
+    let labelHeight = UIFont.preferredFont(
+      forTextStyle: labelTextStyle,
+      compatibleWith: traitCollection
+    ).lineHeight
+    return max(
+      minimumItemHeight,
+      ceil(labelHeight + (itemVerticalPadding * 2))
+    )
+  }
+
+  static func itemsHeight(
+    compatibleWith traitCollection: UITraitCollection
+  ) -> CGFloat {
+    (itemHeight(compatibleWith: traitCollection) * itemCount)
+      + (itemSpacing * (itemCount - 1))
+  }
+
+  static func contentHeight(
+    compatibleWith traitCollection: UITraitCollection
+  ) -> CGFloat {
+    (contentPadding * 2) + itemsHeight(compatibleWith: traitCollection)
+  }
+
+  static func size(
+    compatibleWith traitCollection: UITraitCollection,
+    maximumHeight: CGFloat = NativeAttachmentMenuLayout.maximumHeight
+  ) -> CGSize {
+    CGSize(
+      width: width,
+      height: min(
+        contentHeight(compatibleWith: traitCollection),
+        maximumHeight
+      )
+    )
+  }
+}
+
+func makeNativeAttachmentMenuButton(
+  title: String,
+  symbol: String,
+  action: UIAction
+) -> UIButton {
+  let button = UIButton(primaryAction: action)
+  button.accessibilityLabel = title
+
+  let symbolConfiguration = UIImage.SymbolConfiguration(
+    pointSize: 18,
+    weight: .regular
+  )
+  let iconView = UIImageView(
+    image: UIImage(
+      systemName: symbol,
+      withConfiguration: symbolConfiguration
+    )
+  )
+  iconView.tintColor = .label
+  iconView.contentMode = .center
+  iconView.translatesAutoresizingMaskIntoConstraints = false
+
+  let titleLabel = UILabel()
+  titleLabel.text = title
+  titleLabel.textColor = .label
+  titleLabel.font = .preferredFont(
+    forTextStyle: NativeAttachmentMenuLayout.labelTextStyle
+  )
+  titleLabel.adjustsFontForContentSizeCategory = true
+  titleLabel.textAlignment = .left
+  titleLabel.translatesAutoresizingMaskIntoConstraints = false
+
+  button.addSubview(iconView)
+  button.addSubview(titleLabel)
+  NSLayoutConstraint.activate([
+    iconView.leadingAnchor.constraint(
+      equalTo: button.leadingAnchor,
+      constant: 8
+    ),
+    iconView.centerYAnchor.constraint(equalTo: button.centerYAnchor),
+    iconView.widthAnchor.constraint(equalToConstant: 26),
+    titleLabel.leadingAnchor.constraint(
+      equalTo: iconView.trailingAnchor,
+      constant: 12
+    ),
+    titleLabel.trailingAnchor.constraint(
+      equalTo: button.trailingAnchor,
+      constant: -8
+    ),
+    titleLabel.centerYAnchor.constraint(equalTo: button.centerYAnchor),
+  ])
+  button.configurationUpdateHandler = { button in
+    button.alpha = button.isHighlighted ? 0.62 : 1
+  }
+  return button
+}
diff --git a/mobile/ios/RunnerTests/RunnerTests.swift b/mobile/ios/RunnerTests/RunnerTests.swift
index a174c78684d..c5333cfdf22 100644
--- a/mobile/ios/RunnerTests/RunnerTests.swift
+++ b/mobile/ios/RunnerTests/RunnerTests.swift
@@ -6,6 +6,179 @@ import XCTest
 
 class RunnerTests: XCTestCase {
 
+  @MainActor
+  func testExpandedAttachmentSurfaceDismissesKeyboard() {
+    let window = KeyboardDismissalSpyWindow()
+
+    NativeAttachmentExpandedSurfaceBehavior.dismissKeyboard(in: window)
+
+    XCTAssertTrue(window.didForceEndEditing)
+  }
+
+  func testExpandedAttachmentSurfaceMeasuresKeyboardOverlap() {
+    XCTAssertEqual(
+      NativeAttachmentExpandedSurfaceBehavior.keyboardOverlap(
+        containerBounds: CGRect(x: 0, y: 0, width: 390, height: 844),
+        keyboardLayoutFrame: CGRect(
+          x: 0,
+          y: 544,
+          width: 390,
+          height: 300
+        )
+      ),
+      300
+    )
+    XCTAssertEqual(
+      NativeAttachmentExpandedSurfaceBehavior.keyboardOverlap(
+        containerBounds: CGRect(x: 0, y: 0, width: 390, height: 844),
+        keyboardLayoutFrame: CGRect(x: 0, y: 844, width: 390, height: 0)
+      ),
+      0
+    )
+  }
+
+  func testAttachmentMenuReturnsToKeyboardDismissedAnchor() {
+    let anchorBounds = CGRect(x: 0, y: 0, width: 44, height: 44)
+
+    XCTAssertEqual(
+      NativeAttachmentPopoverAnchorLayout.sourceRect(
+        anchorBounds: anchorBounds,
+        keyboardDismissalOffset: 300,
+        isExpanded: true
+      ),
+      anchorBounds.offsetBy(dx: 0, dy: 340)
+    )
+    XCTAssertEqual(
+      NativeAttachmentPopoverAnchorLayout.sourceRect(
+        anchorBounds: anchorBounds,
+        keyboardDismissalOffset: 300,
+        isExpanded: false
+      ),
+      anchorBounds.offsetBy(dx: 0, dy: 300)
+    )
+  }
+
+  func testAttachmentMenuKeepsKeyboardWhenMenuFitsAboveTrigger() {
+    XCTAssertEqual(
+      NativeAttachmentPopoverPresentationLayout.keyboardDismissalOffset(
+        sourceRect: CGRect(x: 320, y: 480, width: 44, height: 44),
+        containerBounds: CGRect(x: 0, y: 0, width: 390, height: 844),
+        safeAreaInsets: UIEdgeInsets(top: 59, left: 0, bottom: 34, right: 0),
+        keyboardLayoutFrame: CGRect(
+          x: 0,
+          y: 544,
+          width: 390,
+          height: 300
+        ),
+        menuHeight: NativeAttachmentMenuLayout.size(
+          compatibleWith: UITraitCollection(
+            preferredContentSizeCategory: .large
+          )
+        ).height
+      ),
+      0
+    )
+  }
+
+  func testAttachmentMenuDismissesKeyboardAndRepositionsInCompactHeight() {
+    let sourceRect = CGRect(x: 760, y: 168, width: 44, height: 44)
+    let keyboardDismissalOffset =
+      NativeAttachmentPopoverPresentationLayout.keyboardDismissalOffset(
+        sourceRect: sourceRect,
+        containerBounds: CGRect(x: 0, y: 0, width: 844, height: 390),
+        safeAreaInsets: UIEdgeInsets(top: 0, left: 59, bottom: 21, right: 59),
+        keyboardLayoutFrame: CGRect(
+          x: 0,
+          y: 228,
+          width: 844,
+          height: 162
+        ),
+        menuHeight: NativeAttachmentMenuLayout.size(
+          compatibleWith: UITraitCollection(
+            preferredContentSizeCategory: .large
+          )
+        ).height
+      )
+
+    XCTAssertEqual(keyboardDismissalOffset, 162)
+    XCTAssertEqual(
+      NativeAttachmentPopoverPresentationLayout.sourceRect(
+        sourceRect,
+        keyboardDismissalOffset: keyboardDismissalOffset
+      ),
+      sourceRect.offsetBy(dx: 0, dy: 162)
+    )
+  }
+
+  func testAttachmentMenuDoesNotMoveWithoutSoftwareKeyboard() {
+    XCTAssertEqual(
+      NativeAttachmentPopoverPresentationLayout.keyboardDismissalOffset(
+        sourceRect: CGRect(x: 760, y: 168, width: 44, height: 44),
+        containerBounds: CGRect(x: 0, y: 0, width: 844, height: 390),
+        safeAreaInsets: UIEdgeInsets(top: 0, left: 59, bottom: 21, right: 59),
+        keyboardLayoutFrame: CGRect(x: 0, y: 390, width: 844, height: 0),
+        menuHeight: NativeAttachmentMenuLayout.size(
+          compatibleWith: UITraitCollection(
+            preferredContentSizeCategory: .large
+          )
+        ).height
+      ),
+      0
+    )
+  }
+
+  func testEmbeddedPhotoPickerAppliesOneZoomInStepWithoutAnimation() {
+    var zoomInCalls = 0
+    var animationsWereEnabled = true
+
+    EmbeddedPhotoPickerLayout.applyPreferredScale {
+      zoomInCalls += 1
+      animationsWereEnabled = UIView.areAnimationsEnabled
+    }
+
+    XCTAssertEqual(zoomInCalls, 1)
+    XCTAssertFalse(animationsWereEnabled)
+  }
+
+  func testNativeAttachmentMenuUsesRoomyRowsAndInsets() {
+    let traits = UITraitCollection(preferredContentSizeCategory: .large)
+    let size = NativeAttachmentMenuLayout.size(compatibleWith: traits)
+
+    XCTAssertEqual(size.width, 216)
+    XCTAssertEqual(size.height, 264)
+    XCTAssertEqual(NativeAttachmentMenuLayout.contentPadding, 16)
+    XCTAssertEqual(
+      NativeAttachmentMenuLayout.itemHeight(compatibleWith: traits),
+      52
+    )
+    XCTAssertEqual(NativeAttachmentMenuLayout.itemSpacing, 8)
+    XCTAssertEqual(NativeAttachmentMenuLayout.labelTextStyle, .title3)
+  }
+
+  func testNativeAttachmentMenuGrowsAndScrollsForAccessibilityText() {
+    let traits = UITraitCollection(
+      preferredContentSizeCategory: .accessibilityExtraExtraExtraLarge
+    )
+    let itemHeight = NativeAttachmentMenuLayout.itemHeight(
+      compatibleWith: traits
+    )
+    let contentHeight = NativeAttachmentMenuLayout.contentHeight(
+      compatibleWith: traits
+    )
+    let size = NativeAttachmentMenuLayout.size(compatibleWith: traits)
+
+    XCTAssertGreaterThan(itemHeight, 52)
+    XCTAssertGreaterThan(contentHeight, 264)
+    XCTAssertEqual(
+      size.height,
+      min(contentHeight, NativeAttachmentMenuLayout.maximumHeight)
+    )
+    XCTAssertLessThanOrEqual(
+      size.height,
+      NativeAttachmentMenuLayout.maximumHeight
+    )
+  }
+
   func testDynamicIslandQrScannerRecognizesTallSafeAreas() {
     for safeAreaTopInset in [51, 59, 62] {
       XCTAssertTrue(
@@ -228,6 +401,15 @@ class RunnerTests: XCTestCase {
   }
 }
 
+private final class KeyboardDismissalSpyWindow: UIWindow {
+  private(set) var didForceEndEditing = false
+
+  override func endEditing(_ force: Bool) -> Bool {
+    didForceEndEditing = force
+    return true
+  }
+}
+
 private enum RelayImagePolicyError: Error {
   case invalidPng
   case invalidJpeg
diff --git a/mobile/lib/app.dart b/mobile/lib/app.dart
index 3d6a562a92c..5b266c93f97 100644
--- a/mobile/lib/app.dart
+++ b/mobile/lib/app.dart
@@ -16,6 +16,7 @@ import 'shared/auth/auth.dart';
 import 'shared/deeplink/pending_deep_link_provider.dart';
 import 'shared/relay/relay.dart';
 import 'shared/theme/theme.dart';
+import 'shared/widgets/buzz_loading_indicator.dart';
 
 class App extends HookConsumerWidget {
   const App({super.key});
@@ -113,6 +114,10 @@ class _SplashScreen extends StatelessWidget {
 
   @override
   Widget build(BuildContext context) {
-    return const Scaffold(body: Center(child: CircularProgressIndicator()));
+    return const Scaffold(
+      body: Center(
+        child: BuzzLoadingIndicator(size: 56, semanticLabel: 'Starting Buzz'),
+      ),
+    );
   }
 }
diff --git a/mobile/lib/features/activity/activity_page.dart b/mobile/lib/features/activity/activity_page.dart
index af9fb2a08ac..db398504810 100644
--- a/mobile/lib/features/activity/activity_page.dart
+++ b/mobile/lib/features/activity/activity_page.dart
@@ -1,23 +1,48 @@
+import 'dart:async';
+
 import 'package:flutter/material.dart';
 import 'package:flutter_hooks/flutter_hooks.dart';
 import 'package:hooks_riverpod/hooks_riverpod.dart';
 import 'package:lucide_icons_flutter/lucide_icons.dart';
 
+import '../../shared/relay/relay.dart';
 import '../../shared/theme/theme.dart';
-import '../../shared/widgets/filter_chip_bar.dart';
+import '../../shared/utils/string_utils.dart';
+import '../../shared/widgets/avatar_image.dart';
+import '../../shared/widgets/anchored_popover_menu.dart';
+import '../../shared/widgets/buzz_loading_indicator.dart';
 import '../../shared/widgets/frosted_app_bar.dart';
 import '../../shared/widgets/frosted_scaffold.dart';
+import '../../shared/widgets/message_author_meta.dart';
 import '../channels/channel.dart';
 import '../channels/channel_detail_page.dart';
-import '../channels/message_content.dart';
 import '../channels/channels_provider.dart';
-import '../channels/small_avatar.dart';
+import '../channels/dm_channel_labels.dart';
+import '../channels/message_content.dart';
+import '../channels/read_state/read_state_format.dart';
+import '../channels/read_state/read_state_provider.dart';
 import '../profile/user_cache_provider.dart';
+import '../profile/user_profile.dart';
 import 'activity_provider.dart';
-import 'feed_item.dart';
+import 'compose_drafts_provider.dart';
+import 'inbox_item.dart';
+import 'inbox_local_state_provider.dart';
+import 'inbox_read_state.dart';
+import 'reminders_provider.dart';
 
-enum _Filter { all, mentions, needsAction, activity, agents }
+part 'activity_page/header_actions.dart';
+part 'activity_page/inbox_row.dart';
+part 'activity_page/lists.dart';
+part 'activity_page/status_views.dart';
 
+/// Conversation-oriented Activity inbox.
+///
+/// Matches desktop's Home inbox item design and semantics (see
+/// `desktop/src/features/home/ui/InboxListPane.tsx`): full sender avatar +
+/// name, contextual "Mentioned in #channel"-style label, unread dot + time,
+/// message preview — while keeping mobile's list → canonical destination
+/// navigation. Row taps deep-link to the represented message (oldest unread
+/// for grouped conversations) rather than just opening the channel.
 class ActivityPage extends HookConsumerWidget {
   const ActivityPage({super.key});
 
@@ -25,401 +50,271 @@ class ActivityPage extends HookConsumerWidget {
   Widget build(BuildContext context, WidgetRef ref) {
     final feedAsync = ref.watch(activityProvider);
     final channelsAsync = ref.watch(channelsProvider);
-    final filter = useState(_Filter.all);
+    final filter = useState(InboxFilter.all);
+    final unreadOnly = useState(false);
     final headerTitleStyle = context.textTheme.titleMedium?.copyWith(
       fontSize: 22,
       fontWeight: FontWeight.w600,
     );
 
-    // Cache last successful feed so the UI doesn't flash on rebuild.
-    final cachedFeed = useRef<HomeFeedResponse?>(null);
-    if (feedAsync.asData?.value case final data?) {
-      cachedFeed.value = data;
-    }
-    final feed = cachedFeed.value;
-
-    final Widget content;
-    if (feed != null && !feed.isEmpty) {
-      final items = _filteredItems(feed, filter.value);
-      final channels = channelsAsync.asData?.value ?? [];
-
-      // Preload user profiles for visible feed items.
-      final pubkeys = items.map((i) => i.pubkey).toSet().toList();
-      ref.read(userCacheProvider.notifier).preload(pubkeys);
-
-      content = items.isEmpty
-          ? _EmptyFilterState(filter: filter.value)
-          : RefreshIndicator(
-              onRefresh: () => ref.read(activityProvider.notifier).refresh(),
-              child: ListView.separated(
-                padding: const EdgeInsets.symmetric(vertical: Grid.xxs),
-                itemCount: items.length,
-                separatorBuilder: (_, _) => const SizedBox(height: Grid.half),
-                itemBuilder: (context, index) {
-                  final item = items[index];
-                  return _FeedItemTile(
-                    item: item,
-                    onTap: () => _openItem(context, item, channels),
-                  );
-                },
-              ),
-            );
-    } else if (feedAsync.hasError) {
-      content = _ErrorView(
-        onRetry: () => ref.read(activityProvider.notifier).refresh(),
-      );
-    } else if (feedAsync.hasValue) {
-      content = const _EmptyState();
-    } else {
-      content = const _LoadingSkeleton();
-    }
+    final readState = ref.watch(readStateProvider);
+    final localState = ref.watch(inboxLocalStateProvider);
+    final drafts = ref.watch(composeDraftsProvider);
+    final dueReminderCount = ref.watch(dueReminderCountProvider);
+    final allItems = ref.watch(inboxItemsProvider);
+    final myPk = ref.watch(myPubkeyProvider);
 
-    return FrostedScaffold(
-      appBar: FrostedAppBar(
-        gradient: context.appColors.topSectionGradient,
-        title: const Text('Activity'),
-        titleStyle: headerTitleStyle,
-      ),
-      body: SafeArea(
-        top: false,
-        child: Padding(
-          padding: EdgeInsets.only(
-            top: frostedAppBarHeight(context, titleStyle: headerTitleStyle),
-          ),
-          child: Column(
-            children: [
-              FilterChipBar<_Filter>(
-                expandItems: false,
-                visualDensity: const VisualDensity(horizontal: -2),
-                chipVerticalPadding: Grid.xxs,
-                barVerticalPadding: Grid.twelve,
-                selected: filter.value,
-                onSelected: (f) => filter.value = f,
-                items: [
-                  const FilterChipItem(id: _Filter.all, label: 'All'),
-                  FilterChipItem(
-                    id: _Filter.mentions,
-                    label: 'Mentions',
-                    icon: LucideIcons.atSign,
-                    count: feed?.mentions.length,
-                  ),
-                  FilterChipItem(
-                    id: _Filter.needsAction,
-                    label: 'Action',
-                    icon: LucideIcons.circleAlert,
-                    count: feed?.needsAction.length,
-                  ),
-                  FilterChipItem(
-                    id: _Filter.activity,
-                    label: 'Activity',
-                    icon: LucideIcons.activity,
-                    count: feed?.activity.length,
-                  ),
-                  FilterChipItem(
-                    id: _Filter.agents,
-                    label: 'Agents',
-                    icon: LucideIcons.bot,
-                    count: feed?.agentActivity.length,
-                  ),
-                ],
-              ),
-              Expanded(child: content),
-            ],
-          ),
-        ),
-      ),
-    );
-  }
+    // Cache the last non-empty feed so the UI doesn't flash on rebuild.
+    final hasLoadedOnce = useRef(false);
+    if (feedAsync.hasValue) hasLoadedOnce.value = true;
 
-  List<FeedItem> _filteredItems(HomeFeedResponse feed, _Filter filter) {
-    return switch (filter) {
-      _Filter.all => feed.all,
-      _Filter.mentions => feed.mentions,
-      _Filter.needsAction => feed.needsAction,
-      _Filter.activity => feed.activity,
-      _Filter.agents => feed.agentActivity,
-    };
-  }
+    final channels = channelsAsync.asData?.value ?? const <Channel>[];
+    final channelById = {for (final c in channels) c.id: c};
 
-  void _openItem(BuildContext context, FeedItem item, List<Channel> channels) {
-    if (item.channelId == null) return;
-    final channel = channels
-        .where((c) => c.id == item.channelId)
-        .cast<Channel?>()
-        .firstOrNull;
-    if (channel == null) return;
-    Navigator.of(context).push(
-      MaterialPageRoute<void>(
-        builder: (_) => ChannelDetailPage(channel: channel),
-      ),
+    int? markerOf(String contextId) => readState.effectiveTimestamp(contextId);
+    bool isDone(InboxItem item) => isInboxItemDone(
+      item,
+      markerOf: markerOf,
+      localUnreadOverrides: localState.unreadIds,
+      localDoneSet: localState.doneIds,
     );
-  }
-}
 
-class _FeedItemTile extends ConsumerWidget {
-  final FeedItem item;
-  final VoidCallback onTap;
+    final visibleItems = [
+      for (final item in allItems)
+        if (matchesInboxFilter(item, filter.value) &&
+            (!unreadOnly.value || !isDone(item)))
+          item,
+    ];
 
-  const _FeedItemTile({required this.item, required this.onTap});
+    // Preload sender profiles for visible rows.
+    final pubkeys = visibleItems.map((i) => i.item.pubkey).toSet().toList();
+    ref.read(userCacheProvider.notifier).preload(pubkeys);
 
-  @override
-  Widget build(BuildContext context, WidgetRef ref) {
-    final userCache = ref.watch(userCacheProvider);
-    final profile = userCache[item.pubkey.toLowerCase()];
-    final authorLabel = profile?.label ?? _shortPubkey(item.pubkey);
+    final unreadVisibleCount = visibleItems.where((i) => !isDone(i)).length;
 
-    return InkWell(
-      onTap: item.channelId != null ? onTap : null,
-      child: Padding(
-        padding: const EdgeInsets.symmetric(
-          horizontal: Grid.gutter,
-          vertical: Grid.twelve,
-        ),
-        child: Column(
-          crossAxisAlignment: CrossAxisAlignment.start,
-          children: [
-            // Header row: icon + headline + author + channel + time
-            Row(
-              children: [
-                Expanded(
-                  child: Row(
-                    children: [
-                      Icon(
-                        _categoryIcon(item.category),
-                        size: 14,
-                        color: context.colors.primary,
-                      ),
-                      const SizedBox(width: Grid.half),
-                      Text(
-                        item.headline,
-                        style: context.textTheme.labelMedium?.copyWith(
-                          fontWeight: FontWeight.w600,
-                        ),
-                      ),
-                      const SizedBox(width: Grid.xxs),
-                      SmallAvatar(pubkey: item.pubkey, userCache: userCache),
-                      const SizedBox(width: Grid.quarter),
-                      Flexible(
-                        child: Text(
-                          authorLabel,
-                          style: context.textTheme.labelSmall?.copyWith(
-                            color: context.colors.onSurfaceVariant,
-                          ),
-                          overflow: TextOverflow.ellipsis,
-                        ),
-                      ),
-                      if (item.channelName.isNotEmpty) ...[
-                        const SizedBox(width: Grid.half),
-                        Flexible(
-                          child: Text(
-                            '#${item.channelName}',
-                            style: context.textTheme.labelSmall?.copyWith(
-                              color: context.colors.primary.withValues(
-                                alpha: 0.8,
-                              ),
-                            ),
-                            overflow: TextOverflow.ellipsis,
-                          ),
-                        ),
-                      ],
-                    ],
-                  ),
-                ),
-                const SizedBox(width: Grid.xxs),
-                Text(
-                  _relativeTime(item.createdAt),
-                  style: context.textTheme.labelSmall?.copyWith(
-                    color: context.colors.onSurfaceVariant,
-                  ),
-                ),
-              ],
-            ),
-            const SizedBox(height: Grid.half),
-            // Content preview (max 2 lines)
-            MessageContent(
-              content: item.displayContent,
-              tags: item.tags,
-              maxLines: 2,
-              baseStyle: context.textTheme.bodySmall?.copyWith(
-                color: context.colors.onSurfaceVariant,
-              ),
-            ),
-          ],
-        ),
-      ),
-    );
-  }
+    void markItemRead(InboxItem item) {
+      final notifier = ref.read(readStateProvider.notifier);
+      ref
+          .read(inboxLocalStateProvider.notifier)
+          .clearUnread(groupedInboxItemIds(item));
+      final threadRootId = item.threadRootId;
+      if (threadRootId != null) {
+        notifier.markContextRead(
+          threadContextKey(threadRootId),
+          item.latestActivityAt,
+        );
+        final channelRead = groupedChannelReadTimestamp(item);
+        if (channelRead != null) {
+          notifier.markContextRead(
+            channelRead.channelId,
+            channelRead.timestamp,
+          );
+        }
+        return;
+      }
+      final channelId = item.item.channelId;
+      if (channelId != null) {
+        notifier.markContextRead(channelId, item.latestActivityAt);
+        ref
+            .read(channelsProvider.notifier)
+            .clearObservedUnreadCoveredByRead(channelId, item.latestActivityAt);
+        return;
+      }
+      ref.read(inboxLocalStateProvider.notifier).markDone(item.id);
+    }
 
-  static IconData _categoryIcon(String category) {
-    return switch (category) {
-      'mention' => LucideIcons.atSign,
-      'needs_action' => LucideIcons.circleAlert,
-      'agent_activity' => LucideIcons.bot,
-      _ => LucideIcons.activity,
-    };
-  }
+    void markItemUnread(InboxItem item) {
+      ref
+          .read(inboxLocalStateProvider.notifier)
+          .markUnread(groupedInboxItemIds(item));
+    }
 
-  static String _shortPubkey(String pk) =>
-      pk.length >= 8 ? '${pk.substring(0, 8)}...' : pk;
+    void openItem(InboxItem item) {
+      final channelId = item.item.channelId;
+      if (channelId == null) {
+        ScaffoldMessenger.maybeOf(context)?.showSnackBar(
+          const SnackBar(content: Text("This item isn't linked to a channel.")),
+        );
+        return;
+      }
+      final channel = channelById[channelId];
+      if (channel == null) {
+        ScaffoldMessenger.maybeOf(context)?.showSnackBar(
+          const SnackBar(content: Text('Channel not found in this workspace.')),
+        );
+        return;
+      }
 
-  static String _relativeTime(int unixSeconds) {
-    final now = DateTime.now().millisecondsSinceEpoch ~/ 1000;
-    final diff = now - unixSeconds;
+      // Deep-link to the represented message: oldest unread in the group,
+      // falling back to the latest event.
+      final readAt = resolveInboxItemReadAt(item, markerOf: markerOf);
+      final target = item.deepLinkTarget(readAt);
+      final thread = threadReferenceOf(target.tags);
+      final threadRootId = isBroadcastReply(target.tags)
+          ? null
+          : thread.parentId;
 
-    if (diff < 60) return 'now';
-    if (diff < 3600) return '${diff ~/ 60}m';
-    if (diff < 86400) return '${diff ~/ 3600}h';
-    if (diff < 604800) return '${diff ~/ 86400}d';
-    final date = DateTime.fromMillisecondsSinceEpoch(unixSeconds * 1000);
-    return '${date.month}/${date.day}';
-  }
-}
-
-class _LoadingSkeleton extends StatelessWidget {
-  const _LoadingSkeleton();
-
-  @override
-  Widget build(BuildContext context) {
-    return ListView.separated(
-      padding: const EdgeInsets.all(Grid.xs),
-      itemCount: 8,
-      separatorBuilder: (_, _) => const SizedBox(height: Grid.xs),
-      itemBuilder: (context, _) => Column(
-        crossAxisAlignment: CrossAxisAlignment.start,
-        children: [
-          Container(
-            width: 180,
-            height: 12,
-            decoration: BoxDecoration(
-              color: context.colors.outlineVariant.withValues(alpha: 0.4),
-              borderRadius: BorderRadius.circular(4),
-            ),
+      Navigator.of(context).push(
+        MaterialPageRoute<void>(
+          builder: (_) => ChannelDetailPage(
+            channel: channel,
+            initialMessageId: target.id,
+            initialThreadRootId: threadRootId,
           ),
-          const SizedBox(height: Grid.xxs),
-          Container(
-            width: double.infinity,
-            height: 10,
-            decoration: BoxDecoration(
-              color: context.colors.outlineVariant.withValues(alpha: 0.3),
-              borderRadius: BorderRadius.circular(4),
-            ),
+        ),
+      );
+    }
+
+    void openDraft(ComposeDraft draft) {
+      final channel = channelById[draft.channelId];
+      if (channel == null) {
+        ScaffoldMessenger.maybeOf(context)?.showSnackBar(
+          const SnackBar(
+            content: Text('Channel for this draft is no longer available.'),
           ),
-          const SizedBox(height: Grid.half),
-          Container(
-            width: 240,
-            height: 10,
-            decoration: BoxDecoration(
-              color: context.colors.outlineVariant.withValues(alpha: 0.2),
-              borderRadius: BorderRadius.circular(4),
-            ),
+        );
+        return;
+      }
+      Navigator.of(context).push(
+        MaterialPageRoute<void>(
+          builder: (_) => ChannelDetailPage(
+            channel: channel,
+            initialThreadRootId: draft.threadHeadId,
           ),
-        ],
-      ),
-    );
-  }
-}
-
-class _EmptyState extends StatelessWidget {
-  const _EmptyState();
+        ),
+      );
+    }
 
-  @override
-  Widget build(BuildContext context) {
-    return Center(
-      child: Column(
-        mainAxisSize: MainAxisSize.min,
-        children: [
-          Icon(
-            LucideIcons.bell,
-            size: Grid.xl,
-            color: context.colors.onSurfaceVariant,
+    void openReminder(Reminder reminder) {
+      final target = reminder.target;
+      if (target == null) {
+        ScaffoldMessenger.maybeOf(context)?.showSnackBar(
+          const SnackBar(
+            content: Text("This reminder isn't linked to a message."),
           ),
-          const SizedBox(height: Grid.xs),
-          Text(
-            'No activity yet',
-            style: context.textTheme.bodyLarge?.copyWith(
-              color: context.colors.onSurfaceVariant,
-            ),
+        );
+        return;
+      }
+      final channel = channelById[target.channelId];
+      if (channel == null) {
+        ScaffoldMessenger.maybeOf(context)?.showSnackBar(
+          const SnackBar(
+            content: Text('Channel for this reminder is no longer available.'),
           ),
-          const SizedBox(height: Grid.half),
-          Text(
-            'Mentions, replies, and reactions will show up here.',
-            style: context.textTheme.bodySmall?.copyWith(
-              color: context.colors.onSurfaceVariant,
-            ),
-            textAlign: TextAlign.center,
+        );
+        return;
+      }
+      Navigator.of(context).push(
+        MaterialPageRoute<void>(
+          builder: (_) => ChannelDetailPage(
+            channel: channel,
+            initialMessageId: target.eventId,
           ),
-        ],
-      ),
-    );
-  }
-}
+        ),
+      );
+    }
 
-class _EmptyFilterState extends StatelessWidget {
-  final _Filter filter;
+    Future<void> refresh() async {
+      await Future.wait([
+        ref.read(activityProvider.notifier).refresh(),
+        ref.read(remindersProvider.notifier).refresh(),
+      ]);
+    }
 
-  const _EmptyFilterState({required this.filter});
+    final Widget body;
+    if (filter.value == InboxFilter.reminders) {
+      body = _RemindersList(onOpen: openReminder, onRefresh: refresh);
+    } else if (filter.value == InboxFilter.drafts) {
+      body = _DraftsList(
+        drafts: drafts,
+        channelById: channelById,
+        myPubkey: myPk,
+        onOpen: openDraft,
+        onDelete: (draft) =>
+            ref.read(composeDraftsProvider.notifier).remove(draft.key),
+      );
+    } else if (feedAsync.hasError && allItems.isEmpty) {
+      body = _ErrorView(onRetry: refresh);
+    } else if (!hasLoadedOnce.value && allItems.isEmpty) {
+      body = const _LoadingSkeleton();
+    } else if (visibleItems.isEmpty) {
+      body = _EmptyFilterState(
+        filter: filter.value,
+        unreadOnly: unreadOnly.value,
+      );
+    } else {
+      // Compute the "New" boundary: index of the first unread row when the
+      // rows above it are read (list is newest-first, so unread rows sit on
+      // top; the divider marks where the unread block ends).
+      final firstReadIndex = visibleItems.indexWhere(isDone);
+      final newBoundaryIndex = !unreadOnly.value && firstReadIndex > 0
+          ? firstReadIndex
+          : -1;
 
-  @override
-  Widget build(BuildContext context) {
-    final (icon, message) = switch (filter) {
-      _Filter.mentions => (LucideIcons.atSign, 'No mentions yet'),
-      _Filter.needsAction => (
-        LucideIcons.circleAlert,
-        'Nothing needs your action',
-      ),
-      _Filter.activity => (LucideIcons.activity, 'No recent channel activity'),
-      _Filter.agents => (LucideIcons.bot, 'No agent updates'),
-      _Filter.all => (LucideIcons.bell, 'No activity yet'),
-    };
+      body = RefreshIndicator(
+        onRefresh: refresh,
+        child: ListView.builder(
+          padding: const EdgeInsets.symmetric(vertical: Grid.xxs),
+          itemCount: visibleItems.length,
+          itemBuilder: (context, index) {
+            final item = visibleItems[index];
+            final channel = item.item.channelId != null
+                ? channelById[item.item.channelId]
+                : null;
+            return Column(
+              crossAxisAlignment: CrossAxisAlignment.stretch,
+              children: [
+                if (index == newBoundaryIndex) const _NewBoundaryDivider(),
+                _InboxRow(
+                  item: item,
+                  channel: channel,
+                  currentPubkey: myPk,
+                  isDone: isDone(item),
+                  onTap: () => openItem(item),
+                  onMarkRead: () => markItemRead(item),
+                  onMarkUnread: () => markItemUnread(item),
+                ),
+              ],
+            );
+          },
+        ),
+      );
+    }
 
-    return Center(
-      child: Column(
-        mainAxisSize: MainAxisSize.min,
-        children: [
-          Icon(icon, size: Grid.lg, color: context.colors.onSurfaceVariant),
-          const SizedBox(height: Grid.xxs),
-          Text(
-            message,
-            style: context.textTheme.bodyMedium?.copyWith(
-              color: context.colors.onSurfaceVariant,
-            ),
+    return FrostedScaffold(
+      backgroundColor: Colors.transparent,
+      appBar: FrostedAppBar(
+        gradient: context.appColors.topSectionGradient,
+        automaticallyImplyLeading: false,
+        title: const Text('Activity'),
+        titleStyle: headerTitleStyle,
+        actions: [
+          _FilterMenuButton(
+            filter: filter.value,
+            dueReminderCount: dueReminderCount,
+            draftCount: drafts.length,
+            onChanged: (f) => filter.value = f,
+          ),
+          _InboxOptionsButton(
+            unreadOnly: unreadOnly.value,
+            unreadCount: unreadVisibleCount,
+            onUnreadOnlyChanged: (v) => unreadOnly.value = v,
+            onMarkAllRead: () {
+              for (final item in visibleItems) {
+                if (!isDone(item)) markItemRead(item);
+              }
+            },
           ),
         ],
       ),
-    );
-  }
-}
-
-class _ErrorView extends StatelessWidget {
-  final VoidCallback onRetry;
-
-  const _ErrorView({required this.onRetry});
-
-  @override
-  Widget build(BuildContext context) {
-    return Center(
-      child: Column(
-        mainAxisSize: MainAxisSize.min,
-        children: [
-          Icon(
-            LucideIcons.triangleAlert,
-            size: Grid.lg,
-            color: context.colors.error,
-          ),
-          const SizedBox(height: Grid.xxs),
-          Text(
-            'Failed to load activity',
-            style: context.textTheme.bodyMedium?.copyWith(
-              color: context.colors.onSurfaceVariant,
-            ),
-          ),
-          const SizedBox(height: Grid.xs),
-          FilledButton.icon(
-            onPressed: onRetry,
-            icon: const Icon(LucideIcons.refreshCcw, size: 16),
-            label: const Text('Retry'),
+      body: SafeArea(
+        top: false,
+        child: Padding(
+          padding: EdgeInsets.only(
+            top: frostedAppBarHeight(context, titleStyle: headerTitleStyle),
           ),
-        ],
+          child: body,
+        ),
       ),
     );
   }
diff --git a/mobile/lib/features/activity/activity_page/header_actions.dart b/mobile/lib/features/activity/activity_page/header_actions.dart
new file mode 100644
index 00000000000..56592e2e69f
--- /dev/null
+++ b/mobile/lib/features/activity/activity_page/header_actions.dart
@@ -0,0 +1,236 @@
+part of '../activity_page.dart';
+
+const _filterLabels = <InboxFilter, String>{
+  InboxFilter.all: 'All',
+  InboxFilter.mention: 'Mentions',
+  InboxFilter.thread: 'Threads',
+  InboxFilter.needsAction: 'Needs Action',
+  InboxFilter.activity: 'Activity',
+  InboxFilter.agentActivity: 'Agents',
+  InboxFilter.reminders: 'Reminders',
+  InboxFilter.drafts: 'Drafts',
+};
+
+/// Compact filter dropdown replacing the old chip rail — mirrors desktop's
+/// inbox filter menu (`FILTER_OPTIONS`).
+class _FilterMenuButton extends StatelessWidget {
+  final InboxFilter filter;
+  final int dueReminderCount;
+  final int draftCount;
+  final ValueChanged<InboxFilter> onChanged;
+
+  const _FilterMenuButton({
+    required this.filter,
+    required this.dueReminderCount,
+    required this.draftCount,
+    required this.onChanged,
+  });
+
+  @override
+  Widget build(BuildContext context) {
+    return Builder(
+      builder: (buttonContext) => InkWell(
+        key: const ValueKey('activity-filter-menu'),
+        borderRadius: BorderRadius.circular(Radii.md),
+        onTap: () async {
+          final selected = await showAnchoredPopover<InboxFilter>(
+            context: buttonContext,
+            width: 240,
+            alignment: AnchoredPopoverAlignment.start,
+            offset: const Offset(0, Grid.half),
+            menuPadding: const EdgeInsets.symmetric(vertical: Grid.half),
+            color: context.colors.surface.withValues(alpha: 0.98),
+            elevation: 8,
+            shadowColor: context.colors.shadow.withValues(alpha: 0.18),
+            shape: RoundedRectangleBorder(
+              borderRadius: BorderRadius.circular(Radii.card),
+              side: BorderSide(
+                color: context.colors.outlineVariant.withValues(alpha: 0.45),
+              ),
+            ),
+            surfaceKey: const ValueKey('activity-filter-popover'),
+            items: [
+              for (final entry in _filterLabels.entries)
+                PopupMenuItem(
+                  value: entry.key,
+                  height: Grid.xl,
+                  padding: const EdgeInsets.symmetric(horizontal: Grid.twelve),
+                  child: Row(
+                    children: [
+                      SizedBox(
+                        width: Grid.sm,
+                        child: entry.key == filter
+                            ? Icon(
+                                LucideIcons.check,
+                                size: 16,
+                                color: context.colors.primary,
+                              )
+                            : null,
+                      ),
+                      Expanded(
+                        child: Text(
+                          entry.value,
+                          maxLines: 1,
+                          overflow: TextOverflow.ellipsis,
+                          style: context.textTheme.labelLarge?.copyWith(
+                            color: context.colors.onSurface,
+                          ),
+                        ),
+                      ),
+                      if (entry.key == InboxFilter.reminders &&
+                          dueReminderCount > 0)
+                        _CountBadge(count: dueReminderCount)
+                      else if (entry.key == InboxFilter.drafts &&
+                          draftCount > 0)
+                        _CountBadge(count: draftCount),
+                    ],
+                  ),
+                ),
+            ],
+          );
+          if (buttonContext.mounted && selected != null) onChanged(selected);
+        },
+        child: ConstrainedBox(
+          constraints: const BoxConstraints(minHeight: Grid.xl),
+          child: Padding(
+            padding: const EdgeInsets.symmetric(horizontal: Grid.xxs),
+            child: Row(
+              mainAxisSize: MainAxisSize.min,
+              children: [
+                Text(
+                  _filterLabels[filter]!,
+                  style: context.textTheme.labelLarge?.copyWith(
+                    fontWeight: FontWeight.w600,
+                  ),
+                ),
+                const SizedBox(width: Grid.quarter),
+                Icon(
+                  LucideIcons.chevronDown,
+                  size: 16,
+                  color: context.colors.onSurfaceVariant,
+                ),
+                if (dueReminderCount > 0 || draftCount > 0) ...[
+                  const SizedBox(width: Grid.quarter),
+                  Container(
+                    width: 6,
+                    height: 6,
+                    decoration: BoxDecoration(
+                      shape: BoxShape.circle,
+                      color: context.colors.primary,
+                    ),
+                  ),
+                ],
+              ],
+            ),
+          ),
+        ),
+      ),
+    );
+  }
+}
+
+class _CountBadge extends StatelessWidget {
+  final int count;
+
+  const _CountBadge({required this.count});
+
+  @override
+  Widget build(BuildContext context) {
+    return Container(
+      padding: const EdgeInsets.symmetric(
+        horizontal: Grid.half + Grid.quarter,
+        vertical: Grid.quarter,
+      ),
+      decoration: BoxDecoration(
+        color: context.colors.primary,
+        borderRadius: BorderRadius.circular(Grid.xxs),
+      ),
+      child: Text(
+        '$count',
+        style: context.textTheme.labelSmall?.copyWith(
+          color: context.colors.onPrimary,
+          fontWeight: FontWeight.w600,
+        ),
+      ),
+    );
+  }
+}
+
+/// Overflow menu with the unread-only toggle and mark-all-read, mirroring
+/// desktop's inbox options popover.
+class _InboxOptionsButton extends StatelessWidget {
+  final bool unreadOnly;
+  final int unreadCount;
+  final ValueChanged<bool> onUnreadOnlyChanged;
+  final VoidCallback onMarkAllRead;
+
+  const _InboxOptionsButton({
+    required this.unreadOnly,
+    required this.unreadCount,
+    required this.onUnreadOnlyChanged,
+    required this.onMarkAllRead,
+  });
+
+  @override
+  Widget build(BuildContext context) {
+    return Builder(
+      builder: (buttonContext) => IconButton(
+        key: const ValueKey('activity-options-menu'),
+        tooltip: 'Activity options',
+        icon: const Icon(LucideIcons.ellipsis, size: 20),
+        onPressed: () async {
+          final selected = await showAnchoredPopover<String>(
+            context: buttonContext,
+            width: 216,
+            alignment: AnchoredPopoverAlignment.end,
+            color: context.colors.surface,
+            elevation: 4,
+            shadowColor: context.colors.shadow.withValues(alpha: 0.18),
+            shape: RoundedRectangleBorder(
+              borderRadius: BorderRadius.circular(Radii.md),
+              side: BorderSide(color: context.colors.outline),
+            ),
+            surfaceKey: const ValueKey('activity-options-popover'),
+            items: [
+              PopupMenuItem(
+                value: 'unread-only',
+                child: Row(
+                  children: [
+                    Expanded(
+                      child: Text(unreadOnly ? 'Show all' : 'Show unread'),
+                    ),
+                    if (unreadOnly)
+                      Icon(
+                        LucideIcons.check,
+                        size: 16,
+                        color: context.colors.primary,
+                      ),
+                  ],
+                ),
+              ),
+              PopupMenuItem(
+                value: 'mark-all-read',
+                enabled: unreadCount > 0,
+                child: Row(
+                  children: [
+                    const Expanded(child: Text('Mark all as read')),
+                    if (unreadCount > 0)
+                      Text(
+                        '$unreadCount',
+                        style: context.textTheme.labelSmall?.copyWith(
+                          color: context.colors.onSurfaceVariant,
+                        ),
+                      ),
+                  ],
+                ),
+              ),
+            ],
+          );
+          if (!buttonContext.mounted || selected == null) return;
+          if (selected == 'unread-only') onUnreadOnlyChanged(!unreadOnly);
+          if (selected == 'mark-all-read') onMarkAllRead();
+        },
+      ),
+    );
+  }
+}
diff --git a/mobile/lib/features/activity/activity_page/inbox_row.dart b/mobile/lib/features/activity/activity_page/inbox_row.dart
new file mode 100644
index 00000000000..fb267c03be3
--- /dev/null
+++ b/mobile/lib/features/activity/activity_page/inbox_row.dart
@@ -0,0 +1,247 @@
+part of '../activity_page.dart';
+
+/// "New" boundary between unread and previously read rows.
+class _NewBoundaryDivider extends StatelessWidget {
+  const _NewBoundaryDivider();
+
+  @override
+  Widget build(BuildContext context) {
+    return Padding(
+      padding: const EdgeInsets.symmetric(
+        horizontal: Grid.gutter,
+        vertical: Grid.half,
+      ),
+      child: Row(
+        children: [
+          Expanded(
+            child: Divider(color: context.colors.error.withValues(alpha: 0.5)),
+          ),
+          Padding(
+            padding: const EdgeInsets.symmetric(horizontal: Grid.xxs),
+            child: Text(
+              'New',
+              style: context.textTheme.labelSmall?.copyWith(
+                color: context.colors.error,
+                fontWeight: FontWeight.w600,
+              ),
+            ),
+          ),
+          Expanded(
+            child: Divider(color: context.colors.error.withValues(alpha: 0.5)),
+          ),
+        ],
+      ),
+    );
+  }
+}
+
+/// One conversation row, matching desktop's inbox item hierarchy:
+/// avatar | sender + unread dot + time | contextual label | preview.
+class _InboxRow extends ConsumerWidget {
+  final InboxItem item;
+  final Channel? channel;
+  final String? currentPubkey;
+  final bool isDone;
+  final VoidCallback onTap;
+  final VoidCallback onMarkRead;
+  final VoidCallback onMarkUnread;
+
+  const _InboxRow({
+    required this.item,
+    required this.channel,
+    required this.currentPubkey,
+    required this.isDone,
+    required this.onTap,
+    required this.onMarkRead,
+    required this.onMarkUnread,
+  });
+
+  @override
+  Widget build(BuildContext context, WidgetRef ref) {
+    final userCache = ref.watch(userCacheProvider);
+    final profile = userCache[item.item.pubkey.toLowerCase()];
+    final senderLabel = profile?.displayName ?? shortPubkey(item.item.pubkey);
+
+    final isDm = channel?.isDm ?? false;
+    final channelName = channel != null && !isDm
+        ? (channel!.name.isNotEmpty ? channel!.name : null)
+        : null;
+    final label = inboxTypeLabel(
+      item,
+      channelName: channelName,
+      isDm: isDm,
+      senderLabel: senderLabel,
+    );
+
+    final mutedColor = context.colors.onSurfaceVariant;
+    final labelColor = item.isActionRequired && !isDone
+        ? context.colors.tertiary
+        : mutedColor;
+
+    return InkWell(
+      key: ValueKey('inbox-row-${item.id}'),
+      onTap: onTap,
+      onLongPress: () => _showRowActions(context),
+      child: Padding(
+        padding: const EdgeInsets.symmetric(
+          horizontal: Grid.gutter,
+          vertical: Grid.twelve,
+        ),
+        child: Row(
+          crossAxisAlignment: CrossAxisAlignment.start,
+          children: [
+            _RowAvatar(pubkey: item.item.pubkey, profile: profile),
+            const SizedBox(width: messageAvatarContentGap),
+            Expanded(
+              child: Column(
+                crossAxisAlignment: CrossAxisAlignment.start,
+                children: [
+                  // Sender + unread dot + timestamp.
+                  Row(
+                    children: [
+                      Expanded(
+                        child: MessageAuthorMeta(
+                          displayName: senderLabel,
+                          username: messageUsernameLabel(profile),
+                          timestamp: _inboxTimestamp(item.latestActivityAt),
+                          nameColor: context.colors.onSurface,
+                          metadataColor: mutedColor,
+                          nameStyle: activityUsernameTextStyle,
+                          metadataStyle: activityTimestampTextStyle,
+                          displayNameKey: ValueKey(
+                            'activity-author-${item.id}',
+                          ),
+                          usernameKey: ValueKey('activity-username-${item.id}'),
+                          timestampKey: ValueKey(
+                            'activity-timestamp-${item.id}',
+                          ),
+                        ),
+                      ),
+                      if (!isDone) ...[
+                        const SizedBox(width: Grid.xxs),
+                        Container(
+                          key: ValueKey('inbox-unread-dot-${item.id}'),
+                          width: 6,
+                          height: 6,
+                          decoration: BoxDecoration(
+                            shape: BoxShape.circle,
+                            color: context.colors.primary,
+                          ),
+                        ),
+                      ],
+                    ],
+                  ),
+                  const SizedBox(height: Grid.quarter),
+                  // Contextual label: "Mentioned in #channel" etc.
+                  Row(
+                    children: [
+                      Flexible(
+                        child: Text(
+                          label.text,
+                          style: activityContextTextStyle.copyWith(
+                            color: labelColor,
+                          ),
+                          overflow: TextOverflow.ellipsis,
+                        ),
+                      ),
+                      if (label.channelLabel != null) ...[
+                        const SizedBox(width: Grid.half),
+                        Flexible(
+                          child: Container(
+                            padding: const EdgeInsets.symmetric(
+                              horizontal: Grid.half + Grid.quarter,
+                              vertical: Grid.quarter / 2,
+                            ),
+                            decoration: BoxDecoration(
+                              color: context.colors.surfaceContainerHighest,
+                              borderRadius: BorderRadius.circular(Grid.half),
+                            ),
+                            child: Text(
+                              '#${label.channelLabel}',
+                              style: activityContextTextStyle.copyWith(
+                                color: mutedColor,
+                              ),
+                              overflow: TextOverflow.ellipsis,
+                            ),
+                          ),
+                        ),
+                      ],
+                    ],
+                  ),
+                  const SizedBox(height: Grid.half),
+                  // Message preview.
+                  MessageContent(
+                    content: item.item.displayContent,
+                    tags: item.item.tags,
+                    maxLines: 2,
+                    baseStyle: activityPreviewTextStyle.copyWith(
+                      color: context.colors.onSurface,
+                    ),
+                  ),
+                ],
+              ),
+            ),
+          ],
+        ),
+      ),
+    );
+  }
+
+  void _showRowActions(BuildContext context) {
+    showModalBottomSheet<void>(
+      context: context,
+      builder: (sheetContext) => SafeArea(
+        child: Column(
+          mainAxisSize: MainAxisSize.min,
+          children: [
+            ListTile(
+              leading: Icon(
+                isDone ? LucideIcons.mail : LucideIcons.mailOpen,
+                size: 20,
+              ),
+              title: Text(isDone ? 'Mark unread' : 'Mark as read'),
+              onTap: () {
+                Navigator.of(sheetContext).pop();
+                isDone ? onMarkUnread() : onMarkRead();
+              },
+            ),
+            ListTile(
+              leading: const Icon(LucideIcons.externalLink, size: 20),
+              title: const Text('Open conversation'),
+              onTap: () {
+                Navigator.of(sheetContext).pop();
+                onTap();
+              },
+            ),
+          ],
+        ),
+      ),
+    );
+  }
+}
+
+class _RowAvatar extends StatelessWidget {
+  final String pubkey;
+  final UserProfile? profile;
+
+  const _RowAvatar({required this.pubkey, required this.profile});
+
+  @override
+  Widget build(BuildContext context) {
+    final initial =
+        profile?.initial ?? (pubkey.isNotEmpty ? pubkey[0].toUpperCase() : '?');
+    return AvatarImage(
+      imageUrl: profile?.avatarUrl,
+      radius: activityAvatarSize / 2,
+      backgroundColor: context.colors.primaryContainer,
+      fallback: Text(
+        initial,
+        style: TextStyle(
+          fontSize: 14,
+          fontWeight: FontWeight.w600,
+          color: context.colors.onPrimaryContainer,
+        ),
+      ),
+    );
+  }
+}
diff --git a/mobile/lib/features/activity/activity_page/lists.dart b/mobile/lib/features/activity/activity_page/lists.dart
new file mode 100644
index 00000000000..37311c9287c
--- /dev/null
+++ b/mobile/lib/features/activity/activity_page/lists.dart
@@ -0,0 +1,165 @@
+part of '../activity_page.dart';
+
+/// Reminders surface for the Reminders filter — due/pending NIP-ER
+/// reminders that deep-link to their target message.
+class _RemindersList extends ConsumerWidget {
+  final void Function(Reminder reminder) onOpen;
+  final Future<void> Function() onRefresh;
+
+  const _RemindersList({required this.onOpen, required this.onRefresh});
+
+  @override
+  Widget build(BuildContext context, WidgetRef ref) {
+    final remindersAsync = ref.watch(remindersProvider);
+    final reminders = [
+      for (final r in remindersAsync.value ?? const <Reminder>[])
+        if (r.status == 'pending') r,
+    ];
+
+    if (remindersAsync.isLoading && reminders.isEmpty) {
+      return const Center(
+        child: BuzzLoadingIndicator(
+          size: 44,
+          semanticLabel: 'Loading reminders',
+        ),
+      );
+    }
+    if (reminders.isEmpty) {
+      return const _EmptySurface(
+        icon: LucideIcons.clock,
+        message: 'No reminders',
+        detail: 'Reminders you set will show up here.',
+      );
+    }
+
+    final now = DateTime.now().millisecondsSinceEpoch ~/ 1000;
+    return RefreshIndicator(
+      onRefresh: onRefresh,
+      child: ListView.builder(
+        padding: const EdgeInsets.symmetric(vertical: Grid.xxs),
+        itemCount: reminders.length,
+        itemBuilder: (context, index) {
+          final reminder = reminders[index];
+          final due = reminder.isDue(now);
+          final title = reminder.note?.trim().isNotEmpty == true
+              ? reminder.note!.trim()
+              : reminder.target?.preview ?? 'Reminder';
+          return ListTile(
+            key: ValueKey('reminder-row-${reminder.id}'),
+            leading: Icon(
+              due ? LucideIcons.bellRing : LucideIcons.clock,
+              size: 20,
+              color: due
+                  ? context.colors.primary
+                  : context.colors.onSurfaceVariant,
+            ),
+            title: Text(title, maxLines: 2, overflow: TextOverflow.ellipsis),
+            subtitle: reminder.notBefore != null
+                ? Text(
+                    due
+                        ? 'Due now'
+                        : 'Due ${_inboxTimestamp(reminder.notBefore!)}',
+                  )
+                : null,
+            onTap: () => onOpen(reminder),
+          );
+        },
+      ),
+    );
+  }
+}
+
+/// Drafts surface for the Drafts filter — locally saved unsent composer
+/// text that reopens the target composer.
+class _DraftsList extends StatelessWidget {
+  final List<ComposeDraft> drafts;
+  final Map<String, Channel> channelById;
+  final String? myPubkey;
+  final void Function(ComposeDraft draft) onOpen;
+  final void Function(ComposeDraft draft) onDelete;
+
+  const _DraftsList({
+    required this.drafts,
+    required this.channelById,
+    required this.myPubkey,
+    required this.onOpen,
+    required this.onDelete,
+  });
+
+  @override
+  Widget build(BuildContext context) {
+    if (drafts.isEmpty) {
+      return const _EmptySurface(
+        icon: LucideIcons.filePen,
+        message: 'No drafts',
+        detail: 'Unsent messages you start composing will show up here.',
+      );
+    }
+
+    return ListView.builder(
+      padding: const EdgeInsets.symmetric(vertical: Grid.xxs),
+      itemCount: drafts.length,
+      itemBuilder: (context, index) {
+        final draft = drafts[index];
+        final channel = channelById[draft.channelId];
+        final destination = channel == null
+            ? 'Unavailable channel'
+            : channel.isDm
+            ? resolveDmChannelDisplayLabel(channel, currentPubkey: myPubkey)
+            : '#${channel.name}';
+        return ListTile(
+          key: ValueKey('draft-row-${draft.key}'),
+          leading: Icon(
+            LucideIcons.filePen,
+            size: 20,
+            color: context.colors.onSurfaceVariant,
+          ),
+          title: Text(draft.text, maxLines: 2, overflow: TextOverflow.ellipsis),
+          subtitle: Text(
+            draft.threadHeadId != null ? 'Thread in $destination' : destination,
+          ),
+          trailing: IconButton(
+            icon: const Icon(LucideIcons.trash2, size: 18),
+            tooltip: 'Delete draft',
+            onPressed: () => onDelete(draft),
+          ),
+          onTap: () => onOpen(draft),
+        );
+      },
+    );
+  }
+}
+
+/// Inbox list timestamp — desktop's `formatInboxTimestamp`:
+/// time today, "Yesterday", short date this year, dated otherwise.
+String _inboxTimestamp(int unixSeconds, {DateTime? now}) {
+  final current = now ?? DateTime.now();
+  final date = DateTime.fromMillisecondsSinceEpoch(unixSeconds * 1000);
+  final today = DateTime(current.year, current.month, current.day);
+  final day = DateTime(date.year, date.month, date.day);
+  final dayDiff = today.difference(day).inDays;
+
+  if (dayDiff == 0) {
+    final hour = date.hour % 12 == 0 ? 12 : date.hour % 12;
+    final minute = date.minute.toString().padLeft(2, '0');
+    return '$hour:$minute ${date.hour < 12 ? 'AM' : 'PM'}';
+  }
+  if (dayDiff == 1) return 'Yesterday';
+
+  const months = [
+    'Jan',
+    'Feb',
+    'Mar',
+    'Apr',
+    'May',
+    'Jun',
+    'Jul',
+    'Aug',
+    'Sep',
+    'Oct',
+    'Nov',
+    'Dec',
+  ];
+  final label = '${months[date.month - 1]} ${date.day}';
+  return date.year == current.year ? label : '$label, ${date.year}';
+}
diff --git a/mobile/lib/features/activity/activity_page/status_views.dart b/mobile/lib/features/activity/activity_page/status_views.dart
new file mode 100644
index 00000000000..11115d9dc8e
--- /dev/null
+++ b/mobile/lib/features/activity/activity_page/status_views.dart
@@ -0,0 +1,172 @@
+part of '../activity_page.dart';
+
+class _LoadingSkeleton extends StatelessWidget {
+  const _LoadingSkeleton();
+
+  @override
+  Widget build(BuildContext context) {
+    return ListView.separated(
+      padding: const EdgeInsets.all(Grid.gutter),
+      itemCount: 8,
+      separatorBuilder: (_, _) => const SizedBox(height: Grid.xs),
+      itemBuilder: (context, _) => Row(
+        crossAxisAlignment: CrossAxisAlignment.start,
+        children: [
+          Container(
+            width: 36,
+            height: 36,
+            decoration: BoxDecoration(
+              shape: BoxShape.circle,
+              color: context.colors.outlineVariant.withValues(alpha: 0.4),
+            ),
+          ),
+          const SizedBox(width: Grid.twelve),
+          Expanded(
+            child: Column(
+              crossAxisAlignment: CrossAxisAlignment.start,
+              children: [
+                Container(
+                  width: 140,
+                  height: 12,
+                  decoration: BoxDecoration(
+                    color: context.colors.outlineVariant.withValues(alpha: 0.4),
+                    borderRadius: BorderRadius.circular(4),
+                  ),
+                ),
+                const SizedBox(height: Grid.xxs),
+                Container(
+                  width: double.infinity,
+                  height: 10,
+                  decoration: BoxDecoration(
+                    color: context.colors.outlineVariant.withValues(alpha: 0.3),
+                    borderRadius: BorderRadius.circular(4),
+                  ),
+                ),
+                const SizedBox(height: Grid.half),
+                Container(
+                  width: 220,
+                  height: 10,
+                  decoration: BoxDecoration(
+                    color: context.colors.outlineVariant.withValues(alpha: 0.2),
+                    borderRadius: BorderRadius.circular(4),
+                  ),
+                ),
+              ],
+            ),
+          ),
+        ],
+      ),
+    );
+  }
+}
+
+class _EmptySurface extends StatelessWidget {
+  final IconData icon;
+  final String message;
+  final String? detail;
+
+  const _EmptySurface({required this.icon, required this.message, this.detail});
+
+  @override
+  Widget build(BuildContext context) {
+    return Center(
+      child: Padding(
+        padding: const EdgeInsets.symmetric(horizontal: Grid.gutter),
+        child: Column(
+          mainAxisSize: MainAxisSize.min,
+          children: [
+            Icon(icon, size: Grid.lg, color: context.colors.onSurfaceVariant),
+            const SizedBox(height: Grid.xxs),
+            Text(
+              message,
+              style: context.textTheme.bodyMedium?.copyWith(
+                color: context.colors.onSurfaceVariant,
+              ),
+            ),
+            if (detail != null) ...[
+              const SizedBox(height: Grid.half),
+              Text(
+                detail!,
+                style: context.textTheme.bodySmall?.copyWith(
+                  color: context.colors.onSurfaceVariant,
+                ),
+                textAlign: TextAlign.center,
+              ),
+            ],
+          ],
+        ),
+      ),
+    );
+  }
+}
+
+class _EmptyFilterState extends StatelessWidget {
+  final InboxFilter filter;
+  final bool unreadOnly;
+
+  const _EmptyFilterState({required this.filter, required this.unreadOnly});
+
+  @override
+  Widget build(BuildContext context) {
+    if (unreadOnly) {
+      return const _EmptySurface(
+        icon: LucideIcons.mailOpen,
+        message: 'No unread messages',
+        detail: 'Turn off the unread filter to see read messages.',
+      );
+    }
+    final (icon, message) = switch (filter) {
+      InboxFilter.mention => (LucideIcons.atSign, 'No mentions yet'),
+      InboxFilter.thread => (
+        LucideIcons.messageSquare,
+        'No thread replies yet',
+      ),
+      InboxFilter.needsAction => (
+        LucideIcons.circleAlert,
+        'Nothing needs your action',
+      ),
+      InboxFilter.activity => (
+        LucideIcons.activity,
+        'No recent channel activity',
+      ),
+      InboxFilter.agentActivity => (LucideIcons.bot, 'No agent updates'),
+      _ => (LucideIcons.bell, 'No activity yet'),
+    };
+    return _EmptySurface(icon: icon, message: message);
+  }
+}
+
+class _ErrorView extends StatelessWidget {
+  final Future<void> Function() onRetry;
+
+  const _ErrorView({required this.onRetry});
+
+  @override
+  Widget build(BuildContext context) {
+    return Center(
+      child: Column(
+        mainAxisSize: MainAxisSize.min,
+        children: [
+          Icon(
+            LucideIcons.triangleAlert,
+            size: Grid.lg,
+            color: context.colors.error,
+          ),
+          const SizedBox(height: Grid.xxs),
+          Text(
+            'Failed to load activity',
+            style: context.textTheme.bodyMedium?.copyWith(
+              color: context.colors.onSurfaceVariant,
+            ),
+          ),
+          const SizedBox(height: Grid.xs),
+          FilledButton.icon(
+            onPressed: () => unawaited(onRetry()),
+            icon: const Icon(LucideIcons.refreshCcw, size: 16),
+            label: const Text('Retry'),
+          ),
+        ],
+      ),
+    );
+  }
+}
diff --git a/mobile/lib/features/activity/activity_provider.dart b/mobile/lib/features/activity/activity_provider.dart
index be6cfd9a59c..87f00bf2bb9 100644
--- a/mobile/lib/features/activity/activity_provider.dart
+++ b/mobile/lib/features/activity/activity_provider.dart
@@ -1,19 +1,45 @@
 import 'package:hooks_riverpod/hooks_riverpod.dart';
 
 import '../../shared/relay/relay.dart';
+import '../channels/channel.dart';
+import '../channels/channels_provider.dart';
 import 'feed_item.dart';
+import 'inbox_item.dart';
 
-/// Builds the home activity feed by issuing two parallel REQs over the relay
-/// websocket: one for mentions of me on user-visible channel kinds, and one
-/// for agent-activity / approval kinds addressed to me.
+/// Builds the Activity inbox feed over the relay websocket.
+///
+/// Sources mirror desktop's Home inbox (`useHomeFeedQuery` + `get_feed`):
+/// - mentions of me on user-visible channel kinds (also yields thread
+///   replies, which the thread filter classifies from NIP-10 tags)
+/// - workflow approvals / needs-action events addressed to me
+/// - agent job lifecycle events addressed to me (kinds 43001-43006)
+/// - recent DM messages from others (desktop surfaces DMs through p-tags;
+///   mobile queries DM channels directly so untagged DM sends still appear)
 class ActivityNotifier extends AsyncNotifier<HomeFeedResponse> {
   @override
   Future<HomeFeedResponse> build() {
     ref.watch(relayConfigProvider);
     ref.watch(relaySessionProvider);
+    // React to the DM channel set (loading → data, membership changes) so a
+    // cold start where channels resolve after the first fetch still surfaces
+    // DMs without a manual refresh.
+    ref.watch(channelsProvider.select(_dmChannelKey));
     return _fetch();
   }
 
+  /// Stable identity for the joined DM channel set: null while channels are
+  /// loading, otherwise the sorted member-DM ids. Keeps unrelated channel
+  /// updates from refetching the feed.
+  static String? _dmChannelKey(AsyncValue<List<Channel>> channels) {
+    final value = channels.asData?.value;
+    if (value == null) return null;
+    final ids = [
+      for (final channel in value)
+        if (channel.isDm && channel.isMember) channel.id,
+    ]..sort();
+    return ids.join(',');
+  }
+
   Future<HomeFeedResponse> _fetch() async {
     final myPk = ref.read(myPubkeyProvider);
     if (myPk == null) {
@@ -27,6 +53,15 @@ class ActivityNotifier extends AsyncNotifier<HomeFeedResponse> {
 
     final session = ref.read(relaySessionProvider.notifier);
 
+    // DM channels come from the channel list; while it is still loading the
+    // DM source is skipped, and build() rebuilds when it resolves (see the
+    // channelsProvider watch above).
+    final dmChannelIds = [
+      for (final channel
+          in ref.read(channelsProvider).asData?.value ?? const <Channel>[])
+        if (channel.isDm && channel.isMember) channel.id,
+    ];
+
     final results = await Future.wait([
       // Mentions of me on user-visible channel content.
       session.fetchHistory(
@@ -38,7 +73,7 @@ class ActivityNotifier extends AsyncNotifier<HomeFeedResponse> {
           limit: 50,
         ),
       ),
-      // Agent activity and approvals addressed to me.
+      // Workflow approvals addressed to me.
       session.fetchHistory(
         NostrFilter(
           kinds: const [46010, 46011, 46012],
@@ -48,24 +83,67 @@ class ActivityNotifier extends AsyncNotifier<HomeFeedResponse> {
           limit: 20,
         ),
       ),
+      // Agent job lifecycle events addressed to me.
+      session.fetchHistory(
+        NostrFilter(
+          kinds: const [43001, 43002, 43003, 43004, 43005, 43006],
+          tags: {
+            '#p': [myPk],
+          },
+          limit: 20,
+        ),
+      ),
+      // Recent DM traffic (filtered to other senders below).
+      if (dmChannelIds.isEmpty)
+        Future.value(const <NostrEvent>[])
+      else
+        session.fetchHistory(
+          NostrFilter(kinds: const [9], tags: {'#h': dmChannelIds}, limit: 30),
+        ),
     ]);
 
-    final mentions = results[0]
-        .where((e) => e.pubkey.toLowerCase() != myPk.toLowerCase())
-        .map((e) => _feedItem(e, category: 'mention'))
-        .toList();
-    final approvals = results[1]
-        .map((e) => _feedItem(e, category: 'needs_action'))
-        .toList();
+    bool isFromOther(NostrEvent e) =>
+        e.pubkey.toLowerCase() != myPk.toLowerCase();
 
-    mentions.sort((a, b) => b.createdAt.compareTo(a.createdAt));
-    approvals.sort((a, b) => b.createdAt.compareTo(a.createdAt));
+    // Dedupe across sources by event id, keeping the higher-priority
+    // category (needs_action > mention > agent_activity > activity).
+    final byId = <String, FeedItem>{};
+    void add(Iterable<NostrEvent> events, String category) {
+      for (final event in events) {
+        final existing = byId[event.id];
+        if (existing != null &&
+            categoryPriority(existing.category) <= categoryPriority(category)) {
+          continue;
+        }
+        byId[event.id] = _feedItem(event, category: category);
+      }
+    }
+
+    add(results[1], 'needs_action');
+    add(results[0].where(isFromOther), 'mention');
+    add(results[2], 'agent_activity');
+    add(results[3].where(isFromOther), 'activity');
+
+    final items = byId.values.toList()
+      ..sort((a, b) => b.createdAt.compareTo(a.createdAt));
 
     return HomeFeedResponse(
-      mentions: mentions,
-      needsAction: approvals,
-      activity: const [],
-      agentActivity: const [],
+      mentions: [
+        for (final i in items)
+          if (i.category == 'mention') i,
+      ],
+      needsAction: [
+        for (final i in items)
+          if (i.category == 'needs_action') i,
+      ],
+      activity: [
+        for (final i in items)
+          if (i.category == 'activity') i,
+      ],
+      agentActivity: [
+        for (final i in items)
+          if (i.category == 'agent_activity') i,
+      ],
     );
   }
 
@@ -92,3 +170,16 @@ final activityProvider =
     AsyncNotifierProvider<ActivityNotifier, HomeFeedResponse>(
       ActivityNotifier.new,
     );
+
+/// Conversation-grouped inbox rows derived from the raw feed. DM messages
+/// group by DM channel so one conversation renders as one row.
+final inboxItemsProvider = Provider<List<InboxItem>>((ref) {
+  final feed = ref.watch(activityProvider).value;
+  if (feed == null) return const [];
+  final dmChannelIds = {
+    for (final channel
+        in ref.watch(channelsProvider).asData?.value ?? const <Channel>[])
+      if (channel.isDm) channel.id,
+  };
+  return buildInboxItems(feed.all, isDmChannel: dmChannelIds.contains);
+});
diff --git a/mobile/lib/features/activity/compose_drafts_provider.dart b/mobile/lib/features/activity/compose_drafts_provider.dart
new file mode 100644
index 00000000000..b9a079e9a8e
--- /dev/null
+++ b/mobile/lib/features/activity/compose_drafts_provider.dart
@@ -0,0 +1,144 @@
+import 'dart:convert';
+
+import 'package:flutter/foundation.dart';
+import 'package:hooks_riverpod/hooks_riverpod.dart';
+
+import '../../shared/relay/relay.dart';
+import '../../shared/theme/theme_provider.dart';
+
+const _draftsPrefsKey = 'compose_drafts_v1';
+const _maxDrafts = 50;
+
+/// A locally persisted, unsent composer draft.
+///
+/// Mobile has no durable relay-backed draft store (desktop keeps drafts
+/// locally too), so drafts are device-local by design: the inbox Drafts
+/// filter reflects what this device's composer has in flight.
+@immutable
+class ComposeDraft {
+  /// `<channelId>` for channel composers, `<channelId>:<threadHeadId>` for
+  /// thread composers.
+  final String key;
+  final String channelId;
+  final String? threadHeadId;
+  final String text;
+  final int updatedAt; // unix seconds
+
+  const ComposeDraft({
+    required this.key,
+    required this.channelId,
+    required this.threadHeadId,
+    required this.text,
+    required this.updatedAt,
+  });
+
+  Map<String, dynamic> toJson() => {
+    'key': key,
+    'channel_id': channelId,
+    if (threadHeadId != null) 'thread_head_id': threadHeadId,
+    'text': text,
+    'updated_at': updatedAt,
+  };
+
+  static ComposeDraft? fromJson(Object? raw) {
+    if (raw is! Map<String, dynamic>) return null;
+    final key = raw['key'];
+    final channelId = raw['channel_id'];
+    final text = raw['text'];
+    final updatedAt = raw['updated_at'];
+    if (key is! String || channelId is! String || text is! String) return null;
+    if (text.trim().isEmpty) return null;
+    return ComposeDraft(
+      key: key,
+      channelId: channelId,
+      threadHeadId: raw['thread_head_id'] as String?,
+      text: text,
+      updatedAt: updatedAt is int ? updatedAt : 0,
+    );
+  }
+}
+
+String composeDraftKey(String channelId, {String? threadHeadId}) =>
+    threadHeadId == null ? channelId : '$channelId:$threadHeadId';
+
+/// SharedPreferences-backed store of unsent composer drafts, newest first.
+///
+/// Drafts are plaintext, so persistence is namespaced by community (relay)
+/// and account pubkey: switching community or account rebuilds this provider
+/// against that identity's own store and can never surface another
+/// identity's draft text.
+class ComposeDraftsNotifier extends Notifier<List<ComposeDraft>> {
+  late String _prefsKey;
+
+  @override
+  List<ComposeDraft> build() {
+    // Rebuild (and re-read the identity-scoped store) whenever the active
+    // community or the derived account pubkey changes.
+    final config = ref.watch(relayConfigProvider);
+    final pubkey = ref.watch(myPubkeyProvider) ?? 'anon';
+    _prefsKey = '$_draftsPrefsKey:${config.baseUrl}:$pubkey';
+
+    final prefs = ref.read(savedPrefsProvider);
+    final raw = prefs.getString(_prefsKey);
+    if (raw == null) return const [];
+    try {
+      final decoded = jsonDecode(raw);
+      if (decoded is! List) return const [];
+      final drafts = decoded
+          .map(ComposeDraft.fromJson)
+          .whereType<ComposeDraft>()
+          .toList();
+      drafts.sort((a, b) => b.updatedAt.compareTo(a.updatedAt));
+      return drafts;
+    } catch (_) {
+      return const [];
+    }
+  }
+
+  /// Persist [text] for the composer identified by [key]. Empty text removes
+  /// the draft.
+  void save({
+    required String key,
+    required String channelId,
+    String? threadHeadId,
+    required String text,
+  }) {
+    if (text.trim().isEmpty) {
+      remove(key);
+      return;
+    }
+    final existing = state.where((d) => d.key == key).firstOrNull;
+    if (existing?.text == text) return;
+    final draft = ComposeDraft(
+      key: key,
+      channelId: channelId,
+      threadHeadId: threadHeadId,
+      text: text,
+      updatedAt: DateTime.now().millisecondsSinceEpoch ~/ 1000,
+    );
+    final next = [draft, ...state.where((d) => d.key != key)];
+    _persist(next.length > _maxDrafts ? next.sublist(0, _maxDrafts) : next);
+  }
+
+  void remove(String key) {
+    if (!state.any((d) => d.key == key)) return;
+    _persist([...state.where((d) => d.key != key)]);
+  }
+
+  String? textFor(String key) =>
+      state.where((d) => d.key == key).firstOrNull?.text;
+
+  void _persist(List<ComposeDraft> drafts) {
+    state = List.unmodifiable(drafts);
+    final prefs = ref.read(savedPrefsProvider);
+    prefs.setString(
+      _prefsKey,
+      jsonEncode([for (final d in drafts) d.toJson()]),
+    );
+  }
+}
+
+final composeDraftsProvider =
+    NotifierProvider<ComposeDraftsNotifier, List<ComposeDraft>>(
+      ComposeDraftsNotifier.new,
+    );
diff --git a/mobile/lib/features/activity/feed_item.dart b/mobile/lib/features/activity/feed_item.dart
index 5d3d1012fc3..84aa1eba49e 100644
--- a/mobile/lib/features/activity/feed_item.dart
+++ b/mobile/lib/features/activity/feed_item.dart
@@ -41,6 +41,17 @@ class FeedItem {
     category: json['category'] as String,
   );
 
+  /// The message whose thread directly contains this item, when this event is
+  /// a reply. For nested replies this is the direct parent, not the outer root.
+  String? get threadHeadId {
+    for (final tag in tags) {
+      if (tag.length >= 4 && tag[0] == 'e' && tag[3] == 'reply') {
+        return tag[1];
+      }
+    }
+    return null;
+  }
+
   /// Human-readable headline based on event kind and category.
   String get headline {
     switch (kind) {
diff --git a/mobile/lib/features/activity/inbox_item.dart b/mobile/lib/features/activity/inbox_item.dart
new file mode 100644
index 00000000000..3fe618fc54e
--- /dev/null
+++ b/mobile/lib/features/activity/inbox_item.dart
@@ -0,0 +1,284 @@
+import 'package:flutter/foundation.dart';
+
+import 'feed_item.dart';
+
+/// Inbox filters, mirroring desktop's `InboxFilter` in
+/// `desktop/src/features/home/lib/inbox.ts`.
+enum InboxFilter {
+  all,
+  mention,
+  thread,
+  needsAction,
+  activity,
+  agentActivity,
+  reminders,
+  drafts,
+}
+
+/// Category ordering used to pick the label for a grouped conversation.
+/// Mirrors desktop's `categoryPriority`.
+int categoryPriority(String category) {
+  return switch (category) {
+    'needs_action' => 0,
+    'mention' => 1,
+    'agent_activity' => 2,
+    _ => 3,
+  };
+}
+
+/// Thread reference from NIP-10 tags — desktop's `getThreadReference`.
+({String? parentId, String? rootId}) threadReferenceOf(
+  List<List<String>> tags,
+) {
+  List<String>? rootTag;
+  List<String>? replyTag;
+  for (final tag in tags) {
+    if (tag.length >= 4 && tag[0] == 'e') {
+      if (tag[3] == 'root') rootTag = tag;
+      if (tag[3] == 'reply') replyTag = tag;
+    }
+  }
+  if (replyTag == null) return (parentId: null, rootId: null);
+  final parentId = replyTag[1];
+  return (parentId: parentId, rootId: rootTag?[1] ?? parentId);
+}
+
+/// Broadcast replies surface at the channel top level — desktop's
+/// `isBroadcastReply`.
+bool isBroadcastReply(List<List<String>> tags) {
+  return tags.any(
+    (tag) => tag.length >= 2 && tag[0] == 'broadcast' && tag[1] == '1',
+  );
+}
+
+/// A thread reply that is not broadcast — desktop's `isThreadReply`.
+bool isThreadReply(List<List<String>> tags) {
+  return threadReferenceOf(tags).parentId != null && !isBroadcastReply(tags);
+}
+
+/// Stable conversation identity: `rootId ?? parentId ?? event.id`, except
+/// ordinary (non-thread) DM messages, which group by DM channel identity so
+/// one DM conversation renders as one row. Mirrors desktop's
+/// `getInboxConversationId`.
+String inboxConversationId(
+  List<List<String>> tags,
+  String eventId, {
+  String? dmChannelId,
+}) {
+  final thread = threadReferenceOf(tags);
+  final threadId = thread.rootId ?? thread.parentId;
+  if (threadId != null) return threadId;
+  if (dmChannelId != null) return 'dm:$dmChannelId';
+  return eventId;
+}
+
+/// One conversation-grouped inbox row. Mirrors desktop's `InboxItem`.
+@immutable
+class InboxItem {
+  /// Stable conversation identity for the thread group.
+  final String conversationId;
+
+  /// Representative (latest) event id.
+  final String id;
+
+  /// Representative (latest) feed item.
+  final FeedItem item;
+
+  /// All events grouped into this conversation, unordered.
+  final List<FeedItem> groupItems;
+
+  /// Distinct categories present in the group, priority-sorted.
+  final List<String> categories;
+
+  final bool isActionRequired;
+  final int latestActivityAt;
+
+  const InboxItem({
+    required this.conversationId,
+    required this.id,
+    required this.item,
+    required this.groupItems,
+    required this.categories,
+    required this.isActionRequired,
+    required this.latestActivityAt,
+  });
+
+  /// Root id if any grouped event carries thread-reply tags.
+  String? get threadRootId {
+    for (final candidate in [item, ...groupItems]) {
+      if (isThreadReply(candidate.tags)) {
+        return threadReferenceOf(candidate.tags).rootId;
+      }
+    }
+    return null;
+  }
+
+  /// The event the row should deep-link to: the oldest event in the group
+  /// newer than [readAt] (oldest unread), falling back to the latest event.
+  FeedItem deepLinkTarget(int? readAt) {
+    if (readAt != null) {
+      FeedItem? oldestUnread;
+      for (final candidate in groupItems) {
+        if (candidate.createdAt <= readAt) continue;
+        if (oldestUnread == null ||
+            candidate.createdAt < oldestUnread.createdAt) {
+          oldestUnread = candidate;
+        }
+      }
+      if (oldestUnread != null) return oldestUnread;
+    }
+    return item;
+  }
+}
+
+/// Contextual row label — desktop's `getInboxTypeLabel`:
+/// "DM from X" / "Mentioned in" / "Needs action in" / "Thread in" / "... in".
+({String text, String? channelLabel}) inboxTypeLabel(
+  InboxItem item, {
+  required String? channelName,
+  required bool isDm,
+  required String senderLabel,
+}) {
+  if (isDm) {
+    return (
+      text: senderLabel.isNotEmpty ? 'DM from $senderLabel' : 'DM',
+      channelLabel: null,
+    );
+  }
+
+  final category = item.categories.firstOrNull ?? item.item.category;
+  if (category == 'mention') {
+    return (
+      text: channelName != null ? 'Mentioned in' : 'Mentioned',
+      channelLabel: channelName,
+    );
+  }
+  if (category == 'needs_action') {
+    return (
+      text: channelName != null ? 'Needs action in' : 'Needs action',
+      channelLabel: channelName,
+    );
+  }
+  if (item.threadRootId != null) {
+    return (
+      text: channelName != null ? 'Thread in' : 'Thread',
+      channelLabel: channelName,
+    );
+  }
+
+  final headline = item.item.headline;
+  return (
+    text: channelName != null ? '$headline in' : headline,
+    channelLabel: channelName,
+  );
+}
+
+/// Whether [item] matches [filter] — desktop's `matchesInboxFilter`.
+/// `reminders` and `drafts` are separate surfaces and never match here.
+bool matchesInboxFilter(InboxItem item, InboxFilter filter) {
+  return switch (filter) {
+    InboxFilter.all => true,
+    InboxFilter.thread => [
+      item.item,
+      ...item.groupItems,
+    ].any((i) => isThreadReply(i.tags)),
+    InboxFilter.mention => item.categories.contains('mention'),
+    InboxFilter.needsAction => item.categories.contains('needs_action'),
+    InboxFilter.activity => item.categories.contains('activity'),
+    InboxFilter.agentActivity => item.categories.contains('agent_activity'),
+    InboxFilter.reminders || InboxFilter.drafts => false,
+  };
+}
+
+/// Group raw feed items into conversation rows sorted by latest activity.
+/// [isDmChannel] identifies DM channels so their ordinary top-level messages
+/// collapse into one row per DM conversation. Mirrors desktop's
+/// `buildInboxItems`.
+List<InboxItem> buildInboxItems(
+  Iterable<FeedItem> feedItems, {
+  bool Function(String channelId)? isDmChannel,
+}) {
+  final groups = <String, List<FeedItem>>{};
+  for (final item in feedItems) {
+    final channelId = item.channelId;
+    final dmChannelId =
+        channelId != null && (isDmChannel?.call(channelId) ?? false)
+        ? channelId
+        : null;
+    final key = inboxConversationId(
+      item.tags,
+      item.id,
+      dmChannelId: dmChannelId,
+    );
+    groups.putIfAbsent(key, () => []).add(item);
+  }
+
+  final rows = <InboxItem>[];
+  for (final entry in groups.entries) {
+    final items = entry.value;
+    var latest = items.first;
+    var latestActivityAt = 0;
+    for (final item in items) {
+      if (item.createdAt > latest.createdAt) latest = item;
+      if (item.createdAt > latestActivityAt) latestActivityAt = item.createdAt;
+    }
+    final categories = items.map((i) => i.category).toSet().toList()
+      ..sort((a, b) => categoryPriority(a).compareTo(categoryPriority(b)));
+
+    rows.add(
+      InboxItem(
+        conversationId: entry.key,
+        id: latest.id,
+        item: latest,
+        groupItems: List.unmodifiable(items),
+        categories: List.unmodifiable(categories),
+        isActionRequired: categories.contains('needs_action'),
+        latestActivityAt: latestActivityAt,
+      ),
+    );
+  }
+
+  rows.sort((a, b) => b.latestActivityAt.compareTo(a.latestActivityAt));
+  return rows;
+}
+
+/// Date-bucket label for section headers — desktop's `groupInboxItems`:
+/// Today / Yesterday / weekday (within 7 days) / short date.
+String inboxDayLabel(int unixSeconds, {DateTime? now}) {
+  final current = now ?? DateTime.now();
+  final date = DateTime.fromMillisecondsSinceEpoch(unixSeconds * 1000);
+  final today = DateTime(current.year, current.month, current.day);
+  final day = DateTime(date.year, date.month, date.day);
+  final dayDiff = today.difference(day).inDays;
+
+  if (dayDiff == 0) return 'Today';
+  if (dayDiff == 1) return 'Yesterday';
+  if (dayDiff < 7 && dayDiff > 0) {
+    const weekdays = [
+      'Monday',
+      'Tuesday',
+      'Wednesday',
+      'Thursday',
+      'Friday',
+      'Saturday',
+      'Sunday',
+    ];
+    return weekdays[date.weekday - 1];
+  }
+  const months = [
+    'Jan',
+    'Feb',
+    'Mar',
+    'Apr',
+    'May',
+    'Jun',
+    'Jul',
+    'Aug',
+    'Sep',
+    'Oct',
+    'Nov',
+    'Dec',
+  ];
+  final label = '${months[date.month - 1]} ${date.day}';
+  return date.year == current.year ? label : '$label, ${date.year}';
+}
diff --git a/mobile/lib/features/activity/inbox_local_state_provider.dart b/mobile/lib/features/activity/inbox_local_state_provider.dart
new file mode 100644
index 00000000000..ace1e9cb841
--- /dev/null
+++ b/mobile/lib/features/activity/inbox_local_state_provider.dart
@@ -0,0 +1,93 @@
+import 'dart:convert';
+
+import 'package:flutter/foundation.dart';
+import 'package:hooks_riverpod/hooks_riverpod.dart';
+
+import '../../shared/theme/theme_provider.dart';
+
+const _localStateKey = 'activity_inbox_local_state_v1';
+const _maxTrackedIds = 500;
+
+/// Local, per-device inbox row overrides — mirrors desktop's
+/// `useFeedItemState`:
+/// - [doneIds] marks channel-less rows (e.g. approvals without an `h` tag)
+///   as read, since they have no NIP-RS context to advance.
+/// - [unreadIds] is the per-row "mark unread" override that reopens a row
+///   without rewinding the shared channel/thread read marker.
+@immutable
+class InboxLocalState {
+  final Set<String> doneIds;
+  final Set<String> unreadIds;
+
+  const InboxLocalState({required this.doneIds, required this.unreadIds});
+
+  const InboxLocalState.empty() : doneIds = const {}, unreadIds = const {};
+}
+
+class InboxLocalStateNotifier extends Notifier<InboxLocalState> {
+  @override
+  InboxLocalState build() {
+    final prefs = ref.read(savedPrefsProvider);
+    final raw = prefs.getString(_localStateKey);
+    if (raw == null) return const InboxLocalState.empty();
+    try {
+      final decoded = jsonDecode(raw);
+      if (decoded is! Map<String, dynamic>) {
+        return const InboxLocalState.empty();
+      }
+      Set<String> readIds(Object? value) =>
+          value is List ? value.whereType<String>().toSet() : const <String>{};
+      return InboxLocalState(
+        doneIds: readIds(decoded['done']),
+        unreadIds: readIds(decoded['unread']),
+      );
+    } catch (_) {
+      return const InboxLocalState.empty();
+    }
+  }
+
+  void markDone(String id) {
+    _update(
+      doneIds: {...state.doneIds, id},
+      unreadIds: {...state.unreadIds}..remove(id),
+    );
+  }
+
+  void markUnread(Iterable<String> ids) {
+    _update(
+      doneIds: {...state.doneIds}..removeAll(ids),
+      unreadIds: {...state.unreadIds, ...ids},
+    );
+  }
+
+  void clearUnread(Iterable<String> ids) {
+    if (!ids.any(state.unreadIds.contains)) return;
+    _update(
+      doneIds: state.doneIds,
+      unreadIds: {...state.unreadIds}..removeAll(ids),
+    );
+  }
+
+  void _update({required Set<String> doneIds, required Set<String> unreadIds}) {
+    Set<String> capped(Set<String> ids) => ids.length <= _maxTrackedIds
+        ? ids
+        : ids.skip(ids.length - _maxTrackedIds).toSet();
+    state = InboxLocalState(
+      doneIds: capped(doneIds),
+      unreadIds: capped(unreadIds),
+    );
+    final prefs = ref.read(savedPrefsProvider);
+    prefs.setString(
+      _localStateKey,
+      jsonEncode({
+        'done': state.doneIds.toList(),
+        'unread': state.unreadIds.toList(),
+      }),
+    );
+  }
+}
+
+final inboxLocalStateProvider =
+    NotifierProvider<InboxLocalStateNotifier, InboxLocalState>(
+      InboxLocalStateNotifier.new,
+    );
diff --git a/mobile/lib/features/activity/inbox_read_state.dart b/mobile/lib/features/activity/inbox_read_state.dart
new file mode 100644
index 00000000000..130562072c0
--- /dev/null
+++ b/mobile/lib/features/activity/inbox_read_state.dart
@@ -0,0 +1,71 @@
+import '../channels/read_state/read_state_format.dart';
+import 'inbox_item.dart';
+
+/// Resolves the effective NIP-RS read marker for one inbox row, mirroring
+/// desktop's `resolveInboxItemReadAt`:
+/// - thread rows use `max(thread:<root>, msg:<id>)`
+/// - channel rows use the channel context marker
+/// - rows with no channel have no marker (caller falls back to local state)
+int? resolveInboxItemReadAt(
+  InboxItem item, {
+  required int? Function(String contextId) markerOf,
+}) {
+  final channelId = item.item.channelId;
+  final threadRootId = item.threadRootId;
+  if (threadRootId != null) {
+    return maxReadAt([
+      markerOf(threadContextKey(threadRootId)),
+      markerOf(msgContextKey(item.item.id)),
+    ]);
+  }
+  return channelId == null ? null : markerOf(channelId);
+}
+
+/// Whether the row is read ("done"), mirroring desktop's
+/// `useHomeInboxReadState` projection: a local unread override always wins;
+/// otherwise the row is done when no grouped activity is newer than the
+/// shared read marker; channel-less rows fall back to the local done set.
+bool isInboxItemDone(
+  InboxItem item, {
+  required int? Function(String contextId) markerOf,
+  required Set<String> localUnreadOverrides,
+  required Set<String> localDoneSet,
+}) {
+  final ids = groupedInboxItemIds(item);
+  if (ids.any(localUnreadOverrides.contains)) return false;
+
+  final readAt = resolveInboxItemReadAt(item, markerOf: markerOf);
+  if (readAt != null) return item.latestActivityAt <= readAt;
+
+  if (item.threadRootId != null || item.item.channelId != null) return false;
+  return localDoneSet.contains(item.id);
+}
+
+/// All event ids identified with the row — desktop's `getGroupedInboxItemIds`.
+List<String> groupedInboxItemIds(InboxItem item) {
+  return {item.id, item.item.id, ...item.groupItems.map((i) => i.id)}.toList();
+}
+
+/// The channel-level timestamp that marking a thread row read should also
+/// advance — desktop's `getGroupedChannelReadTimestamp`. Only top-level
+/// (non-thread-reply) grouped events count, so marking a thread read cannot
+/// swallow unrelated channel messages.
+({String channelId, int timestamp})? groupedChannelReadTimestamp(
+  InboxItem item,
+) {
+  final channelId = item.item.channelId;
+  if (channelId == null) return null;
+
+  int? timestamp;
+  for (final groupItem in item.groupItems) {
+    if (groupItem.channelId != channelId || isThreadReply(groupItem.tags)) {
+      continue;
+    }
+    if (timestamp == null || groupItem.createdAt > timestamp) {
+      timestamp = groupItem.createdAt;
+    }
+  }
+  return timestamp == null
+      ? null
+      : (channelId: channelId, timestamp: timestamp);
+}
diff --git a/mobile/lib/features/activity/reminders_provider.dart b/mobile/lib/features/activity/reminders_provider.dart
new file mode 100644
index 00000000000..333d8e10b23
--- /dev/null
+++ b/mobile/lib/features/activity/reminders_provider.dart
@@ -0,0 +1,224 @@
+import 'dart:convert';
+
+import 'package:flutter/foundation.dart';
+import 'package:hooks_riverpod/hooks_riverpod.dart';
+import 'package:nostr/nostr.dart' as nostr;
+
+import '../../shared/crypto/nip44.dart';
+import '../../shared/relay/relay.dart';
+
+/// NIP-ER event reminder kind — matches desktop's `KIND_EVENT_REMINDER`.
+const kindEventReminder = 30300;
+
+/// Message a reminder points at. Mirrors desktop's `ReminderTarget`.
+@immutable
+class ReminderTarget {
+  final String eventId;
+  final String channelId;
+  final String preview;
+  final String authorPubkey;
+
+  const ReminderTarget({
+    required this.eventId,
+    required this.channelId,
+    required this.preview,
+    required this.authorPubkey,
+  });
+}
+
+/// A decrypted NIP-ER reminder. Mirrors desktop's `Reminder`.
+@immutable
+class Reminder {
+  /// The `d`-tag (unique reminder identity).
+  final String id;
+
+  /// Unix seconds when due; null for done/cancelled reminders.
+  final int? notBefore;
+
+  final String status; // "pending" | "done" | "cancelled"
+  final ReminderTarget? target;
+  final String? note;
+  final int createdAt;
+  final String eventId;
+
+  const Reminder({
+    required this.id,
+    required this.notBefore,
+    required this.status,
+    required this.target,
+    required this.note,
+    required this.createdAt,
+    required this.eventId,
+  });
+
+  bool isDue(int nowUnixSeconds) =>
+      status == 'pending' && notBefore != null && notBefore! <= nowUnixSeconds;
+}
+
+/// Parse NIP-ER `not_before`: ASCII digits, no leading zero except "0".
+/// Mirrors desktop's `parseNotBefore` strictness.
+int? parseNotBefore(String raw) {
+  if (!RegExp(r'^(0|[1-9][0-9]*)$').hasMatch(raw)) return null;
+  return int.tryParse(raw);
+}
+
+/// Validate decrypted reminder plaintext — desktop's `parseReminderContent`.
+/// Off-shape content fails closed (returns null).
+({String status, ReminderTarget? target, String? note})? parseReminderContent(
+  String plaintext,
+) {
+  final Object? parsed;
+  try {
+    parsed = jsonDecode(plaintext);
+  } catch (_) {
+    return null;
+  }
+  if (parsed is! Map<String, dynamic>) return null;
+
+  final status = parsed['status'];
+  if (status != 'pending' && status != 'done' && status != 'cancelled') {
+    return null;
+  }
+  final note = parsed['note'];
+  if (note != null && note is! String) return null;
+
+  ReminderTarget? target;
+  final rawTarget = parsed['target'];
+  if (rawTarget != null) {
+    if (rawTarget is! Map<String, dynamic>) return null;
+    final eventId = rawTarget['eventId'];
+    final channelId = rawTarget['channelId'];
+    final preview = rawTarget['preview'];
+    final authorPubkey = rawTarget['authorPubkey'];
+    if (eventId is! String ||
+        channelId is! String ||
+        preview is! String ||
+        authorPubkey is! String) {
+      return null;
+    }
+    target = ReminderTarget(
+      eventId: eventId,
+      channelId: channelId,
+      preview: preview,
+      authorPubkey: authorPubkey,
+    );
+  }
+
+  final noteText = note as String?;
+  if (target == null && (noteText == null || noteText.isEmpty)) return null;
+
+  return (status: status as String, target: target, note: noteText);
+}
+
+/// Decode one kind:30300 event into a [Reminder], or null when malformed.
+Reminder? decodeReminderEvent(
+  NostrEvent event, {
+  required String Function(String ciphertext) decrypt,
+}) {
+  String? dTag;
+  int? notBefore;
+  for (final tag in event.tags) {
+    if (tag.length >= 2 && tag[0] == 'd') dTag ??= tag[1];
+    if (tag.length >= 2 && tag[0] == 'not_before') {
+      notBefore ??= parseNotBefore(tag[1]);
+    }
+  }
+  if (dTag == null) return null;
+
+  final String plaintext;
+  try {
+    plaintext = decrypt(event.content);
+  } catch (_) {
+    return null;
+  }
+  final content = parseReminderContent(plaintext);
+  if (content == null) return null;
+
+  return Reminder(
+    id: dTag,
+    notBefore: notBefore,
+    status: content.status,
+    target: content.target,
+    note: content.note,
+    createdAt: event.createdAt,
+    eventId: event.id,
+  );
+}
+
+/// Fetches the user's NIP-ER reminders (kind 30300, self-encrypted). These
+/// are the same relay events Buzz Desktop reads and writes, so reminders
+/// created on Desktop appear here and vice versa.
+class RemindersNotifier extends AsyncNotifier<List<Reminder>> {
+  @override
+  Future<List<Reminder>> build() {
+    ref.watch(relayConfigProvider);
+    ref.watch(relaySessionProvider);
+    return _fetch();
+  }
+
+  Future<List<Reminder>> _fetch() async {
+    final config = ref.read(relayConfigProvider);
+    final myPk = ref.read(myPubkeyProvider);
+    final nsec = config.nsec?.trim();
+    if (myPk == null || nsec == null || nsec.isEmpty) return const [];
+
+    final String privkeyHex;
+    try {
+      privkeyHex = nostr.Nip19.decode(payload: nsec).data;
+    } catch (_) {
+      return const [];
+    }
+    if (privkeyHex.isEmpty) return const [];
+    final conversationKey = getConversationKey(privkeyHex, myPk);
+
+    final session = ref.read(relaySessionProvider.notifier);
+    final events = await session.fetchHistory(
+      NostrFilter(
+        kinds: const [kindEventReminder],
+        authors: [myPk],
+        limit: 200,
+      ),
+    );
+
+    // Parameterized-replaceable: keep only the newest event per d-tag.
+    final newestByDTag = <String, NostrEvent>{};
+    for (final event in events) {
+      final dTag = event.getTagValue('d');
+      if (dTag == null) continue;
+      final existing = newestByDTag[dTag];
+      if (existing == null || event.createdAt > existing.createdAt) {
+        newestByDTag[dTag] = event;
+      }
+    }
+
+    final reminders = <Reminder>[];
+    for (final event in newestByDTag.values) {
+      final reminder = decodeReminderEvent(
+        event,
+        decrypt: (ciphertext) => nip44Decrypt(conversationKey, ciphertext),
+      );
+      if (reminder != null) reminders.add(reminder);
+    }
+    reminders.sort(
+      (a, b) =>
+          (a.notBefore ?? a.createdAt).compareTo(b.notBefore ?? b.createdAt),
+    );
+    return reminders;
+  }
+
+  Future<void> refresh() async {
+    state = await AsyncValue.guard(_fetch);
+  }
+}
+
+final remindersProvider =
+    AsyncNotifierProvider<RemindersNotifier, List<Reminder>>(
+      RemindersNotifier.new,
+    );
+
+/// Count of due pending reminders — powers the filter badge.
+final dueReminderCountProvider = Provider<int>((ref) {
+  final reminders = ref.watch(remindersProvider).value ?? const <Reminder>[];
+  final now = DateTime.now().millisecondsSinceEpoch ~/ 1000;
+  return reminders.where((r) => r.isDue(now)).length;
+});
diff --git a/mobile/lib/features/channels/agent_activity/agent_activity_sheet.dart b/mobile/lib/features/channels/agent_activity/agent_activity_sheet.dart
index c0c76406176..26a53f89038 100644
--- a/mobile/lib/features/channels/agent_activity/agent_activity_sheet.dart
+++ b/mobile/lib/features/channels/agent_activity/agent_activity_sheet.dart
@@ -4,6 +4,7 @@ import 'package:hooks_riverpod/hooks_riverpod.dart';
 import 'package:lucide_icons_flutter/lucide_icons.dart';
 
 import '../../../shared/theme/theme.dart';
+import '../../../shared/widgets/buzz_loading_indicator.dart';
 import '../../profile/user_cache_provider.dart';
 import '../date_formatters.dart';
 import 'observer_models.dart';
@@ -189,13 +190,10 @@ class _EmptyState extends StatelessWidget {
       child: Column(
         mainAxisSize: MainAxisSize.min,
         children: [
-          SizedBox(
-            width: 24,
-            height: 24,
-            child: CircularProgressIndicator(
-              strokeWidth: 2,
-              color: context.colors.onSurfaceVariant,
-            ),
+          BuzzLoadingIndicator(
+            size: 28,
+            color: context.colors.onSurfaceVariant,
+            semanticLabel: 'Waiting for agent activity',
           ),
           const SizedBox(height: Grid.xxs),
           Text(
diff --git a/mobile/lib/features/channels/camera_capture_cleanup.dart b/mobile/lib/features/channels/camera_capture_cleanup.dart
index 6937218c9e7..469a150e130 100644
--- a/mobile/lib/features/channels/camera_capture_cleanup.dart
+++ b/mobile/lib/features/channels/camera_capture_cleanup.dart
@@ -5,16 +5,26 @@ import 'package:image_picker/image_picker.dart';
 Future<void> processCapturedImage(
   XFile image,
   Future<void> Function(XFile image) onCapture,
+) async {
+  await processTemporaryImages([image], (images) => onCapture(images.single));
+}
+
+/// Processes native-owned [images], then removes their temporary files.
+Future<void> processTemporaryImages(
+  List<XFile> images,
+  Future<void> Function(List<XFile> images) process,
 ) async {
   try {
-    await onCapture(image);
+    await process(images);
   } finally {
-    final path = image.path;
-    if (path.isNotEmpty) {
-      try {
-        await File(path).delete();
-      } on FileSystemException {
-        // The camera plugin may already have removed its temporary file.
+    for (final image in images) {
+      final path = image.path;
+      if (path.isNotEmpty) {
+        try {
+          await File(path).delete();
+        } on FileSystemException {
+          // The native picker may already have removed its temporary file.
+        }
       }
     }
   }
diff --git a/mobile/lib/features/channels/channel_detail_page.dart b/mobile/lib/features/channels/channel_detail_page.dart
index 85addedcb9e..4304705f905 100644
--- a/mobile/lib/features/channels/channel_detail_page.dart
+++ b/mobile/lib/features/channels/channel_detail_page.dart
@@ -1,6 +1,8 @@
 import 'dart:async';
+import 'dart:math' show min;
 
 import 'package:flutter/material.dart';
+import 'package:flutter/rendering.dart' show ScrollDirection;
 import 'package:flutter_hooks/flutter_hooks.dart';
 import 'package:hooks_riverpod/hooks_riverpod.dart';
 import 'package:lucide_icons_flutter/lucide_icons.dart';
@@ -9,8 +11,11 @@ import 'package:scrollable_positioned_list/scrollable_positioned_list.dart';
 import '../../shared/relay/relay.dart';
 import '../../shared/theme/theme.dart';
 import '../../shared/widgets/avatar_image.dart';
+import '../../shared/widgets/buzz_loading_indicator.dart';
 import '../../shared/widgets/frosted_app_bar.dart';
 import '../../shared/widgets/frosted_scaffold.dart';
+import '../../shared/widgets/message_author_meta.dart';
+import '../../shared/widgets/skeleton.dart';
 import '../profile/presence_cache_provider.dart';
 import '../profile/profile_provider.dart';
 import '../profile/user_cache_provider.dart';
@@ -22,6 +27,7 @@ import 'agent_activity/working_bots_provider.dart';
 import 'channel_management_provider.dart';
 import 'channel_messages_provider.dart';
 import 'channel_typing_provider.dart';
+import 'channel_typing_indicator.dart';
 import 'channels_provider.dart';
 import 'compose_bar.dart';
 import 'date_formatters.dart';
@@ -121,6 +127,7 @@ class ChannelDetailPage extends HookConsumerWidget {
     final detailsAsync = ref.watch(channelDetailsProvider(channel.id));
     final channelsAsync = ref.watch(channelsProvider);
     final messagesState = ref.watch(channelMessagesProvider(channel.id));
+    final sessionStatus = ref.watch(relaySessionProvider).status;
     final readState = ref.watch(readStateProvider);
     final currentPubkey = ref
         .watch(profileProvider)
@@ -148,6 +155,30 @@ class ChannelDetailPage extends HookConsumerWidget {
         channel;
     final resolvedChannel =
         detailsAsync.whenData(baseChannel.mergeDetails).value ?? baseChannel;
+    final messagesNotifier = ref.read(
+      channelMessagesProvider(channel.id).notifier,
+    );
+    final isConnectionInProgress =
+        sessionStatus == SessionStatus.connecting ||
+        sessionStatus == SessionStatus.reconnecting;
+    final showConnectionSkeleton = useState(false);
+    final shouldDebounceConnectionSkeleton =
+        isConnectionInProgress &&
+        (resolvedChannel.isForum || messagesNotifier.hasLoadedMessages);
+    useEffect(() {
+      if (!shouldDebounceConnectionSkeleton) {
+        showConnectionSkeleton.value = false;
+        return null;
+      }
+      final timer = Timer(const Duration(seconds: 2), () {
+        showConnectionSkeleton.value = true;
+      });
+      return timer.cancel;
+    }, [shouldDebounceConnectionSkeleton]);
+    final showInitialConnectionSkeleton =
+        !resolvedChannel.isForum &&
+        isConnectionInProgress &&
+        !messagesNotifier.hasLoadedMessages;
     final appBarTitleContentHeight = resolvedChannel.isDm
         ? _dmAppBarTitleContentHeight(context)
         : 0.0;
@@ -189,6 +220,7 @@ class ChannelDetailPage extends HookConsumerWidget {
       appBar: FrostedAppBar(
         iconColor: context.colors.primary,
         titleContentHeight: appBarTitleContentHeight,
+        titleStyle: channelTitleTextStyle,
         title: resolvedChannel.isDm
             ? _DmAppBarTitle(
                 channel: resolvedChannel,
@@ -259,67 +291,95 @@ class ChannelDetailPage extends HookConsumerWidget {
         children: [
           Expanded(
             child: resolvedChannel.isForum
-                ? ForumPostsView(
-                    channel: resolvedChannel,
-                    currentPubkey: currentPubkey,
-                  )
-                : messagesState.when(
-                    loading: () => Padding(
-                      padding: EdgeInsets.only(
-                        top: frostedAppBarHeight(
-                          context,
-                          titleContentHeight: appBarTitleContentHeight,
-                        ),
+                ? Stack(
+                    fit: StackFit.expand,
+                    children: [
+                      ForumPostsView(
+                        channel: resolvedChannel,
+                        currentPubkey: currentPubkey,
                       ),
-                      child: const Center(child: CircularProgressIndicator()),
+                      if (showConnectionSkeleton.value)
+                        Positioned(
+                          top:
+                              frostedAppBarHeight(
+                                context,
+                                titleContentHeight: appBarTitleContentHeight,
+                              ) +
+                              Grid.xs,
+                          left: Grid.gutter,
+                          right: Grid.gutter,
+                          child: _ForumConnectionSkeleton(
+                            status: sessionStatus,
+                          ),
+                        ),
+                    ],
+                  )
+                : SkeletonReveal(
+                    loading:
+                        showInitialConnectionSkeleton ||
+                        showConnectionSkeleton.value ||
+                        messagesState.isLoading,
+                    shimmerEnabled: sessionStatus != SessionStatus.disconnected,
+                    skeleton: _MessageTimelineSkeleton(
+                      appBarTitleContentHeight: appBarTitleContentHeight,
+                      status: sessionStatus,
                     ),
-                    error: (e, _) => Padding(
-                      padding: EdgeInsets.only(
-                        top: frostedAppBarHeight(
-                          context,
-                          titleContentHeight: appBarTitleContentHeight,
+                    content: messagesState.when(
+                      loading: SizedBox.shrink,
+                      error: (e, _) => Padding(
+                        padding: EdgeInsets.only(
+                          top: frostedAppBarHeight(
+                            context,
+                            titleContentHeight: appBarTitleContentHeight,
+                          ),
                         ),
-                      ),
-                      child: Center(
-                        child: Text(
-                          'Failed to load messages',
-                          style: context.textTheme.bodyMedium?.copyWith(
-                            color: context.colors.error,
+                        child: Center(
+                          child: Text(
+                            'Failed to load messages',
+                            style: context.textTheme.bodyMedium?.copyWith(
+                              color: context.colors.error,
+                            ),
                           ),
                         ),
                       ),
+                      data: (events) {
+                        final messages = formatTimeline(
+                          events,
+                          currentPubkey: currentPubkey,
+                        );
+                        final summaries = ref
+                            .read(channelMessagesProvider(channel.id).notifier)
+                            .threadSummaries;
+                        final entries = buildMainTimelineEntries(
+                          messages,
+                          relaySummaries: summaries,
+                        );
+                        return _MessageList(
+                          entries: entries,
+                          allMessages: messages,
+                          initialMessageId: initialMessageId,
+                          initialThreadRootId: initialThreadRootId,
+                          channelId: channel.id,
+                          currentPubkey: currentPubkey,
+                          isMember: resolvedChannel.isMember,
+                          isArchived: resolvedChannel.isArchived,
+                          appBarTitleContentHeight: appBarTitleContentHeight,
+                        );
+                      },
                     ),
-                    data: (events) {
-                      final messages = formatTimeline(
-                        events,
-                        currentPubkey: currentPubkey,
-                      );
-                      final summaries = ref
-                          .read(channelMessagesProvider(channel.id).notifier)
-                          .threadSummaries;
-                      final entries = buildMainTimelineEntries(
-                        messages,
-                        relaySummaries: summaries,
-                      );
-                      return _MessageList(
-                        entries: entries,
-                        allMessages: messages,
-                        initialMessageId: initialMessageId,
-                        initialThreadRootId: initialThreadRootId,
-                        channelId: channel.id,
-                        currentPubkey: currentPubkey,
-                        isMember: resolvedChannel.isMember,
-                        isArchived: resolvedChannel.isArchived,
-                        appBarTitleContentHeight: appBarTitleContentHeight,
-                      );
-                    },
                   ),
           ),
-          _DetailConnectionBanner(
-            status: ref.watch(relaySessionProvider).status,
-          ),
-          if (!resolvedChannel.isForum && typingEntries.isNotEmpty)
-            _TypingIndicator(entries: typingEntries),
+          if (!resolvedChannel.isForum)
+            AnimatedSize(
+              duration: MediaQuery.disableAnimationsOf(context)
+                  ? Duration.zero
+                  : const Duration(milliseconds: 180),
+              curve: Curves.easeOutCubic,
+              alignment: Alignment.bottomCenter,
+              child: typingEntries.isEmpty
+                  ? const SizedBox.shrink()
+                  : ChannelTypingIndicator(entries: typingEntries),
+            ),
           if (!resolvedChannel.isForum &&
               resolvedChannel.isMember &&
               !resolvedChannel.isArchived)
diff --git a/mobile/lib/features/channels/channel_detail_page/app_bar.dart b/mobile/lib/features/channels/channel_detail_page/app_bar.dart
index 251a6ea0b8d..406d68b4f56 100644
--- a/mobile/lib/features/channels/channel_detail_page/app_bar.dart
+++ b/mobile/lib/features/channels/channel_detail_page/app_bar.dart
@@ -8,9 +8,9 @@ double _scaledTextHeight(BuildContext context, TextStyle style) {
 }
 
 double _dmAppBarTitleContentHeight(BuildContext context) {
-  final titleStyle = context.textTheme.titleSmall;
+  const titleStyle = channelTitleTextStyle;
   final presenceStyle = context.textTheme.bodySmall;
-  if (titleStyle == null || presenceStyle == null) {
+  if (presenceStyle == null) {
     return 30;
   }
   final textHeight =
@@ -19,70 +19,6 @@ double _dmAppBarTitleContentHeight(BuildContext context) {
   return textHeight > 30 ? textHeight : 30;
 }
 
-class _TypingIndicator extends ConsumerWidget {
-  final List<TypingEntry> entries;
-
-  const _TypingIndicator({required this.entries});
-
-  @override
-  Widget build(BuildContext context, WidgetRef ref) {
-    final userCache = ref.watch(userCacheProvider);
-    final names = entries.map((e) {
-      final profile =
-          userCache[e.pubkey.toLowerCase()] ??
-          ref.read(userCacheProvider.notifier).get(e.pubkey.toLowerCase());
-      return profile?.label ?? shortPubkey(e.pubkey);
-    }).toList();
-    final text = switch (names.length) {
-      1 => '${names[0]} is typing…',
-      2 => '${names[0]} and ${names[1]} are typing…',
-      _ => '${names[0]} and ${names.length - 1} others are typing…',
-    };
-
-    final visibleEntries = entries.take(3).toList();
-    final avatarCount = visibleEntries.length;
-
-    return Container(
-      width: double.infinity,
-      padding: const EdgeInsets.symmetric(
-        horizontal: Grid.gutter,
-        vertical: Grid.quarter + 2,
-      ),
-      child: Row(
-        children: [
-          SizedBox(
-            width: 20.0 + (avatarCount - 1) * 12.0,
-            height: 20,
-            child: Stack(
-              children: [
-                for (var i = 0; i < avatarCount; i++)
-                  Positioned(
-                    left: i * 12.0,
-                    child: SmallAvatar(
-                      pubkey: visibleEntries[i].pubkey,
-                      userCache: userCache,
-                    ),
-                  ),
-              ],
-            ),
-          ),
-          const SizedBox(width: Grid.xxs),
-          Flexible(
-            child: Text(
-              text,
-              style: context.textTheme.labelSmall?.copyWith(
-                color: context.colors.outline,
-                fontStyle: FontStyle.italic,
-              ),
-              overflow: TextOverflow.ellipsis,
-            ),
-          ),
-        ],
-      ),
-    );
-  }
-}
-
 class _MembersButton extends ConsumerWidget {
   final String channelId;
   final Channel channel;
@@ -240,7 +176,7 @@ class _DmAppBarTitle extends ConsumerWidget {
                       ),
                       maxLines: 1,
                       overflow: TextOverflow.ellipsis,
-                      style: context.textTheme.titleSmall,
+                      style: channelTitleTextStyle,
                     ),
                   ),
                   if (channel.isEphemeral) ...[
diff --git a/mobile/lib/features/channels/channel_detail_page/banners.dart b/mobile/lib/features/channels/channel_detail_page/banners.dart
index d94fe5e5b51..2ed9c23a5f3 100644
--- a/mobile/lib/features/channels/channel_detail_page/banners.dart
+++ b/mobile/lib/features/channels/channel_detail_page/banners.dart
@@ -54,44 +54,160 @@ class _HeaderEphemeralBadge extends StatelessWidget {
   }
 }
 
-class _DetailConnectionBanner extends StatelessWidget {
+class _MessageTimelineSkeleton extends StatelessWidget {
+  final double appBarTitleContentHeight;
   final SessionStatus status;
 
-  const _DetailConnectionBanner({required this.status});
+  const _MessageTimelineSkeleton({
+    required this.appBarTitleContentHeight,
+    required this.status,
+  });
 
   @override
   Widget build(BuildContext context) {
-    if (status == SessionStatus.connected ||
-        status == SessionStatus.disconnected) {
-      return const SizedBox.shrink();
-    }
-
-    return Container(
-      width: double.infinity,
-      padding: const EdgeInsets.symmetric(
-        horizontal: Grid.gutter,
-        vertical: Grid.quarter + 2,
+    final semanticsLabel = switch (status) {
+      SessionStatus.connecting => 'Connecting',
+      SessionStatus.reconnecting => 'Reconnecting',
+      SessionStatus.connected || SessionStatus.disconnected => 'Loading',
+    };
+    return Semantics(
+      key: const Key('channel-detail-connection-skeleton'),
+      liveRegion: true,
+      label: semanticsLabel,
+      child: ExcludeSemantics(
+        child: ListView.separated(
+          physics: const NeverScrollableScrollPhysics(),
+          padding: EdgeInsets.fromLTRB(
+            Grid.gutter,
+            frostedAppBarHeight(
+                  context,
+                  titleContentHeight: appBarTitleContentHeight,
+                ) +
+                Grid.xs,
+            Grid.gutter,
+            Grid.xs,
+          ),
+          itemCount: 4,
+          separatorBuilder: (_, _) => const SizedBox(height: Grid.xs),
+          itemBuilder: (_, index) => _MessageSkeletonRow(index: index),
+        ),
       ),
-      color: context.colors.surfaceContainerHighest,
-      child: Row(
-        mainAxisAlignment: MainAxisAlignment.center,
-        children: [
-          SizedBox(
-            width: 12,
-            height: 12,
-            child: CircularProgressIndicator(
-              strokeWidth: 2,
-              color: context.colors.onSurfaceVariant,
-            ),
+    );
+  }
+}
+
+class _MessageSkeletonRow extends StatelessWidget {
+  final int index;
+
+  const _MessageSkeletonRow({required this.index});
+
+  @override
+  Widget build(BuildContext context) {
+    const authorWidths = <double>[112, 96, 128, 80];
+    const lineWidths = <List<double>>[
+      [280, 224],
+      [272, 184],
+      [232],
+      [288, 216],
+    ];
+    final availableWidth = MediaQuery.sizeOf(context).width - 88;
+
+    return Row(
+      crossAxisAlignment: CrossAxisAlignment.start,
+      children: [
+        SkeletonBar(
+          width: 36,
+          height: 36,
+          borderRadius: BorderRadius.circular(Radii.full),
+        ),
+        const SizedBox(width: Grid.xxs),
+        Expanded(
+          child: Column(
+            crossAxisAlignment: CrossAxisAlignment.start,
+            children: [
+              Row(
+                children: [
+                  SkeletonBar(width: authorWidths[index], height: 15),
+                  const SizedBox(width: Grid.xxs),
+                  const SkeletonBar(width: 40, height: 12),
+                ],
+              ),
+              const SizedBox(height: Grid.half),
+              for (final width in lineWidths[index]) ...[
+                SkeletonBar(width: min(width, availableWidth), height: 16),
+                const SizedBox(height: Grid.half),
+              ],
+              const Row(
+                children: [
+                  SkeletonBar(width: 32, height: 16),
+                  SizedBox(width: Grid.xs),
+                  SkeletonBar(width: 32, height: 16),
+                  SizedBox(width: Grid.xs),
+                  SkeletonBar(width: 32, height: 16),
+                ],
+              ),
+            ],
           ),
-          const SizedBox(width: Grid.xxs),
-          Text(
-            'Reconnecting…',
-            style: context.textTheme.labelSmall?.copyWith(
-              color: context.colors.onSurfaceVariant,
+        ),
+      ],
+    );
+  }
+}
+
+class _ForumConnectionSkeleton extends StatelessWidget {
+  final SessionStatus status;
+
+  const _ForumConnectionSkeleton({required this.status});
+
+  @override
+  Widget build(BuildContext context) {
+    final semanticsLabel = switch (status) {
+      SessionStatus.connecting => 'Connecting',
+      SessionStatus.reconnecting => 'Reconnecting',
+      SessionStatus.connected || SessionStatus.disconnected => 'Loading',
+    };
+    return Semantics(
+      key: const Key('forum-connection-skeleton'),
+      liveRegion: true,
+      label: semanticsLabel,
+      child: ExcludeSemantics(
+        child: IgnorePointer(
+          child: ExcludeFocus(
+            child: DecoratedBox(
+              decoration: BoxDecoration(
+                color: context.colors.surface,
+                borderRadius: BorderRadius.circular(Radii.lg),
+                border: Border.all(color: context.colors.outlineVariant),
+              ),
+              child: Padding(
+                padding: const EdgeInsets.all(Grid.twelve),
+                child: SkeletonShimmer(
+                  child: const Column(
+                    crossAxisAlignment: CrossAxisAlignment.start,
+                    mainAxisSize: MainAxisSize.min,
+                    children: [
+                      Row(
+                        children: [
+                          SkeletonBar(
+                            width: 28,
+                            height: 28,
+                            borderRadius: BorderRadius.all(
+                              Radius.circular(Radii.full),
+                            ),
+                          ),
+                          SizedBox(width: Grid.xxs),
+                          SkeletonBar(width: 112, height: 14),
+                        ],
+                      ),
+                      SizedBox(height: Grid.xxs),
+                      SkeletonBar(width: 240, height: 14),
+                    ],
+                  ),
+                ),
+              ),
             ),
           ),
-        ],
+        ),
       ),
     );
   }
diff --git a/mobile/lib/features/channels/channel_detail_page/message_bubble.dart b/mobile/lib/features/channels/channel_detail_page/message_bubble.dart
index 453e7882712..5c428fc67b7 100644
--- a/mobile/lib/features/channels/channel_detail_page/message_bubble.dart
+++ b/mobile/lib/features/channels/channel_detail_page/message_bubble.dart
@@ -29,6 +29,10 @@ class _MessageBubble extends ConsumerWidget {
         ref.watch(userCacheProvider.select((cache) => cache[pk])) ??
         ref.read(userCacheProvider.notifier).get(pk);
     final displayName = profile?.label ?? shortPubkey(message.pubkey);
+    final canManageMessage =
+        currentPubkey?.toLowerCase() == pk ||
+        (profile?.ownerPubkey != null &&
+            profile?.ownerPubkey == currentPubkey?.toLowerCase());
 
     // Build mention names map from event p-tags.
     final userCache = ref.watch(userCacheProvider);
@@ -48,118 +52,184 @@ class _MessageBubble extends ConsumerWidget {
       }
     }
 
-    return GestureDetector(
-      behavior: HitTestBehavior.opaque,
-      onLongPress: () => showMessageActions(
-        context: context,
-        ref: ref,
-        message: message,
-        channelId: currentChannelId,
-        canManageMessage:
-            currentPubkey?.toLowerCase() == pk ||
-            (profile?.ownerPubkey != null &&
-                profile?.ownerPubkey == currentPubkey?.toLowerCase()),
-        allMessages: allMessages,
-        currentPubkey: currentPubkey,
-        isMember: isMember,
-        isArchived: isArchived,
-      ),
-      child: Padding(
-        padding: EdgeInsets.only(top: showAuthor ? Grid.xs : Grid.half),
-        child: Row(
-          crossAxisAlignment: CrossAxisAlignment.start,
-          children: [
-            if (showAuthor)
-              GestureDetector(
-                onTap: () => showUserProfileSheet(context, message.pubkey),
-                child: _UserAvatar(profile: profile, pubkey: message.pubkey),
-              )
-            else
-              const SizedBox(width: 36),
-            const SizedBox(width: Grid.xxs),
-            Expanded(
-              child: Transform.translate(
-                offset: Offset(0, showAuthor ? -Grid.quarter : 0),
-                child: Column(
-                  crossAxisAlignment: CrossAxisAlignment.start,
-                  children: [
-                    if (showAuthor)
-                      Padding(
-                        padding: const EdgeInsets.only(bottom: Grid.quarter),
-                        child: Row(
-                          crossAxisAlignment: CrossAxisAlignment.center,
-                          children: [
-                            GestureDetector(
-                              onTap: () =>
-                                  showUserProfileSheet(context, message.pubkey),
-                              child: Text(
-                                displayName,
-                                style: context.textTheme.titleSmall?.copyWith(
-                                  fontWeight: FontWeight.w600,
-                                  color: context.colors.onSurface,
-                                ),
-                              ),
+    return Padding(
+      padding: EdgeInsets.only(top: showAuthor ? Grid.xs : 0),
+      child: Material(
+        color: Colors.transparent,
+        borderRadius: BorderRadius.circular(Radii.md),
+        // The media carousel intentionally continues through the list's trailing
+        // gutter. InkWell still clips its ink to [borderRadius], while leaving
+        // overflowing message content visible.
+        clipBehavior: Clip.none,
+        child: InkWell(
+          key: ValueKey('message-row-${message.id}'),
+          borderRadius: BorderRadius.circular(Radii.md),
+          highlightColor: context.colors.primary.withValues(alpha: 0.1),
+          onLongPress: () => showMessageActions(
+            context: context,
+            ref: ref,
+            message: message,
+            channelId: currentChannelId,
+            canManageMessage: canManageMessage,
+            allMessages: allMessages,
+            currentPubkey: currentPubkey,
+            isMember: isMember,
+            isArchived: isArchived,
+          ),
+          child: Padding(
+            padding: EdgeInsets.only(
+              top: showAuthor ? 0 : Grid.xxs,
+              bottom: showAuthor ? 0 : Grid.xxs,
+            ),
+            child: Row(
+              crossAxisAlignment: CrossAxisAlignment.start,
+              children: [
+                if (showAuthor)
+                  GestureDetector(
+                    onTap: () => showUserProfileSheet(context, message.pubkey),
+                    child: _UserAvatar(
+                      profile: profile,
+                      pubkey: message.pubkey,
+                    ),
+                  )
+                else
+                  const SizedBox(width: messageAvatarSize),
+                const SizedBox(width: messageAvatarContentGap),
+                Expanded(
+                  child: Padding(
+                    padding: EdgeInsets.only(top: showAuthor ? Grid.half : 0),
+                    child: Column(
+                      crossAxisAlignment: CrossAxisAlignment.start,
+                      children: [
+                        if (showAuthor)
+                          Padding(
+                            padding: const EdgeInsets.only(
+                              bottom: Grid.quarter,
                             ),
-                            const SizedBox(width: Grid.xxs),
-                            _messageTimestamp(context, message.createdAt),
-                            if (message.edited) ...[
-                              const SizedBox(width: Grid.half),
-                              Text(
-                                '(edited)',
-                                style: context.textTheme.labelSmall?.copyWith(
-                                  color: context.colors.onSurfaceVariant,
-                                  fontStyle: FontStyle.italic,
+                            child: Row(
+                              children: [
+                                Expanded(
+                                  child: MessageAuthorMeta(
+                                    displayName: displayName,
+                                    username: messageUsernameLabel(profile),
+                                    timestamp: formatMessageTime(
+                                      message.createdAt,
+                                    ),
+                                    nameColor: context.colors.onSurface,
+                                    metadataColor:
+                                        context.colors.onSurfaceVariant,
+                                    onAuthorTap: () => showUserProfileSheet(
+                                      context,
+                                      message.pubkey,
+                                    ),
+                                    displayNameKey: ValueKey(
+                                      'message-author-${message.id}',
+                                    ),
+                                    usernameKey: ValueKey(
+                                      'message-username-${message.id}',
+                                    ),
+                                    timestampKey: ValueKey(
+                                      'message-timestamp-${message.id}',
+                                    ),
+                                  ),
                                 ),
+                                if (message.edited) ...[
+                                  const SizedBox(width: Grid.half),
+                                  Text(
+                                    '(edited)',
+                                    style: context.textTheme.labelSmall
+                                        ?.copyWith(
+                                          color:
+                                              context.colors.onSurfaceVariant,
+                                          fontStyle: FontStyle.italic,
+                                        ),
+                                  ),
+                                ],
+                              ],
+                            ),
+                          ),
+                        MessageContent(
+                          content: message.content,
+                          mentionNames: mentionNames,
+                          agentMentionPubkeys: agentMentionPubkeys,
+                          channelNames: channelNames,
+                          tags: message.tags,
+                          baseStyle: messageBodyTextStyle.copyWith(
+                            color: context.colors.onSurface,
+                          ),
+                          mediaCarouselTrailingOverflow: Grid.gutter,
+                          onMediaReply: allMessages == null
+                              ? null
+                              : () {
+                                  if (!context.mounted) return;
+                                  Navigator.of(context).push(
+                                    MaterialPageRoute<void>(
+                                      builder: (_) => ThreadDetailPage(
+                                        threadHead: message,
+                                        allMessages: allMessages!,
+                                        channelId: currentChannelId,
+                                        currentPubkey: currentPubkey,
+                                        isMember: isMember,
+                                        isArchived: isArchived,
+                                      ),
+                                    ),
+                                  );
+                                },
+                          onMediaMore: (viewerContext, imageUrl) =>
+                              showImageActions(
+                                context: viewerContext,
+                                ref: ref,
+                                message: message,
+                                channelId: currentChannelId,
+                                imageUrl: imageUrl,
+                                canManageMessage: canManageMessage,
+                                onDeleted: () {
+                                  if (viewerContext.mounted) {
+                                    Navigator.of(viewerContext).maybePop();
+                                  }
+                                },
                               ),
-                            ],
-                          ],
+                          onChannelTap: (channelId) {
+                            openChannelLink(
+                              context: context,
+                              ref: ref,
+                              channelId: channelId,
+                              currentChannelId: currentChannelId,
+                            );
+                          },
+                          onMentionTap: (pubkey) =>
+                              showUserProfileSheet(context, pubkey),
                         ),
-                      ),
-                    MessageContent(
-                      content: message.content,
-                      mentionNames: mentionNames,
-                      agentMentionPubkeys: agentMentionPubkeys,
-                      channelNames: channelNames,
-                      tags: message.tags,
-                      baseStyle: context.textTheme.bodyLarge?.copyWith(
-                        color: context.colors.onSurface,
-                      ),
-                      onChannelTap: (channelId) {
-                        openChannelLink(
-                          context: context,
-                          ref: ref,
-                          channelId: channelId,
-                          currentChannelId: currentChannelId,
-                        );
-                      },
-                      onMentionTap: (pubkey) =>
-                          showUserProfileSheet(context, pubkey),
+                        if (message.reactions.isNotEmpty)
+                          ReactionRow(
+                            reactions: message.reactions,
+                            onToggle: (emoji) =>
+                                toggleReaction(ref, message, emoji),
+                          ),
+                      ],
                     ),
-                    if (message.reactions.isNotEmpty)
-                      ReactionRow(
-                        reactions: message.reactions,
-                        onToggle: (emoji) =>
-                            toggleReaction(ref, message, emoji),
-                      ),
-                  ],
+                  ),
                 ),
-              ),
+              ],
             ),
-          ],
+          ),
         ),
       ),
     );
   }
 }
 
-Widget _messageTimestamp(BuildContext context, int createdAt) {
-  return Text(
-    formatMessageTime(createdAt),
-    style: context.textTheme.labelSmall?.copyWith(
-      fontSize: 14,
-      height: 22 / 14,
-      letterSpacing: context.textTheme.titleSmall?.letterSpacing,
-      color: context.colors.onSurfaceVariant,
+Widget _messageTimestamp(BuildContext context, int createdAt, {Key? key}) {
+  return ConstrainedBox(
+    constraints: const BoxConstraints(maxWidth: Grid.xxl),
+    child: Text(
+      key: key,
+      formatMessageTime(createdAt),
+      maxLines: 1,
+      overflow: TextOverflow.ellipsis,
+      style: messageTimestampTextStyle.copyWith(
+        color: context.colors.onSurfaceVariant,
+      ),
     ),
   );
 }
@@ -172,7 +242,7 @@ class _UserAvatar extends StatelessWidget {
   const _UserAvatar({
     required this.profile,
     required this.pubkey,
-    this.size = 36,
+    this.size = messageAvatarSize,
   });
 
   @override
diff --git a/mobile/lib/features/channels/channel_detail_page/message_list.dart b/mobile/lib/features/channels/channel_detail_page/message_list.dart
index ba5a2e1a718..6a77069beae 100644
--- a/mobile/lib/features/channels/channel_detail_page/message_list.dart
+++ b/mobile/lib/features/channels/channel_detail_page/message_list.dart
@@ -31,6 +31,11 @@ class _MessageList extends HookConsumerWidget {
     final isLoadingOlder = useState(false);
     final isAtLatest = useState(true);
     final hasUserScrolled = useState(false);
+    final followsLatest = useRef(
+      initialMessageId == null && initialThreadRootId == null,
+    );
+    final isAutoScrolling = useRef(false);
+    final autoScrollScheduled = useRef(false);
     final latestEntryId = entries.isEmpty ? null : entries.last.message.id;
     final previousLatestEntryId = useRef<String?>(null);
     final didOpenInitialThread = useRef(false);
@@ -47,24 +52,57 @@ class _MessageList extends HookConsumerWidget {
     }
 
     Future<void> scrollToLatest() async {
-      if (!itemScrollController.isAttached) return;
-      await itemScrollController.scrollTo(
-        index: 0,
-        duration: const Duration(milliseconds: 220),
-        curve: Curves.easeOutCubic,
+      if (!itemScrollController.isAttached || isAutoScrolling.value) return;
+      followsLatest.value = true;
+      hasUserScrolled.value = false;
+      isAutoScrolling.value = true;
+      try {
+        await itemScrollController.scrollTo(
+          index: 0,
+          duration: const Duration(milliseconds: 220),
+          curve: Curves.easeOutCubic,
+        );
+        if (context.mounted && !hasUserScrolled.value) {
+          isAtLatest.value = true;
+        }
+      } finally {
+        isAutoScrolling.value = false;
+      }
+    }
+
+    void scheduleAutoScrollToLatest() {
+      if (autoScrollScheduled.value || isAutoScrolling.value) return;
+      autoScrollScheduled.value = true;
+      WidgetsBinding.instance.addPostFrameCallback((_) {
+        autoScrollScheduled.value = false;
+        if (!context.mounted || !followsLatest.value || hasUserScrolled.value) {
+          return;
+        }
+        scrollToLatest();
+      });
+    }
+
+    bool latestIsAtBoundary() {
+      // In this reversed list, item 0's leading edge is the bottom boundary.
+      return itemPositionsListener.itemPositions.value.any(
+        (position) => position.index == 0 && position.itemLeadingEdge >= 0,
       );
-      if (context.mounted) isAtLatest.value = true;
     }
 
     useEffect(() {
       void onPositionsChanged() {
         final positions = itemPositionsListener.itemPositions.value;
         if (positions.isEmpty) return;
-        final nextIsAtLatest = positions.any(
-          (position) => position.index == 0 && position.itemLeadingEdge < 1,
-        );
-        if (isAtLatest.value != nextIsAtLatest) {
-          isAtLatest.value = nextIsAtLatest;
+        final nextIsAtLatest = latestIsAtBoundary();
+        if (nextIsAtLatest) {
+          if (!isAtLatest.value) isAtLatest.value = true;
+        } else if (followsLatest.value && !hasUserScrolled.value) {
+          // The viewport can shrink when the composer or keyboard opens.
+          // Preserve auto-follow until the user scrolls the timeline.
+          if (!isAtLatest.value) isAtLatest.value = true;
+          scheduleAutoScrollToLatest();
+        } else if (isAtLatest.value) {
+          isAtLatest.value = false;
         }
 
         final oldestVisible = positions
@@ -124,8 +162,11 @@ class _MessageList extends HookConsumerWidget {
       }
       WidgetsBinding.instance.addPostFrameCallback((_) {
         if (!context.mounted || !itemScrollController.isAttached) return;
-        itemScrollController.jumpTo(index: targetIndex, alignment: 0.35);
         didJumpToInitialMessage.value = true;
+        followsLatest.value = false;
+        hasUserScrolled.value = false;
+        isAtLatest.value = false;
+        itemScrollController.jumpTo(index: targetIndex, alignment: 0.35);
       });
       return null;
     }, [initialMessageId, initialThreadRootId, entries.length]);
@@ -187,9 +228,18 @@ class _MessageList extends HookConsumerWidget {
       children: [
         NotificationListener<ScrollNotification>(
           onNotification: (notification) {
-            if (notification is ScrollStartNotification &&
-                notification.dragDetails != null) {
+            if (notification is UserScrollNotification &&
+                notification.direction != ScrollDirection.idle) {
               hasUserScrolled.value = true;
+              followsLatest.value = false;
+            } else if (notification is ScrollEndNotification &&
+                hasUserScrolled.value) {
+              WidgetsBinding.instance.addPostFrameCallback((_) {
+                if (!context.mounted || !latestIsAtBoundary()) return;
+                hasUserScrolled.value = false;
+                followsLatest.value = true;
+                if (!isAtLatest.value) isAtLatest.value = true;
+              });
             }
             return false;
           },
@@ -205,7 +255,7 @@ class _MessageList extends HookConsumerWidget {
                 context,
                 titleContentHeight: appBarTitleContentHeight,
               ),
-              bottom: Grid.xxs,
+              bottom: 0,
             ),
             itemCount: displayEntries.length + (isLoadingOlder.value ? 1 : 0),
             itemBuilder: (context, index) {
@@ -214,10 +264,9 @@ class _MessageList extends HookConsumerWidget {
                 return const Padding(
                   padding: EdgeInsets.symmetric(vertical: Grid.xs),
                   child: Center(
-                    child: SizedBox(
-                      width: 20,
-                      height: 20,
-                      child: CircularProgressIndicator(strokeWidth: 2),
+                    child: BuzzLoadingIndicator(
+                      size: 24,
+                      semanticLabel: 'Loading older messages',
                     ),
                   ),
                 );
@@ -240,53 +289,58 @@ class _MessageList extends HookConsumerWidget {
 
               final showAuthor =
                   !message.isSystem &&
-                  (prevMessage == null ||
+                  (message.hasAttachments ||
+                      prevMessage == null ||
                       prevMessage.isSystem ||
                       showDayDivider ||
                       prevMessage.pubkey.toLowerCase() !=
                           message.pubkey.toLowerCase() ||
                       (message.createdAt - prevMessage.createdAt) > 300);
 
-              return Column(
-                crossAxisAlignment: CrossAxisAlignment.start,
-                children: [
-                  if (showDayDivider)
-                    DayDivider(label: formatDayHeading(message.createdAt)),
-                  if (message.isSystem)
-                    _SystemMessageRow(
-                      message: message,
-                      groupedMessages: entryGroup.length > 1
-                          ? entryGroup.map((entry) => entry.message).toList()
-                          : null,
-                      channelId: channelId,
-                      currentPubkey: currentPubkey,
-                      allMessages: null,
-                      isMember: isMember,
-                      isArchived: isArchived,
-                    )
-                  else ...[
-                    _MessageBubble(
-                      message: message,
-                      showAuthor: showAuthor,
-                      channelNames: channelNamesMap,
-                      currentChannelId: channelId,
-                      currentPubkey: currentPubkey,
-                      allMessages: allMessages,
-                      isMember: isMember,
-                      isArchived: isArchived,
-                    ),
-                    if (entry.summary != null)
-                      _ThreadSummaryRow(
-                        summary: entry.summary!,
+              return Padding(
+                key: ValueKey('channel-message-group-${message.id}'),
+                padding: EdgeInsets.only(bottom: index == 0 ? Grid.xs : 0),
+                child: Column(
+                  crossAxisAlignment: CrossAxisAlignment.start,
+                  children: [
+                    if (showDayDivider)
+                      DayDivider(label: formatDayHeading(message.createdAt)),
+                    if (message.isSystem)
+                      _SystemMessageRow(
                         message: message,
-                        allMessages: allMessages,
+                        groupedMessages: entryGroup.length > 1
+                            ? entryGroup.map((entry) => entry.message).toList()
+                            : null,
                         channelId: channelId,
                         currentPubkey: currentPubkey,
+                        allMessages: null,
+                        isMember: isMember,
+                        isArchived: isArchived,
+                      )
+                    else ...[
+                      _MessageBubble(
+                        message: message,
+                        showAuthor: showAuthor,
+                        channelNames: channelNamesMap,
+                        currentChannelId: channelId,
+                        currentPubkey: currentPubkey,
+                        allMessages: allMessages,
                         isMember: isMember,
                         isArchived: isArchived,
                       ),
+                      if (entry.summary != null)
+                        _ThreadSummaryRow(
+                          summary: entry.summary!,
+                          message: message,
+                          allMessages: allMessages,
+                          channelId: channelId,
+                          currentPubkey: currentPubkey,
+                          isMember: isMember,
+                          isArchived: isArchived,
+                        ),
+                    ],
                   ],
-                ],
+                ),
               );
             },
           ),
diff --git a/mobile/lib/features/channels/channel_detail_page/system_rows.dart b/mobile/lib/features/channels/channel_detail_page/system_rows.dart
index 8ff09b4e5c4..f6019febab7 100644
--- a/mobile/lib/features/channels/channel_detail_page/system_rows.dart
+++ b/mobile/lib/features/channels/channel_detail_page/system_rows.dart
@@ -30,6 +30,9 @@ class _SystemMessageRow extends ConsumerWidget {
     final channelCreator = systemEvent.type == SystemEventType.channelCreated
         ? systemEvent.actorPubkey?.trim()
         : null;
+    final usesMessageStyleLayout =
+        groupedMembership != null ||
+        (channelCreator != null && channelCreator.isNotEmpty);
 
     String resolveLabel(String? pubkey) {
       if (pubkey == null) return 'Someone';
@@ -68,66 +71,83 @@ class _SystemMessageRow extends ConsumerWidget {
       }
     }
 
-    return GestureDetector(
-      behavior: HitTestBehavior.opaque,
-      onLongPress: () => showMessageActions(
-        context: context,
-        ref: ref,
-        message: message,
-        channelId: channelId,
-        canManageMessage: false,
-        allMessages: null,
-        currentPubkey: currentPubkey,
-        isMember: isMember,
-        isArchived: isArchived,
-      ),
-      child: Padding(
-        padding: const EdgeInsets.symmetric(vertical: Grid.xxs),
-        child: Column(
-          crossAxisAlignment: CrossAxisAlignment.start,
-          children: [
-            if (groupedMembership != null)
-              _MembershipSystemMessageContent(
-                event: groupedMembership,
-                createdAt: message.createdAt,
-                resolveLabel: resolveLabel,
-                userCache: userCache,
-              )
-            else if (channelCreator != null && channelCreator.isNotEmpty)
-              _MessageStyleSystemMessageContent(
-                displayPubkey: channelCreator,
-                createdAt: message.createdAt,
-                resolveLabel: resolveLabel,
-                userCache: userCache,
-                actionSpans: const [TextSpan(text: 'created this channel')],
-              )
-            else
-              Row(
-                children: [
-                  _systemEventAvatar(context, systemEvent, userCache),
-                  const SizedBox(width: Grid.xxs),
-                  Expanded(
-                    child: Text(
-                      systemEvent.describe(resolveLabel),
-                      style: context.textTheme.bodyLarge?.copyWith(
-                        color: context.colors.onSurfaceVariant,
+    return Material(
+      color: Colors.transparent,
+      borderRadius: BorderRadius.circular(Radii.md),
+      clipBehavior: Clip.antiAlias,
+      child: InkWell(
+        key: ValueKey('system-message-row-${message.id}'),
+        borderRadius: BorderRadius.circular(Radii.md),
+        highlightColor: context.colors.primary.withValues(alpha: 0.1),
+        onLongPress: () => showMessageActions(
+          context: context,
+          ref: ref,
+          message: message,
+          channelId: channelId,
+          canManageMessage: false,
+          allMessages: null,
+          currentPubkey: currentPubkey,
+          isMember: isMember,
+          isArchived: isArchived,
+        ),
+        child: Padding(
+          padding: const EdgeInsets.symmetric(vertical: Grid.xxs),
+          child: Column(
+            crossAxisAlignment: CrossAxisAlignment.start,
+            children: [
+              if (groupedMembership != null)
+                _MembershipSystemMessageContent(
+                  event: groupedMembership,
+                  createdAt: message.createdAt,
+                  resolveLabel: resolveLabel,
+                  userCache: userCache,
+                )
+              else if (channelCreator != null && channelCreator.isNotEmpty)
+                _MessageStyleSystemMessageContent(
+                  displayPubkey: channelCreator,
+                  createdAt: message.createdAt,
+                  resolveLabel: resolveLabel,
+                  userCache: userCache,
+                  actionSpans: const [TextSpan(text: 'created this channel')],
+                )
+              else
+                Row(
+                  children: [
+                    _systemEventAvatar(context, systemEvent, userCache),
+                    const SizedBox(width: Grid.xxs),
+                    Expanded(
+                      child: Text(
+                        systemEvent.describe(resolveLabel),
+                        style: systemMessageBodyTextStyle.copyWith(
+                          color: context.colors.onSurfaceVariant,
+                        ),
                       ),
                     ),
+                    _messageTimestamp(
+                      context,
+                      message.createdAt,
+                      key: ValueKey('system-message-timestamp-${message.id}'),
+                    ),
+                  ],
+                ),
+              if (reactions.isNotEmpty)
+                Padding(
+                  padding: EdgeInsets.only(
+                    left:
+                        (usesMessageStyleLayout ? messageAvatarSize : 36) +
+                        (usesMessageStyleLayout
+                            ? messageAvatarContentGap
+                            : Grid.xxs),
+                  ),
+                  child: ReactionRow(
+                    reactions: reactions,
+                    onToggle: groupedMessages == null
+                        ? (emoji) => toggleReaction(ref, message, emoji)
+                        : toggleGroupedReaction,
                   ),
-                  _messageTimestamp(context, message.createdAt),
-                ],
-              ),
-            if (reactions.isNotEmpty)
-              Padding(
-                padding: const EdgeInsets.only(left: 36 + Grid.xxs),
-                child: ReactionRow(
-                  reactions: reactions,
-                  onToggle: groupedMessages == null
-                      ? (emoji) => toggleReaction(ref, message, emoji)
-                      : toggleGroupedReaction,
                 ),
-              ),
-          ],
+            ],
+          ),
         ),
       ),
     );
@@ -282,7 +302,7 @@ class _MembershipSystemMessageContent extends StatelessWidget {
 }
 
 TextStyle? _systemActionTextStyle(BuildContext context) {
-  return context.textTheme.bodyLarge?.copyWith(
+  return systemMessageBodyTextStyle.copyWith(
     color: context.colors.onSurfaceVariant,
   );
 }
@@ -310,28 +330,33 @@ class _MessageStyleSystemMessageContent extends StatelessWidget {
         _UserAvatar(
           profile: userCache[displayPubkey.toLowerCase()],
           pubkey: displayPubkey,
-          size: 36,
+          size: messageAvatarSize,
         ),
-        const SizedBox(width: Grid.xxs),
+        const SizedBox(width: messageAvatarContentGap),
         Expanded(
           child: Transform.translate(
             offset: const Offset(0, -Grid.quarter),
             child: Column(
               crossAxisAlignment: CrossAxisAlignment.start,
               children: [
-                Row(
-                  crossAxisAlignment: CrossAxisAlignment.center,
-                  children: [
-                    Text(
-                      resolveLabel(displayPubkey),
-                      style: context.textTheme.titleSmall?.copyWith(
-                        color: context.colors.onSurface,
-                        fontWeight: FontWeight.w600,
-                      ),
-                    ),
-                    const SizedBox(width: Grid.xxs),
-                    _messageTimestamp(context, createdAt),
-                  ],
+                MessageAuthorMeta(
+                  displayName: resolveLabel(displayPubkey),
+                  username: messageUsernameLabel(
+                    userCache[displayPubkey.toLowerCase()],
+                  ),
+                  timestamp: formatMessageTime(createdAt),
+                  nameColor: context.colors.onSurface,
+                  metadataColor: context.colors.onSurfaceVariant,
+                  nameStyle: systemMessageHeadingTextStyle,
+                  displayNameKey: ValueKey(
+                    'system-message-author-$displayPubkey',
+                  ),
+                  usernameKey: ValueKey(
+                    'system-message-username-$displayPubkey',
+                  ),
+                  timestampKey: ValueKey(
+                    'system-message-timestamp-$displayPubkey',
+                  ),
                 ),
                 Text.rich(
                   TextSpan(
@@ -482,10 +507,11 @@ class _ThreadSummaryRow extends ConsumerWidget {
         );
       },
       child: Padding(
+        key: ValueKey('thread-summary-${message.id}'),
         padding: const EdgeInsets.only(
-          left: 36 + Grid.xxs,
+          left: messageAvatarSize + messageAvatarContentGap,
           top: Grid.half,
-          bottom: Grid.half,
+          bottom: Grid.xs,
         ),
         child: Row(
           mainAxisSize: MainAxisSize.min,
@@ -509,36 +535,38 @@ class _ThreadSummaryRow extends ConsumerWidget {
               ),
             ),
             const SizedBox(width: Grid.xxs),
-            Text.rich(
-              TextSpan(
-                children: [
-                  TextSpan(
-                    text:
-                        '${summary.replyCount} ${summary.replyCount == 1 ? 'reply' : 'replies'}',
-                    style: context.textTheme.labelMedium?.copyWith(
-                      color: context.colors.primary,
-                      fontWeight: FontWeight.w600,
-                    ),
-                  ),
-                  if (summary.lastReplyAt case final lastReplyAt?) ...[
-                    TextSpan(
-                      text: ' · ',
-                      style: context.textTheme.labelMedium?.copyWith(
-                        color: context.colors.onSurfaceVariant.withValues(
-                          alpha: 0.5,
-                        ),
-                      ),
-                    ),
+            Flexible(
+              child: Text.rich(
+                TextSpan(
+                  children: [
                     TextSpan(
                       text:
-                          'last reply ${formatThreadSummaryLastReplyTime(lastReplyAt)}',
-                      style: context.textTheme.labelMedium?.copyWith(
-                        color: context.colors.onSurfaceVariant,
-                        fontWeight: FontWeight.w400,
+                          '${summary.replyCount} ${summary.replyCount == 1 ? 'reply' : 'replies'}',
+                      style: replyPreviewTextStyle.copyWith(
+                        color: context.colors.primary,
                       ),
                     ),
+                    if (summary.lastReplyAt case final lastReplyAt?) ...[
+                      TextSpan(
+                        text: ' · ',
+                        style: replyPreviewTextStyle.copyWith(
+                          color: context.colors.onSurfaceVariant.withValues(
+                            alpha: 0.5,
+                          ),
+                        ),
+                      ),
+                      TextSpan(
+                        text:
+                            'last reply ${formatThreadSummaryLastReplyTime(lastReplyAt)}',
+                        style: replyPreviewTextStyle.copyWith(
+                          color: context.colors.onSurfaceVariant,
+                        ),
+                      ),
+                    ],
                   ],
-                ],
+                ),
+                maxLines: 2,
+                overflow: TextOverflow.ellipsis,
               ),
             ),
           ],
diff --git a/mobile/lib/features/channels/channel_messages_provider.dart b/mobile/lib/features/channels/channel_messages_provider.dart
index fb910f069ae..7f657f4b7cd 100644
--- a/mobile/lib/features/channels/channel_messages_provider.dart
+++ b/mobile/lib/features/channels/channel_messages_provider.dart
@@ -28,6 +28,12 @@ class ChannelMessagesNotifier extends Notifier<AsyncValue<List<NostrEvent>>> {
   /// UI can show stale data instead of a blank loading spinner.
   List<NostrEvent>? _lastKnownMessages;
 
+  /// Whether this channel has completed at least one message history load.
+  ///
+  /// This distinguishes a genuinely loaded empty channel from the synthetic
+  /// empty value returned while the relay is not yet connected.
+  bool get hasLoadedMessages => _lastKnownMessages != null;
+
   Map<String, ChannelWindowThreadSummary> get threadSummaries =>
       channelWindowThreadSummaries(_windowStore);
 
diff --git a/mobile/lib/features/channels/channel_sections/channel_sections_manager.dart b/mobile/lib/features/channels/channel_sections/channel_sections_manager.dart
index 13bd5d63d8c..1d103755bac 100644
--- a/mobile/lib/features/channels/channel_sections/channel_sections_manager.dart
+++ b/mobile/lib/features/channels/channel_sections/channel_sections_manager.dart
@@ -48,6 +48,12 @@ class ChannelSectionsManager {
   void Function()? _unsubscribe;
   bool _disposed = false;
 
+  /// Base delay for the startup-sync retry backoff. Overridable in tests.
+  final Duration _startupRetryBaseDelay;
+  Timer? _startupRetryTimer;
+  int _startupRetryAttempt = 0;
+  bool _startupFetchSucceeded = false;
+
   ChannelSectionsManager({
     required this.pubkey,
     required SharedPreferences prefs,
@@ -56,12 +62,15 @@ class ChannelSectionsManager {
     required SignedEventRelay? signedEventRelay,
     required bool remoteEnabled,
     required VoidCallback onChanged,
+    @visibleForTesting
+    Duration startupRetryBaseDelay = const Duration(seconds: 2),
   }) : _storage = ChannelSectionsStorage(prefs),
        _crypto = crypto,
        _relaySession = relaySession,
        _signedEventRelay = signedEventRelay,
        _remoteEnabled = remoteEnabled,
        _onChanged = onChanged,
+       _startupRetryBaseDelay = startupRetryBaseDelay,
        _store = ChannelSectionsStorage(prefs).read(pubkey);
 
   ChannelSectionStore get store => _store;
@@ -74,15 +83,73 @@ class ChannelSectionsManager {
       return;
     }
 
-    await _fetchAndMerge();
-    await _startLiveSubscription();
+    await _syncWithRelay();
     _onChanged();
   }
 
+  /// One startup-sync attempt: fetch the remote blob, then start the live
+  /// subscription. Either step can lose a transient race on cold start (the
+  /// relay rate-limits the burst of per-channel subscriptions and rejects
+  /// with `rate-limited: quota exceeded`) — retry with backoff instead of
+  /// silently giving up, which left desktop-created groups invisible until
+  /// an unrelated refetch.
+  ///
+  /// Retries are intentionally unbounded for the manager's lifetime: this
+  /// sync must eventually land for groups to appear at all, and at the 30s
+  /// delay ceiling a persistent retry is cheap. Do not "fix" this into a
+  /// bounded loop — giving up permanently is the exact bug this replaces.
+  Future<void> _syncWithRelay() async {
+    if (!_startupFetchSucceeded) {
+      _startupFetchSucceeded = await _fetchAndMerge();
+    }
+
+    final subscribed = _unsubscribe != null || await _startLiveSubscription();
+
+    if (!_startupFetchSucceeded || !subscribed) {
+      _scheduleStartupRetry();
+    } else {
+      // Fully recovered — later transient failures (e.g. a late relay
+      // CLOSED) start backing off from the base delay again instead of the
+      // ceiling the cold start climbed to.
+      _startupRetryAttempt = 0;
+    }
+  }
+
+  void _scheduleStartupRetry() {
+    if (_disposed) return;
+    _startupRetryTimer?.cancel();
+    // The inner shift cap is overflow protection, not the delay policy: the
+    // consecutive-failure counter is unbounded, and an unchecked `<<`
+    // past 62 wraps negative, which would make the Timer fire immediately in
+    // a hot loop. At the default 2s base the outer 30s clamp is what callers
+    // actually observe (2s, 4s, …, 30s); the shift cap only bites for the
+    // tiny injected bases used in tests.
+    final delayMs = min(
+      _startupRetryBaseDelay.inMilliseconds << min(_startupRetryAttempt, 5),
+      30000,
+    );
+    _startupRetryAttempt++;
+    debugPrint(
+      '[ChannelSectionsManager] startup sync incomplete; '
+      'retrying in ${delayMs}ms (attempt $_startupRetryAttempt)',
+    );
+    _startupRetryTimer = Timer(Duration(milliseconds: delayMs), () {
+      _startupRetryTimer = null;
+      unawaited(
+        _syncWithRelay().then((_) {
+          if (!_disposed) _onChanged();
+        }),
+      );
+    });
+  }
+
   void dispose({bool flushPending = true}) {
     if (_disposed) return;
     _disposed = true;
 
+    _startupRetryTimer?.cancel();
+    _startupRetryTimer = null;
+
     final hadPending = _publishDebounce != null;
     _publishDebounce?.cancel();
     _publishDebounce = null;
@@ -201,8 +268,10 @@ class ChannelSectionsManager {
     });
   }
 
-  Future<void> _fetchAndMerge() async {
-    if (_relaySession == null) return;
+  /// Returns whether the fetch reached the relay (regardless of whether a
+  /// remote blob exists).
+  Future<bool> _fetchAndMerge() async {
+    if (_relaySession == null) return false;
     try {
       final events = await _relaySession.fetchHistory(
         NostrFilter(
@@ -217,13 +286,17 @@ class ChannelSectionsManager {
       _mergeEvents(events);
       _persist();
       if (!_disposed) _onChanged();
-    } catch (_) {
+      return true;
+    } catch (error) {
+      debugPrint('[ChannelSectionsManager] fetch failed: $error');
       // Local state remains usable when relay is unavailable.
+      return false;
     }
   }
 
-  Future<void> _startLiveSubscription() async {
-    if (_relaySession == null) return;
+  /// Returns whether the live subscription was established.
+  Future<bool> _startLiveSubscription() async {
+    if (_relaySession == null) return false;
     try {
       _unsubscribe = await _relaySession.subscribe(
         NostrFilter(
@@ -235,12 +308,31 @@ class ChannelSectionsManager {
           limit: 1,
         ),
         _handleIncomingEvent,
+        onClosed: _handleSubscriptionClosed,
       );
-    } catch (_) {
-      // Non-fatal — local state and history still work.
+      return true;
+    } catch (error) {
+      debugPrint('[ChannelSectionsManager] live subscription failed: $error');
+      // Non-fatal — local state and history still work; retried by the
+      // startup-sync backoff.
+      return false;
     }
   }
 
+  /// A relay `CLOSED` can arrive after `subscribe()` already reported
+  /// success: the 500ms readiness wait times out silently under load, and
+  /// the rate-limit rejection lands later. Without this handler the manager
+  /// would keep a dead subscription and never retry — the exact
+  /// load-correlated cold-start failure this retry exists for.
+  void _handleSubscriptionClosed(String message) {
+    if (_disposed) return;
+    debugPrint(
+      '[ChannelSectionsManager] live subscription closed by relay: $message',
+    );
+    _unsubscribe = null;
+    _scheduleStartupRetry();
+  }
+
   void _mergeEvents(List<NostrEvent> events) {
     for (final event in events) {
       if (event.pubkey != pubkey) continue;
diff --git a/mobile/lib/features/channels/channel_typing_indicator.dart b/mobile/lib/features/channels/channel_typing_indicator.dart
new file mode 100644
index 00000000000..d021b9e2875
--- /dev/null
+++ b/mobile/lib/features/channels/channel_typing_indicator.dart
@@ -0,0 +1,89 @@
+import 'package:flutter/material.dart';
+import 'package:hooks_riverpod/hooks_riverpod.dart';
+
+import '../../shared/theme/theme.dart';
+import '../../shared/utils/string_utils.dart';
+import '../profile/user_cache_provider.dart';
+import 'channel_typing_provider.dart';
+import 'small_avatar.dart';
+
+/// Composer-adjacent status for people currently typing in a channel or thread.
+class ChannelTypingIndicator extends ConsumerWidget {
+  final List<TypingEntry> entries;
+
+  const ChannelTypingIndicator({super.key, required this.entries});
+
+  @override
+  Widget build(BuildContext context, WidgetRef ref) {
+    final userCache = ref.watch(userCacheProvider);
+    final names = entries.map((entry) {
+      final profile =
+          userCache[entry.pubkey.toLowerCase()] ??
+          ref.read(userCacheProvider.notifier).get(entry.pubkey.toLowerCase());
+      return profile?.label ?? shortPubkey(entry.pubkey);
+    }).toList();
+    final text = switch (names.length) {
+      1 => '${names[0]} is typing…',
+      2 => '${names[0]} and ${names[1]} are typing…',
+      _ => '${names[0]} and ${names.length - 1} others are typing…',
+    };
+    final visibleEntries = entries.take(3).toList();
+    final avatarCount = visibleEntries.length;
+
+    return Padding(
+      padding: const EdgeInsets.only(
+        left: Grid.twelve,
+        right: Grid.twelve,
+        bottom: Grid.xxs,
+      ),
+      child: Container(
+        key: const ValueKey('channel-typing-indicator'),
+        width: double.infinity,
+        padding: const EdgeInsets.symmetric(
+          horizontal: Grid.xxs,
+          vertical: Grid.xxs,
+        ),
+        decoration: BoxDecoration(
+          color: context.colors.surfaceContainerHighest,
+          borderRadius: BorderRadius.circular(Radii.dialog),
+          border: Border.all(
+            color: Colors.black.withValues(alpha: 0.04),
+            width: 1,
+          ),
+        ),
+        child: Row(
+          children: [
+            SizedBox(
+              width: 24.0 + (avatarCount - 1) * 14.0,
+              height: 24,
+              child: Stack(
+                children: [
+                  for (var i = 0; i < avatarCount; i++)
+                    Positioned(
+                      left: i * 14.0,
+                      child: SmallAvatar(
+                        pubkey: visibleEntries[i].pubkey,
+                        userCache: userCache,
+                        size: 24,
+                      ),
+                    ),
+                ],
+              ),
+            ),
+            const SizedBox(width: Grid.xxs),
+            Flexible(
+              child: Text(
+                text,
+                style: context.textTheme.labelSmall?.copyWith(
+                  color: context.colors.primary,
+                  fontStyle: FontStyle.italic,
+                ),
+                overflow: TextOverflow.ellipsis,
+              ),
+            ),
+          ],
+        ),
+      ),
+    );
+  }
+}
diff --git a/mobile/lib/features/channels/channels_page.dart b/mobile/lib/features/channels/channels_page.dart
index 8be9660f12d..ba5d4ebf9dc 100644
--- a/mobile/lib/features/channels/channels_page.dart
+++ b/mobile/lib/features/channels/channels_page.dart
@@ -1,6 +1,6 @@
 import 'dart:async';
 import 'dart:io';
-import 'dart:math' show pi;
+import 'dart:math' show max, min, pi;
 import 'dart:ui';
 
 import 'package:flutter/material.dart';
@@ -14,8 +14,11 @@ import '../../shared/community/community_icon_provider.dart';
 import '../../shared/relay/relay.dart';
 import '../../shared/theme/theme.dart';
 import '../../shared/widgets/avatar_image.dart';
+import '../../shared/widgets/anchored_popover_menu.dart';
+import '../../shared/widgets/buzz_loading_indicator.dart';
 import '../../shared/widgets/frosted_app_bar.dart';
 import '../../shared/widgets/frosted_scaffold.dart';
+import '../../shared/widgets/skeleton.dart';
 import '../../shared/custom_emoji/custom_emoji.dart';
 import '../../shared/custom_emoji/custom_emoji_provider.dart';
 import '../../shared/custom_emoji/custom_emoji_render.dart';
@@ -46,15 +49,13 @@ part 'channels_page/sections.dart';
 part 'channels_page/channel_tile.dart';
 part 'channels_page/sheets.dart';
 part 'channels_page/badges.dart';
+part 'channels_page/skeleton.dart';
 part 'channels_page/community.dart';
 part 'channels_page/quick_actions.dart';
 part 'channels_page/quick_actions_launcher.dart';
 
 enum _QuickAction { createChannel, newDm }
 
-/// Height of the [_ConnectionBanner]: vertical padding (Grid.quarter + 2) × 2
-/// plus the ~16px row content (12px spinner / labelSmall text).
-const double _kBannerHeight = 24.0;
 const double _kChannelSectionInset = Grid.gutter;
 const double _kChannelLeadingWidth = 22.0;
 const double _kChannelIconSize = 18.0;
@@ -69,12 +70,17 @@ const double _kChannelLabelInset =
 /// sections while the labels stay on [_kChannelLabelInset].
 const double _kDmAvatarSize = _kChannelIconSize;
 
+const double _kTopSectionAvatarSize = 32.0;
+
 /// The top section's avatars are 32dp circles, which fill their box edge to
 /// edge; the channel rows below lead with an 18dp glyph left-aligned in a 22dp
 /// box at [_kChannelSectionInset]. Edge-aligning the two leaves the circles
 /// looking pushed outward, so the bar is pulled in to sit the avatar's centre
-/// on the channel-icon column (12 + 16 = 28dp against the glyph's ~29dp).
+/// on the channel-icon column (12 + 16 = 28dp against the glyph's ~29dp). Its
+/// label gap is derived separately so both labels land on the same 50dp column.
 const double _kTopSectionInset = Grid.twelve;
+const double _kTopSectionLabelGap =
+    _kChannelLabelInset - _kTopSectionInset - _kTopSectionAvatarSize;
 const Duration _kSectionExpandDuration = Duration(milliseconds: 220);
 const Duration _kSectionCollapseDuration = Duration(milliseconds: 170);
 const Curve _kSectionExpandCurve = Cubic(0.23, 1, 0.32, 1);
@@ -202,26 +208,26 @@ class ChannelsPage extends HookConsumerWidget {
       return timer.cancel;
     }, [canSurfaceError]);
 
-    // Match desktop's degraded-state debounce: cached content remains steady
-    // through brief socket flaps, and the banner appears only for a sustained
-    // reconnect.
-    final showConnectionBanner = useState(false);
+    // Keep cached content steady through brief socket flaps. A sustained
+    // reconnect swaps to element-shaped skeletons that match desktop.
+    final showConnectionSkeleton = useState(false);
     final isReconnectingWithContent =
         channels != null &&
         (sessionState.status == SessionStatus.connecting ||
             sessionState.status == SessionStatus.reconnecting);
     useEffect(() {
       if (!isReconnectingWithContent) {
-        showConnectionBanner.value = false;
+        showConnectionSkeleton.value = false;
         return null;
       }
       final timer = Timer(const Duration(seconds: 2), () {
-        showConnectionBanner.value = true;
+        showConnectionSkeleton.value = true;
       });
       return timer.cancel;
     }, [isReconnectingWithContent]);
 
     return FrostedScaffold(
+      backgroundColor: Colors.transparent,
       appBar: FrostedAppBar(
         horizontalInset: _kTopSectionInset,
         // Under a Buzz theme the community + account avatar strip carries the
@@ -252,7 +258,7 @@ class ChannelsPage extends HookConsumerWidget {
         channelsAsync: channelsAsync,
         showError: showError.value,
         sessionStatus: sessionState.status,
-        showConnectionBanner: showConnectionBanner.value,
+        showConnectionSkeleton: showConnectionSkeleton.value,
         currentPubkey: currentPubkey,
         onRefresh: () => ref.read(channelsProvider.notifier).refresh(),
         onSelectChannel: openChannel,
diff --git a/mobile/lib/features/channels/channels_page/badges.dart b/mobile/lib/features/channels/channels_page/badges.dart
index 9d697000c88..164d17171a4 100644
--- a/mobile/lib/features/channels/channels_page/badges.dart
+++ b/mobile/lib/features/channels/channels_page/badges.dart
@@ -73,52 +73,6 @@ class _EphemeralBadge extends StatelessWidget {
   }
 }
 
-class _ConnectionBanner extends StatelessWidget {
-  final SessionStatus status;
-
-  const _ConnectionBanner({required this.status});
-
-  @override
-  Widget build(BuildContext context) {
-    if (status == SessionStatus.connected ||
-        status == SessionStatus.disconnected) {
-      return const SizedBox.shrink();
-    }
-
-    final isConnecting = status == SessionStatus.connecting;
-    final message = isConnecting ? 'Connecting…' : 'Reconnecting…';
-
-    return Container(
-      width: double.infinity,
-      padding: const EdgeInsets.symmetric(
-        horizontal: Grid.gutter,
-        vertical: Grid.quarter + 2,
-      ),
-      color: context.colors.surfaceContainerHighest,
-      child: Row(
-        mainAxisAlignment: MainAxisAlignment.center,
-        children: [
-          SizedBox(
-            width: 12,
-            height: 12,
-            child: CircularProgressIndicator(
-              strokeWidth: 2,
-              color: context.colors.onSurfaceVariant,
-            ),
-          ),
-          const SizedBox(width: Grid.xxs),
-          Text(
-            message,
-            style: context.textTheme.labelSmall?.copyWith(
-              color: context.colors.onSurfaceVariant,
-            ),
-          ),
-        ],
-      ),
-    );
-  }
-}
-
 class _ErrorView extends StatelessWidget {
   final Object error;
   final VoidCallback onRetry;
diff --git a/mobile/lib/features/channels/channels_page/body.dart b/mobile/lib/features/channels/channels_page/body.dart
index 0639a13c268..9f0b1dd4a74 100644
--- a/mobile/lib/features/channels/channels_page/body.dart
+++ b/mobile/lib/features/channels/channels_page/body.dart
@@ -5,7 +5,7 @@ class _ChannelsBody extends StatelessWidget {
   final AsyncValue<List<Channel>> channelsAsync;
   final bool showError;
   final SessionStatus sessionStatus;
-  final bool showConnectionBanner;
+  final bool showConnectionSkeleton;
   final String? currentPubkey;
   final Future<void> Function() onRefresh;
   final Future<void> Function(Channel channel) onSelectChannel;
@@ -15,7 +15,7 @@ class _ChannelsBody extends StatelessWidget {
     required this.channelsAsync,
     required this.showError,
     required this.sessionStatus,
-    required this.showConnectionBanner,
+    required this.showConnectionSkeleton,
     required this.currentPubkey,
     required this.onRefresh,
     required this.onSelectChannel,
@@ -24,59 +24,40 @@ class _ChannelsBody extends StatelessWidget {
   @override
   Widget build(BuildContext context) {
     final barHeight = frostedAppBarHeight(context);
-
-    if (channels != null) {
-      return Stack(
-        children: [
-          RefreshIndicator(
+    final loadedChannels = channels;
+    final loading =
+        showConnectionSkeleton || (loadedChannels == null && !showError);
+    final content = showError && channelsAsync.hasError
+        ? Padding(
+            padding: EdgeInsets.only(top: barHeight),
+            child: _ErrorView(error: channelsAsync.error!, onRetry: onRefresh),
+          )
+        : loadedChannels == null
+        ? const SizedBox.shrink()
+        : RefreshIndicator(
             edgeOffset: barHeight,
             onRefresh: onRefresh,
             child: CustomScrollView(
               slivers: [
                 SliverToBoxAdapter(child: SizedBox(height: barHeight)),
-                // Extra space for the connection banner when visible.
-                if (showConnectionBanner)
-                  const SliverToBoxAdapter(
-                    child: SizedBox(height: _kBannerHeight),
-                  ),
                 _SliverChannelsList(
-                  channels: channels!,
+                  channels: loadedChannels,
                   currentPubkey: currentPubkey,
                   onSelectChannel: onSelectChannel,
                 ),
               ],
             ),
-          ),
-          Positioned(
-            top: barHeight,
-            left: 0,
-            right: 0,
-            child: showConnectionBanner
-                ? _ConnectionBanner(status: sessionStatus)
-                : const SizedBox.shrink(),
-          ),
-        ],
-      );
-    }
+          );
 
-    // The error view is gated on a grace timer in the parent — see the
-    // useEffect in ChannelsPage. While the grace window is in flight we fall
-    // through to the connection banner so transient relay-cancellation errors
-    // don't flash the error UI.
-    if (showError && channelsAsync.hasError) {
-      return Padding(
-        padding: EdgeInsets.only(top: barHeight),
-        child: _ErrorView(error: channelsAsync.error!, onRetry: onRefresh),
-      );
-    }
-
-    return Padding(
-      padding: EdgeInsets.only(top: barHeight),
-      child: _ConnectionBanner(
-        status: sessionStatus == SessionStatus.connected
-            ? SessionStatus.connecting
-            : sessionStatus,
+    return SkeletonReveal(
+      loading: loading,
+      shimmerEnabled: sessionStatus != SessionStatus.disconnected,
+      skeleton: _ChannelsSkeleton(
+        channels: loadedChannels,
+        topInset: barHeight,
+        status: sessionStatus,
       ),
+      content: content,
     );
   }
 }
@@ -208,7 +189,10 @@ class _SliverChannelsList extends HookConsumerWidget {
     }
 
     return SliverPadding(
-      padding: const EdgeInsets.only(top: Grid.xxs, bottom: 80),
+      padding: EdgeInsets.only(
+        top: Grid.xxs,
+        bottom: MediaQuery.paddingOf(context).bottom,
+      ),
       sliver: SliverList.list(
         children: [
           if (visibleChannels.isEmpty)
@@ -308,7 +292,11 @@ class _SliverChannelsList extends HookConsumerWidget {
                   if (ts != null) {
                     ref
                         .read(readStateProvider.notifier)
-                        .markContextRead(channel.id, ts);
+                        .markContextRead(
+                          channel.id,
+                          ts,
+                          clearForcedMessages: true,
+                        );
                     ref
                         .read(channelsProvider.notifier)
                         .clearObservedUnreadCoveredByRead(channel.id, ts);
diff --git a/mobile/lib/features/channels/channels_page/channel_tile.dart b/mobile/lib/features/channels/channels_page/channel_tile.dart
index fc3f340b9df..551e3f8dd69 100644
--- a/mobile/lib/features/channels/channels_page/channel_tile.dart
+++ b/mobile/lib/features/channels/channels_page/channel_tile.dart
@@ -66,7 +66,7 @@ class _ChannelTile extends ConsumerWidget {
                     ),
                     maxLines: 1,
                     overflow: TextOverflow.ellipsis,
-                    style: context.textTheme.bodyLarge?.copyWith(
+                    style: contentListTitleTextStyle.copyWith(
                       color: context.colors.onSurface,
                       fontWeight: isUnread ? FontWeight.w700 : FontWeight.w400,
                     ),
@@ -200,14 +200,21 @@ class _ChannelTile extends ConsumerWidget {
                         onMarkRead?.call();
                         ref
                             .read(readStateProvider.notifier)
-                            .markContextRead(channel.id, ts);
+                            .markContextRead(
+                              channel.id,
+                              ts,
+                              clearForcedMessages: true,
+                            );
                         ref
                             .read(channelsProvider.notifier)
                             .clearObservedUnreadCoveredByRead(channel.id, ts);
                       } else {
                         ref
                             .read(readStateProvider.notifier)
-                            .markContextUnread(channel.id);
+                            .markContextUnread(
+                              channel.id,
+                              channelId: channel.id,
+                            );
                       }
                     }
                   },
diff --git a/mobile/lib/features/channels/channels_page/community.dart b/mobile/lib/features/channels/channels_page/community.dart
index 8a67c32b21c..73935f46314 100644
--- a/mobile/lib/features/channels/channels_page/community.dart
+++ b/mobile/lib/features/channels/channels_page/community.dart
@@ -66,7 +66,12 @@ class _CommunitySwitcherSheet extends HookConsumerWidget {
             child: communitiesAsync.when(
               loading: () => const SizedBox(
                 height: 120,
-                child: Center(child: CircularProgressIndicator()),
+                child: Center(
+                  child: BuzzLoadingIndicator(
+                    size: 40,
+                    semanticLabel: 'Loading communities',
+                  ),
+                ),
               ),
               error: (e, _) => Padding(
                 padding: const EdgeInsets.all(Grid.xs),
@@ -475,7 +480,7 @@ class _CommunityIndicator extends ConsumerWidget {
         mainAxisSize: MainAxisSize.min,
         children: [
           _CommunityAvatar(name: name, relayUrl: activeCommunity?.relayUrl),
-          const SizedBox(width: Grid.xxs),
+          const SizedBox(width: _kTopSectionLabelGap),
           if (name != null)
             Flexible(
               child: Text(
@@ -511,7 +516,7 @@ class _CommunityAvatar extends ConsumerWidget {
     super.key,
     required this.name,
     this.relayUrl,
-    this.size = 32,
+    this.size = _kTopSectionAvatarSize,
   });
 
   @override
diff --git a/mobile/lib/features/channels/channels_page/sections.dart b/mobile/lib/features/channels/channels_page/sections.dart
index 394f68f6f7f..f9fe5453d78 100644
--- a/mobile/lib/features/channels/channels_page/sections.dart
+++ b/mobile/lib/features/channels/channels_page/sections.dart
@@ -152,56 +152,72 @@ class _CustomSectionHeader extends ConsumerWidget {
               ),
             ),
             const SizedBox(width: _kChannelLabelGap),
-            Text(
-              section.name,
-              style: context.textTheme.bodyLarge?.copyWith(
-                color: sectionColor,
-                fontWeight: FontWeight.w600,
+            Expanded(
+              child: Text(
+                section.name,
+                maxLines: 1,
+                overflow: TextOverflow.ellipsis,
+                style: contentListTitleTextStyle.copyWith(
+                  color: sectionColor,
+                  fontWeight: FontWeight.w600,
+                ),
               ),
             ),
-            const Spacer(),
-            GestureDetector(
-              onTapUp: (details) async {
-                final overlay =
-                    Overlay.of(context).context.findRenderObject()!
-                        as RenderBox;
-                final position = RelativeRect.fromRect(
-                  details.globalPosition & Size.zero,
-                  Offset.zero & overlay.size,
-                );
-                final value = await showMenu<String>(
-                  context: context,
-                  position: position,
-                  items: [
-                    const PopupMenuItem(value: 'rename', child: Text('Rename')),
-                    PopupMenuItem(
-                      value: 'move_up',
-                      enabled: !isFirst,
-                      child: const Text('Move Up'),
-                    ),
-                    PopupMenuItem(
-                      value: 'move_down',
-                      enabled: !isLast,
-                      child: const Text('Move Down'),
+            Builder(
+              builder: (buttonContext) => IconButton(
+                key: ValueKey('section-menu-${section.id}'),
+                tooltip: '${section.name} options',
+                visualDensity: VisualDensity.compact,
+                icon: Icon(
+                  LucideIcons.ellipsisVertical,
+                  size: _kChannelIconSize,
+                  color: sectionColor,
+                ),
+                onPressed: () async {
+                  final value = await showAnchoredPopover<String>(
+                    context: buttonContext,
+                    width: 216,
+                    alignment: AnchoredPopoverAlignment.end,
+                    color: context.colors.surface,
+                    elevation: 4,
+                    shadowColor: context.colors.shadow.withValues(alpha: 0.18),
+                    shape: RoundedRectangleBorder(
+                      borderRadius: BorderRadius.circular(Radii.md),
+                      side: BorderSide(color: context.colors.outline),
                     ),
-                    const PopupMenuItem(value: 'delete', child: Text('Delete')),
-                  ],
-                );
-                switch (value) {
-                  case 'rename':
-                    onRename();
-                  case 'move_up':
-                    onMoveUp();
-                  case 'move_down':
-                    onMoveDown();
-                  case 'delete':
-                    onDelete();
-                }
-              },
-              child: Icon(
-                LucideIcons.ellipsisVertical,
-                size: _kChannelIconSize,
-                color: sectionColor,
+                    surfaceKey: ValueKey('section-popover-${section.id}'),
+                    items: [
+                      const PopupMenuItem(
+                        value: 'rename',
+                        child: Text('Rename'),
+                      ),
+                      PopupMenuItem(
+                        value: 'move_up',
+                        enabled: !isFirst,
+                        child: const Text('Move Up'),
+                      ),
+                      PopupMenuItem(
+                        value: 'move_down',
+                        enabled: !isLast,
+                        child: const Text('Move Down'),
+                      ),
+                      const PopupMenuItem(
+                        value: 'delete',
+                        child: Text('Delete'),
+                      ),
+                    ],
+                  );
+                  switch (value) {
+                    case 'rename':
+                      onRename();
+                    case 'move_up':
+                      onMoveUp();
+                    case 'move_down':
+                      onMoveDown();
+                    case 'delete':
+                      onDelete();
+                  }
+                },
               ),
             ),
             const SizedBox(width: Grid.quarter),
@@ -318,7 +334,7 @@ class _ChannelSection extends StatelessWidget {
                   ),
                   child: Text(
                     emptyLabel,
-                    style: context.textTheme.bodySmall?.copyWith(
+                    style: contentListBodyTextStyle.copyWith(
                       color: context.colors.onSurfaceVariant,
                     ),
                   ),
@@ -430,7 +446,7 @@ class _SectionHeader extends StatelessWidget {
             const SizedBox(width: _kChannelLabelGap),
             Text(
               label,
-              style: context.textTheme.bodyLarge?.copyWith(
+              style: contentListTitleTextStyle.copyWith(
                 color: sectionColor,
                 fontWeight: FontWeight.w600,
               ),
diff --git a/mobile/lib/features/channels/channels_page/sheets.dart b/mobile/lib/features/channels/channels_page/sheets.dart
index 51aead28c77..2738be0aa90 100644
--- a/mobile/lib/features/channels/channels_page/sheets.dart
+++ b/mobile/lib/features/channels/channels_page/sheets.dart
@@ -642,10 +642,11 @@ class _NewDirectMessageSheet extends HookConsumerWidget {
                                               ),
                                               child: SizedBox.square(
                                                 dimension: 16,
-                                                child:
-                                                    CircularProgressIndicator(
-                                                      strokeWidth: 2,
-                                                    ),
+                                                child: BuzzLoadingIndicator(
+                                                  size: 16,
+                                                  semanticLabel:
+                                                      'Creating conversation',
+                                                ),
                                               ),
                                             )
                                           : null,
@@ -686,7 +687,12 @@ class _NewDirectMessageSheet extends HookConsumerWidget {
                       isSearchTransitionPending) {
                     return const SizedBox(
                       height: 280,
-                      child: Center(child: CircularProgressIndicator()),
+                      child: Center(
+                        child: BuzzLoadingIndicator(
+                          size: 44,
+                          semanticLabel: 'Loading people',
+                        ),
+                      ),
                     );
                   }
                   if (directoryAsync.hasError) {
diff --git a/mobile/lib/features/channels/channels_page/skeleton.dart b/mobile/lib/features/channels/channels_page/skeleton.dart
new file mode 100644
index 00000000000..75d3fc1a870
--- /dev/null
+++ b/mobile/lib/features/channels/channels_page/skeleton.dart
@@ -0,0 +1,136 @@
+part of '../channels_page.dart';
+
+class _ChannelsSkeleton extends StatelessWidget {
+  final List<Channel>? channels;
+  final double topInset;
+  final SessionStatus status;
+
+  const _ChannelsSkeleton({
+    required this.channels,
+    required this.topInset,
+    required this.status,
+  });
+
+  @override
+  Widget build(BuildContext context) {
+    final visibleChannels =
+        channels
+            ?.where((channel) => channel.isMember && !channel.isArchived)
+            .take(8)
+            .toList() ??
+        const <Channel>[];
+    final widths = visibleChannels
+        .map(
+          (channel) => min(
+            240,
+            max(
+              88,
+              24 +
+                  (resolveDmChannelDisplayLabel(
+                        channel,
+                        currentPubkey: null,
+                      ).length *
+                      8),
+            ),
+          ).toDouble(),
+        )
+        .toList();
+    const fallbackWidths = <double>[136, 184, 112, 160, 208, 128];
+    while (widths.length < 6) {
+      widths.add(fallbackWidths[widths.length % fallbackWidths.length]);
+    }
+    final splitAt = min(4, widths.length);
+    final firstSection = widths.take(splitAt).toList();
+    final secondSection = widths.skip(splitAt).toList();
+
+    final semanticsLabel = switch (status) {
+      SessionStatus.connecting => 'Connecting',
+      SessionStatus.reconnecting => 'Reconnecting',
+      SessionStatus.connected || SessionStatus.disconnected => 'Loading',
+    };
+    return Semantics(
+      key: const Key('channels-connection-skeleton'),
+      liveRegion: true,
+      label: semanticsLabel,
+      child: ExcludeSemantics(
+        child: ListView(
+          physics: const NeverScrollableScrollPhysics(),
+          padding: EdgeInsets.fromLTRB(
+            Grid.gutter,
+            topInset + Grid.twelve,
+            Grid.gutter,
+            80,
+          ),
+          children: [
+            _ChannelSkeletonSection(widths: firstSection),
+            const SizedBox(height: Grid.xs),
+            _ChannelSkeletonSection(widths: secondSection),
+          ],
+        ),
+      ),
+    );
+  }
+}
+
+class _ChannelSkeletonSection extends StatelessWidget {
+  final List<double> widths;
+
+  const _ChannelSkeletonSection({required this.widths});
+
+  @override
+  Widget build(BuildContext context) {
+    return Column(
+      children: [
+        const Padding(
+          padding: EdgeInsets.symmetric(vertical: Grid.half),
+          child: Row(
+            children: [
+              SizedBox(
+                width: _kChannelLeadingWidth,
+                child: Align(
+                  alignment: Alignment.centerLeft,
+                  child: SkeletonBar(width: 18, height: 18),
+                ),
+              ),
+              SizedBox(width: Grid.xxs),
+              SkeletonBar(
+                key: Key('channels-skeleton-section-label'),
+                width: 88,
+                height: 16,
+              ),
+            ],
+          ),
+        ),
+        for (var index = 0; index < widths.length; index++)
+          Padding(
+            padding: const EdgeInsets.symmetric(
+              vertical: _kChannelRowVerticalPadding,
+            ),
+            child: Row(
+              children: [
+                SizedBox(
+                  width: _kChannelLeadingWidth,
+                  child: Align(
+                    alignment: Alignment.centerLeft,
+                    child: SkeletonBar(
+                      width: _kChannelIconSize,
+                      height: _kChannelIconSize,
+                      borderRadius: BorderRadius.circular(
+                        index.isEven ? Radii.xs : Radii.full,
+                      ),
+                    ),
+                  ),
+                ),
+                const SizedBox(width: _kChannelLabelGap),
+                SkeletonBar(
+                  key: Key('channels-skeleton-row-label-$index'),
+                  width: widths[index],
+                  height: 16,
+                ),
+              ],
+            ),
+          ),
+      ],
+    );
+  }
+}
diff --git a/mobile/lib/features/channels/channels_provider.dart b/mobile/lib/features/channels/channels_provider.dart
index 74bbe640bd6..614ab054c35 100644
--- a/mobile/lib/features/channels/channels_provider.dart
+++ b/mobile/lib/features/channels/channels_provider.dart
@@ -12,6 +12,7 @@ import 'channel.dart';
 import 'channel_management_provider.dart' show channelDetailsProvider;
 import 'channel_mutes/channel_mutes_provider.dart';
 import 'read_state/read_state_provider.dart';
+import 'thread_follows/thread_follows_provider.dart';
 import 'unread_badge/is_high_priority_event.dart';
 import 'unread_badge/observed_unread_event.dart';
 import 'unread_badge/should_notify_for_event.dart';
@@ -545,6 +546,7 @@ class ChannelsNotifier extends AsyncNotifier<List<Channel>> {
           event,
           myPk,
           participatedRootIds: _participatedRootIds,
+          followedRootIds: _followedRootIds(),
           authoredRootIds: _authoredRootIds,
           mutedChannelIds: mutedChannelIds,
           channelId: channel.id,
@@ -585,6 +587,7 @@ class ChannelsNotifier extends AsyncNotifier<List<Channel>> {
             event,
             myPk,
             participatedRootIds: _participatedRootIds,
+            followedRootIds: _followedRootIds(),
             authoredRootIds: _authoredRootIds,
             mutedChannelIds: mutedChannelIds,
             channelId: channel.id,
@@ -609,6 +612,9 @@ class ChannelsNotifier extends AsyncNotifier<List<Channel>> {
       if (entry.value.muted) entry.key,
   };
 
+  Set<String> _followedRootIds() =>
+      ref.read(threadFollowsProvider).followedRootIds;
+
   void _loadThreadInterestStores(String pubkey) {
     final normalizedPubkey = pubkey.toLowerCase();
     if (_threadInterestPubkey == normalizedPubkey) return;
diff --git a/mobile/lib/features/channels/compose_bar.dart b/mobile/lib/features/channels/compose_bar.dart
index d0190f513a4..6c44285a4ef 100644
--- a/mobile/lib/features/channels/compose_bar.dart
+++ b/mobile/lib/features/channels/compose_bar.dart
@@ -1,10 +1,12 @@
 import 'dart:async';
 import 'dart:collection';
+import 'dart:math' as math;
 
 import 'package:camera/camera.dart' as camera;
 import 'package:flutter/foundation.dart';
 import 'package:flutter/material.dart';
 import 'package:flutter/physics.dart';
+import 'package:flutter/services.dart';
 import 'package:flutter_hooks/flutter_hooks.dart';
 import 'package:hooks_riverpod/hooks_riverpod.dart';
 import 'package:image_picker/image_picker.dart';
@@ -15,10 +17,12 @@ import 'package:nostr/nostr.dart' as nostr;
 import '../../shared/relay/relay.dart';
 import '../../shared/theme/theme.dart';
 import '../../shared/widgets/avatar_image.dart';
+import '../../shared/widgets/buzz_loading_indicator.dart';
 import '../profile/user_cache_provider.dart';
 import '../profile/user_profile.dart';
 import '../../shared/custom_emoji/custom_emoji.dart';
 import '../../shared/custom_emoji/custom_emoji_provider.dart';
+import '../activity/compose_drafts_provider.dart';
 import 'camera_capture_cleanup.dart';
 import 'channel.dart';
 import 'channel_management_provider.dart';
@@ -27,21 +31,21 @@ import 'emoji_picker.dart';
 import 'mentions/mention_candidates.dart';
 import 'mentions/mention_candidates_provider.dart';
 import 'mentions/mention_ranking.dart';
+import 'photo_library.dart';
 
 part 'compose_bar/helpers.dart';
 part 'compose_bar/markdown_editing_controller.dart';
 part 'compose_bar/suggestions.dart';
 part 'compose_bar/formatting_toolbar.dart';
 part 'compose_bar/attachments.dart';
+part 'compose_bar/photo_gallery_picker.dart';
+part 'compose_bar/ios_photo_picker.dart';
+part 'compose_bar/ios_attachment_popover.dart';
 part 'compose_bar/camera_preview.dart';
 part 'compose_bar/send_button.dart';
+part 'compose_bar/layout.dart';
 
-const _pastedImageMimeTypes = <String>[
-  'image/jpeg',
-  'image/jpg',
-  'image/png',
-  'image/webp',
-];
+const _maxConcurrentImageUploads = 3;
 
 /// Rich compose bar with @mention autocomplete and a markdown formatting
 /// toolbar. Used in both channel and thread views — the caller provides an
@@ -77,10 +81,57 @@ class ComposeBar extends HookConsumerWidget {
   Widget build(BuildContext context, WidgetRef ref) {
     final controller = useMemoized(_MarkdownEditingController.new);
     useEffect(() => controller.dispose, [controller]);
+
+    // Restore and persist unsent text as a local draft so the Activity
+    // inbox Drafts filter reflects real composer state.
+    //
+    // The effect is additionally keyed on the active relay + pubkey identity:
+    // provider-level namespacing alone cannot protect a composer that stays
+    // mounted through an in-place community/account switch — the controller
+    // would retain the old identity's text and the next edit would persist it
+    // into the new identity's store. On identity change we replace the
+    // controller content with the new identity's own saved draft (or clear).
+    final draftKey = composeDraftKey(channelId, threadHeadId: threadHeadId);
+    final draftIdentity =
+        '${ref.watch(relayConfigProvider).baseUrl}'
+        ':${ref.watch(myPubkeyProvider) ?? 'anon'}';
+    final lastDraftIdentity = useRef<String?>(null);
+    useEffect(() {
+      final identityChanged =
+          lastDraftIdentity.value != null &&
+          lastDraftIdentity.value != draftIdentity;
+      lastDraftIdentity.value = draftIdentity;
+      final saved = ref.read(composeDraftsProvider.notifier).textFor(draftKey);
+      if (identityChanged) {
+        controller.text = saved ?? '';
+      } else if (saved != null && controller.text.isEmpty) {
+        controller.text = saved;
+      }
+      void persistDraft() {
+        ref
+            .read(composeDraftsProvider.notifier)
+            .save(
+              key: draftKey,
+              channelId: channelId,
+              threadHeadId: threadHeadId,
+              text: controller.text,
+            );
+      }
+
+      controller.addListener(persistDraft);
+      return () => controller.removeListener(persistDraft);
+    }, [controller, draftKey, draftIdentity]);
     final focusNode = useFocusNode();
     final isComposerExpanded = useState(false);
-    final showAttachments = useState(false);
-    final showCamera = useState(false);
+    final attachmentSurface = useState(_AttachmentSurface.closed);
+    final iosAttachmentPopover = useMemoized(
+      _IOSAttachmentPopoverController.new,
+    );
+    useEffect(
+      () =>
+          () => unawaited(iosAttachmentPopover.dispose()),
+      [iosAttachmentPopover],
+    );
     final isSending = useState(false);
     final showFormatting = useState(false);
     final attachments = useState<List<BlobDescriptor>>([]);
@@ -348,8 +399,7 @@ class ComposeBar extends HookConsumerWidget {
       mentionMap.value.clear();
       mentionQuery.value = null;
       channelQuery.value = null;
-      showAttachments.value = false;
-      showCamera.value = false;
+      attachmentSurface.value = _AttachmentSurface.closed;
       showFormatting.value = false;
       uploadError.value = null;
       focusNode.requestFocus();
@@ -492,6 +542,80 @@ class ComposeBar extends HookConsumerWidget {
       }
     }
 
+    Future<void> pickThenUpload({
+      required Future<XFile?> Function() pick,
+      required Future<BlobDescriptor> Function(XFile file) upload,
+    }) async {
+      uploadError.value = null;
+      try {
+        final picked = await pick();
+        if (picked == null || !context.mounted) return;
+        await pickAndUpload(() => upload(picked));
+      } catch (error) {
+        if (context.mounted) {
+          uploadError.value = _formatUploadError(error);
+        }
+      }
+    }
+
+    Future<void> uploadImages(List<XFile> images) async {
+      if (images.isEmpty) return;
+      uploadError.value = null;
+      uploadingCount.value += images.length;
+      try {
+        Future<({BlobDescriptor? uploaded, Object? error})> uploadImage(
+          XFile image,
+        ) async {
+          try {
+            final uploaded = await ref
+                .read(mediaUploadServiceProvider)
+                .uploadImage(image);
+            return (uploaded: uploaded, error: null);
+          } catch (error) {
+            return (uploaded: null, error: error);
+          }
+        }
+
+        final results = <({BlobDescriptor? uploaded, Object? error})>[];
+        for (
+          var start = 0;
+          start < images.length;
+          start += _maxConcurrentImageUploads
+        ) {
+          final end = math.min(
+            start + _maxConcurrentImageUploads,
+            images.length,
+          );
+          results.addAll(
+            await Future.wait([
+              for (final image in images.sublist(start, end))
+                uploadImage(image),
+            ]),
+          );
+        }
+        if (!context.mounted) return;
+
+        final uploaded = [for (final result in results) ?result.uploaded];
+        if (uploaded.isNotEmpty) {
+          attachments.value = [...attachments.value, ...uploaded];
+        }
+        final firstError = results
+            .map((result) => result.error)
+            .whereType<Object>()
+            .firstOrNull;
+        if (firstError != null) {
+          uploadError.value = _formatUploadError(firstError);
+        }
+      } finally {
+        if (context.mounted) {
+          uploadingCount.value = math.max(
+            0,
+            uploadingCount.value - images.length,
+          );
+        }
+      }
+    }
+
     Widget buildContextMenu(
       BuildContext context,
       EditableTextState editableTextState,
@@ -580,31 +704,90 @@ class ComposeBar extends HookConsumerWidget {
 
     // ----- Widget tree ----------------------------------------------------
 
-    void chooseAttachment(Future<BlobDescriptor?> Function() pick) {
-      showAttachments.value = false;
-      showCamera.value = false;
-      pickAndUpload(pick);
+    void chooseAttachment(
+      Future<void> Function() choose, {
+      String? errorMessage,
+    }) {
+      attachmentSurface.value = _AttachmentSurface.closed;
+      unawaited(() async {
+        try {
+          await choose();
+        } catch (error) {
+          if (context.mounted) {
+            uploadError.value = errorMessage ?? _formatUploadError(error);
+          }
+        }
+      }());
     }
 
     void toggleAttachments() {
-      if (showCamera.value) {
-        showCamera.value = false;
-        showAttachments.value = false;
+      attachmentSurface.value = switch (attachmentSurface.value) {
+        _AttachmentSurface.closed => _AttachmentSurface.menu,
+        _AttachmentSurface.menu => _AttachmentSurface.closed,
+        _AttachmentSurface.camera ||
+        _AttachmentSurface.photos => _AttachmentSurface.menu,
+      };
+    }
+
+    void handleAttachmentTap(BuildContext triggerContext) {
+      if (defaultTargetPlatform != TargetPlatform.iOS ||
+          attachmentSurface.value != _AttachmentSurface.closed) {
+        toggleAttachments();
         return;
       }
-      showCamera.value = false;
-      showAttachments.value = !showAttachments.value;
+
+      unawaited(
+        iosAttachmentPopover
+            .present(
+              sourceContext: triggerContext,
+              onCapture: (image) => pickAndUpload(
+                () => ref.read(mediaUploadServiceProvider).uploadImage(image),
+              ),
+              onChoosePhotos: uploadImages,
+              onAllPhotos: () => chooseAttachment(() async {
+                final photos = await ref
+                    .read(mediaUploadServiceProvider)
+                    .pickGalleryImages();
+                await uploadImages(photos);
+              }, errorMessage: 'Unable to open your photo library.'),
+              onVideo: () => chooseAttachment(() {
+                final service = ref.read(mediaUploadServiceProvider);
+                return pickThenUpload(
+                  pick: service.pickGalleryVideo,
+                  upload: service.uploadVideo,
+                );
+              }),
+              onFiles: () => chooseAttachment(() {
+                final service = ref.read(mediaUploadServiceProvider);
+                return pickThenUpload(
+                  pick: service.pickAttachmentFile,
+                  upload: service.uploadFile,
+                );
+              }),
+            )
+            .then((didPresent) {
+              if (!didPresent && context.mounted) {
+                focusNode.unfocus();
+                toggleAttachments();
+              }
+            }),
+      );
     }
 
     void openCamera() {
       focusNode.unfocus();
-      showAttachments.value = false;
-      showCamera.value = true;
+      attachmentSurface.value = _AttachmentSurface.camera;
     }
 
     final motionDuration = reducedMotion
         ? Duration.zero
-        : const Duration(milliseconds: 180);
+        : Duration(
+            milliseconds:
+                attachmentSurface.value == _AttachmentSurface.camera ||
+                    attachmentSurface.value == _AttachmentSurface.photos
+                ? 320
+                : 250,
+          );
     final suggestionOverlayController = useMemoized(
       OverlayPortalController.new,
     );
@@ -618,8 +801,7 @@ class ComposeBar extends HookConsumerWidget {
 
     void expandComposer() {
       if (isComposerExpanded.value) return;
-      showAttachments.value = false;
-      showCamera.value = false;
+      attachmentSurface.value = _AttachmentSurface.closed;
       isComposerExpanded.value = true;
       WidgetsBinding.instance.addPostFrameCallback((_) {
         if (context.mounted) focusNode.requestFocus();
@@ -646,40 +828,48 @@ class ComposeBar extends HookConsumerWidget {
             ),
           )
         : const SizedBox.shrink(key: ValueKey('no-suggestions'));
-    final overlayPanel = showCamera.value
-        ? KeyedSubtree(
-            key: const ValueKey('camera-preview'),
-            child: _InlineCameraPreview(
-              onClose: () => showCamera.value = false,
-              onCapture: (image) async {
-                showCamera.value = false;
-                await pickAndUpload(
-                  () => ref.read(mediaUploadServiceProvider).uploadImage(image),
-                );
-              },
-            ),
-          )
-        : showAttachments.value
-        ? KeyedSubtree(
-            key: const ValueKey('attachment-menu'),
-            child: Align(
-              alignment: Alignment.bottomLeft,
-              heightFactor: 1,
-              child: _AttachmentMenu(
-                onCamera: openCamera,
-                onPhotos: () => chooseAttachment(
-                  ref.read(mediaUploadServiceProvider).pickAndUploadImage,
-                ),
-                onVideo: () => chooseAttachment(
-                  ref.read(mediaUploadServiceProvider).pickAndUploadVideo,
-                ),
-                onFiles: () => chooseAttachment(
-                  ref.read(mediaUploadServiceProvider).pickAndUploadFile,
-                ),
-              ),
-            ),
-          )
-        : suggestionPanel;
+    Widget buildOverlayPanel(_AttachmentSurface surface) {
+      return _AttachmentSurfacePanel(
+        key: ValueKey(
+          surface == _AttachmentSurface.closed
+              ? 'composer-suggestions'
+              : 'attachment-surface',
+        ),
+        surface: surface,
+        suggestionPanel: suggestionPanel,
+        onBack: () => attachmentSurface.value = _AttachmentSurface.menu,
+        onCamera: openCamera,
+        onPhotos: () {
+          focusNode.unfocus();
+          attachmentSurface.value = _AttachmentSurface.photos;
+        },
+        onVideo: () => chooseAttachment(() {
+          final service = ref.read(mediaUploadServiceProvider);
+          return pickThenUpload(
+            pick: service.pickGalleryVideo,
+            upload: service.uploadVideo,
+          );
+        }),
+        onFiles: () => chooseAttachment(() {
+          final service = ref.read(mediaUploadServiceProvider);
+          return pickThenUpload(
+            pick: service.pickAttachmentFile,
+            upload: service.uploadFile,
+          );
+        }),
+        onCapture: (image) async {
+          attachmentSurface.value = _AttachmentSurface.closed;
+          await pickAndUpload(
+            () => ref.read(mediaUploadServiceProvider).uploadImage(image),
+          );
+        },
+        onPickAllPhotos: ref.read(mediaUploadServiceProvider).pickGalleryImages,
+        onChoosePhotos: (photos) async {
+          attachmentSurface.value = _AttachmentSurface.closed;
+          await uploadImages(photos);
+        },
+      );
+    }
 
     // Suggestions and attachments live in the overlay so showing them cannot
     // reflow the composer. Both stay anchored just above the capsule.
@@ -696,233 +886,91 @@ class ComposeBar extends HookConsumerWidget {
             layoutInfo.childPaintTransform,
             Offset.zero,
           );
-          return Positioned(
-            left: composerOrigin.dx,
-            bottom: layoutInfo.overlaySize.height - composerOrigin.dy,
-            width: layoutInfo.childSize.width,
-            child: ClipRect(
-              child: Padding(
-                padding: const EdgeInsets.only(bottom: Grid.xxs),
-                child: _SuggestionPanelMotion(
-                  duration: motionDuration,
-                  child: overlayPanel,
+          return ValueListenableBuilder<_AttachmentSurface>(
+            valueListenable: attachmentSurface,
+            builder: (context, surface, _) {
+              final surfaceDuration = reducedMotion
+                  ? Duration.zero
+                  : Duration(
+                      milliseconds:
+                          surface == _AttachmentSurface.camera ||
+                              surface == _AttachmentSurface.photos
+                          ? 320
+                          : 250,
+                    );
+              final expandedSurfaceCoversComposer =
+                  surface == _AttachmentSurface.camera ||
+                  surface == _AttachmentSurface.photos;
+              final overlayAnchorY =
+                  composerOrigin.dy +
+                  (expandedSurfaceCoversComposer
+                      ? layoutInfo.childSize.height + Grid.twelve
+                      : 0);
+              return AnimatedPositioned(
+                duration: surfaceDuration,
+                curve:
+                    surface == _AttachmentSurface.camera ||
+                        surface == _AttachmentSurface.photos
+                    ? const Cubic(0.34, 1.25, 0.64, 1)
+                    : const Cubic(0.22, 1, 0.36, 1),
+                left: composerOrigin.dx,
+                bottom: layoutInfo.overlaySize.height - overlayAnchorY,
+                width: layoutInfo.childSize.width,
+                child: ClipRect(
+                  child: Padding(
+                    padding: const EdgeInsets.only(bottom: Grid.xxs),
+                    child: surface == _AttachmentSurface.closed
+                        ? _SuggestionPanelMotion(
+                            duration: surfaceDuration,
+                            alignment: Alignment.bottomLeft,
+                            child: buildOverlayPanel(surface),
+                          )
+                        : buildOverlayPanel(surface),
+                  ),
                 ),
-              ),
-            ),
+              );
+            },
           );
         },
-        child: Container(
-          decoration: BoxDecoration(
-            color: context.colors.surfaceContainerHighest,
-            borderRadius: BorderRadius.circular(Radii.dialog),
-            border: Border.all(
-              color: Colors.black.withValues(alpha: 0.04),
-              width: 1,
-            ),
-          ),
-          padding: const EdgeInsets.all(Grid.xxs),
-          child: Column(
-            mainAxisSize: MainAxisSize.min,
-            children: [
-              if (hasAttachments || hasPendingUploads) ...[
-                _AttachmentStrip(
-                  attachments: attachments.value,
-                  uploadingCount: uploadingCount.value,
-                  onRemove: removeAttachment,
-                ),
-                const SizedBox(height: Grid.xxs),
-              ],
-
-              if (uploadError.value case final error?) ...[
-                Align(
-                  alignment: Alignment.centerLeft,
-                  child: Text(
-                    error,
-                    style: context.textTheme.bodySmall?.copyWith(
-                      color: context.colors.error,
-                    ),
-                  ),
-                ),
-                const SizedBox(height: Grid.xxs),
-              ],
-
-              // Keep the default state out of the focus system entirely so
-              // restored native focus cannot expand a newly opened channel.
-              if (isComposerExpanded.value)
-                TextField(
-                  controller: controller,
-                  focusNode: focusNode,
-                  textInputAction: TextInputAction.send,
-                  contextMenuBuilder: buildContextMenu,
-                  contentInsertionConfiguration: ContentInsertionConfiguration(
-                    allowedMimeTypes: _pastedImageMimeTypes,
-                    onContentInserted: uploadPastedImage,
-                  ),
-                  onSubmitted: (_) => send(),
-                  minLines: 1,
-                  maxLines: 5,
-                  style: context.textTheme.bodyLarge,
-                  decoration: InputDecoration(
-                    hintText: resolvedHint,
-                    hintStyle: context.textTheme.bodyLarge?.copyWith(
-                      color: context.colors.onSurfaceVariant,
-                    ),
-                    border: InputBorder.none,
-                    enabledBorder: InputBorder.none,
-                    focusedBorder: InputBorder.none,
-                    contentPadding: const EdgeInsets.symmetric(
-                      horizontal: Grid.half,
-                      vertical: Grid.half,
-                    ),
-                    isDense: true,
-                  ),
-                )
-              else
-                Row(
-                  children: [
-                    _AttachmentTrigger(
-                      open: showAttachments.value || showCamera.value,
-                      onTap: toggleAttachments,
-                    ),
-                    const SizedBox(width: Grid.xxs),
-                    Expanded(
-                      child: Semantics(
-                        button: true,
-                        label: resolvedHint,
-                        child: GestureDetector(
-                          behavior: HitTestBehavior.opaque,
-                          onTap: expandComposer,
-                          child: Padding(
-                            padding: const EdgeInsets.symmetric(
-                              vertical: Grid.half,
-                            ),
-                            child: Align(
-                              alignment: Alignment.centerLeft,
-                              child: Text(
-                                resolvedHint,
-                                style: context.textTheme.bodyLarge?.copyWith(
-                                  color: context.colors.onSurfaceVariant,
-                                ),
-                              ),
-                            ),
-                          ),
-                        ),
-                      ),
-                    ),
-                  ],
-                ),
-
-              ClipRect(
-                child: Align(
-                  alignment: Alignment.topCenter,
-                  heightFactor: composerExpansionValue,
-                  child: IgnorePointer(
-                    ignoring: composerExpansionValue < 0.98,
-                    child: Opacity(
-                      opacity: composerExpansionProgress,
-                      child: Transform.translate(
-                        offset: Offset(
-                          0,
-                          Grid.xxs * (1 - composerExpansionProgress),
-                        ),
-                        child: Column(
-                          children: [
-                            const SizedBox(height: Grid.xxs),
-                            Row(
-                              children: [
-                                _AttachmentTrigger(
-                                  open:
-                                      showAttachments.value ||
-                                      showCamera.value ||
-                                      showFormatting.value,
-                                  onTap: () {
-                                    if (showFormatting.value) {
-                                      showFormatting.value = false;
-                                    } else {
-                                      toggleAttachments();
-                                    }
-                                  },
-                                ),
-                                const SizedBox(width: Grid.half),
-                                Expanded(
-                                  child: AnimatedSwitcher(
-                                    duration: motionDuration,
-                                    switchInCurve: Curves.easeOutCubic,
-                                    switchOutCurve: Curves.easeInCubic,
-                                    layoutBuilder:
-                                        (currentChild, previousChildren) =>
-                                            Stack(
-                                              alignment: Alignment.centerLeft,
-                                              children: [
-                                                ...previousChildren,
-                                                ?currentChild,
-                                              ],
-                                            ),
-                                    child: showFormatting.value
-                                        ? _FormattingToolbar(
-                                            onFormat: applyFormat,
-                                          )
-                                        : Row(
-                                            key: const ValueKey(
-                                              'standard-actions',
-                                            ),
-                                            children: [
-                                              _ComposeAction(
-                                                icon: LucideIcons.atSign,
-                                                onTap: () {
-                                                  showAttachments.value = false;
-                                                  showCamera.value = false;
-                                                  triggerMention();
-                                                },
-                                              ),
-                                              _ComposeAction(
-                                                icon: LucideIcons.hash,
-                                                onTap: () {
-                                                  showAttachments.value = false;
-                                                  showCamera.value = false;
-                                                  triggerChannel();
-                                                },
-                                              ),
-                                              _ComposeAction(
-                                                icon: LucideIcons.smilePlus,
-                                                onTap: () {
-                                                  showAttachments.value = false;
-                                                  showCamera.value = false;
-                                                  showEmojiPicker(
-                                                    context: context,
-                                                    onSelect: insertEmoji,
-                                                  );
-                                                },
-                                              ),
-                                              _ComposeAction(
-                                                icon: LucideIcons.aLargeSmall,
-                                                onTap: () {
-                                                  showAttachments.value = false;
-                                                  showCamera.value = false;
-                                                  showFormatting.value = true;
-                                                },
-                                              ),
-                                              const Spacer(),
-                                              _SendButton(
-                                                isDisabled: hasPendingUploads,
-                                                isSending: isSending.value,
-                                                onTap: send,
-                                              ),
-                                            ],
-                                          ),
-                                  ),
-                                ),
-                              ],
-                            ),
-                          ],
-                        ),
-                      ),
-                    ),
-                  ),
-                ),
-              ),
-            ],
-          ),
+        child: _ComposeBarLayout(
+          attachments: attachments.value,
+          uploadingCount: uploadingCount.value,
+          onRemoveAttachment: removeAttachment,
+          uploadError: uploadError.value,
+          isExpanded: isComposerExpanded.value,
+          controller: controller,
+          focusNode: focusNode,
+          contextMenuBuilder: buildContextMenu,
+          onContentInserted: uploadPastedImage,
+          onSend: () => unawaited(send()),
+          resolvedHint: resolvedHint,
+          attachmentSurface: attachmentSurface.value,
+          onAttachmentTap: handleAttachmentTap,
+          onExpand: expandComposer,
+          expansionValue: composerExpansionValue,
+          expansionProgress: composerExpansionProgress,
+          formattingOpen: showFormatting.value,
+          onCloseFormatting: () => showFormatting.value = false,
+          motionDuration: motionDuration,
+          onFormat: applyFormat,
+          onMention: () {
+            attachmentSurface.value = _AttachmentSurface.closed;
+            triggerMention();
+          },
+          onChannel: () {
+            attachmentSurface.value = _AttachmentSurface.closed;
+            triggerChannel();
+          },
+          onEmoji: () {
+            attachmentSurface.value = _AttachmentSurface.closed;
+            showEmojiPicker(context: context, onSelect: insertEmoji);
+          },
+          onOpenFormatting: () {
+            attachmentSurface.value = _AttachmentSurface.closed;
+            showFormatting.value = true;
+          },
+          hasPendingUploads: hasPendingUploads,
+          isSending: isSending.value,
         ),
       ),
     );
diff --git a/mobile/lib/features/channels/compose_bar/attachments.dart b/mobile/lib/features/channels/compose_bar/attachments.dart
index 1d342cd15cc..7c53ae10982 100644
--- a/mobile/lib/features/channels/compose_bar/attachments.dart
+++ b/mobile/lib/features/channels/compose_bar/attachments.dart
@@ -1,5 +1,254 @@
 part of '../compose_bar.dart';
 
+enum _AttachmentSurface { closed, menu, camera, photos }
+
+const _attachmentMenuWidth = 216.0;
+const _attachmentMenuPadding = Grid.xs;
+const _attachmentMenuItemHeight = 52.0;
+const _attachmentMenuItemSpacing = Grid.xxs;
+const _attachmentMenuIconSize = 24.0;
+const _attachmentMenuIconSlotWidth = 28.0;
+const _attachmentExpandedHeight = 372.0;
+
+@immutable
+class _AttachmentMenuLayout {
+  final double itemHeight;
+  final double contentHeight;
+  final double height;
+
+  const _AttachmentMenuLayout({
+    required this.itemHeight,
+    required this.contentHeight,
+    required this.height,
+  });
+
+  factory _AttachmentMenuLayout.from(BuildContext context) {
+    final textPainter = TextPainter(
+      text: TextSpan(text: 'Camera', style: context.textTheme.titleMedium),
+      textDirection: Directionality.of(context),
+      textScaler: MediaQuery.textScalerOf(context),
+      maxLines: 1,
+    )..layout();
+    final itemHeight = math.max(
+      _attachmentMenuItemHeight,
+      textPainter.height + (Grid.xxs * 2),
+    );
+    textPainter.dispose();
+    final contentHeight =
+        (_attachmentMenuPadding * 2) +
+        (itemHeight * 4) +
+        (_attachmentMenuItemSpacing * 3);
+
+    return _AttachmentMenuLayout(
+      itemHeight: itemHeight,
+      contentHeight: contentHeight,
+      height: math.min(contentHeight, _attachmentExpandedHeight),
+    );
+  }
+
+  bool get isScrollable => contentHeight > height;
+}
+
+class _AttachmentSurfacePanel extends HookWidget {
+  final _AttachmentSurface surface;
+  final Widget suggestionPanel;
+  final VoidCallback onBack;
+  final VoidCallback onCamera;
+  final VoidCallback onPhotos;
+  final VoidCallback onVideo;
+  final VoidCallback onFiles;
+  final Future<void> Function(XFile image) onCapture;
+  final Future<List<XFile>> Function() onPickAllPhotos;
+  final Future<void> Function(List<XFile> photos) onChoosePhotos;
+
+  const _AttachmentSurfacePanel({
+    super.key,
+    required this.surface,
+    required this.suggestionPanel,
+    required this.onBack,
+    required this.onCamera,
+    required this.onPhotos,
+    required this.onVideo,
+    required this.onFiles,
+    required this.onCapture,
+    required this.onPickAllPhotos,
+    required this.onChoosePhotos,
+  });
+
+  @override
+  Widget build(BuildContext context) {
+    if (surface == _AttachmentSurface.closed) return suggestionPanel;
+
+    final menuLayout = _AttachmentMenuLayout.from(context);
+    final reducedMotion = MediaQuery.disableAnimationsOf(context);
+    final isExpanded =
+        surface == _AttachmentSurface.camera ||
+        surface == _AttachmentSurface.photos;
+    final morphController = useAnimationController(
+      initialValue: isExpanded ? 1 : 0,
+      duration: reducedMotion
+          ? Duration.zero
+          : const Duration(milliseconds: 320),
+      reverseDuration: reducedMotion
+          ? Duration.zero
+          : const Duration(milliseconds: 250),
+    );
+    final rawProgress = useAnimation(morphController);
+    final renderedExpandedSurface = useState<_AttachmentSurface?>(
+      isExpanded ? surface : null,
+    );
+    final latestSurface = useRef(surface);
+    latestSurface.value = surface;
+
+    useEffect(() {
+      void disposeCollapsedContent(AnimationStatus status) {
+        if (status == AnimationStatus.dismissed &&
+            latestSurface.value == _AttachmentSurface.menu) {
+          renderedExpandedSurface.value = null;
+        }
+      }
+
+      morphController.addStatusListener(disposeCollapsedContent);
+      return () =>
+          morphController.removeStatusListener(disposeCollapsedContent);
+    }, [morphController]);
+
+    useEffect(() {
+      if (isExpanded) {
+        renderedExpandedSurface.value = surface;
+        morphController.forward();
+      } else {
+        morphController.reverse();
+      }
+      return null;
+    }, [isExpanded, morphController, surface]);
+
+    final visibleExpandedSurface =
+        renderedExpandedSurface.value ?? (isExpanded ? surface : null);
+    final cameraInitializationReady =
+        reducedMotion ||
+        (surface == _AttachmentSurface.camera && rawProgress >= 1);
+    final expandedContent = switch (visibleExpandedSurface) {
+      _AttachmentSurface.camera => KeyedSubtree(
+        key: const ValueKey('camera-preview'),
+        child: KeyedSubtree(
+          key: ValueKey(
+            cameraInitializationReady
+                ? 'camera-initialization-ready'
+                : 'camera-initialization-deferred',
+          ),
+          child: _InlineCameraPreview(
+            initializeCamera: cameraInitializationReady,
+            onClose: onBack,
+            onCapture: onCapture,
+          ),
+        ),
+      ),
+      _AttachmentSurface.photos => KeyedSubtree(
+        key: const ValueKey('photo-gallery'),
+        child: _PhotoGalleryPicker(
+          onBack: onBack,
+          onPickAllPhotos: onPickAllPhotos,
+          onChoosePhotos: onChoosePhotos,
+        ),
+      ),
+      _AttachmentSurface.closed ||
+      _AttachmentSurface.menu ||
+      null => const SizedBox.shrink(),
+    };
+
+    double interval(double value, double begin, double end) {
+      return ((value - begin) / (end - begin)).clamp(0.0, 1.0);
+    }
+
+    final menuOpacity = 1 - interval(rawProgress, 0.12, 0.38);
+    final expandedOpacity = interval(rawProgress, 0.28, 0.65);
+    final sizeProgress = morphController.status == AnimationStatus.reverse
+        ? const Cubic(0.22, 1, 0.36, 1).transform(rawProgress)
+        : Curves.easeInOutCubic.transform(rawProgress);
+
+    return LayoutBuilder(
+      builder: (context, constraints) {
+        final expandedWidth = constraints.maxWidth;
+        const expandedHeight = _attachmentExpandedHeight;
+        final width =
+            _attachmentMenuWidth +
+            ((expandedWidth - _attachmentMenuWidth) * sizeProgress);
+        final height =
+            menuLayout.height +
+            ((expandedHeight - menuLayout.height) * sizeProgress);
+        final baseColor = context.colors.surfaceContainerHighest;
+        final expandedColor =
+            visibleExpandedSurface == _AttachmentSurface.camera
+            ? Colors.black
+            : baseColor;
+
+        return Align(
+          alignment: Alignment.topLeft,
+          heightFactor: 1,
+          child: SizedBox(
+            width: width,
+            height: height,
+            child: DecoratedBox(
+              decoration: BoxDecoration(
+                color: Color.lerp(baseColor, expandedColor, sizeProgress),
+                borderRadius: BorderRadius.circular(Radii.dialog),
+                border: Border.all(
+                  color: Colors.black.withValues(alpha: 0.04),
+                  width: 1,
+                ),
+              ),
+              child: ClipRRect(
+                borderRadius: BorderRadius.circular(Radii.dialog),
+                child: Material(
+                  type: MaterialType.transparency,
+                  child: Stack(
+                    clipBehavior: Clip.hardEdge,
+                    children: [
+                      Positioned(
+                        left: 0,
+                        top: 0,
+                        width: _attachmentMenuWidth,
+                        height: menuLayout.height,
+                        child: IgnorePointer(
+                          ignoring: surface != _AttachmentSurface.menu,
+                          child: Opacity(
+                            opacity: menuOpacity,
+                            child: _AttachmentMenu(
+                              layout: menuLayout,
+                              onCamera: onCamera,
+                              onPhotos: onPhotos,
+                              onVideo: onVideo,
+                              onFiles: onFiles,
+                            ),
+                          ),
+                        ),
+                      ),
+                      Positioned(
+                        left: 0,
+                        top: 0,
+                        width: expandedWidth,
+                        height: expandedHeight,
+                        child: IgnorePointer(
+                          ignoring: !isExpanded,
+                          child: Opacity(
+                            opacity: expandedOpacity,
+                            child: expandedContent,
+                          ),
+                        ),
+                      ),
+                    ],
+                  ),
+                ),
+              ),
+            ),
+          ),
+        );
+      },
+    );
+  }
+}
+
 @immutable
 class _ComposeDraftPayload {
   final String content;
@@ -24,16 +273,21 @@ class _ComposeDraftPayload {
 }
 
 class _AttachmentTrigger extends StatelessWidget {
-  final bool open;
-  final VoidCallback onTap;
+  final _AttachmentSurface surface;
+  final bool formattingOpen;
+  final ValueChanged<BuildContext> onTap;
 
-  const _AttachmentTrigger({required this.open, required this.onTap});
+  const _AttachmentTrigger({
+    required this.surface,
+    required this.formattingOpen,
+    required this.onTap,
+  });
 
   @override
   Widget build(BuildContext context) {
     final duration = MediaQuery.disableAnimationsOf(context)
         ? Duration.zero
-        : const Duration(milliseconds: 180);
+        : const Duration(milliseconds: 240);
 
     return SizedBox.square(
       dimension: 36,
@@ -47,18 +301,44 @@ class _AttachmentTrigger extends StatelessWidget {
           ),
         ),
         child: IconButton(
-          tooltip: open ? 'Close attachments' : 'Add attachment',
-          onPressed: onTap,
+          tooltip: switch (surface) {
+            _AttachmentSurface.closed =>
+              formattingOpen ? 'Close formatting' : 'Add attachment',
+            _AttachmentSurface.menu => 'Close attachments',
+            _AttachmentSurface.camera ||
+            _AttachmentSurface.photos => 'Back to attachment options',
+          },
+          onPressed: () => onTap(context),
           padding: EdgeInsets.zero,
           visualDensity: VisualDensity.compact,
           icon: AnimatedRotation(
             duration: duration,
-            curve: Curves.easeInOutCubic,
-            turns: open ? 0.125 : 0,
-            child: Icon(
-              LucideIcons.plus,
-              size: 20,
-              color: context.colors.onSurfaceVariant,
+            curve: Curves.easeOutBack,
+            turns: surface == _AttachmentSurface.menu || formattingOpen
+                ? 0.125
+                : 0,
+            child: AnimatedSwitcher(
+              duration: duration,
+              switchInCurve: Curves.easeOutBack,
+              switchOutCurve: Curves.easeInOutCubic,
+              transitionBuilder: (child, animation) => FadeTransition(
+                opacity: animation,
+                child: ScaleTransition(
+                  scale: Tween<double>(begin: 0.92, end: 1).animate(animation),
+                  child: child,
+                ),
+              ),
+              child: Icon(
+                switch (surface) {
+                  _AttachmentSurface.camera => LucideIcons.camera,
+                  _AttachmentSurface.photos => LucideIcons.images,
+                  _AttachmentSurface.closed ||
+                  _AttachmentSurface.menu => LucideIcons.plus,
+                },
+                key: ValueKey('attachment-trigger-${surface.name}'),
+                size: 20,
+                color: context.colors.onSurfaceVariant,
+              ),
             ),
           ),
         ),
@@ -68,12 +348,14 @@ class _AttachmentTrigger extends StatelessWidget {
 }
 
 class _AttachmentMenu extends StatelessWidget {
+  final _AttachmentMenuLayout layout;
   final VoidCallback onCamera;
   final VoidCallback onPhotos;
   final VoidCallback onVideo;
   final VoidCallback onFiles;
 
   const _AttachmentMenu({
+    required this.layout,
     required this.onCamera,
     required this.onPhotos,
     required this.onVideo,
@@ -82,53 +364,46 @@ class _AttachmentMenu extends StatelessWidget {
 
   @override
   Widget build(BuildContext context) {
-    return Container(
-      width: 176,
-      clipBehavior: Clip.antiAlias,
-      decoration: BoxDecoration(
-        color: context.colors.surfaceContainerHighest,
-        borderRadius: BorderRadius.circular(Radii.dialog),
-        border: Border.all(
-          color: Colors.black.withValues(alpha: 0.04),
-          width: 1,
-        ),
-      ),
-      padding: const EdgeInsets.symmetric(vertical: Grid.xxs),
-      child: Column(
-        mainAxisSize: MainAxisSize.min,
-        children: [
-          _AttachmentMenuItem(
-            icon: LucideIcons.camera,
-            label: 'Camera',
-            onTap: onCamera,
-          ),
-          _AttachmentMenuItem(
-            icon: LucideIcons.images,
-            label: 'Photos',
-            onTap: onPhotos,
-          ),
-          _AttachmentMenuItem(
-            icon: LucideIcons.video,
-            label: 'Video',
-            onTap: onVideo,
-          ),
-          _AttachmentMenuItem(
-            icon: LucideIcons.file,
-            label: 'Files',
-            onTap: onFiles,
-          ),
-        ],
+    return SizedBox(
+      key: const ValueKey('attachment-menu'),
+      width: _attachmentMenuWidth,
+      height: layout.height,
+      child: ListView.separated(
+        key: const ValueKey('attachment-menu-scroll'),
+        padding: const EdgeInsets.all(_attachmentMenuPadding),
+        physics: layout.isScrollable
+            ? null
+            : const NeverScrollableScrollPhysics(),
+        itemCount: 4,
+        separatorBuilder: (_, _) =>
+            const SizedBox(height: _attachmentMenuItemSpacing),
+        itemBuilder: (context, index) {
+          final (icon, label, onTap) = switch (index) {
+            0 => (LucideIcons.camera, 'Camera', onCamera),
+            1 => (LucideIcons.images, 'Photos', onPhotos),
+            2 => (LucideIcons.video, 'Video', onVideo),
+            _ => (LucideIcons.file, 'Files', onFiles),
+          };
+          return _AttachmentMenuItem(
+            height: layout.itemHeight,
+            icon: icon,
+            label: label,
+            onTap: onTap,
+          );
+        },
       ),
     );
   }
 }
 
 class _AttachmentMenuItem extends StatelessWidget {
+  final double height;
   final IconData icon;
   final String label;
   final VoidCallback onTap;
 
   const _AttachmentMenuItem({
+    required this.height,
     required this.icon,
     required this.label,
     required this.onTap,
@@ -137,21 +412,40 @@ class _AttachmentMenuItem extends StatelessWidget {
   @override
   Widget build(BuildContext context) {
     return SizedBox(
-      height: 48,
+      key: ValueKey('attachment-menu-item-${label.toLowerCase()}'),
+      height: height,
       child: Tooltip(
         message: label,
         child: InkWell(
           onTap: onTap,
           child: Padding(
-            padding: const EdgeInsets.symmetric(horizontal: Grid.twelve),
+            padding: const EdgeInsets.symmetric(horizontal: Grid.xxs),
             child: Row(
               children: [
-                Icon(icon, size: 20, color: context.colors.onSurfaceVariant),
+                SizedBox(
+                  key: ValueKey('attachment-menu-icon-${label.toLowerCase()}'),
+                  width: _attachmentMenuIconSlotWidth,
+                  child: Center(
+                    child: Icon(
+                      icon,
+                      size: _attachmentMenuIconSize,
+                      color: context.colors.onSurfaceVariant,
+                    ),
+                  ),
+                ),
                 const SizedBox(width: Grid.xxs),
-                Text(
-                  label,
-                  style: context.textTheme.bodyLarge?.copyWith(
-                    color: context.colors.onSurface,
+                Expanded(
+                  child: Text(
+                    label,
+                    key: ValueKey(
+                      'attachment-menu-label-${label.toLowerCase()}',
+                    ),
+                    maxLines: 1,
+                    overflow: TextOverflow.ellipsis,
+                    style: context.textTheme.titleMedium?.copyWith(
+                      color: context.colors.onSurface,
+                      fontWeight: FontWeight.w400,
+                    ),
                   ),
                 ),
               ],
@@ -201,38 +495,50 @@ class _AttachmentStrip extends StatelessWidget {
                 ? 'Uploading attachment…'
                 : 'Uploading $uploadingCount attachments…';
             return Semantics(
+              excludeSemantics: true,
               liveRegion: true,
               label: label,
               child: Container(
                 key: const ValueKey('compose-upload-progress'),
-                width: 128,
+                width: thumbWidth,
                 decoration: BoxDecoration(
                   color: context.colors.surface,
                   borderRadius: BorderRadius.circular(Radii.md),
                   border: Border.all(color: context.colors.outlineVariant),
                 ),
-                padding: const EdgeInsets.symmetric(horizontal: Grid.xxs),
-                child: Row(
-                  mainAxisAlignment: MainAxisAlignment.center,
+                child: Stack(
+                  alignment: Alignment.center,
                   children: [
-                    SizedBox.square(
-                      dimension: 18,
-                      child: CircularProgressIndicator(
-                        strokeWidth: 2,
-                        color: context.colors.primary,
-                      ),
+                    BuzzLoadingIndicator(
+                      size: 34,
+                      color: context.colors.primary,
+                      semanticLabel: label,
                     ),
-                    const SizedBox(width: Grid.half),
-                    Flexible(
-                      child: Text(
-                        label,
-                        maxLines: 2,
-                        overflow: TextOverflow.ellipsis,
-                        style: context.textTheme.labelSmall?.copyWith(
-                          color: context.colors.onSurfaceVariant,
+                    if (uploadingCount > 1)
+                      PositionedDirectional(
+                        top: Grid.quarter,
+                        end: Grid.quarter,
+                        child: Container(
+                          key: const ValueKey('compose-upload-count'),
+                          constraints: const BoxConstraints(
+                            minWidth: 22,
+                            minHeight: 22,
+                          ),
+                          alignment: Alignment.center,
+                          decoration: BoxDecoration(
+                            color: context.colors.primary,
+                            shape: BoxShape.circle,
+                          ),
+                          padding: const EdgeInsets.all(3),
+                          child: Text(
+                            '$uploadingCount',
+                            style: context.textTheme.labelSmall?.copyWith(
+                              color: context.colors.onPrimary,
+                              fontWeight: FontWeight.w700,
+                            ),
+                          ),
                         ),
                       ),
-                    ),
                   ],
                 ),
               ),
diff --git a/mobile/lib/features/channels/compose_bar/camera_preview.dart b/mobile/lib/features/channels/compose_bar/camera_preview.dart
index df16827ba5b..e51c2d16aaf 100644
--- a/mobile/lib/features/channels/compose_bar/camera_preview.dart
+++ b/mobile/lib/features/channels/compose_bar/camera_preview.dart
@@ -1,10 +1,15 @@
 part of '../compose_bar.dart';
 
 class _InlineCameraPreview extends HookConsumerWidget {
+  final bool initializeCamera;
   final Future<void> Function(XFile image) onCapture;
   final VoidCallback onClose;
 
-  const _InlineCameraPreview({required this.onCapture, required this.onClose});
+  const _InlineCameraPreview({
+    required this.initializeCamera,
+    required this.onCapture,
+    required this.onClose,
+  });
 
   @override
   Widget build(BuildContext context, WidgetRef ref) {
@@ -15,6 +20,8 @@ class _InlineCameraPreview extends HookConsumerWidget {
     final error = useState<String?>(null);
 
     useEffect(() {
+      if (!initializeCamera) return null;
+
       var disposed = false;
       var generation = 0;
 
@@ -76,7 +83,9 @@ class _InlineCameraPreview extends HookConsumerWidget {
         onInactive: () => unawaited(disposeCurrent()),
         onResume: () => unawaited(initialize()),
       );
-      unawaited(initialize());
+      WidgetsBinding.instance.addPostFrameCallback((_) {
+        if (!disposed) unawaited(initialize());
+      });
 
       return () {
         disposed = true;
@@ -86,7 +95,7 @@ class _InlineCameraPreview extends HookConsumerWidget {
         controllerRef.value = null;
         unawaited(current?.dispose() ?? Future<void>.value());
       };
-    }, const []);
+    }, [initializeCamera]);
 
     Future<void> capture() async {
       final activeController = controller.value;
@@ -115,50 +124,44 @@ class _InlineCameraPreview extends HookConsumerWidget {
     }
 
     final activeController = controller.value;
-    return Container(
-      width: double.infinity,
-      clipBehavior: Clip.antiAlias,
-      decoration: BoxDecoration(
-        color: Colors.black,
-        borderRadius: BorderRadius.circular(Radii.dialog),
-      ),
-      foregroundDecoration: BoxDecoration(
-        borderRadius: BorderRadius.circular(Radii.dialog),
-        border: Border.all(
-          color: Colors.black.withValues(alpha: 0.04),
-          width: 1,
-        ),
-      ),
-      child: AspectRatio(
-        aspectRatio: 4 / 3,
-        child: Stack(
-          fit: StackFit.expand,
-          children: [
-            if (activeController case final initialized?)
-              _CameraFeed(controller: initialized)
-            else
-              _CameraPlaceholder(
-                isInitializing: isInitializing.value,
-                message: error.value,
-              ),
-            if (activeController != null)
-              Align(
-                alignment: Alignment.bottomCenter,
-                child: Padding(
-                  padding: const EdgeInsets.all(Grid.twelve),
-                  child: _CameraCaptureButton(
-                    isPressed: isCapturing.value,
-                    onTap: capture,
-                  ),
+    final usesAndroidCameraLayout =
+        defaultTargetPlatform == TargetPlatform.android;
+    return ColoredBox(
+      color: Colors.black,
+      child: Stack(
+        fit: StackFit.expand,
+        children: [
+          if (activeController case final initialized?)
+            _CameraFeed(controller: initialized)
+          else
+            _CameraPlaceholder(
+              isInitializing: isInitializing.value,
+              message: error.value,
+            ),
+          if (activeController != null)
+            Align(
+              alignment: Alignment.bottomCenter,
+              child: Padding(
+                padding: const EdgeInsets.all(Grid.twelve),
+                child: _CameraCaptureButton(
+                  isPressed: isCapturing.value,
+                  onTap: capture,
                 ),
               ),
-            Positioned(
-              top: Grid.xxs,
-              right: Grid.xxs,
-              child: _CameraCloseButton(onTap: onClose),
             ),
-          ],
-        ),
+          Positioned(
+            top: usesAndroidCameraLayout ? null : Grid.xxs,
+            left: usesAndroidCameraLayout ? Grid.twelve : null,
+            right: usesAndroidCameraLayout ? null : Grid.xxs,
+            bottom: usesAndroidCameraLayout
+                ? Grid.twelve + ((_cameraCaptureSize - _cameraBackSize) / 2)
+                : null,
+            child: _CameraCloseButton(
+              onTap: onClose,
+              emphasized: usesAndroidCameraLayout,
+            ),
+          ),
+        ],
       ),
     );
   }
@@ -204,9 +207,10 @@ class _CameraPlaceholder extends StatelessWidget {
         child: Padding(
           padding: const EdgeInsets.all(Grid.sm),
           child: isInitializing
-              ? const CircularProgressIndicator(
+              ? const BuzzLoadingIndicator(
+                  size: 44,
                   color: Colors.white,
-                  strokeWidth: 2,
+                  semanticLabel: 'Starting camera',
                 )
               : Column(
                   mainAxisSize: MainAxisSize.min,
@@ -254,8 +258,8 @@ class _CameraCaptureButton extends StatelessWidget {
           duration: duration,
           curve: Curves.easeOutCubic,
           child: Container(
-            width: 64,
-            height: 64,
+            width: _cameraCaptureSize,
+            height: _cameraCaptureSize,
             decoration: BoxDecoration(
               color: Colors.white.withValues(alpha: 0.24),
               shape: BoxShape.circle,
@@ -277,27 +281,33 @@ class _CameraCaptureButton extends StatelessWidget {
 
 class _CameraCloseButton extends StatelessWidget {
   final VoidCallback onTap;
+  final bool emphasized;
 
-  const _CameraCloseButton({required this.onTap});
+  const _CameraCloseButton({required this.onTap, required this.emphasized});
 
   @override
   Widget build(BuildContext context) {
     return SizedBox.square(
-      dimension: 36,
+      dimension: emphasized ? _cameraBackSize : 36,
       child: IconButton(
         onPressed: onTap,
-        tooltip: 'Close camera',
+        tooltip: 'Back to attachment options',
         padding: EdgeInsets.zero,
         style: IconButton.styleFrom(
-          backgroundColor: Colors.black.withValues(alpha: 0.56),
+          backgroundColor: Colors.black.withValues(
+            alpha: emphasized ? 0.68 : 0.56,
+          ),
           foregroundColor: Colors.white,
         ),
-        icon: const Icon(LucideIcons.x, size: 18),
+        icon: Icon(LucideIcons.arrowLeft, size: emphasized ? 24 : 18),
       ),
     );
   }
 }
 
+const _cameraCaptureSize = 64.0;
+const _cameraBackSize = 44.0;
+
 String _cameraErrorMessage(Object error) {
   if (error is camera.CameraException) {
     return switch (error.code) {
diff --git a/mobile/lib/features/channels/compose_bar/helpers.dart b/mobile/lib/features/channels/compose_bar/helpers.dart
index 983aa270668..145d28fb441 100644
--- a/mobile/lib/features/channels/compose_bar/helpers.dart
+++ b/mobile/lib/features/channels/compose_bar/helpers.dart
@@ -1,6 +1,12 @@
 part of '../compose_bar.dart';
 
 const _typingThrottleMs = 3000;
+const _pastedImageMimeTypes = <String>[
+  'image/jpeg',
+  'image/jpg',
+  'image/png',
+  'image/webp',
+];
 
 /// Cap on ranked mention suggestions shown — matches desktop's
 /// `MENTION_SUGGESTION_LIMIT`.
diff --git a/mobile/lib/features/channels/compose_bar/ios_attachment_popover.dart b/mobile/lib/features/channels/compose_bar/ios_attachment_popover.dart
new file mode 100644
index 00000000000..0a0c4f1a99a
--- /dev/null
+++ b/mobile/lib/features/channels/compose_bar/ios_attachment_popover.dart
@@ -0,0 +1,199 @@
+part of '../compose_bar.dart';
+
+const _nativeAttachmentPopoverChannel = MethodChannel(
+  'buzz/native_attachment_popover',
+);
+
+final _iosAttachmentPopoverCoordinator = _IOSAttachmentPopoverCoordinator(
+  _nativeAttachmentPopoverChannel,
+);
+
+class _IOSAttachmentPopoverCallbacks {
+  final Future<void> Function(XFile image) onCapture;
+  final Future<void> Function(List<XFile> photos) onChoosePhotos;
+  final VoidCallback onAllPhotos;
+  final VoidCallback onVideo;
+  final VoidCallback onFiles;
+
+  const _IOSAttachmentPopoverCallbacks({
+    required this.onCapture,
+    required this.onChoosePhotos,
+    required this.onAllPhotos,
+    required this.onVideo,
+    required this.onFiles,
+  });
+}
+
+class _IOSAttachmentPopoverCoordinator {
+  static final Object _cancelledSupportCheck = Object();
+
+  final MethodChannel _channel;
+
+  Object? _activeOwner;
+  _IOSAttachmentPopoverCallbacks? _callbacks;
+  Completer<void>? _pendingSupportCancellation;
+  bool _didPresent = false;
+  bool _handlerInstalled = false;
+
+  _IOSAttachmentPopoverCoordinator(this._channel);
+
+  Future<bool> present({
+    required Object owner,
+    required BuildContext sourceContext,
+    required Future<void> Function(XFile image) onCapture,
+    required Future<void> Function(List<XFile> photos) onChoosePhotos,
+    required VoidCallback onAllPhotos,
+    required VoidCallback onVideo,
+    required VoidCallback onFiles,
+  }) async {
+    if (defaultTargetPlatform != TargetPlatform.iOS) return false;
+    if (_activeOwner case final activeOwner?) {
+      if (identical(activeOwner, owner)) return true;
+      if (!_didPresent) _clearOwner(activeOwner);
+      return _didPresent;
+    }
+
+    final supportCancellation = Completer<void>();
+    _activeOwner = owner;
+    _pendingSupportCancellation = supportCancellation;
+    _callbacks = _IOSAttachmentPopoverCallbacks(
+      onCapture: onCapture,
+      onChoosePhotos: onChoosePhotos,
+      onAllPhotos: onAllPhotos,
+      onVideo: onVideo,
+      onFiles: onFiles,
+    );
+    _ensureHandler();
+
+    try {
+      final supportResult = await Future.any<Object?>([
+        _channel.invokeMethod<bool>('isSupported'),
+        supportCancellation.future.then<Object?>((_) => _cancelledSupportCheck),
+      ]);
+      if (identical(supportResult, _cancelledSupportCheck)) return true;
+      if (identical(_pendingSupportCancellation, supportCancellation)) {
+        _pendingSupportCancellation = null;
+      }
+      if (!identical(_activeOwner, owner)) return false;
+      final supported = supportResult == true;
+      if (!supported || !sourceContext.mounted) {
+        _clearOwner(owner);
+        return false;
+      }
+
+      final renderObject = sourceContext.findRenderObject();
+      if (renderObject is! RenderBox || !renderObject.hasSize) {
+        _clearOwner(owner);
+        return false;
+      }
+      final origin = renderObject.localToGlobal(Offset.zero);
+
+      _didPresent = true;
+      final didPresent =
+          await _channel.invokeMethod<bool>('present', {
+            'x': origin.dx,
+            'y': origin.dy,
+            'width': renderObject.size.width,
+            'height': renderObject.size.height,
+          }) ??
+          false;
+      if (!identical(_activeOwner, owner)) return false;
+      if (!didPresent) _clearOwner(owner);
+      return didPresent;
+    } on PlatformException {
+      _clearOwner(owner);
+      return false;
+    }
+  }
+
+  Future<void> disposeOwner(Object owner) async {
+    if (!identical(_activeOwner, owner)) return;
+
+    _callbacks = null;
+    if (!_didPresent) {
+      _clearOwner(owner);
+      return;
+    }
+
+    try {
+      await _channel.invokeMethod<void>('dismiss');
+    } on PlatformException {
+      // The native bridge is unavailable, so there is nothing left to dismiss.
+    } on MissingPluginException {
+      // The native bridge is unavailable, so there is nothing left to dismiss.
+    } finally {
+      _clearOwner(owner);
+    }
+  }
+
+  void _ensureHandler() {
+    if (_handlerInstalled) return;
+    _handlerInstalled = true;
+    _channel.setMethodCallHandler(_handleMethodCall);
+  }
+
+  Future<void> _handleMethodCall(MethodCall call) async {
+    final callbacks = _callbacks;
+    switch (call.method) {
+      case 'cameraCaptured':
+        if (call.arguments case final String path) {
+          final activeCallbacks = callbacks;
+          if (activeCallbacks != null) {
+            await processCapturedImage(XFile(path), activeCallbacks.onCapture);
+          }
+        }
+      case 'photosSelected':
+        final paths = (call.arguments as List<Object?>? ?? const [])
+            .whereType<String>()
+            .toList();
+        if (callbacks != null && paths.isNotEmpty) {
+          await processTemporaryImages([
+            for (final path in paths) XFile(path),
+          ], callbacks.onChoosePhotos);
+        }
+      case 'pickAllPhotos':
+        callbacks?.onAllPhotos();
+      case 'pickVideo':
+        callbacks?.onVideo();
+      case 'pickFiles':
+        callbacks?.onFiles();
+      case 'dismissed':
+        _activeOwner = null;
+        _callbacks = null;
+        _didPresent = false;
+    }
+  }
+
+  void _clearOwner(Object owner) {
+    if (!identical(_activeOwner, owner)) return;
+    final supportCancellation = _pendingSupportCancellation;
+    _pendingSupportCancellation = null;
+    if (supportCancellation != null && !supportCancellation.isCompleted) {
+      supportCancellation.complete();
+    }
+    _activeOwner = null;
+    _callbacks = null;
+    _didPresent = false;
+  }
+}
+
+class _IOSAttachmentPopoverController {
+  Future<bool> present({
+    required BuildContext sourceContext,
+    required Future<void> Function(XFile image) onCapture,
+    required Future<void> Function(List<XFile> photos) onChoosePhotos,
+    required VoidCallback onAllPhotos,
+    required VoidCallback onVideo,
+    required VoidCallback onFiles,
+  }) => _iosAttachmentPopoverCoordinator.present(
+    owner: this,
+    sourceContext: sourceContext,
+    onCapture: onCapture,
+    onChoosePhotos: onChoosePhotos,
+    onAllPhotos: onAllPhotos,
+    onVideo: onVideo,
+    onFiles: onFiles,
+  );
+
+  Future<void> dispose() => _iosAttachmentPopoverCoordinator.disposeOwner(this);
+}
diff --git a/mobile/lib/features/channels/compose_bar/ios_photo_picker.dart b/mobile/lib/features/channels/compose_bar/ios_photo_picker.dart
new file mode 100644
index 00000000000..039b5160a3d
--- /dev/null
+++ b/mobile/lib/features/channels/compose_bar/ios_photo_picker.dart
@@ -0,0 +1,232 @@
+part of '../compose_bar.dart';
+
+const _inlinePhotoPickerViewType = 'buzz/inline_photo_picker';
+const _inlinePhotoPickerSupportChannel = MethodChannel(
+  'buzz/inline_photo_picker',
+);
+
+class _IOSInlinePhotoPicker extends HookWidget {
+  final VoidCallback onBack;
+  final Future<List<XFile>> Function() onPickAllPhotos;
+  final Future<void> Function(List<XFile> photos) onChoosePhotos;
+  final Widget fallback;
+
+  const _IOSInlinePhotoPicker({
+    required this.onBack,
+    required this.onPickAllPhotos,
+    required this.onChoosePhotos,
+    required this.fallback,
+  });
+
+  @override
+  Widget build(BuildContext context) {
+    final supportFuture = useMemoized(
+      () async =>
+          await _inlinePhotoPickerSupportChannel.invokeMethod<bool>(
+            'isSupported',
+          ) ??
+          false,
+    );
+    final support = useFuture(supportFuture);
+    final pickerChannel = useState<MethodChannel?>(null);
+    final selectedCount = useState(0);
+    final selectedPaths = useState<List<String>>(const []);
+    final isPreparingSelection = useState(false);
+    final isProcessing = useState(false);
+
+    useEffect(() {
+      final channel = pickerChannel.value;
+      if (channel == null) return null;
+
+      channel.setMethodCallHandler((call) async {
+        switch (call.method) {
+          case 'selectionCountChanged':
+            selectedCount.value = call.arguments as int? ?? 0;
+            selectedPaths.value = const [];
+            isPreparingSelection.value = selectedCount.value > 0;
+          case 'selectionDidChange':
+            final paths = (call.arguments as List<Object?>? ?? const [])
+                .whereType<String>()
+                .toList();
+            selectedPaths.value = paths;
+            isPreparingSelection.value = false;
+          case 'didFail':
+            isPreparingSelection.value = false;
+            if (!context.mounted) return;
+            ScaffoldMessenger.maybeOf(context)?.showSnackBar(
+              SnackBar(
+                content: Text(
+                  call.arguments as String? ??
+                      'Unable to prepare the selected photos.',
+                ),
+              ),
+            );
+        }
+      });
+      return () => channel.setMethodCallHandler(null);
+    }, [pickerChannel.value]);
+
+    final canSelect =
+        selectedCount.value > 0 &&
+        selectedPaths.value.length == selectedCount.value &&
+        !isPreparingSelection.value &&
+        !isProcessing.value;
+
+    Future<void> submitSelection() async {
+      if (!canSelect) return;
+      isProcessing.value = true;
+      try {
+        final paths = List<String>.from(selectedPaths.value);
+        final claimed =
+            await pickerChannel.value?.invokeMethod<bool>(
+              'claimSelection',
+              paths,
+            ) ??
+            false;
+        if (!claimed) return;
+        final photos = [for (final path in paths) XFile(path)];
+        await processTemporaryImages(photos, onChoosePhotos);
+      } finally {
+        if (context.mounted) isProcessing.value = false;
+      }
+    }
+
+    Future<void> openAllPhotos() async {
+      if (isPreparingSelection.value || isProcessing.value) return;
+      isProcessing.value = true;
+      try {
+        final photos = await onPickAllPhotos();
+        if (photos.isNotEmpty) {
+          await onChoosePhotos(photos);
+        }
+      } catch (_) {
+        if (context.mounted) {
+          ScaffoldMessenger.maybeOf(context)?.showSnackBar(
+            const SnackBar(content: Text('Unable to open your photo library.')),
+          );
+        }
+      } finally {
+        if (context.mounted) isProcessing.value = false;
+      }
+    }
+
+    if (support.connectionState != ConnectionState.done) {
+      return const _NativePhotoPickerLoading();
+    }
+    if (support.hasError || support.data != true) return fallback;
+
+    return SizedBox(
+      key: const ValueKey('ios-inline-photo-picker'),
+      height: _attachmentExpandedHeight,
+      width: double.infinity,
+      child: Stack(
+        fit: StackFit.expand,
+        children: [
+          UiKitView(
+            viewType: _inlinePhotoPickerViewType,
+            creationParamsCodec: const StandardMessageCodec(),
+            onPlatformViewCreated: (viewId) {
+              pickerChannel.value = MethodChannel(
+                'buzz/inline_photo_picker/$viewId',
+              );
+            },
+          ),
+          PositionedDirectional(
+            start: Grid.twelve,
+            bottom: Grid.twelve,
+            child: SafeArea(
+              top: false,
+              child: DecoratedBox(
+                decoration: BoxDecoration(
+                  color: Colors.black.withValues(alpha: 0.62),
+                  shape: BoxShape.circle,
+                  border: Border.all(
+                    color: Colors.white.withValues(alpha: 0.28),
+                  ),
+                ),
+                child: IconButton(
+                  key: const ValueKey('ios-inline-photo-picker-back'),
+                  onPressed: isProcessing.value ? null : onBack,
+                  tooltip: 'Back to attachment options',
+                  icon: const Icon(
+                    LucideIcons.chevronLeft,
+                    color: Colors.white,
+                  ),
+                ),
+              ),
+            ),
+          ),
+          PositionedDirectional(
+            end: Grid.twelve,
+            bottom: Grid.twelve,
+            child: SafeArea(
+              top: false,
+              child: FilledButton(
+                key: const ValueKey('ios-inline-photo-picker-select'),
+                onPressed: canSelect
+                    ? submitSelection
+                    : selectedCount.value == 0 &&
+                          !isPreparingSelection.value &&
+                          !isProcessing.value
+                    ? openAllPhotos
+                    : null,
+                style: FilledButton.styleFrom(
+                  backgroundColor: Colors.black.withValues(alpha: 0.76),
+                  disabledBackgroundColor: Colors.black.withValues(alpha: 0.32),
+                  foregroundColor: Colors.white,
+                  disabledForegroundColor: Colors.white70,
+                  minimumSize: const Size(0, 48),
+                  padding: const EdgeInsets.symmetric(horizontal: Grid.twelve),
+                  shape: const StadiumBorder(),
+                  side: BorderSide(color: Colors.white.withValues(alpha: 0.28)),
+                ),
+                child: isPreparingSelection.value
+                    ? const SizedBox.square(
+                        dimension: 20,
+                        child: BuzzLoadingIndicator(
+                          size: 20,
+                          color: Colors.white,
+                          semanticLabel: 'Preparing selected photos',
+                        ),
+                      )
+                    : Text(
+                        selectedCount.value == 0
+                            ? 'All Photos'
+                            : 'Add ${selectedCount.value} '
+                                  '${selectedCount.value == 1 ? 'photo' : 'photos'}',
+                      ),
+              ),
+            ),
+          ),
+          if (isProcessing.value)
+            const ColoredBox(
+              color: Color.fromRGBO(0, 0, 0, 0.28),
+              child: Center(
+                child: BuzzLoadingIndicator(
+                  size: 44,
+                  color: Colors.white,
+                  semanticLabel: 'Preparing selected photos',
+                ),
+              ),
+            ),
+        ],
+      ),
+    );
+  }
+}
+
+class _NativePhotoPickerLoading extends StatelessWidget {
+  const _NativePhotoPickerLoading();
+
+  @override
+  Widget build(BuildContext context) {
+    return SizedBox(
+      key: const ValueKey('ios-inline-photo-picker-loading'),
+      height: _attachmentExpandedHeight,
+      width: double.infinity,
+      child: const Center(
+        child: BuzzLoadingIndicator(size: 44, semanticLabel: 'Opening Photos'),
+      ),
+    );
+  }
+}
diff --git a/mobile/lib/features/channels/compose_bar/layout.dart b/mobile/lib/features/channels/compose_bar/layout.dart
new file mode 100644
index 00000000000..2d62db836d4
--- /dev/null
+++ b/mobile/lib/features/channels/compose_bar/layout.dart
@@ -0,0 +1,245 @@
+part of '../compose_bar.dart';
+
+class _ComposeBarLayout extends StatelessWidget {
+  final List<BlobDescriptor> attachments;
+  final int uploadingCount;
+  final ValueChanged<String> onRemoveAttachment;
+  final String? uploadError;
+  final bool isExpanded;
+  final TextEditingController controller;
+  final FocusNode focusNode;
+  final EditableTextContextMenuBuilder contextMenuBuilder;
+  final ValueChanged<KeyboardInsertedContent> onContentInserted;
+  final VoidCallback onSend;
+  final String resolvedHint;
+  final _AttachmentSurface attachmentSurface;
+  final ValueChanged<BuildContext> onAttachmentTap;
+  final VoidCallback onExpand;
+  final double expansionValue;
+  final double expansionProgress;
+  final bool formattingOpen;
+  final VoidCallback onCloseFormatting;
+  final Duration motionDuration;
+  final void Function(String prefix, [String? suffix]) onFormat;
+  final VoidCallback onMention;
+  final VoidCallback onChannel;
+  final VoidCallback onEmoji;
+  final VoidCallback onOpenFormatting;
+  final bool hasPendingUploads;
+  final bool isSending;
+
+  const _ComposeBarLayout({
+    required this.attachments,
+    required this.uploadingCount,
+    required this.onRemoveAttachment,
+    required this.uploadError,
+    required this.isExpanded,
+    required this.controller,
+    required this.focusNode,
+    required this.contextMenuBuilder,
+    required this.onContentInserted,
+    required this.onSend,
+    required this.resolvedHint,
+    required this.attachmentSurface,
+    required this.onAttachmentTap,
+    required this.onExpand,
+    required this.expansionValue,
+    required this.expansionProgress,
+    required this.formattingOpen,
+    required this.onCloseFormatting,
+    required this.motionDuration,
+    required this.onFormat,
+    required this.onMention,
+    required this.onChannel,
+    required this.onEmoji,
+    required this.onOpenFormatting,
+    required this.hasPendingUploads,
+    required this.isSending,
+  });
+
+  @override
+  Widget build(BuildContext context) {
+    return Container(
+      decoration: BoxDecoration(
+        color: context.colors.surfaceContainerHighest,
+        borderRadius: BorderRadius.circular(Radii.dialog),
+        border: Border.all(
+          color: Colors.black.withValues(alpha: 0.04),
+          width: 1,
+        ),
+      ),
+      padding: const EdgeInsets.all(Grid.xxs),
+      child: Column(
+        mainAxisSize: MainAxisSize.min,
+        children: [
+          if (attachments.isNotEmpty || hasPendingUploads) ...[
+            _AttachmentStrip(
+              attachments: attachments,
+              uploadingCount: uploadingCount,
+              onRemove: onRemoveAttachment,
+            ),
+            const SizedBox(height: Grid.xxs),
+          ],
+          if (uploadError case final error?) ...[
+            Align(
+              alignment: Alignment.centerLeft,
+              child: Text(
+                error,
+                style: context.textTheme.bodySmall?.copyWith(
+                  color: context.colors.error,
+                ),
+              ),
+            ),
+            const SizedBox(height: Grid.xxs),
+          ],
+          // Keep the default state out of the focus system entirely so
+          // restored native focus cannot expand a newly opened channel.
+          if (isExpanded)
+            TextField(
+              controller: controller,
+              focusNode: focusNode,
+              textInputAction: TextInputAction.send,
+              contextMenuBuilder: contextMenuBuilder,
+              contentInsertionConfiguration: ContentInsertionConfiguration(
+                allowedMimeTypes: _pastedImageMimeTypes,
+                onContentInserted: onContentInserted,
+              ),
+              onSubmitted: (_) => onSend(),
+              minLines: 1,
+              maxLines: 5,
+              style: context.textTheme.bodyLarge,
+              decoration: InputDecoration(
+                hintText: resolvedHint,
+                hintStyle: context.textTheme.bodyLarge?.copyWith(
+                  color: context.colors.onSurfaceVariant,
+                ),
+                border: InputBorder.none,
+                enabledBorder: InputBorder.none,
+                focusedBorder: InputBorder.none,
+                contentPadding: const EdgeInsets.symmetric(
+                  horizontal: Grid.half,
+                  vertical: Grid.half,
+                ),
+                isDense: true,
+              ),
+            )
+          else
+            Row(
+              children: [
+                _AttachmentTrigger(
+                  surface: attachmentSurface,
+                  formattingOpen: false,
+                  onTap: onAttachmentTap,
+                ),
+                const SizedBox(width: Grid.xxs),
+                Expanded(
+                  child: Semantics(
+                    button: true,
+                    label: resolvedHint,
+                    child: GestureDetector(
+                      behavior: HitTestBehavior.opaque,
+                      onTap: onExpand,
+                      child: Padding(
+                        padding: const EdgeInsets.symmetric(
+                          vertical: Grid.half,
+                        ),
+                        child: Align(
+                          alignment: Alignment.centerLeft,
+                          child: Text(
+                            resolvedHint,
+                            style: context.textTheme.bodyLarge?.copyWith(
+                              color: context.colors.onSurfaceVariant,
+                            ),
+                          ),
+                        ),
+                      ),
+                    ),
+                  ),
+                ),
+              ],
+            ),
+          ClipRect(
+            child: Align(
+              alignment: Alignment.topCenter,
+              heightFactor: expansionValue,
+              child: IgnorePointer(
+                ignoring: expansionValue < 0.98,
+                child: Opacity(
+                  opacity: expansionProgress,
+                  child: Transform.translate(
+                    offset: Offset(0, Grid.xxs * (1 - expansionProgress)),
+                    child: Column(
+                      children: [
+                        const SizedBox(height: Grid.xxs),
+                        Row(
+                          children: [
+                            _AttachmentTrigger(
+                              surface: attachmentSurface,
+                              formattingOpen: formattingOpen,
+                              onTap: (triggerContext) {
+                                if (formattingOpen) {
+                                  onCloseFormatting();
+                                } else {
+                                  onAttachmentTap(triggerContext);
+                                }
+                              },
+                            ),
+                            const SizedBox(width: Grid.half),
+                            Expanded(
+                              child: AnimatedSwitcher(
+                                duration: motionDuration,
+                                switchInCurve: Curves.easeOutCubic,
+                                switchOutCurve: Curves.easeInCubic,
+                                layoutBuilder:
+                                    (currentChild, previousChildren) => Stack(
+                                      alignment: Alignment.centerLeft,
+                                      children: [
+                                        ...previousChildren,
+                                        ?currentChild,
+                                      ],
+                                    ),
+                                child: formattingOpen
+                                    ? _FormattingToolbar(onFormat: onFormat)
+                                    : Row(
+                                        key: const ValueKey('standard-actions'),
+                                        children: [
+                                          _ComposeAction(
+                                            icon: LucideIcons.atSign,
+                                            onTap: onMention,
+                                          ),
+                                          _ComposeAction(
+                                            icon: LucideIcons.hash,
+                                            onTap: onChannel,
+                                          ),
+                                          _ComposeAction(
+                                            icon: LucideIcons.smilePlus,
+                                            onTap: onEmoji,
+                                          ),
+                                          _ComposeAction(
+                                            icon: LucideIcons.aLargeSmall,
+                                            onTap: onOpenFormatting,
+                                          ),
+                                          const Spacer(),
+                                          _SendButton(
+                                            isDisabled: hasPendingUploads,
+                                            isSending: isSending,
+                                            onTap: onSend,
+                                          ),
+                                        ],
+                                      ),
+                              ),
+                            ),
+                          ],
+                        ),
+                      ],
+                    ),
+                  ),
+                ),
+              ),
+            ),
+          ),
+        ],
+      ),
+    );
+  }
+}
diff --git a/mobile/lib/features/channels/compose_bar/photo_gallery_picker.dart b/mobile/lib/features/channels/compose_bar/photo_gallery_picker.dart
new file mode 100644
index 00000000000..8b19b74aa2e
--- /dev/null
+++ b/mobile/lib/features/channels/compose_bar/photo_gallery_picker.dart
@@ -0,0 +1,382 @@
+part of '../compose_bar.dart';
+
+class _PhotoGalleryPicker extends StatelessWidget {
+  final VoidCallback onBack;
+  final Future<List<XFile>> Function() onPickAllPhotos;
+  final Future<void> Function(List<XFile> photos) onChoosePhotos;
+
+  const _PhotoGalleryPicker({
+    required this.onBack,
+    required this.onPickAllPhotos,
+    required this.onChoosePhotos,
+  });
+
+  @override
+  Widget build(BuildContext context) {
+    final fallback = _RecentPhotoGalleryPicker(
+      onBack: onBack,
+      onPickAllPhotos: onPickAllPhotos,
+      onChoosePhotos: onChoosePhotos,
+    );
+    if (defaultTargetPlatform != TargetPlatform.iOS) return fallback;
+    return _IOSInlinePhotoPicker(
+      onBack: onBack,
+      onPickAllPhotos: onPickAllPhotos,
+      onChoosePhotos: onChoosePhotos,
+      fallback: fallback,
+    );
+  }
+}
+
+class _RecentPhotoGalleryPicker extends HookConsumerWidget {
+  final VoidCallback onBack;
+  final Future<List<XFile>> Function() onPickAllPhotos;
+  final Future<void> Function(List<XFile> photos) onChoosePhotos;
+
+  const _RecentPhotoGalleryPicker({
+    required this.onBack,
+    required this.onPickAllPhotos,
+    required this.onChoosePhotos,
+  });
+
+  @override
+  Widget build(BuildContext context, WidgetRef ref) {
+    final recentPhotos = useMemoized(
+      ref.read(photoLibraryProvider).loadRecentPhotos,
+    );
+    final recentSnapshot = useFuture(recentPhotos);
+    final selection = useState<List<RecentPhoto>>([]);
+    final isResolving = useState(false);
+    final actionError = useState<String?>(null);
+    final reducedMotion = MediaQuery.disableAnimationsOf(context);
+
+    void togglePhoto(RecentPhoto photo) {
+      if (isResolving.value) return;
+      final current = selection.value;
+      final existingIndex = current.indexWhere((item) => item.id == photo.id);
+      selection.value = existingIndex < 0
+          ? [...current, photo]
+          : [
+              ...current.take(existingIndex),
+              ...current.skip(existingIndex + 1),
+            ];
+    }
+
+    Future<void> choosePhotos() async {
+      if (isResolving.value) return;
+      isResolving.value = true;
+      actionError.value = null;
+      try {
+        final photos = selection.value.isEmpty
+            ? await onPickAllPhotos()
+            : await ref
+                  .read(photoLibraryProvider)
+                  .resolveSelectedPhotos(selection.value);
+        if (photos.isNotEmpty && context.mounted) {
+          await onChoosePhotos(photos);
+        }
+      } catch (_) {
+        if (context.mounted) {
+          actionError.value = selection.value.isEmpty
+              ? 'Unable to open your photo library.'
+              : 'Unable to prepare the selected photos.';
+        }
+      } finally {
+        if (context.mounted) isResolving.value = false;
+      }
+    }
+
+    final selectedCount = selection.value.length;
+    final actionLabel = selectedCount == 0
+        ? 'All photos'
+        : selectedCount == 1
+        ? 'Add 1 photo'
+        : 'Add $selectedCount photos';
+
+    Widget buildGalleryBody() {
+      if (recentSnapshot.connectionState != ConnectionState.done) {
+        return const Center(
+          child: BuzzLoadingIndicator(
+            size: 44,
+            semanticLabel: 'Loading recent photos',
+          ),
+        );
+      }
+      if (recentSnapshot.hasError) {
+        return const _PhotoGalleryMessage(
+          icon: LucideIcons.images,
+          title: 'Recent photos aren’t available',
+          message: 'Use All photos to choose with the system photo picker.',
+        );
+      }
+
+      final photos = recentSnapshot.data ?? const <RecentPhoto>[];
+      if (photos.isEmpty) {
+        return const _PhotoGalleryMessage(
+          icon: LucideIcons.images,
+          title: 'No recent photos',
+          message: 'Use All photos to browse your photo library.',
+        );
+      }
+      return GridView.builder(
+        key: const ValueKey('recent-photo-grid'),
+        padding: EdgeInsets.zero,
+        gridDelegate: const SliverGridDelegateWithFixedCrossAxisCount(
+          crossAxisCount: 4,
+          crossAxisSpacing: Grid.quarter,
+          mainAxisSpacing: Grid.quarter,
+        ),
+        itemCount: photos.length,
+        itemBuilder: (context, index) {
+          final photo = photos[index];
+          final selectionIndex = selection.value.indexWhere(
+            (item) => item.id == photo.id,
+          );
+          return _RecentPhotoTile(
+            photo: photo,
+            selectionIndex: selectionIndex,
+            reducedMotion: reducedMotion,
+            onTap: () => togglePhoto(photo),
+          );
+        },
+      );
+    }
+
+    return Padding(
+      key: const ValueKey('photo-gallery-picker'),
+      padding: const EdgeInsets.all(Grid.xxs),
+      child: Column(
+        mainAxisSize: MainAxisSize.min,
+        children: [
+          SizedBox(
+            height: 40,
+            child: Row(
+              children: [
+                IconButton(
+                  key: const ValueKey('photo-gallery-back'),
+                  onPressed: isResolving.value ? null : onBack,
+                  tooltip: 'Back to attachment options',
+                  visualDensity: VisualDensity.compact,
+                  icon: const Icon(LucideIcons.arrowLeft, size: 20),
+                ),
+                const SizedBox(width: Grid.quarter),
+                Expanded(
+                  child: Text(
+                    'Recent photos',
+                    style: context.textTheme.titleSmall?.copyWith(
+                      color: context.colors.onSurface,
+                      fontWeight: FontWeight.w600,
+                    ),
+                  ),
+                ),
+                if (selectedCount > 0)
+                  Padding(
+                    padding: const EdgeInsets.only(right: Grid.half),
+                    child: Text(
+                      '$selectedCount selected',
+                      style: context.textTheme.labelMedium?.copyWith(
+                        color: context.colors.onSurfaceVariant,
+                      ),
+                    ),
+                  ),
+              ],
+            ),
+          ),
+          const SizedBox(height: Grid.half),
+          Expanded(
+            child: Column(
+              children: [
+                Expanded(child: buildGalleryBody()),
+                if (actionError.value case final error?) ...[
+                  const SizedBox(height: Grid.half),
+                  ConstrainedBox(
+                    constraints: const BoxConstraints(maxHeight: 72),
+                    child: SingleChildScrollView(
+                      child: Text(
+                        error,
+                        key: const ValueKey('photo-gallery-error'),
+                        style: context.textTheme.bodySmall?.copyWith(
+                          color: context.colors.error,
+                        ),
+                        textAlign: TextAlign.center,
+                      ),
+                    ),
+                  ),
+                ],
+              ],
+            ),
+          ),
+          const SizedBox(height: Grid.xxs),
+          SizedBox(
+            width: double.infinity,
+            child: selectedCount == 0
+                ? OutlinedButton.icon(
+                    key: const ValueKey('photo-gallery-action'),
+                    onPressed: isResolving.value ? null : choosePhotos,
+                    icon: isResolving.value
+                        ? BuzzLoadingIndicator(
+                            size: 22,
+                            color: context.colors.primary,
+                            semanticLabel: 'Opening all photos',
+                          )
+                        : const Icon(LucideIcons.images, size: 18),
+                    label: Text(actionLabel),
+                  )
+                : FilledButton.icon(
+                    key: const ValueKey('photo-gallery-action'),
+                    onPressed: isResolving.value ? null : choosePhotos,
+                    icon: isResolving.value
+                        ? const BuzzLoadingIndicator(
+                            size: 22,
+                            color: Colors.white,
+                            semanticLabel: 'Preparing selected photos',
+                          )
+                        : const Icon(LucideIcons.plus, size: 18),
+                    label: Text(actionLabel),
+                  ),
+          ),
+        ],
+      ),
+    );
+  }
+}
+
+class _RecentPhotoTile extends StatelessWidget {
+  final RecentPhoto photo;
+  final int selectionIndex;
+  final bool reducedMotion;
+  final VoidCallback onTap;
+
+  const _RecentPhotoTile({
+    required this.photo,
+    required this.selectionIndex,
+    required this.reducedMotion,
+    required this.onTap,
+  });
+
+  @override
+  Widget build(BuildContext context) {
+    final isSelected = selectionIndex >= 0;
+    return Semantics(
+      button: true,
+      selected: isSelected,
+      label: isSelected
+          ? 'Photo ${selectionIndex + 1} selected'
+          : 'Select photo',
+      child: GestureDetector(
+        key: ValueKey('recent-photo-${photo.id}'),
+        behavior: HitTestBehavior.opaque,
+        onTap: onTap,
+        child: Stack(
+          fit: StackFit.expand,
+          children: [
+            ClipRRect(
+              borderRadius: BorderRadius.circular(Radii.sm),
+              child: Image.memory(
+                photo.thumbnailBytes,
+                fit: BoxFit.cover,
+                gaplessPlayback: true,
+              ),
+            ),
+            AnimatedContainer(
+              duration: reducedMotion
+                  ? Duration.zero
+                  : const Duration(milliseconds: 140),
+              curve: Curves.easeOutCubic,
+              decoration: BoxDecoration(
+                borderRadius: BorderRadius.circular(Radii.sm),
+                border: Border.all(
+                  color: isSelected
+                      ? context.colors.primary
+                      : Colors.transparent,
+                  width: isSelected ? 3 : 0,
+                ),
+                color: isSelected
+                    ? Colors.black.withValues(alpha: 0.08)
+                    : Colors.transparent,
+              ),
+            ),
+            PositionedDirectional(
+              top: Grid.half,
+              end: Grid.half,
+              child: AnimatedScale(
+                scale: isSelected ? 1 : 0.8,
+                duration: reducedMotion
+                    ? Duration.zero
+                    : const Duration(milliseconds: 140),
+                curve: Curves.easeOutCubic,
+                child: AnimatedOpacity(
+                  opacity: isSelected ? 1 : 0,
+                  duration: reducedMotion
+                      ? Duration.zero
+                      : const Duration(milliseconds: 100),
+                  child: Container(
+                    key: ValueKey('photo-selection-index-${photo.id}'),
+                    width: 24,
+                    height: 24,
+                    alignment: Alignment.center,
+                    decoration: BoxDecoration(
+                      color: context.colors.primary,
+                      shape: BoxShape.circle,
+                      border: Border.all(color: Colors.white, width: 1.5),
+                    ),
+                    child: Text(
+                      '${selectionIndex + 1}',
+                      style: context.textTheme.labelSmall?.copyWith(
+                        color: context.colors.onPrimary,
+                        fontWeight: FontWeight.w700,
+                      ),
+                    ),
+                  ),
+                ),
+              ),
+            ),
+          ],
+        ),
+      ),
+    );
+  }
+}
+
+class _PhotoGalleryMessage extends StatelessWidget {
+  final IconData icon;
+  final String title;
+  final String message;
+
+  const _PhotoGalleryMessage({
+    required this.icon,
+    required this.title,
+    required this.message,
+  });
+
+  @override
+  Widget build(BuildContext context) {
+    return Center(
+      child: Padding(
+        padding: const EdgeInsets.all(Grid.sm),
+        child: Column(
+          mainAxisSize: MainAxisSize.min,
+          children: [
+            Icon(icon, size: 32, color: context.colors.onSurfaceVariant),
+            const SizedBox(height: Grid.xxs),
+            Text(
+              title,
+              style: context.textTheme.titleSmall?.copyWith(
+                color: context.colors.onSurface,
+              ),
+              textAlign: TextAlign.center,
+            ),
+            const SizedBox(height: Grid.quarter),
+            Text(
+              message,
+              style: context.textTheme.bodySmall?.copyWith(
+                color: context.colors.onSurfaceVariant,
+              ),
+              textAlign: TextAlign.center,
+            ),
+          ],
+        ),
+      ),
+    );
+  }
+}
diff --git a/mobile/lib/features/channels/compose_bar/send_button.dart b/mobile/lib/features/channels/compose_bar/send_button.dart
index 45bd1df9c27..54060ae948e 100644
--- a/mobile/lib/features/channels/compose_bar/send_button.dart
+++ b/mobile/lib/features/channels/compose_bar/send_button.dart
@@ -27,13 +27,10 @@ class _SendButton extends StatelessWidget {
         ),
         padding: EdgeInsets.zero,
         icon: isSending
-            ? SizedBox(
-                width: 16,
-                height: 16,
-                child: CircularProgressIndicator(
-                  strokeWidth: 2,
-                  color: context.colors.onPrimary,
-                ),
+            ? BuzzLoadingIndicator(
+                size: 18,
+                color: context.colors.onPrimary,
+                semanticLabel: 'Sending message',
               )
             : Icon(
                 LucideIcons.arrowUp,
diff --git a/mobile/lib/features/channels/compose_bar/suggestions.dart b/mobile/lib/features/channels/compose_bar/suggestions.dart
index f1deefcdaf5..ed97284d460 100644
--- a/mobile/lib/features/channels/compose_bar/suggestions.dart
+++ b/mobile/lib/features/channels/compose_bar/suggestions.dart
@@ -1,44 +1,95 @@
 part of '../compose_bar.dart';
 
-class _SuggestionPanelMotion extends StatelessWidget {
+class _SuggestionPanelMotion extends HookWidget {
   final Duration duration;
+  final Alignment alignment;
   final Widget child;
 
-  const _SuggestionPanelMotion({required this.duration, required this.child});
+  const _SuggestionPanelMotion({
+    required this.duration,
+    required this.alignment,
+    required this.child,
+  });
 
   @override
   Widget build(BuildContext context) {
-    return AnimatedSwitcher(
-      duration: duration,
-      reverseDuration: duration,
-      layoutBuilder: (currentChild, previousChildren) => Stack(
-        alignment: Alignment.bottomLeft,
-        clipBehavior: Clip.none,
-        children: [...previousChildren, ?currentChild],
-      ),
-      transitionBuilder: (child, animation) {
-        final curvedAnimation = CurvedAnimation(
-          parent: animation,
-          curve: Curves.easeOutCubic,
-          reverseCurve: Curves.easeInCubic,
-        );
-
-        return AnimatedBuilder(
-          animation: curvedAnimation,
-          child: child,
-          builder: (context, child) => IgnorePointer(
-            ignoring: animation.status == AnimationStatus.reverse,
-            child: Opacity(
-              opacity: curvedAnimation.value,
-              child: Transform.translate(
-                offset: Offset(0, Grid.xs * (1 - curvedAnimation.value)),
-                child: child,
+    final reducedMotion = MediaQuery.disableAnimationsOf(context);
+    final springController = useAnimationController(
+      initialValue: 1,
+      upperBound: 1.08,
+    );
+    final springValue = useAnimation(springController);
+    final previousChildKey = useRef<Key?>(child.key);
+
+    useEffect(() {
+      if (previousChildKey.value == child.key) return null;
+      previousChildKey.value = child.key;
+      if (reducedMotion) {
+        springController.value = 1;
+      } else {
+        springController
+          ..stop()
+          ..value = 0.9
+          ..animateWith(
+            SpringSimulation(
+              SpringDescription.withDurationAndBounce(
+                duration: const Duration(milliseconds: 320),
+                bounce: 0.18,
               ),
+              0.9,
+              1,
+              0,
+              snapToEnd: true,
             ),
+          );
+      }
+      return null;
+    }, [child.key, reducedMotion]);
+
+    return Transform.scale(
+      scale: springValue,
+      alignment: alignment,
+      child: AnimatedSize(
+        duration: duration,
+        curve: Curves.easeInOutCubic,
+        alignment: alignment,
+        child: AnimatedSwitcher(
+          duration: duration,
+          reverseDuration: duration,
+          layoutBuilder: (currentChild, previousChildren) => Stack(
+            alignment: alignment,
+            clipBehavior: Clip.none,
+            children: [...previousChildren, ?currentChild],
           ),
-        );
-      },
-      child: child,
+          transitionBuilder: (child, animation) {
+            final curvedAnimation = CurvedAnimation(
+              parent: animation,
+              curve: Curves.easeOutBack,
+              reverseCurve: Curves.easeInOutCubic,
+            );
+
+            return AnimatedBuilder(
+              animation: curvedAnimation,
+              child: child,
+              builder: (context, child) => IgnorePointer(
+                ignoring: animation.status == AnimationStatus.reverse,
+                child: Opacity(
+                  opacity: animation.value.clamp(0.0, 1.0),
+                  child: Transform.translate(
+                    offset: Offset(0, Grid.xs * (1 - animation.value)),
+                    child: Transform.scale(
+                      scale: 0.92 + (0.08 * curvedAnimation.value),
+                      alignment: alignment,
+                      child: child,
+                    ),
+                  ),
+                ),
+              ),
+            );
+          },
+          child: child,
+        ),
+      ),
     );
   }
 }
diff --git a/mobile/lib/features/channels/manage_channel_sheet.dart b/mobile/lib/features/channels/manage_channel_sheet.dart
index d1f0c231ae1..15ad07b0cde 100644
--- a/mobile/lib/features/channels/manage_channel_sheet.dart
+++ b/mobile/lib/features/channels/manage_channel_sheet.dart
@@ -4,6 +4,7 @@ import 'package:hooks_riverpod/hooks_riverpod.dart';
 import 'package:lucide_icons_flutter/lucide_icons.dart';
 
 import '../../shared/theme/theme.dart';
+import '../../shared/widgets/buzz_loading_indicator.dart';
 import 'channel.dart';
 import 'channel_management_provider.dart';
 import 'channel_mutes/channel_mutes_provider.dart';
@@ -272,7 +273,12 @@ class ManageChannelSheet extends HookConsumerWidget {
                     ],
                   );
                 },
-                loading: () => const Center(child: CircularProgressIndicator()),
+                loading: () => const Center(
+                  child: BuzzLoadingIndicator(
+                    size: 40,
+                    semanticLabel: 'Loading channel details',
+                  ),
+                ),
                 error: (error, _) => Text(
                   error.toString(),
                   style: context.textTheme.bodySmall?.copyWith(
diff --git a/mobile/lib/features/channels/media_viewer_hero.dart b/mobile/lib/features/channels/media_viewer_hero.dart
new file mode 100644
index 00000000000..00be663a6f6
--- /dev/null
+++ b/mobile/lib/features/channels/media_viewer_hero.dart
@@ -0,0 +1,72 @@
+import 'package:flutter/material.dart';
+
+/// Keeps image-viewer shared-element motion consistent at every source.
+class MediaViewerHero extends StatelessWidget {
+  /// The identity shared by the inline image and full-screen image.
+  final Object tag;
+
+  /// The image rendered during and after the shared-element transition.
+  final Widget child;
+
+  /// Creates an image-viewer shared element.
+  const MediaViewerHero({super.key, required this.tag, required this.child});
+
+  @override
+  Widget build(BuildContext context) {
+    return Hero(
+      tag: tag,
+      createRectTween: (begin, end) => RectTween(begin: begin, end: end),
+      flightShuttleBuilder:
+          (
+            flightContext,
+            animation,
+            flightDirection,
+            fromHeroContext,
+            toHeroContext,
+          ) {
+            final sourceHero = fromHeroContext.widget;
+            final destinationHero = toHeroContext.widget;
+            final sourceChild = sourceHero is Hero ? sourceHero.child : child;
+            final destinationChild = destinationHero is Hero
+                ? destinationHero.child
+                : child;
+            return _MediaViewerHeroFlight(
+              animation: animation,
+              sourceChild: sourceChild,
+              destinationChild: destinationChild,
+            );
+          },
+      child: child,
+    );
+  }
+}
+
+class _MediaViewerHeroFlight extends StatelessWidget {
+  final Animation<double> animation;
+  final Widget sourceChild;
+  final Widget destinationChild;
+
+  const _MediaViewerHeroFlight({
+    required this.animation,
+    required this.sourceChild,
+    required this.destinationChild,
+  });
+
+  @override
+  Widget build(BuildContext context) {
+    final destinationOpacity = CurvedAnimation(
+      parent: animation,
+      curve: const Interval(0.18, 0.82, curve: Curves.easeInOutCubic),
+    );
+    return Stack(
+      fit: StackFit.expand,
+      children: [
+        FadeTransition(
+          opacity: ReverseAnimation(destinationOpacity),
+          child: sourceChild,
+        ),
+        FadeTransition(opacity: destinationOpacity, child: destinationChild),
+      ],
+    );
+  }
+}
diff --git a/mobile/lib/features/channels/media_viewer_page.dart b/mobile/lib/features/channels/media_viewer_page.dart
index 1c4052e1b8a..f7e1af92118 100644
--- a/mobile/lib/features/channels/media_viewer_page.dart
+++ b/mobile/lib/features/channels/media_viewer_page.dart
@@ -1,34 +1,106 @@
 import 'dart:async';
 
+import 'package:flutter/foundation.dart';
 import 'package:flutter/material.dart';
+import 'package:flutter/physics.dart';
 import 'package:flutter_hooks/flutter_hooks.dart';
+import 'package:hooks_riverpod/hooks_riverpod.dart';
 import 'package:lucide_icons_flutter/lucide_icons.dart';
 import 'package:video_player/video_player.dart';
 
 import '../../shared/relay/relay.dart';
 import '../../shared/theme/theme.dart';
+import '../../shared/widgets/buzz_loading_indicator.dart';
+import 'media_viewer_hero.dart';
 
-const _imageViewerPushDuration = Duration(milliseconds: 280);
-const _imageViewerPopDuration = Duration(milliseconds: 220);
-const _imageViewerTransitionOffset = Offset(0, 0.08);
+export 'media_viewer_hero.dart';
+
+part 'media_viewer_page/image_controls.dart';
+part 'media_viewer_page/route_transition.dart';
+
+const _imageViewerPushDuration = Duration(milliseconds: 260);
+const _imageViewerPopDuration = Duration(milliseconds: 170);
 const _identityTransformEpsilon = 0.0001;
 final List<double> _identityTransformStorage = List<double>.unmodifiable(
   Matrix4.identity().storage,
 );
 
+/// Opens message-specific actions for the currently visible image.
+typedef MediaViewerMoreAction =
+    void Function(BuildContext context, String imageUrl);
+
+/// An image and its source Hero tag in a full-screen media gallery.
+@immutable
+class MediaViewerImage {
+  /// The image URL.
+  final String url;
+
+  /// The shared-element transition tag for the source thumbnail.
+  final Object heroTag;
+
+  /// The accessible image description.
+  final String? semanticLabel;
+
+  /// The logical decode width already cached by the source thumbnail.
+  final double? previewDecodeWidth;
+
+  /// The image's intrinsic width-to-height ratio, when provided by metadata.
+  final double? aspectRatio;
+
+  /// A display-sized provider that can be warmed before this page is shown.
+  final ImageProvider<Object>? preloadProvider;
+
+  /// Creates a media-viewer image.
+  const MediaViewerImage({
+    required this.url,
+    required this.heroTag,
+    this.semanticLabel,
+    this.previewDecodeWidth,
+    this.aspectRatio,
+    this.preloadProvider,
+  });
+}
+
 PageRoute<void> buildImageViewerRoute({
   required String imageUrl,
   required Object heroTag,
   String? semanticLabel,
+  double? previewDecodeWidth,
+  double? aspectRatio,
+  List<MediaViewerImage>? galleryItems,
+  int initialIndex = 0,
+  VoidCallback? onReply,
+  MediaViewerMoreAction? onMore,
+  bool disableAnimations = false,
 }) {
+  final images =
+      galleryItems ??
+      [
+        MediaViewerImage(
+          url: imageUrl,
+          heroTag: heroTag,
+          semanticLabel: semanticLabel,
+          previewDecodeWidth: previewDecodeWidth,
+          aspectRatio: aspectRatio,
+        ),
+      ];
+  final safeInitialIndex = initialIndex.clamp(0, images.length - 1).toInt();
   return PageRouteBuilder<void>(
-    transitionDuration: _imageViewerPushDuration,
-    reverseTransitionDuration: _imageViewerPopDuration,
+    transitionDuration: disableAnimations
+        ? Duration.zero
+        : _imageViewerPushDuration,
+    reverseTransitionDuration: disableAnimations
+        ? Duration.zero
+        : _imageViewerPopDuration,
     pageBuilder: (context, animation, secondaryAnimation) =>
         MediaImageViewerPage(
           imageUrl: imageUrl,
           heroTag: heroTag,
           semanticLabel: semanticLabel,
+          galleryItems: images,
+          initialIndex: safeInitialIndex,
+          onReply: onReply,
+          onMore: onMore,
         ),
     transitionsBuilder: (context, animation, secondaryAnimation, child) =>
         _MediaViewerRouteTransition(animation: animation, child: child),
@@ -40,12 +112,25 @@ void openImageViewer(
   required String imageUrl,
   required Object heroTag,
   String? semanticLabel,
+  double? previewDecodeWidth,
+  double? aspectRatio,
+  List<MediaViewerImage>? galleryItems,
+  int initialIndex = 0,
+  VoidCallback? onReply,
+  MediaViewerMoreAction? onMore,
 }) {
   Navigator.of(context).push(
     buildImageViewerRoute(
       imageUrl: imageUrl,
       heroTag: heroTag,
       semanticLabel: semanticLabel,
+      previewDecodeWidth: previewDecodeWidth,
+      aspectRatio: aspectRatio,
+      galleryItems: galleryItems,
+      initialIndex: initialIndex,
+      onReply: onReply,
+      onMore: onMore,
+      disableAnimations: MediaQuery.disableAnimationsOf(context),
     ),
   );
 }
@@ -57,8 +142,12 @@ void openVideoViewer(
 }) {
   Navigator.of(context).push(
     PageRouteBuilder<void>(
-      transitionDuration: _imageViewerPushDuration,
-      reverseTransitionDuration: _imageViewerPopDuration,
+      transitionDuration: MediaQuery.disableAnimationsOf(context)
+          ? Duration.zero
+          : _imageViewerPushDuration,
+      reverseTransitionDuration: MediaQuery.disableAnimationsOf(context)
+          ? Duration.zero
+          : _imageViewerPopDuration,
       pageBuilder: (context, animation, secondaryAnimation) =>
           MediaVideoViewerPage(videoUrl: videoUrl, posterUrl: posterUrl),
       transitionsBuilder: (context, animation, secondaryAnimation, child) =>
@@ -67,189 +156,345 @@ void openVideoViewer(
   );
 }
 
-class _MediaViewerRouteTransition extends StatelessWidget {
-  final Animation<double> animation;
-  final Widget child;
-
-  const _MediaViewerRouteTransition({
-    required this.animation,
-    required this.child,
-  });
-
-  @override
-  Widget build(BuildContext context) {
-    final fade = CurvedAnimation(
-      parent: animation,
-      curve: Curves.easeOut,
-      reverseCurve: Curves.easeIn,
-    );
-    final slide = CurvedAnimation(
-      parent: animation,
-      curve: Curves.easeOutCubic,
-      reverseCurve: Curves.easeInCubic,
-    );
-
-    return FadeTransition(
-      opacity: fade,
-      child: SlideTransition(
-        position: Tween<Offset>(
-          begin: _imageViewerTransitionOffset,
-          end: Offset.zero,
-        ).animate(slide),
-        child: child,
-      ),
-    );
-  }
-}
-
-// StatefulWidget retained: imperative gesture/animation controllers with
-// listener lifecycle don't map cleanly to hooks (allowed exception).
-class MediaImageViewerPage extends StatefulWidget {
+class MediaImageViewerPage extends HookConsumerWidget {
   final String imageUrl;
   final Object heroTag;
   final String? semanticLabel;
+  final List<MediaViewerImage>? galleryItems;
+  final int initialIndex;
+  final VoidCallback? onReply;
+  final MediaViewerMoreAction? onMore;
 
   const MediaImageViewerPage({
     super.key,
     required this.imageUrl,
     required this.heroTag,
     this.semanticLabel,
+    this.galleryItems,
+    this.initialIndex = 0,
+    this.onReply,
+    this.onMore,
   });
 
-  @override
-  State<MediaImageViewerPage> createState() => _MediaImageViewerPageState();
-}
-
-class _MediaImageViewerPageState extends State<MediaImageViewerPage>
-    with SingleTickerProviderStateMixin {
-  late final TransformationController _transformationController;
-  late final AnimationController _snapBackController;
-  bool _isTransformed = false;
-  bool _disableHeroOnDismiss = false;
-  double _dragOffset = 0;
-  bool _isDragging = false;
-
   static const _dismissThreshold = 100.0;
+  static const _dismissVelocity = 700.0;
   static const _backgroundFadeDivisor = 300.0;
+  static const _filmstripScrubExtent = 44.0;
 
   @override
-  void initState() {
-    super.initState();
-    _transformationController = TransformationController();
-    _transformationController.addListener(_handleTransformChanged);
-    _snapBackController = AnimationController(
-      vsync: this,
+  Widget build(BuildContext context, WidgetRef ref) {
+    final images = useMemoized(
+      () =>
+          galleryItems ??
+          [
+            MediaViewerImage(
+              url: imageUrl,
+              heroTag: heroTag,
+              semanticLabel: semanticLabel,
+            ),
+          ],
+      [galleryItems, imageUrl, heroTag, semanticLabel],
+    );
+    final safeInitialIndex = initialIndex.clamp(0, images.length - 1).toInt();
+    final currentIndex = useState(safeInitialIndex);
+    final pageController = usePageController(initialPage: safeInitialIndex);
+    final pagePosition = useState(safeInitialIndex.toDouble());
+    final transformationControllers = useMemoized(
+      () => [
+        for (var index = 0; index < images.length; index++)
+          TransformationController(),
+      ],
+      [images],
+    );
+    final snapBackController = useAnimationController(
       duration: const Duration(milliseconds: 200),
     );
-  }
+    final zoomResetController = useAnimationController(
+      duration: const Duration(milliseconds: 180),
+    );
+    final zoomResetListener = useRef<VoidCallback?>(null);
+    final fullResolutionIndices = useState<Set<int>>(<int>{});
+    final isTransformed = useState(false);
+    final disableHeroOnDismiss = useState(false);
+    final dragOffset = useState(0.0);
+    final isDragging = useState(false);
+
+    void handlePagePositionChanged() {
+      if (!pageController.hasClients) return;
+      final nextPosition = pageController.page;
+      if (nextPosition == null ||
+          (nextPosition - pagePosition.value).abs() < 0.0001) {
+        return;
+      }
+      pagePosition.value = nextPosition;
+    }
 
-  @override
-  void dispose() {
-    _transformationController.removeListener(_handleTransformChanged);
-    _transformationController.dispose();
-    _snapBackController.dispose();
-    super.dispose();
-  }
+    void handleTransformChanged(int index) {
+      if (index != currentIndex.value) return;
+      final nextIsTransformed = _hasImageTransform(
+        transformationControllers[index].value,
+      );
+      if (nextIsTransformed == isTransformed.value) {
+        return;
+      }
 
-  void _handleTransformChanged() {
-    final isTransformed = _hasImageTransform(_transformationController.value);
-    if (isTransformed == _isTransformed) {
-      return;
+      isTransformed.value = nextIsTransformed;
+      if (nextIsTransformed && isDragging.value) {
+        isDragging.value = false;
+        dragOffset.value = 0;
+      }
     }
 
-    setState(() {
-      _isTransformed = isTransformed;
-      // If the user zooms in while dragging, cancel the drag.
-      if (_isTransformed && _isDragging) {
-        _isDragging = false;
-        _dragOffset = 0;
+    useEffect(() {
+      pageController.addListener(handlePagePositionChanged);
+      return () => pageController.removeListener(handlePagePositionChanged);
+    }, [pageController]);
+
+    useEffect(() {
+      final listeners = <VoidCallback>[];
+      for (var index = 0; index < transformationControllers.length; index++) {
+        final controllerIndex = index;
+        void listener() => handleTransformChanged(controllerIndex);
+        listeners.add(listener);
+        transformationControllers[index].addListener(listener);
       }
-    });
-  }
+      return () {
+        for (var index = 0; index < transformationControllers.length; index++) {
+          transformationControllers[index]
+            ..removeListener(listeners[index])
+            ..dispose();
+        }
+      };
+    }, [transformationControllers]);
+
+    useEffect(() {
+      var cancelled = false;
+      WidgetsBinding.instance.addPostFrameCallback((_) {
+        if (!cancelled && context.mounted) {
+          _precacheViewerImages(context, images, currentIndex.value);
+        }
+      });
+      return () => cancelled = true;
+    }, [images]);
+
+    useEffect(() {
+      return () {
+        final listener = zoomResetListener.value;
+        if (listener != null) {
+          zoomResetController.removeListener(listener);
+        }
+      };
+    }, [zoomResetController]);
+
+    void onPageChanged(int index) {
+      _precacheViewerImages(context, images, index);
+      currentIndex.value = index;
+      isTransformed.value = _hasImageTransform(
+        transformationControllers[index].value,
+      );
+      disableHeroOnDismiss.value = index != safeInitialIndex;
+      dragOffset.value = 0;
+      isDragging.value = false;
+    }
 
-  void _onInteractionStart(ScaleStartDetails details) {
-    if (!_isTransformed && details.pointerCount == 1) {
-      _isDragging = true;
+    void onFilmstripScrubUpdate(double delta) {
+      if (isTransformed.value || !pageController.hasClients) return;
+      final position = pageController.position;
+      final viewport = position.viewportDimension;
+      if (viewport <= 0) return;
+      final target =
+          (pageController.offset - ((delta / _filmstripScrubExtent) * viewport))
+              .clamp(position.minScrollExtent, position.maxScrollExtent)
+              .toDouble();
+      pageController.jumpTo(target);
     }
-  }
 
-  void _onInteractionUpdate(ScaleUpdateDetails details) {
-    if (_isDragging && !_isTransformed) {
-      setState(() {
-        _dragOffset += details.focalPointDelta.dy;
-      });
+    void onFilmstripScrubEnd() {
+      if (!pageController.hasClients) return;
+      final targetPage = (pageController.page ?? currentIndex.value.toDouble())
+          .round()
+          .clamp(0, images.length - 1);
+      if (MediaQuery.disableAnimationsOf(context)) {
+        pageController.jumpToPage(targetPage);
+        return;
+      }
+      pageController.animateToPage(
+        targetPage,
+        duration: const Duration(milliseconds: 180),
+        curve: Curves.easeOutCubic,
+      );
     }
-  }
 
-  void _onInteractionEnd(ScaleEndDetails details) {
-    if (!_isDragging) return;
-    _isDragging = false;
+    void upgradeToFullResolution(int index) {
+      if (images[index].previewDecodeWidth == null ||
+          fullResolutionIndices.value.contains(index)) {
+        return;
+      }
+      fullResolutionIndices.value = {...fullResolutionIndices.value, index};
+    }
 
-    if (_dragOffset.abs() > _dismissThreshold) {
-      _dismiss();
-    } else {
-      _animateSnapBack();
+    void onImageInteractionStart(int index, ScaleStartDetails details) {
+      if (details.pointerCount > 1) {
+        upgradeToFullResolution(index);
+      }
+      if (details.pointerCount == 1 && !isTransformed.value) {
+        isDragging.value = true;
+      }
     }
-  }
 
-  void _animateSnapBack() {
-    final startOffset = _dragOffset;
-    final tween = Tween<double>(begin: startOffset, end: 0);
-    final curved = CurvedAnimation(
-      parent: _snapBackController,
-      curve: Curves.easeOut,
-    );
+    void onImageInteractionUpdate(int index, ScaleUpdateDetails details) {
+      if (details.pointerCount > 1 || details.scale != 1) {
+        final needsFullResolution =
+            images[index].previewDecodeWidth != null &&
+            !fullResolutionIndices.value.contains(index);
+        if (isDragging.value || needsFullResolution) {
+          if (needsFullResolution) {
+            fullResolutionIndices.value = {
+              ...fullResolutionIndices.value,
+              index,
+            };
+          }
+          isDragging.value = false;
+          dragOffset.value = 0;
+        }
+        return;
+      }
 
-    void listener() {
-      setState(() {
-        _dragOffset = tween.evaluate(curved);
-      });
+      if (!isDragging.value || isTransformed.value) return;
+      dragOffset.value = (dragOffset.value + details.focalPointDelta.dy).clamp(
+        0.0,
+        MediaQuery.sizeOf(context).height,
+      );
     }
 
-    _snapBackController
-      ..reset()
-      ..addListener(listener);
-    _snapBackController.forward().whenCompleteOrCancel(() {
-      _snapBackController.removeListener(listener);
-    });
-  }
+    void resetImageTransform(int index) {
+      final controller = transformationControllers[index];
+      if (!_hasImageTransform(controller.value)) {
+        return;
+      }
+
+      final previousListener = zoomResetListener.value;
+      if (previousListener != null) {
+        zoomResetController.removeListener(previousListener);
+      }
+      zoomResetController.stop();
 
-  bool get _canDismissWithHero => !_isTransformed || _disableHeroOnDismiss;
+      if (MediaQuery.disableAnimationsOf(context)) {
+        controller.value = Matrix4.identity();
+        zoomResetListener.value = null;
+        return;
+      }
 
-  Future<void> _prepareHeroFallbackDismiss() async {
-    if (_canDismissWithHero) {
-      return;
+      final animation =
+          Matrix4Tween(
+            begin: Matrix4.copy(controller.value),
+            end: Matrix4.identity(),
+          ).animate(
+            CurvedAnimation(
+              parent: zoomResetController,
+              curve: Curves.easeOutCubic,
+            ),
+          );
+      void listener() => controller.value = animation.value;
+      zoomResetListener.value = listener;
+      zoomResetController
+        ..reset()
+        ..addListener(listener)
+        ..forward();
     }
 
-    setState(() {
-      _disableHeroOnDismiss = true;
-    });
+    bool canDismissWithHero() =>
+        !isTransformed.value || disableHeroOnDismiss.value;
 
-    await WidgetsBinding.instance.endOfFrame;
-  }
+    Future<void> prepareHeroFallbackDismiss() async {
+      if (canDismissWithHero()) {
+        return;
+      }
+      disableHeroOnDismiss.value = true;
+      await WidgetsBinding.instance.endOfFrame;
+    }
 
-  Future<void> _dismiss() async {
-    await _prepareHeroFallbackDismiss();
-    if (!mounted) {
-      return;
+    Future<void> dismiss() async {
+      await prepareHeroFallbackDismiss();
+      if (!context.mounted) {
+        return;
+      }
+      Navigator.of(context).maybePop();
     }
-    Navigator.of(context).maybePop();
-  }
 
-  @override
-  Widget build(BuildContext context) {
+    void animateSnapBack() {
+      final tween = Tween<double>(begin: dragOffset.value, end: 0);
+
+      void listener() {
+        dragOffset.value = tween.evaluate(snapBackController);
+      }
+
+      snapBackController
+        ..stop()
+        ..reset()
+        ..addListener(listener);
+      snapBackController
+          .animateWith(
+            SpringSimulation(
+              SpringDescription.withDurationAndBounce(
+                duration: const Duration(milliseconds: 260),
+                bounce: 0.14,
+              ),
+              0,
+              1,
+              0,
+              snapToEnd: true,
+            ),
+          )
+          .whenCompleteOrCancel(() {
+            snapBackController.removeListener(listener);
+          });
+    }
+
+    void finishVerticalDismiss(double velocity) {
+      isDragging.value = false;
+      if (dragOffset.value > _dismissThreshold || velocity > _dismissVelocity) {
+        unawaited(dismiss());
+      } else {
+        animateSnapBack();
+      }
+    }
+
+    void onImageInteractionEnd(ScaleEndDetails details) {
+      if (!isDragging.value) return;
+      finishVerticalDismiss(details.velocity.pixelsPerSecond.dy);
+    }
+
+    Future<void> replyInThread() async {
+      final callback = onReply;
+      if (callback == null) return;
+      final route = ModalRoute.of(context);
+      await dismiss();
+      await route?.completed;
+      callback();
+    }
+
+    void showMoreActions() {
+      onMore?.call(context, images[currentIndex.value].url);
+    }
+
+    final viewportHeight = MediaQuery.sizeOf(context).height;
+    final dragProgress = (dragOffset.value / viewportHeight).clamp(0.0, 1.0);
+    final imageScale = 1 - (dragProgress * 0.1);
+    final chromeOpacity = (1 - (dragOffset.value / 160)).clamp(0.0, 1.0);
+
     return PopScope<void>(
-      canPop: _canDismissWithHero,
+      canPop: canDismissWithHero(),
       onPopInvokedWithResult: (didPop, result) {
         if (didPop) {
           return;
         }
-        unawaited(_dismiss());
+        unawaited(dismiss());
       },
       child: Scaffold(
         key: const ValueKey('message-media-image-viewer'),
         backgroundColor: Colors.black.withValues(
-          alpha: (1 - (_dragOffset.abs() / _backgroundFadeDivisor)).clamp(
+          alpha: (1 - (dragOffset.value.abs() / _backgroundFadeDivisor)).clamp(
             0.3,
             1.0,
           ),
@@ -258,52 +503,146 @@ class _MediaImageViewerPageState extends State<MediaImageViewerPage>
           children: [
             Positioned.fill(
               child: Transform.translate(
-                offset: Offset(0, _dragOffset),
-                child: InteractiveViewer(
-                  transformationController: _transformationController,
-                  onInteractionStart: _onInteractionStart,
-                  onInteractionUpdate: _onInteractionUpdate,
-                  onInteractionEnd: _onInteractionEnd,
-                  minScale: 1,
-                  maxScale: 4,
-                  child: Center(
-                    child: HeroMode(
-                      key: const ValueKey(
-                        'message-media-image-viewer-hero-mode',
-                      ),
-                      enabled: !_disableHeroOnDismiss,
-                      child: Hero(
-                        tag: widget.heroTag,
-                        child: MediaImage(
-                          url: widget.imageUrl,
-                          boundDecodeToLayout: false,
-                          fit: BoxFit.contain,
-                          semanticLabel: widget.semanticLabel,
-                          errorBuilder: (_, _, _) => const _MediaLoadFailure(
-                            message: 'Failed to load image',
-                            icon: LucideIcons.imageOff,
-                          ),
+                offset: Offset(0, dragOffset.value),
+                child: Transform.scale(
+                  scale: imageScale,
+                  child: PageView.builder(
+                    key: const ValueKey('message-media-image-viewer-pages'),
+                    controller: pageController,
+                    physics: isTransformed.value
+                        ? const NeverScrollableScrollPhysics()
+                        : const PageScrollPhysics(),
+                    itemCount: images.length,
+                    onPageChanged: onPageChanged,
+                    itemBuilder: (context, index) {
+                      final image = images[index];
+                      final viewPadding = MediaQuery.viewPaddingOf(context);
+                      return Padding(
+                        padding: EdgeInsets.only(
+                          top: viewPadding.top + 48 + Grid.xxs,
+                          bottom: viewPadding.bottom + 56 + (Grid.xxs * 2),
+                        ),
+                        child: LayoutBuilder(
+                          builder: (context, constraints) {
+                            final viewerSize = _imageViewerSize(
+                              Size(constraints.maxWidth, constraints.maxHeight),
+                              image.aspectRatio,
+                            );
+                            return GestureDetector(
+                              key: ValueKey(
+                                'message-media-image-viewer-gesture:$index',
+                              ),
+                              behavior: HitTestBehavior.opaque,
+                              onDoubleTap: () => resetImageTransform(index),
+                              child: InteractiveViewer(
+                                transformationController:
+                                    transformationControllers[index],
+                                onInteractionStart: (details) =>
+                                    onImageInteractionStart(index, details),
+                                onInteractionUpdate: (details) =>
+                                    onImageInteractionUpdate(index, details),
+                                onInteractionEnd: onImageInteractionEnd,
+                                panEnabled: isTransformed.value,
+                                scaleEnabled: true,
+                                minScale: 1,
+                                maxScale: 4,
+                                boundaryMargin: const EdgeInsets.all(Grid.xxl),
+                                clipBehavior: Clip.none,
+                                child: Align(
+                                  alignment: Alignment.center,
+                                  child: SizedBox(
+                                    width: viewerSize.width,
+                                    height: viewerSize.height,
+                                    child: HeroMode(
+                                      key: index == safeInitialIndex
+                                          ? const ValueKey(
+                                              'message-media-image-viewer-hero-mode',
+                                            )
+                                          : ValueKey(
+                                              'message-media-image-viewer-hero-mode-$index',
+                                            ),
+                                      enabled:
+                                          !disableHeroOnDismiss.value &&
+                                          index == safeInitialIndex,
+                                      child: MediaViewerHero(
+                                        tag: image.heroTag,
+                                        child: MediaImage(
+                                          key: ValueKey(
+                                            'message-media-image-viewer-image:$index',
+                                          ),
+                                          url: image.url,
+                                          decodeWidth:
+                                              fullResolutionIndices.value
+                                                  .contains(index)
+                                              ? null
+                                              : image.previewDecodeWidth,
+                                          boundDecodeToLayout: false,
+                                          fit: BoxFit.contain,
+                                          semanticLabel: image.semanticLabel,
+                                          errorBuilder: (_, _, _) =>
+                                              const _MediaLoadFailure(
+                                                message: 'Failed to load image',
+                                                icon: LucideIcons.imageOff,
+                                              ),
+                                        ),
+                                      ),
+                                    ),
+                                  ),
+                                ),
+                              ),
+                            );
+                          },
                         ),
-                      ),
-                    ),
+                      );
+                    },
                   ),
                 ),
               ),
             ),
             PositionedDirectional(
-              top: Grid.sm,
-              end: Grid.sm,
-              child: SafeArea(
-                child: DecoratedBox(
-                  decoration: const BoxDecoration(
-                    color: Color.fromRGBO(0, 0, 0, 0.56),
-                    shape: BoxShape.circle,
+              bottom: 0,
+              start: 0,
+              end: 0,
+              child: Opacity(
+                opacity: chromeOpacity,
+                child: SafeArea(
+                  child: _MediaViewerBottomControls(
+                    images: images,
+                    currentIndex: currentIndex.value,
+                    pagePosition: pagePosition,
+                    onScrubUpdate: onFilmstripScrubUpdate,
+                    onScrubEnd: onFilmstripScrubEnd,
+                    onSelect: (index) {
+                      if (index == currentIndex.value) return;
+                      if (MediaQuery.disableAnimationsOf(context)) {
+                        pageController.jumpToPage(index);
+                        return;
+                      }
+                      pageController.animateToPage(
+                        index,
+                        duration: const Duration(milliseconds: 220),
+                        curve: Curves.easeOutCubic,
+                      );
+                    },
+                    onReply: onReply == null
+                        ? null
+                        : () => unawaited(replyInThread()),
+                    onMore: onMore == null ? null : showMoreActions,
                   ),
-                  child: IconButton(
+                ),
+              ),
+            ),
+            PositionedDirectional(
+              top: 0,
+              end: Grid.sm,
+              child: Opacity(
+                opacity: chromeOpacity,
+                child: SafeArea(
+                  child: _MediaViewerCircleButton(
                     key: const ValueKey('message-media-image-viewer-close'),
-                    onPressed: _dismiss,
+                    icon: LucideIcons.x,
                     tooltip: 'Close image viewer',
-                    icon: const Icon(LucideIcons.x, color: Colors.white),
+                    onPressed: () => unawaited(dismiss()),
                   ),
                 ),
               ),
@@ -315,17 +654,6 @@ class _MediaImageViewerPageState extends State<MediaImageViewerPage>
   }
 }
 
-bool _hasImageTransform(Matrix4 transform) {
-  final storage = transform.storage;
-  for (var index = 0; index < storage.length; index++) {
-    if ((storage[index] - _identityTransformStorage[index]).abs() >
-        _identityTransformEpsilon) {
-      return true;
-    }
-  }
-  return false;
-}
-
 // StatefulWidget retained: owns a VideoPlayerController with async init and
 // disposal — kept imperative deliberately (allowed exception).
 class MediaVideoViewerPage extends StatefulWidget {
@@ -462,7 +790,13 @@ class _VideoLoadingPoster extends StatelessWidget {
           else
             _videoPlaceholder(context),
           const ColoredBox(color: Color.fromRGBO(0, 0, 0, 0.24)),
-          const Center(child: CircularProgressIndicator()),
+          const Center(
+            child: BuzzLoadingIndicator(
+              size: 44,
+              color: Colors.white,
+              semanticLabel: 'Loading video',
+            ),
+          ),
         ],
       ),
     );
diff --git a/mobile/lib/features/channels/media_viewer_page/image_controls.dart b/mobile/lib/features/channels/media_viewer_page/image_controls.dart
new file mode 100644
index 00000000000..77361676116
--- /dev/null
+++ b/mobile/lib/features/channels/media_viewer_page/image_controls.dart
@@ -0,0 +1,300 @@
+part of '../media_viewer_page.dart';
+
+class _MediaViewerBottomControls extends StatelessWidget {
+  final List<MediaViewerImage> images;
+  final int currentIndex;
+  final ValueListenable<double> pagePosition;
+  final ValueChanged<double> onScrubUpdate;
+  final VoidCallback onScrubEnd;
+  final ValueChanged<int> onSelect;
+  final VoidCallback? onReply;
+  final VoidCallback? onMore;
+
+  const _MediaViewerBottomControls({
+    required this.images,
+    required this.currentIndex,
+    required this.pagePosition,
+    required this.onScrubUpdate,
+    required this.onScrubEnd,
+    required this.onSelect,
+    required this.onReply,
+    required this.onMore,
+  });
+
+  @override
+  Widget build(BuildContext context) {
+    return Padding(
+      padding: const EdgeInsets.fromLTRB(Grid.sm, Grid.xxs, Grid.sm, 0),
+      child: Row(
+        crossAxisAlignment: CrossAxisAlignment.center,
+        children: [
+          _MediaViewerCircleButton(
+            key: const ValueKey('message-media-image-viewer-reply-thread'),
+            icon: LucideIcons.messageSquareReply,
+            tooltip: 'Reply in thread',
+            onPressed: onReply,
+          ),
+          const SizedBox(width: Grid.xxs),
+          Expanded(
+            child: images.length > 1
+                ? _MediaViewerFilmstrip(
+                    key: const ValueKey('message-media-image-viewer-filmstrip'),
+                    images: images,
+                    currentIndex: currentIndex,
+                    pagePosition: pagePosition,
+                    onScrubUpdate: onScrubUpdate,
+                    onScrubEnd: onScrubEnd,
+                    onSelect: onSelect,
+                  )
+                : const SizedBox(height: 56),
+          ),
+          const SizedBox(width: Grid.xxs),
+          _MediaViewerCircleButton(
+            key: const ValueKey('message-media-image-viewer-more-actions'),
+            icon: LucideIcons.ellipsis,
+            tooltip: 'More image actions',
+            onPressed: onMore,
+          ),
+        ],
+      ),
+    );
+  }
+}
+
+class _MediaViewerFilmstrip extends StatelessWidget {
+  final List<MediaViewerImage> images;
+  final int currentIndex;
+  final ValueListenable<double> pagePosition;
+  final ValueChanged<double> onScrubUpdate;
+  final VoidCallback onScrubEnd;
+  final ValueChanged<int> onSelect;
+
+  const _MediaViewerFilmstrip({
+    super.key,
+    required this.images,
+    required this.currentIndex,
+    required this.pagePosition,
+    required this.onScrubUpdate,
+    required this.onScrubEnd,
+    required this.onSelect,
+  });
+
+  @override
+  Widget build(BuildContext context) {
+    return SizedBox(
+      height: 56,
+      child: RepaintBoundary(
+        child: GestureDetector(
+          behavior: HitTestBehavior.opaque,
+          onHorizontalDragUpdate: (details) =>
+              onScrubUpdate(details.primaryDelta ?? 0),
+          onHorizontalDragEnd: (_) => onScrubEnd(),
+          child: ValueListenableBuilder<double>(
+            valueListenable: pagePosition,
+            builder: (context, position, _) {
+              return LayoutBuilder(
+                builder: (context, constraints) {
+                  const compactWidth = 40.0;
+                  const focusedWidth = 72.0;
+                  const itemHeight = 52.0;
+                  const spacing = Grid.half;
+                  final clampedPosition = position
+                      .clamp(0.0, images.length - 1.0)
+                      .toDouble();
+                  final widths = <double>[];
+                  final proximities = <double>[];
+                  final centers = <double>[];
+                  var cursor = 0.0;
+
+                  for (var index = 0; index < images.length; index++) {
+                    final proximity = (1 - (index - clampedPosition).abs())
+                        .clamp(0.0, 1.0)
+                        .toDouble();
+                    final width =
+                        compactWidth +
+                        ((focusedWidth - compactWidth) * proximity);
+                    widths.add(width);
+                    proximities.add(proximity);
+                    centers.add(cursor + (width / 2));
+                    cursor += width + spacing;
+                  }
+
+                  final lowerIndex = clampedPosition.floor();
+                  final upperIndex = clampedPosition.ceil();
+                  final fraction = clampedPosition - lowerIndex;
+                  final lowerCenter = centers[lowerIndex];
+                  final upperCenter = centers[upperIndex];
+                  final focusCenter =
+                      lowerCenter + ((upperCenter - lowerCenter) * fraction);
+                  final viewportCenter = constraints.maxWidth / 2;
+
+                  return Stack(
+                    clipBehavior: Clip.hardEdge,
+                    children: [
+                      for (var index = 0; index < images.length; index++)
+                        Positioned(
+                          left:
+                              viewportCenter +
+                              centers[index] -
+                              focusCenter -
+                              (widths[index] / 2),
+                          top: Grid.quarter,
+                          width: widths[index],
+                          height: itemHeight,
+                          child: _MediaViewerFilmstripImage(
+                            image: images[index],
+                            index: index,
+                            proximity: proximities[index],
+                            selected: index == currentIndex,
+                            onSelect: onSelect,
+                          ),
+                        ),
+                    ],
+                  );
+                },
+              );
+            },
+          ),
+        ),
+      ),
+    );
+  }
+}
+
+class _MediaViewerFilmstripImage extends StatelessWidget {
+  final MediaViewerImage image;
+  final int index;
+  final double proximity;
+  final bool selected;
+  final ValueChanged<int> onSelect;
+
+  const _MediaViewerFilmstripImage({
+    required this.image,
+    required this.index,
+    required this.proximity,
+    required this.selected,
+    required this.onSelect,
+  });
+
+  @override
+  Widget build(BuildContext context) {
+    final borderWidth = 1 + (1.5 * proximity);
+    return Semantics(
+      button: true,
+      selected: selected,
+      label: selected
+          ? 'Image ${index + 1}, selected'
+          : 'Show image ${index + 1}',
+      child: GestureDetector(
+        key: ValueKey('message-media-image-viewer-thumbnail:$index'),
+        onTap: () => onSelect(index),
+        child: Container(
+          height: 52,
+          padding: EdgeInsets.all(borderWidth),
+          decoration: BoxDecoration(
+            borderRadius: BorderRadius.circular(Radii.sm),
+            border: Border.all(
+              color: Colors.white.withValues(alpha: 0.28 + (0.72 * proximity)),
+              width: borderWidth,
+            ),
+          ),
+          child: ClipRRect(
+            key: ValueKey('message-media-image-viewer-thumbnail-clip:$index'),
+            borderRadius: BorderRadius.circular(Radii.sm - borderWidth),
+            clipBehavior: Clip.antiAlias,
+            child: Opacity(
+              opacity: 0.62 + (0.38 * proximity),
+              child: MediaImage(
+                url: image.url,
+                decodeWidth: 72,
+                fit: BoxFit.cover,
+                semanticLabel: image.semanticLabel,
+                errorBuilder: (_, _, _) => const ColoredBox(
+                  color: Color.fromRGBO(255, 255, 255, 0.12),
+                  child: Icon(
+                    LucideIcons.imageOff,
+                    color: Colors.white70,
+                    size: 18,
+                  ),
+                ),
+              ),
+            ),
+          ),
+        ),
+      ),
+    );
+  }
+}
+
+class _MediaViewerCircleButton extends StatelessWidget {
+  final IconData icon;
+  final String tooltip;
+  final VoidCallback? onPressed;
+
+  const _MediaViewerCircleButton({
+    super.key,
+    required this.icon,
+    required this.tooltip,
+    required this.onPressed,
+  });
+
+  @override
+  Widget build(BuildContext context) {
+    return SizedBox.square(
+      dimension: 48,
+      child: onPressed == null
+          ? const SizedBox.shrink()
+          : DecoratedBox(
+              decoration: BoxDecoration(
+                color: Colors.white.withValues(alpha: 0.16),
+                shape: BoxShape.circle,
+              ),
+              child: IconButton(
+                onPressed: onPressed,
+                tooltip: tooltip,
+                icon: Icon(icon, color: Colors.white, size: 20),
+              ),
+            ),
+    );
+  }
+}
+
+Size _imageViewerSize(Size viewport, double? aspectRatio) {
+  if (aspectRatio == null || aspectRatio <= 0) {
+    return viewport;
+  }
+
+  final safeAspectRatio = aspectRatio.clamp(0.05, 20.0).toDouble();
+  if (viewport.aspectRatio > safeAspectRatio) {
+    return Size(viewport.height * safeAspectRatio, viewport.height);
+  }
+  return Size(viewport.width, viewport.width / safeAspectRatio);
+}
+
+void _precacheViewerImages(
+  BuildContext context,
+  List<MediaViewerImage> images,
+  int focusedIndex,
+) {
+  for (var index = focusedIndex - 2; index <= focusedIndex + 2; index++) {
+    if (index < 0 || index >= images.length) {
+      continue;
+    }
+    final provider = images[index].preloadProvider;
+    if (provider == null) {
+      continue;
+    }
+    unawaited(precacheImage(provider, context, onError: (_, _) {}));
+  }
+}
+
+bool _hasImageTransform(Matrix4 transform) {
+  final storage = transform.storage;
+  for (var index = 0; index < storage.length; index++) {
+    if ((storage[index] - _identityTransformStorage[index]).abs() >
+        _identityTransformEpsilon) {
+      return true;
+    }
+  }
+  return false;
+}
diff --git a/mobile/lib/features/channels/media_viewer_page/route_transition.dart b/mobile/lib/features/channels/media_viewer_page/route_transition.dart
new file mode 100644
index 00000000000..5ebed62a95a
--- /dev/null
+++ b/mobile/lib/features/channels/media_viewer_page/route_transition.dart
@@ -0,0 +1,22 @@
+part of '../media_viewer_page.dart';
+
+class _MediaViewerRouteTransition extends StatelessWidget {
+  final Animation<double> animation;
+  final Widget child;
+
+  const _MediaViewerRouteTransition({
+    required this.animation,
+    required this.child,
+  });
+
+  @override
+  Widget build(BuildContext context) {
+    final fade = CurvedAnimation(
+      parent: animation,
+      curve: Curves.easeOutCubic,
+      reverseCurve: Curves.easeInOutCubic,
+    );
+
+    return FadeTransition(opacity: fade, child: child);
+  }
+}
diff --git a/mobile/lib/features/channels/members_sheet.dart b/mobile/lib/features/channels/members_sheet.dart
index b17d9f4823f..e1c79164ee1 100644
--- a/mobile/lib/features/channels/members_sheet.dart
+++ b/mobile/lib/features/channels/members_sheet.dart
@@ -5,6 +5,7 @@ import 'package:lucide_icons_flutter/lucide_icons.dart';
 
 import '../../shared/theme/theme.dart';
 import '../../shared/widgets/avatar_image.dart';
+import '../../shared/widgets/buzz_loading_indicator.dart';
 import '../profile/user_cache_provider.dart';
 import '../profile/user_profile.dart';
 import '../profile/user_status.dart';
@@ -150,7 +151,12 @@ class MembersSheet extends HookConsumerWidget {
                       ),
                   ],
                 ),
-                loading: () => const Center(child: CircularProgressIndicator()),
+                loading: () => const Center(
+                  child: BuzzLoadingIndicator(
+                    size: 44,
+                    semanticLabel: 'Loading members',
+                  ),
+                ),
                 error: (error, _) => Center(
                   child: Text(
                     error.toString(),
@@ -240,13 +246,10 @@ class _MemberTile extends ConsumerWidget {
           ? Row(
               mainAxisSize: MainAxisSize.min,
               children: [
-                SizedBox(
-                  width: 10,
-                  height: 10,
-                  child: CircularProgressIndicator(
-                    strokeWidth: 1.5,
-                    color: context.appColors.success,
-                  ),
+                BuzzLoadingIndicator(
+                  size: 14,
+                  color: context.appColors.success,
+                  semanticLabel: 'Agent working',
                 ),
                 const SizedBox(width: Grid.half),
                 Text(
diff --git a/mobile/lib/features/channels/message_actions.dart b/mobile/lib/features/channels/message_actions.dart
index c1b52203e6d..c4cc5e2a0e2 100644
--- a/mobile/lib/features/channels/message_actions.dart
+++ b/mobile/lib/features/channels/message_actions.dart
@@ -1,24 +1,38 @@
+import 'dart:async';
+import 'dart:io';
+
+import 'package:flutter/foundation.dart';
 import 'package:flutter/material.dart';
 import 'package:flutter/services.dart';
 import 'package:hooks_riverpod/hooks_riverpod.dart';
 import 'package:lucide_icons_flutter/lucide_icons.dart';
+import 'package:path_provider/path_provider.dart';
+import 'package:photo_manager/photo_manager.dart';
+import 'package:share_plus/share_plus.dart';
 
+import '../../shared/clipboard_utils.dart';
+import '../../shared/deeplink/deep_link.dart';
+import '../../shared/relay/relay.dart';
 import '../../shared/theme/theme.dart';
 import '../../shared/custom_emoji/custom_emoji.dart';
 import '../../shared/custom_emoji/custom_emoji_provider.dart';
+import '../../shared/widgets/sheet_divider.dart';
+import '../../shared/reminders/remind_me_later_sheet.dart';
+import '../../shared/reminders/reminder_service.dart';
 import 'channel_management_provider.dart';
 import 'emoji_picker.dart';
+import 'read_state/message_read_state.dart';
+import 'read_state/read_state_format.dart';
+import 'read_state/read_state_provider.dart';
 import 'thread_detail_page.dart';
+import 'thread_follows/thread_follows_provider.dart';
 import 'timeline_message.dart';
 
-const quickEmojis = [
-  '\u{1F44D}',
-  '\u{2764}\u{FE0F}',
-  '\u{1F602}',
-  '\u{1F389}',
-  '\u{1F440}',
-  '\u{1F64F}',
-];
+const quickEmojis = ['\u{1F44D}', '\u{2764}\u{FE0F}', '\u{1F602}', '\u{1F389}'];
+
+/// Preview length for reminder targets — matches desktop's
+/// `msg.body.slice(0, 100)`.
+const _reminderPreviewLength = 100;
 
 void showMessageActions({
   required BuildContext context,
@@ -33,116 +47,194 @@ void showMessageActions({
 }) {
   showModalBottomSheet<void>(
     context: context,
+    isScrollControlled: true,
     showDragHandle: true,
     builder: (sheetContext) => SafeArea(
-      child: Padding(
-        padding: const EdgeInsets.fromLTRB(
-          Grid.gutter,
-          0,
-          Grid.gutter,
-          Grid.xs,
+      child: ConstrainedBox(
+        constraints: BoxConstraints(
+          maxHeight: MediaQuery.sizeOf(sheetContext).height * 0.7,
         ),
-        child: Column(
-          mainAxisSize: MainAxisSize.min,
-          children: [
-            // Quick emoji row
-            Row(
-              mainAxisAlignment: MainAxisAlignment.spaceEvenly,
+        child: SingleChildScrollView(
+          child: Padding(
+            padding: const EdgeInsets.fromLTRB(
+              Grid.gutter,
+              0,
+              Grid.gutter,
+              Grid.xs,
+            ),
+            child: Column(
+              mainAxisSize: MainAxisSize.min,
               children: [
-                for (final emoji in quickEmojis)
-                  GestureDetector(
+                // Quick emoji row
+                Row(
+                  mainAxisAlignment: MainAxisAlignment.spaceEvenly,
+                  children: [
+                    for (final emoji in quickEmojis)
+                      _QuickReactionCircle(
+                        onTap: () {
+                          Navigator.of(sheetContext).pop();
+                          ref
+                              .read(channelActionsProvider)
+                              .addReaction(message.id, emoji);
+                        },
+                        child: Text(
+                          emoji,
+                          style: const TextStyle(fontSize: 24),
+                        ),
+                      ),
+                    _QuickReactionCircle(
+                      onTap: () {
+                        Navigator.of(sheetContext).pop();
+                        showEmojiPicker(
+                          context: context,
+                          onSelect: (emoji) {
+                            ref
+                                .read(channelActionsProvider)
+                                .addReaction(message.id, emoji);
+                          },
+                        );
+                      },
+                      child: Icon(
+                        LucideIcons.plus,
+                        size: 24,
+                        color: sheetContext.colors.onSurfaceVariant,
+                      ),
+                    ),
+                  ],
+                ),
+                const SizedBox(height: Grid.xs),
+                if (!message.isSystem) ...[
+                  // Fast actions: respond now, hand off context, defer.
+                  _FastActionsRow(
+                    message: message,
+                    channelId: channelId,
+                    allMessages: allMessages,
+                    currentPubkey: currentPubkey,
+                    isMember: isMember,
+                    isArchived: isArchived,
+                    pageContext: context,
+                  ),
+                  const SizedBox(height: Grid.xs),
+                  // Triage: come back to this message later.
+                  _MarkReadUnreadTile(message: message, channelId: channelId),
+                  _FollowThreadTile(message: message),
+                  const SheetDivider(),
+                  // Export: take the content out of the conversation.
+                  ListTile(
+                    leading: const Icon(LucideIcons.copy),
+                    title: const Text('Copy text'),
                     onTap: () {
                       Navigator.of(sheetContext).pop();
-                      ref
-                          .read(channelActionsProvider)
-                          .addReaction(message.id, emoji);
+                      // Copy to clipboard
+                      final data = ClipboardData(text: message.content);
+                      Clipboard.setData(data);
                     },
-                    child: Container(
-                      width: 44,
-                      height: 44,
-                      alignment: Alignment.center,
-                      decoration: BoxDecoration(
-                        color: sheetContext.colors.surfaceContainerHighest,
-                        shape: BoxShape.circle,
-                      ),
-                      child: Text(emoji, style: const TextStyle(fontSize: 20)),
-                    ),
                   ),
-                GestureDetector(
-                  onTap: () {
-                    Navigator.of(sheetContext).pop();
-                    showEmojiPicker(
-                      context: context,
-                      onSelect: (emoji) {
-                        ref
-                            .read(channelActionsProvider)
-                            .addReaction(message.id, emoji);
-                      },
-                    );
-                  },
-                  child: Container(
-                    width: 44,
-                    height: 44,
-                    alignment: Alignment.center,
-                    decoration: BoxDecoration(
-                      color: sheetContext.colors.surfaceContainerHighest,
-                      shape: BoxShape.circle,
+                ],
+                if (canManageMessage) ...[
+                  if (!message.isSystem) const SheetDivider(),
+                  ListTile(
+                    leading: const Icon(LucideIcons.pencil),
+                    title: const Text('Edit message'),
+                    onTap: () {
+                      Navigator.of(sheetContext).pop();
+                      _showEditSheet(
+                        context: context,
+                        ref: ref,
+                        message: message,
+                        channelId: channelId,
+                      );
+                    },
+                  ),
+                  ListTile(
+                    leading: Icon(
+                      LucideIcons.trash2,
+                      color: sheetContext.colors.error,
                     ),
-                    child: Icon(
-                      LucideIcons.plus,
-                      size: 20,
-                      color: sheetContext.colors.onSurfaceVariant,
+                    title: Text(
+                      'Delete message',
+                      style: TextStyle(color: sheetContext.colors.error),
                     ),
+                    onTap: () {
+                      Navigator.of(sheetContext).pop();
+                      _confirmDelete(
+                        context: context,
+                        ref: ref,
+                        channelId: channelId,
+                        messageId: message.id,
+                      );
+                    },
                   ),
-                ),
+                ],
               ],
             ),
-            const SizedBox(height: Grid.xs),
-            if (allMessages != null && !message.isSystem)
-              ListTile(
-                leading: const Icon(LucideIcons.messageSquareReply),
-                title: const Text('Reply in thread'),
-                onTap: () {
-                  Navigator.of(sheetContext).pop();
-                  Navigator.of(context).push(
-                    MaterialPageRoute<void>(
-                      builder: (_) => ThreadDetailPage(
-                        threadHead: message,
-                        allMessages: allMessages,
-                        channelId: channelId,
-                        currentPubkey: currentPubkey,
-                        isMember: isMember,
-                        isArchived: isArchived,
-                      ),
-                    ),
-                  );
-                },
-              ),
-            if (!message.isSystem)
-              ListTile(
-                leading: const Icon(LucideIcons.copy),
-                title: const Text('Copy text'),
-                onTap: () {
-                  Navigator.of(sheetContext).pop();
-                  // Copy to clipboard
-                  final data = ClipboardData(text: message.content);
-                  Clipboard.setData(data);
-                },
-              ),
+          ),
+        ),
+      ),
+    ),
+  );
+}
+
+/// Image-focused actions shown from the full-screen viewer.
+void showImageActions({
+  required BuildContext context,
+  required WidgetRef ref,
+  required TimelineMessage message,
+  required String channelId,
+  required String imageUrl,
+  required bool canManageMessage,
+  VoidCallback? onDeleted,
+}) {
+  showModalBottomSheet<void>(
+    context: context,
+    showDragHandle: true,
+    builder: (sheetContext) => SafeArea(
+      child: Padding(
+        padding: const EdgeInsets.fromLTRB(
+          Grid.gutter,
+          0,
+          Grid.gutter,
+          Grid.xs,
+        ),
+        child: Column(
+          mainAxisSize: MainAxisSize.min,
+          children: [
+            ListTile(
+              leading: const Icon(LucideIcons.download),
+              title: const Text('Save image'),
+              onTap: () {
+                Navigator.of(sheetContext).pop();
+                unawaited(_saveImage(context, ref, imageUrl));
+              },
+            ),
+            ListTile(
+              leading: const Icon(LucideIcons.share2),
+              title: const Text('Share image'),
+              onTap: () {
+                final renderBox = context.findRenderObject() as RenderBox?;
+                final shareOrigin = renderBox == null
+                    ? null
+                    : renderBox.localToGlobal(Offset.zero) & renderBox.size;
+                Navigator.of(sheetContext).pop();
+                unawaited(
+                  _shareImage(context, ref, imageUrl, shareOrigin: shareOrigin),
+                );
+              },
+            ),
+            ListTile(
+              leading: const Icon(LucideIcons.link2),
+              title: const Text('Copy image link'),
+              onTap: () {
+                Navigator.of(sheetContext).pop();
+                copyToClipboard(
+                  context,
+                  imageUrl,
+                  message: 'Image link copied',
+                );
+              },
+            ),
             if (canManageMessage) ...[
-              ListTile(
-                leading: const Icon(LucideIcons.pencil),
-                title: const Text('Edit message'),
-                onTap: () {
-                  Navigator.of(sheetContext).pop();
-                  _showEditSheet(
-                    context: context,
-                    ref: ref,
-                    message: message,
-                    channelId: channelId,
-                  );
-                },
-              ),
+              const SheetDivider(),
               ListTile(
                 leading: Icon(
                   LucideIcons.trash2,
@@ -159,6 +251,7 @@ void showMessageActions({
                     ref: ref,
                     channelId: channelId,
                     messageId: message.id,
+                    onDeleted: onDeleted,
                   );
                 },
               ),
@@ -170,6 +263,383 @@ void showMessageActions({
   );
 }
 
+@immutable
+class _DownloadedImage {
+  final Uint8List bytes;
+  final String filename;
+
+  const _DownloadedImage({required this.bytes, required this.filename});
+}
+
+Future<_DownloadedImage> _downloadImage(WidgetRef ref, String imageUrl) async {
+  final response = await ref
+      .read(mediaHttpClientProvider)
+      .get(
+        Uri.parse(imageUrl),
+        headers: ref.read(mediaGetAuthServiceProvider).headersFor(imageUrl),
+      );
+  if (response.statusCode < 200 || response.statusCode >= 300) {
+    throw HttpException(
+      'Image download failed (${response.statusCode})',
+      uri: Uri.parse(imageUrl),
+    );
+  }
+  return _DownloadedImage(
+    bytes: response.bodyBytes,
+    filename: downloadedImageFilename(
+      imageUrl,
+      response.headers['content-type'],
+    ),
+  );
+}
+
+/// Returns a safe image filename while preserving supported image formats.
+@visibleForTesting
+String downloadedImageFilename(String imageUrl, String? contentType) {
+  final pathSegments = Uri.tryParse(imageUrl)?.pathSegments;
+  final rawName = pathSegments == null || pathSegments.isEmpty
+      ? ''
+      : pathSegments.last;
+  final safeName = rawName
+      .replaceAll(RegExp(r'[^A-Za-z0-9._-]'), '-')
+      .replaceAll(RegExp(r'-+'), '-');
+  if (RegExp(
+    r'\.(avif|bmp|gif|heic|heif|jpe?g|png|webp)$',
+    caseSensitive: false,
+  ).hasMatch(safeName)) {
+    return safeName;
+  }
+  final extension = switch (contentType?.split(';').first.trim()) {
+    'image/avif' => '.avif',
+    'image/gif' => '.gif',
+    'image/heic' => '.heic',
+    'image/heif' => '.heif',
+    'image/png' => '.png',
+    'image/webp' => '.webp',
+    _ => '.jpg',
+  };
+  return 'buzz-${DateTime.now().millisecondsSinceEpoch}$extension';
+}
+
+Future<void> _saveImage(
+  BuildContext context,
+  WidgetRef ref,
+  String imageUrl,
+) async {
+  final messenger = ScaffoldMessenger.maybeOf(context);
+  try {
+    final needsPhotoLibraryPermission =
+        defaultTargetPlatform == TargetPlatform.iOS ||
+        await requiresLegacyMediaStoragePermission();
+    if (needsPhotoLibraryPermission) {
+      final permission = await PhotoManager.requestPermissionExtend(
+        requestOption: const PermissionRequestOption(
+          iosAccessLevel: IosAccessLevel.addOnly,
+          androidPermission: AndroidPermission(
+            type: RequestType.image,
+            mediaLocation: false,
+          ),
+        ),
+      );
+      if (!permission.isAuth) {
+        throw const FileSystemException(
+          'Photo library permission was not granted.',
+        );
+      }
+    }
+    final image = await _downloadImage(ref, imageUrl);
+    await PhotoManager.editor.saveImage(image.bytes, filename: image.filename);
+    messenger?.showSnackBar(
+      const SnackBar(content: Text('Image saved to Photos')),
+    );
+  } catch (_) {
+    messenger?.showSnackBar(
+      const SnackBar(content: Text('Could not save image')),
+    );
+  }
+}
+
+Future<void> _shareImage(
+  BuildContext context,
+  WidgetRef ref,
+  String imageUrl, {
+  Rect? shareOrigin,
+}) async {
+  final messenger = ScaffoldMessenger.maybeOf(context);
+  try {
+    final image = await _downloadImage(ref, imageUrl);
+    final directory = await getTemporaryDirectory();
+    final file = File(
+      '${directory.path}${Platform.pathSeparator}${image.filename}',
+    );
+    await file.writeAsBytes(image.bytes, flush: true);
+    await SharePlus.instance.share(
+      ShareParams(files: [XFile(file.path)], sharePositionOrigin: shareOrigin),
+    );
+  } catch (_) {
+    messenger?.showSnackBar(
+      const SnackBar(content: Text('Could not share image')),
+    );
+  }
+}
+
+/// Canonical `buzz://message` link for a timeline message, including thread
+/// context when the message is a reply.
+String messageLinkFor({
+  required TimelineMessage message,
+  required String channelId,
+}) {
+  return buildMessageLink(
+    channelId: channelId,
+    messageId: message.id,
+    threadRootId: message.rootId,
+  );
+}
+
+class _MarkReadUnreadTile extends ConsumerWidget {
+  final TimelineMessage message;
+  final String channelId;
+
+  const _MarkReadUnreadTile({required this.message, required this.channelId});
+
+  @override
+  Widget build(BuildContext context, WidgetRef ref) {
+    final readState = ref.watch(readStateProvider);
+    if (!readState.isReady) return const SizedBox.shrink();
+
+    final unread = isMessageUnread(
+      readState,
+      channelId: channelId,
+      messageId: message.id,
+      createdAt: message.createdAt,
+      threadRootId: message.rootId,
+    );
+
+    return ListTile(
+      leading: Icon(unread ? LucideIcons.mailCheck : LucideIcons.mailOpen),
+      title: Text(unread ? 'Mark read' : 'Mark unread'),
+      onTap: () {
+        Navigator.of(context).pop();
+        final notifier = ref.read(readStateProvider.notifier);
+        if (unread) {
+          // Advances the `msg:` marker and clears this message's own forced
+          // flag — a channel-level forced unread (channel tile) is a separate
+          // choice and stays untouched.
+          notifier.markContextRead(
+            msgContextKey(message.id),
+            message.createdAt,
+          );
+        } else {
+          // Read markers are monotonic and cannot move backward, so mark
+          // unread forces this message unread locally (session-local, does
+          // not survive relaunch). The channel surfaces it as unread too.
+          notifier.markContextUnread(
+            msgContextKey(message.id),
+            channelId: channelId,
+          );
+        }
+      },
+    );
+  }
+}
+
+class _FollowThreadTile extends ConsumerWidget {
+  final TimelineMessage message;
+
+  const _FollowThreadTile({required this.message});
+
+  @override
+  Widget build(BuildContext context, WidgetRef ref) {
+    final follows = ref.watch(threadFollowsProvider);
+    // Follow acts on the effective thread root: the root for replies, the
+    // message itself for potential thread heads (matches desktop).
+    final rootId = message.rootId ?? message.id;
+    final following = follows.isFollowing(rootId);
+
+    return ListTile(
+      leading: Icon(following ? LucideIcons.bellOff : LucideIcons.bellRing),
+      title: Text(following ? 'Unfollow thread' : 'Follow thread'),
+      onTap: () {
+        Navigator.of(context).pop();
+        final notifier = ref.read(threadFollowsProvider.notifier);
+        if (following) {
+          notifier.unfollowThread(rootId);
+        } else {
+          notifier.followThread(rootId);
+        }
+      },
+    );
+  }
+}
+
+/// Promoted actions for the three dominant mobile jobs: respond now (Reply),
+/// hand off context (Copy link — the `buzz://message` link is the workspace's
+/// context-transfer primitive), and defer (Remind me).
+class _FastActionsRow extends ConsumerWidget {
+  final TimelineMessage message;
+  final String channelId;
+  final List<TimelineMessage>? allMessages;
+  final String? currentPubkey;
+  final bool isMember;
+  final bool isArchived;
+
+  /// The long-pressed message's page context — survives the sheet pop, used
+  /// for the thread push and the copy-link snackbar.
+  final BuildContext pageContext;
+
+  const _FastActionsRow({
+    required this.message,
+    required this.channelId,
+    required this.allMessages,
+    required this.currentPubkey,
+    required this.isMember,
+    required this.isArchived,
+    required this.pageContext,
+  });
+
+  @override
+  Widget build(BuildContext context, WidgetRef ref) {
+    final messages = allMessages;
+    final canRemind = ref.watch(reminderServiceProvider) != null;
+
+    final tiles = <Widget>[
+      if (messages != null)
+        _FastActionTile(
+          icon: LucideIcons.messageSquareReply,
+          label: 'Reply',
+          onTap: () {
+            Navigator.of(context).pop();
+            Navigator.of(pageContext).push(
+              MaterialPageRoute<void>(
+                builder: (_) => ThreadDetailPage(
+                  threadHead: message,
+                  allMessages: messages,
+                  channelId: channelId,
+                  currentPubkey: currentPubkey,
+                  isMember: isMember,
+                  isArchived: isArchived,
+                ),
+              ),
+            );
+          },
+        ),
+      _FastActionTile(
+        icon: LucideIcons.link2,
+        label: 'Copy link',
+        onTap: () {
+          Navigator.of(context).pop();
+          copyToClipboard(
+            pageContext,
+            messageLinkFor(message: message, channelId: channelId),
+            message: 'Message link copied',
+          );
+        },
+      ),
+      if (canRemind)
+        _FastActionTile(
+          icon: LucideIcons.clock,
+          label: 'Remind me',
+          onTap: () {
+            final rootContext = Navigator.of(
+              context,
+              rootNavigator: true,
+            ).context;
+            Navigator.of(context).pop();
+            showRemindMeLaterSheet(
+              context: rootContext,
+              ref: ref,
+              target: ReminderTarget(
+                eventId: message.id,
+                channelId: channelId,
+                preview: message.content.characters
+                    .take(_reminderPreviewLength)
+                    .toString(),
+                authorPubkey: message.pubkey,
+              ),
+            );
+          },
+        ),
+    ];
+
+    return Row(
+      mainAxisAlignment: MainAxisAlignment.spaceEvenly,
+      children: tiles,
+    );
+  }
+}
+
+class _FastActionTile extends StatelessWidget {
+  final IconData icon;
+  final String label;
+  final VoidCallback onTap;
+
+  const _FastActionTile({
+    required this.icon,
+    required this.label,
+    required this.onTap,
+  });
+
+  @override
+  Widget build(BuildContext context) {
+    return GestureDetector(
+      onTap: onTap,
+      behavior: HitTestBehavior.opaque,
+      child: Column(
+        mainAxisSize: MainAxisSize.min,
+        children: [
+          // Pill-shaped icon container with the caption below the fill,
+          // matching the emoji circles' fill and tap treatment.
+          Container(
+            width: 76,
+            height: 56,
+            alignment: Alignment.center,
+            decoration: BoxDecoration(
+              color: context.colors.surfaceContainerHighest,
+              borderRadius: BorderRadius.circular(Radii.dialog),
+            ),
+            child: Icon(icon, size: 24, color: context.colors.onSurface),
+          ),
+          const SizedBox(height: Grid.xxs),
+          Text(
+            label,
+            maxLines: 1,
+            overflow: TextOverflow.ellipsis,
+            style: context.textTheme.labelMedium?.copyWith(
+              color: context.colors.onSurface,
+            ),
+          ),
+        ],
+      ),
+    );
+  }
+}
+
+/// Circular filled tap target shared by the quick-reaction emojis and the
+/// "+" emoji-picker tile — one treatment, one place to change it.
+class _QuickReactionCircle extends StatelessWidget {
+  final VoidCallback onTap;
+  final Widget child;
+
+  const _QuickReactionCircle({required this.onTap, required this.child});
+
+  @override
+  Widget build(BuildContext context) {
+    return GestureDetector(
+      onTap: onTap,
+      child: Container(
+        width: 52,
+        height: 52,
+        alignment: Alignment.center,
+        decoration: BoxDecoration(
+          color: context.colors.surfaceContainerHighest,
+          shape: BoxShape.circle,
+        ),
+        child: child,
+      ),
+    );
+  }
+}
+
 void _showEditSheet({
   required BuildContext context,
   required WidgetRef ref,
@@ -242,6 +712,7 @@ void _confirmDelete({
   required WidgetRef ref,
   required String channelId,
   required String messageId,
+  VoidCallback? onDeleted,
 }) {
   showDialog<void>(
     context: context,
@@ -254,17 +725,19 @@ void _confirmDelete({
           child: const Text('Cancel'),
         ),
         FilledButton(
-          onPressed: () {
+          onPressed: () async {
             Navigator.of(dialogContext).pop();
             final messenger = ScaffoldMessenger.of(context);
-            ref
-                .read(channelActionsProvider)
-                .deleteMessage(channelId: channelId, eventId: messageId)
-                .catchError((Object error) {
-                  messenger.showSnackBar(
-                    SnackBar(content: Text('Failed to delete message: $error')),
-                  );
-                });
+            try {
+              await ref
+                  .read(channelActionsProvider)
+                  .deleteMessage(channelId: channelId, eventId: messageId);
+              onDeleted?.call();
+            } catch (error) {
+              messenger.showSnackBar(
+                SnackBar(content: Text('Failed to delete message: $error')),
+              );
+            }
           },
           style: FilledButton.styleFrom(
             backgroundColor: dialogContext.colors.error,
diff --git a/mobile/lib/features/channels/message_content.dart b/mobile/lib/features/channels/message_content.dart
index cb1af75c68d..664594ade7c 100644
--- a/mobile/lib/features/channels/message_content.dart
+++ b/mobile/lib/features/channels/message_content.dart
@@ -1,3 +1,4 @@
+import 'dart:async';
 import 'dart:io';
 import 'dart:math' as math;
 
@@ -21,6 +22,8 @@ import '../../shared/custom_emoji/custom_emoji_render.dart';
 import 'media_viewer_page.dart';
 import 'message_media.dart';
 
+part 'message_content/media_carousel.dart';
+
 const _messageMediaMaxInlineWidth = 320.0;
 const _messageMediaMaxImageHeight = 240.0;
 
@@ -92,10 +95,25 @@ class MessageContent extends HookConsumerWidget {
   /// mentioned user's pubkey.
   final void Function(String pubkey)? onMentionTap;
 
+  /// Opens the message's thread from the full-screen image viewer.
+  final VoidCallback? onMediaReply;
+
+  /// Opens message-specific actions for an image in the full-screen viewer.
+  final MediaViewerMoreAction? onMediaMore;
+
   final TextStyle? baseStyle;
 
   final int? maxLines;
 
+  /// Allows a multi-image carousel to reclaim leading space reserved by the
+  /// surrounding message layout, while keeping its image count aligned with
+  /// the message body.
+  final double mediaCarouselLeadingOverflow;
+
+  /// Allows a multi-image carousel to continue through the trailing page
+  /// gutter while keeping its first image and count aligned with the body.
+  final double mediaCarouselTrailingOverflow;
+
   const MessageContent({
     super.key,
     required this.content,
@@ -105,8 +123,12 @@ class MessageContent extends HookConsumerWidget {
     this.tags = const [],
     this.onChannelTap,
     this.onMentionTap,
+    this.onMediaReply,
+    this.onMediaMore,
     this.baseStyle,
     this.maxLines,
+    this.mediaCarouselLeadingOverflow = 0,
+    this.mediaCarouselTrailingOverflow = 0,
   });
 
   @override
@@ -115,6 +137,10 @@ class MessageContent extends HookConsumerWidget {
         baseStyle ??
         context.textTheme.bodyMedium?.copyWith(color: context.colors.onSurface);
     final imetaByUrl = parseImetaTags(tags);
+    final trailingGallery = maxLines == null
+        ? _extractTrailingImageGallery(content, imetaByUrl)
+        : null;
+    final markdownContent = trailingGallery?.content ?? content;
     final customEmoji = _mergeCustomEmoji(
       customEmojiFromTags(tags),
       ref.watch(customEmojiListProvider),
@@ -124,7 +150,7 @@ class MessageContent extends HookConsumerWidget {
       // Convert autolinks and bare URLs to standard markdown links,
       // but skip content inside backticks (inline code / fenced blocks).
       final buffer = StringBuffer();
-      final parts = content.split('`');
+      final parts = markdownContent.split('`');
       for (var i = 0; i < parts.length; i++) {
         if (i.isOdd) {
           // Inside backticks — preserve as-is.
@@ -186,9 +212,9 @@ class MessageContent extends HookConsumerWidget {
         result = '\u200B$result';
       }
       return result;
-    }, [content, mentionNames]);
+    }, [markdownContent, mentionNames]);
 
-    return GptMarkdown(
+    final markdown = GptMarkdown(
       finalContent,
       style: style,
       followLinkColor: false,
@@ -210,6 +236,25 @@ class MessageContent extends HookConsumerWidget {
         ...MarkdownComponent.inlineComponents,
       ],
     );
+    if (trailingGallery == null) return markdown;
+
+    return Column(
+      crossAxisAlignment: CrossAxisAlignment.start,
+      mainAxisSize: MainAxisSize.min,
+      children: [
+        if (trailingGallery.content.trim().isNotEmpty) markdown,
+        _MessageImageCarousel(
+          key: ValueKey(
+            trailingGallery.items.map((item) => item.url).join('\u0000'),
+          ),
+          items: trailingGallery.items,
+          leadingOverflow: mediaCarouselLeadingOverflow,
+          trailingOverflow: mediaCarouselTrailingOverflow,
+          onReply: onMediaReply,
+          onMore: onMediaMore,
+        ),
+      ],
+    );
   }
 
   Widget _buildMedia(BuildContext context, String imageUrl, ImetaEntry? imeta) {
@@ -221,6 +266,8 @@ class MessageContent extends HookConsumerWidget {
       url: imageUrl,
       imeta: imeta,
       semanticLabel: imeta?.alt ?? 'Message image',
+      onReply: onMediaReply,
+      onMore: onMediaMore,
     );
   }
 
@@ -298,17 +345,22 @@ class _MessageImagePreview extends HookConsumerWidget {
   final String url;
   final ImetaEntry? imeta;
   final String semanticLabel;
+  final VoidCallback? onReply;
+  final MediaViewerMoreAction? onMore;
 
   const _MessageImagePreview({
     required this.url,
     required this.imeta,
     required this.semanticLabel,
+    required this.onReply,
+    required this.onMore,
   });
 
   @override
   Widget build(BuildContext context, WidgetRef ref) {
     final heroTag = useMemoized(() => Object());
     final layout = _resolveImagePreviewLayout(context, imeta?.aspectRatio);
+    final previewDecodeWidth = layout.width ?? _messageMediaMaxWidth(context);
 
     return Padding(
       padding: const EdgeInsets.only(top: Grid.half),
@@ -318,6 +370,10 @@ class _MessageImagePreview extends HookConsumerWidget {
           imageUrl: url,
           heroTag: heroTag,
           semanticLabel: semanticLabel,
+          previewDecodeWidth: previewDecodeWidth,
+          aspectRatio: imeta?.aspectRatio,
+          onReply: onReply,
+          onMore: onMore,
         ),
         child: _MessageMediaPreviewFrame(
           previewKey: ValueKey('message-media-image-preview:$url'),
@@ -325,15 +381,19 @@ class _MessageImagePreview extends HookConsumerWidget {
           width: layout.width,
           height: layout.height,
           constraints: layout.constraints,
-          child: Hero(
+          child: MediaViewerHero(
             tag: heroTag,
-            child: MediaImage(
-              url: url,
-              fit: layout.fit,
-              semanticLabel: semanticLabel,
-              errorBuilder: (_, _, _) => _MediaPreviewFallback(
-                icon: LucideIcons.imageOff,
-                label: 'Image unavailable',
+            child: ClipRRect(
+              borderRadius: BorderRadius.circular(Radii.md),
+              child: MediaImage(
+                url: url,
+                decodeWidth: previewDecodeWidth,
+                fit: layout.fit,
+                semanticLabel: semanticLabel,
+                errorBuilder: (_, _, _) => _MediaPreviewFallback(
+                  icon: LucideIcons.imageOff,
+                  label: 'Image unavailable',
+                ),
               ),
             ),
           ),
diff --git a/mobile/lib/features/channels/message_content/media_carousel.dart b/mobile/lib/features/channels/message_content/media_carousel.dart
new file mode 100644
index 00000000000..545adba36ca
--- /dev/null
+++ b/mobile/lib/features/channels/message_content/media_carousel.dart
@@ -0,0 +1,302 @@
+part of '../message_content.dart';
+
+const _messageMediaCarouselHeight = 220.0;
+
+@immutable
+class _MessageGalleryItem {
+  final String url;
+  final String semanticLabel;
+  final double? aspectRatio;
+
+  const _MessageGalleryItem({
+    required this.url,
+    required this.semanticLabel,
+    required this.aspectRatio,
+  });
+}
+
+@immutable
+class _TrailingImageGallery {
+  final String content;
+  final List<_MessageGalleryItem> items;
+
+  const _TrailingImageGallery({required this.content, required this.items});
+}
+
+class _MessageGalleryPrecache extends HookWidget {
+  final List<ImageProvider<Object>> providers;
+  final int focusedIndex;
+
+  const _MessageGalleryPrecache({
+    required this.providers,
+    required this.focusedIndex,
+  });
+
+  @override
+  Widget build(BuildContext context) {
+    final providerSignature = Object.hashAll(providers);
+    useEffect(() {
+      var cancelled = false;
+      WidgetsBinding.instance.addPostFrameCallback((_) {
+        if (cancelled || !context.mounted) {
+          return;
+        }
+        for (var index = focusedIndex - 2; index <= focusedIndex + 2; index++) {
+          if (index < 0 || index >= providers.length) {
+            continue;
+          }
+          unawaited(
+            precacheImage(providers[index], context, onError: (_, _) {}),
+          );
+        }
+      });
+      return () => cancelled = true;
+    }, [focusedIndex, providerSignature]);
+    return const SizedBox.shrink();
+  }
+}
+
+_TrailingImageGallery? _extractTrailingImageGallery(
+  String content,
+  Map<String, ImetaEntry> imetaByUrl,
+) {
+  final lines = content.split('\n');
+  var cursor = lines.length - 1;
+  while (cursor >= 0 && lines[cursor].trim().isEmpty) {
+    cursor -= 1;
+  }
+
+  final items = <_MessageGalleryItem>[];
+  final imagePattern = RegExp(r'^!\[([^\]]*)\]\((https?://[^)\s]+)\)$');
+  while (cursor >= 0) {
+    final match = imagePattern.firstMatch(lines[cursor].trim());
+    if (match == null) break;
+    final url = match.group(2)!;
+    final imeta = imetaByUrl[url];
+    if (classifyMediaUrl(url, imeta: imeta) == MessageMediaKind.video) {
+      break;
+    }
+    final markdownLabel = match.group(1)?.trim();
+    items.insert(
+      0,
+      _MessageGalleryItem(
+        url: url,
+        semanticLabel:
+            imeta?.alt ??
+            (markdownLabel?.isNotEmpty == true
+                ? markdownLabel!
+                : 'Message image'),
+        aspectRatio: imeta?.aspectRatio,
+      ),
+    );
+    cursor -= 1;
+  }
+
+  if (items.length < 2) return null;
+  return _TrailingImageGallery(
+    content: lines.take(cursor + 1).join('\n').trimRight(),
+    items: items,
+  );
+}
+
+class _MessageImageCarousel extends HookConsumerWidget {
+  final List<_MessageGalleryItem> items;
+  final double leadingOverflow;
+  final double trailingOverflow;
+  final VoidCallback? onReply;
+  final MediaViewerMoreAction? onMore;
+
+  const _MessageImageCarousel({
+    super.key,
+    required this.items,
+    required this.leadingOverflow,
+    required this.trailingOverflow,
+    required this.onReply,
+    required this.onMore,
+  });
+
+  @override
+  Widget build(BuildContext context, WidgetRef ref) {
+    final itemSignature = items.map((item) => item.url).join('\u0000');
+    final heroTags = useMemoized(
+      () => [for (var index = 0; index < items.length; index++) Object()],
+      [itemSignature],
+    );
+    final controller = usePageController(viewportFraction: 0.9);
+    final currentIndex = useState(0);
+    final mediaAuth = ref.watch(mediaGetAuthServiceProvider);
+    final mediaClient = ref.watch(mediaHttpClientProvider);
+
+    return Padding(
+      padding: const EdgeInsets.only(top: Grid.half),
+      child: Column(
+        crossAxisAlignment: CrossAxisAlignment.start,
+        mainAxisSize: MainAxisSize.min,
+        children: [
+          Text(
+            '${items.length} images',
+            key: const ValueKey('message-media-carousel-count'),
+            style: context.textTheme.labelMedium?.copyWith(
+              color: context.colors.onSurfaceVariant,
+              fontWeight: FontWeight.w400,
+            ),
+          ),
+          const SizedBox(height: Grid.half + Grid.quarter),
+          LayoutBuilder(
+            builder: (context, constraints) {
+              final contentWidth = constraints.hasBoundedWidth
+                  ? constraints.maxWidth
+                  : _messageMediaMaxWidth(context);
+              final carouselWidth =
+                  contentWidth + leadingOverflow + trailingOverflow;
+              final leadingExtent = leadingOverflow;
+              final isLeftToRight =
+                  Directionality.of(context) == TextDirection.ltr;
+              final itemTrailingPaddings = [
+                for (var index = 0; index < items.length; index++)
+                  index == items.length - 1 ? Grid.gutter : Grid.half,
+              ];
+              final previewDecodeWidths = [
+                for (var index = 0; index < items.length; index++)
+                  math.max(
+                    1.0,
+                    carouselWidth * controller.viewportFraction -
+                        itemTrailingPaddings[index],
+                  ),
+              ];
+              final devicePixelRatio = MediaQuery.devicePixelRatioOf(context);
+              final previewProviders = [
+                for (var index = 0; index < items.length; index++)
+                  ResizeImage.resizeIfNeeded(
+                    (previewDecodeWidths[index] * devicePixelRatio).ceil(),
+                    null,
+                    MediaImageProvider(
+                      url: items[index].url,
+                      auth: mediaAuth,
+                      client: mediaClient,
+                    ),
+                  ),
+              ];
+              final viewerItems = [
+                for (var index = 0; index < items.length; index++)
+                  MediaViewerImage(
+                    url: items[index].url,
+                    heroTag: heroTags[index],
+                    semanticLabel: items[index].semanticLabel,
+                    previewDecodeWidth: previewDecodeWidths[index],
+                    aspectRatio: items[index].aspectRatio,
+                    preloadProvider: previewProviders[index],
+                  ),
+              ];
+              final carousel = SizedBox(
+                key: const ValueKey('message-media-carousel'),
+                width: carouselWidth,
+                height: _messageMediaCarouselHeight,
+                child: PageView.builder(
+                  controller: controller,
+                  allowImplicitScrolling: true,
+                  // Keep the first image aligned with the message body, but
+                  // allow later pages to paint through the avatar gutter as
+                  // the row scrolls.
+                  clipBehavior: Clip.none,
+                  padEnds: false,
+                  itemCount: items.length,
+                  onPageChanged: (index) => currentIndex.value = index,
+                  itemBuilder: (context, index) {
+                    final item = items[index];
+                    return Padding(
+                      key: ValueKey('message-media-carousel-page:${item.url}'),
+                      padding: EdgeInsetsDirectional.only(
+                        end: itemTrailingPaddings[index],
+                      ),
+                      child: Semantics(
+                        button: true,
+                        excludeSemantics: true,
+                        label: 'Open ${item.semanticLabel}',
+                        child: GestureDetector(
+                          key: ValueKey(
+                            'message-media-carousel-item:${item.url}',
+                          ),
+                          onTap: () => openImageViewer(
+                            context,
+                            imageUrl: item.url,
+                            heroTag: heroTags[index],
+                            semanticLabel: item.semanticLabel,
+                            previewDecodeWidth: previewDecodeWidths[index],
+                            aspectRatio: item.aspectRatio,
+                            galleryItems: viewerItems,
+                            initialIndex: index,
+                            onReply: onReply,
+                            onMore: onMore,
+                          ),
+                          child: Container(
+                            clipBehavior: Clip.antiAlias,
+                            decoration: BoxDecoration(
+                              color: context.colors.surfaceContainerHighest,
+                              borderRadius: BorderRadius.circular(Radii.md),
+                              border: Border.all(
+                                color: context.colors.outlineVariant,
+                              ),
+                            ),
+                            child: MediaViewerHero(
+                              tag: heroTags[index],
+                              child: ClipRRect(
+                                borderRadius: BorderRadius.circular(Radii.md),
+                                child: MediaImage(
+                                  url: item.url,
+                                  decodeWidth: previewDecodeWidths[index],
+                                  fit: BoxFit.cover,
+                                  semanticLabel: item.semanticLabel,
+                                  errorBuilder: (_, _, _) =>
+                                      const _MediaPreviewFallback(
+                                        icon: LucideIcons.imageOff,
+                                        label: 'Image unavailable',
+                                      ),
+                                ),
+                              ),
+                            ),
+                          ),
+                        ),
+                      ),
+                    );
+                  },
+                ),
+              );
+
+              final carouselSurface = Stack(
+                clipBehavior: Clip.none,
+                children: [
+                  carousel,
+                  _MessageGalleryPrecache(
+                    providers: previewProviders,
+                    focusedIndex: currentIndex.value,
+                  ),
+                ],
+              );
+
+              if (leadingExtent <= 0 && trailingOverflow <= 0) {
+                return carouselSurface;
+              }
+              return SizedBox(
+                width: contentWidth,
+                height: _messageMediaCarouselHeight,
+                child: OverflowBox(
+                  alignment: AlignmentDirectional.centerStart,
+                  minWidth: carouselWidth,
+                  maxWidth: carouselWidth,
+                  child: Transform.translate(
+                    offset: Offset(
+                      isLeftToRight ? -leadingExtent : leadingExtent,
+                      0,
+                    ),
+                    child: carouselSurface,
+                  ),
+                ),
+              );
+            },
+          ),
+        ],
+      ),
+    );
+  }
+}
diff --git a/mobile/lib/features/channels/photo_library.dart b/mobile/lib/features/channels/photo_library.dart
new file mode 100644
index 00000000000..8a01de01e0f
--- /dev/null
+++ b/mobile/lib/features/channels/photo_library.dart
@@ -0,0 +1,104 @@
+import 'package:flutter/foundation.dart';
+import 'package:hooks_riverpod/hooks_riverpod.dart';
+import 'package:image_picker/image_picker.dart';
+import 'package:photo_manager/photo_manager.dart';
+
+const _recentPhotoCount = 30;
+const _photoPermissionRequest = PermissionRequestOption(
+  androidPermission: AndroidPermission(
+    type: RequestType.image,
+    mediaLocation: false,
+  ),
+);
+
+/// A recent photo exposed to Buzz's compact in-composer gallery.
+@immutable
+class RecentPhoto {
+  /// The platform photo-library identifier.
+  final String id;
+
+  /// Thumbnail bytes sized for the compact picker grid.
+  final Uint8List thumbnailBytes;
+
+  /// Creates a recent photo value.
+  const RecentPhoto({required this.id, required this.thumbnailBytes});
+}
+
+/// Reads recent photos and resolves selected library assets to uploadable files.
+abstract interface class PhotoLibrary {
+  /// Requests access when needed and returns the newest visible photos.
+  Future<List<RecentPhoto>> loadRecentPhotos();
+
+  /// Resolves selected photos in the supplied selection order.
+  Future<List<XFile>> resolveSelectedPhotos(List<RecentPhoto> photos);
+}
+
+/// Indicates that the compact gallery cannot read the device photo library.
+class PhotoLibraryAccessException implements Exception {
+  /// Creates a photo-library access error.
+  const PhotoLibraryAccessException();
+
+  @override
+  String toString() => 'Photo access is turned off for Buzz.';
+}
+
+/// Provides the device photo library. Tests can override this with fixtures.
+final photoLibraryProvider = Provider<PhotoLibrary>(
+  (ref) => const DevicePhotoLibrary(),
+);
+
+/// The device-backed implementation of [PhotoLibrary].
+class DevicePhotoLibrary implements PhotoLibrary {
+  /// Creates the device photo library.
+  const DevicePhotoLibrary();
+
+  @override
+  Future<List<RecentPhoto>> loadRecentPhotos() async {
+    final permission = await PhotoManager.requestPermissionExtend(
+      requestOption: _photoPermissionRequest,
+    );
+    if (!permission.hasAccess) {
+      throw const PhotoLibraryAccessException();
+    }
+
+    final assets = await PhotoManager.getAssetListPaged(
+      page: 0,
+      pageCount: _recentPhotoCount,
+      type: RequestType.image,
+      filterOption: FilterOptionGroup(
+        imageOption: const FilterOption(needTitle: true),
+        orders: const [
+          OrderOption(type: OrderOptionType.createDate, asc: false),
+        ],
+      ),
+    );
+
+    final loaded = await Future.wait([
+      for (final asset in assets) _loadRecentPhoto(asset),
+    ]);
+    return [for (final photo in loaded) ?photo];
+  }
+
+  Future<RecentPhoto?> _loadRecentPhoto(AssetEntity asset) async {
+    final bytes = await asset.thumbnailDataWithSize(
+      const ThumbnailSize.square(256),
+      quality: 84,
+    );
+    if (bytes == null || bytes.isEmpty) return null;
+    return RecentPhoto(id: asset.id, thumbnailBytes: bytes);
+  }
+
+  @override
+  Future<List<XFile>> resolveSelectedPhotos(List<RecentPhoto> photos) async {
+    final resolved = <XFile>[];
+    for (final photo in photos) {
+      final asset = await AssetEntity.fromId(photo.id);
+      final file = await asset?.file;
+      if (file == null) {
+        throw const PhotoLibraryAccessException();
+      }
+      resolved.add(XFile(file.path, name: asset?.title));
+    }
+    return resolved;
+  }
+}
diff --git a/mobile/lib/features/channels/reaction_row.dart b/mobile/lib/features/channels/reaction_row.dart
index 8814d698fb9..2f2404ccf7c 100644
--- a/mobile/lib/features/channels/reaction_row.dart
+++ b/mobile/lib/features/channels/reaction_row.dart
@@ -75,11 +75,10 @@ class ReactionRow extends StatelessWidget {
                       const SizedBox(width: Grid.quarter),
                       Text(
                         '${reaction.count}',
-                        style: context.textTheme.labelSmall?.copyWith(
+                        style: reactionCountTextStyle.copyWith(
                           color: reaction.reactedByCurrentUser
                               ? context.colors.primary
                               : context.colors.onSurfaceVariant,
-                          fontWeight: FontWeight.w600,
                         ),
                       ),
                     ],
diff --git a/mobile/lib/features/channels/read_state/message_read_state.dart b/mobile/lib/features/channels/read_state/message_read_state.dart
new file mode 100644
index 00000000000..7eaecabe607
--- /dev/null
+++ b/mobile/lib/features/channels/read_state/message_read_state.dart
@@ -0,0 +1,44 @@
+import 'read_state_format.dart';
+import 'read_state_provider.dart';
+
+/// Effective read timestamp for a single message: the newest of the channel
+/// marker, the message's own `msg:` marker, and (for thread replies) the
+/// thread's `thread:` marker — the same precedence the unread badge uses via
+/// `observedUnreadEventReadAt`.
+int? effectiveMessageReadAt(
+  ReadStateState readState, {
+  required String channelId,
+  required String messageId,
+  String? threadRootId,
+}) {
+  return maxReadAt([
+    readState.effectiveTimestamp(channelId),
+    readState.effectiveTimestamp(msgContextKey(messageId)),
+    if (threadRootId != null)
+      readState.effectiveTimestamp(threadContextKey(threadRootId)),
+  ]);
+}
+
+/// Whether a message should currently show as unread in the actions menu.
+///
+/// A message-level forced unread (from this menu) wins; otherwise the
+/// timestamp precedence decides. A channel-level forced unread (from the
+/// channel tile) is deliberately not consulted: it is a channel-scoped
+/// choice, and letting it leak in here would make the message-level toggle
+/// unable to round-trip without clearing the channel-level choice.
+bool isMessageUnread(
+  ReadStateState readState, {
+  required String channelId,
+  required String messageId,
+  required int createdAt,
+  String? threadRootId,
+}) {
+  if (readState.isForcedUnread(msgContextKey(messageId))) return true;
+  final readAt = effectiveMessageReadAt(
+    readState,
+    channelId: channelId,
+    messageId: messageId,
+    threadRootId: threadRootId,
+  );
+  return readAt == null || createdAt > readAt;
+}
diff --git a/mobile/lib/features/channels/read_state/read_state_provider.dart b/mobile/lib/features/channels/read_state/read_state_provider.dart
index 07ffc9044a0..b82f1af5fd3 100644
--- a/mobile/lib/features/channels/read_state/read_state_provider.dart
+++ b/mobile/lib/features/channels/read_state/read_state_provider.dart
@@ -13,14 +13,19 @@ class ReadStateState {
   final String? pubkey;
   final Map<String, int> contexts;
   final int version;
-  final Set<String> locallyForcedChannelIds;
+
+  /// Session-local forced-unread flags, keyed by the forced context id
+  /// (a channel id from the channel tile, or a `msg:` key from the message
+  /// actions sheet), each mapped to the channel it belongs to so channel
+  /// tiles and badges can surface message-level forces.
+  final Map<String, String> forcedUnreadContexts;
 
   const ReadStateState({
     required this.isReady,
     required this.pubkey,
     required this.contexts,
     required this.version,
-    this.locallyForcedChannelIds = const {},
+    this.forcedUnreadContexts = const {},
   });
 
   const ReadStateState.inert()
@@ -28,7 +33,16 @@ class ReadStateState {
       pubkey = null,
       contexts = const {},
       version = 0,
-      locallyForcedChannelIds = const {};
+      forcedUnreadContexts = const {};
+
+  /// Channels that should surface as unread because of a forced-unread flag —
+  /// either forced directly, or containing a forced message.
+  Set<String> get locallyForcedChannelIds =>
+      forcedUnreadContexts.values.toSet();
+
+  /// Whether this exact context (channel id or `msg:` key) is forced unread.
+  bool isForcedUnread(String contextId) =>
+      forcedUnreadContexts.containsKey(contextId);
 
   int? effectiveTimestamp(String contextId) => contexts[contextId];
 
@@ -43,7 +57,7 @@ class ReadStateState {
       pubkey: pubkey,
       contexts: Map.unmodifiable({...contexts, contextId: timestamp}),
       version: version + 1,
-      locallyForcedChannelIds: locallyForcedChannelIds,
+      forcedUnreadContexts: forcedUnreadContexts,
     );
   }
 }
@@ -51,14 +65,14 @@ class ReadStateState {
 class ReadStateNotifier extends Notifier<ReadStateState> {
   ReadStateManager? _manager;
   bool _isInitialized = false;
-  final Set<String> _locallyForcedChannelIds = {};
+  final Map<String, String> _forcedUnreadContexts = {};
 
   @override
   ReadStateState build() {
     _manager?.dispose(flushPending: false);
     _manager = null;
     _isInitialized = false;
-    _locallyForcedChannelIds.clear();
+    _forcedUnreadContexts.clear();
 
     final relayConfig = ref.watch(relayConfigProvider);
     ref.watch(relaySessionProvider);
@@ -130,15 +144,45 @@ class ReadStateNotifier extends Notifier<ReadStateState> {
     return _stateFromManager(manager, isReady: false);
   }
 
-  void markContextRead(String contextId, int unixTimestamp) {
-    _locallyForcedChannelIds.remove(contextId);
+  /// Advance a context's read marker. Clears the forced-unread flag for
+  /// exactly this context, if any. An explicit channel-level "Mark read"
+  /// (channel tile/menu) should pass [clearForcedMessages] so message-level
+  /// forces inside the channel are released too; the automatic read on
+  /// channel open must not, so a message deliberately marked unread stays
+  /// unread until acted on.
+  void markContextRead(
+    String contextId,
+    int unixTimestamp, {
+    bool clearForcedMessages = false,
+  }) {
+    var removed = _forcedUnreadContexts.remove(contextId) != null;
+    if (clearForcedMessages) {
+      final before = _forcedUnreadContexts.length;
+      _forcedUnreadContexts.removeWhere(
+        (_, channelId) => channelId == contextId,
+      );
+      removed = removed || _forcedUnreadContexts.length != before;
+    }
     _manager?.markContextRead(contextId, unixTimestamp);
+    if (removed) {
+      _refreshForcedState();
+    }
+  }
+
+  /// Force a context unread for the rest of the session. [contextId] is a
+  /// channel id (channel-tile action) or a `msg:` key (message actions
+  /// sheet); [channelId] is the channel the context belongs to, so tiles and
+  /// badges can surface message-level forces. Read markers are monotonic,
+  /// so this is the only way to move a context back to unread.
+  void markContextUnread(String contextId, {required String channelId}) {
+    if (_manager == null) return;
+    _forcedUnreadContexts[contextId] = channelId;
+    _refreshForcedState();
   }
 
-  void markContextUnread(String contextId) {
+  void _refreshForcedState() {
     final manager = _manager;
     if (manager == null) return;
-    _locallyForcedChannelIds.add(contextId);
     state = _stateFromManager(
       manager,
       isReady: _isInitialized,
@@ -153,7 +197,9 @@ class ReadStateNotifier extends Notifier<ReadStateState> {
   void _emitManagerState(ReadStateManager manager) {
     if (_manager != manager) return;
     final advances = manager.drainSyncedAdvances();
-    _locallyForcedChannelIds.removeAll(advances);
+    for (final contextId in advances) {
+      _forcedUnreadContexts.remove(contextId);
+    }
     state = _stateFromManager(
       manager,
       isReady: _isInitialized,
@@ -171,8 +217,8 @@ class ReadStateNotifier extends Notifier<ReadStateState> {
       pubkey: manager.pubkey,
       contexts: manager.effectiveContexts,
       version: (previousVersion ?? 0) + 1,
-      locallyForcedChannelIds: Set.unmodifiable(
-        Set<String>.from(_locallyForcedChannelIds),
+      forcedUnreadContexts: Map.unmodifiable(
+        Map<String, String>.from(_forcedUnreadContexts),
       ),
     );
   }
diff --git a/mobile/lib/features/channels/thread_detail_page.dart b/mobile/lib/features/channels/thread_detail_page.dart
index a81de36e049..e8081f42fec 100644
--- a/mobile/lib/features/channels/thread_detail_page.dart
+++ b/mobile/lib/features/channels/thread_detail_page.dart
@@ -7,10 +7,12 @@ import '../../shared/theme/theme.dart';
 import '../../shared/widgets/avatar_image.dart';
 import '../../shared/widgets/frosted_app_bar.dart';
 import '../../shared/widgets/frosted_scaffold.dart';
+import '../../shared/widgets/message_author_meta.dart';
 import '../profile/user_cache_provider.dart';
 import '../profile/user_profile.dart';
 import 'channel_link_navigation.dart';
 import 'channel_typing_provider.dart';
+import 'channel_typing_indicator.dart';
 import 'thread_replies_provider.dart';
 import 'channels_provider.dart';
 import 'compose_bar.dart';
@@ -53,9 +55,13 @@ class ThreadDetailPage extends HookConsumerWidget {
 
   @override
   Widget build(BuildContext context, WidgetRef ref) {
+    // Relay thread queries are keyed by the outermost root, even when this
+    // page displays a nested branch. Query that root, then select this head's
+    // direct children from the returned subtree below.
+    final queryRootId = threadHead.rootId ?? threadHead.id;
     final repliesState = ref.watch(
       threadRepliesWithLocalProvider(
-        ThreadRepliesArgs(channelId: channelId, rootId: threadHead.id),
+        ThreadRepliesArgs(channelId: channelId, rootId: queryRootId),
       ),
     );
     final replyMessages = repliesState.whenData((events) {
@@ -65,7 +71,10 @@ class ThreadDetailPage extends HookConsumerWidget {
     final fetchedReplies = replyMessages.value;
     final allMsgs = fetchedReplies == null
         ? allMessages
-        : [threadHead, ...fetchedReplies];
+        : [
+            threadHead,
+            ...fetchedReplies.where((message) => message.id != threadHead.id),
+          ];
 
     // Index all messages by parentId so we can find direct children of any
     // message and compute thread summaries for nested threads.
@@ -146,11 +155,15 @@ class ThreadDetailPage extends HookConsumerWidget {
     });
 
     return FrostedScaffold(
-      appBar: const FrostedAppBar(title: Text('Thread')),
+      appBar: const FrostedAppBar(
+        title: Text('Thread'),
+        titleStyle: channelTitleTextStyle,
+      ),
       body: Column(
         children: [
           Expanded(
             child: ScrollablePositionedList.builder(
+              key: const ValueKey('thread-message-list'),
               itemScrollController: itemScrollController,
               // Reversed so the list opens pinned to the newest reply,
               // matching the channel message list.
@@ -159,47 +172,54 @@ class ThreadDetailPage extends HookConsumerWidget {
                 left: Grid.gutter,
                 right: Grid.gutter,
                 top: frostedAppBarHeight(context),
-                bottom: Grid.xxs,
+                bottom: 0,
               ),
               itemCount: replies.length + 1, // +1 for thread head
               itemBuilder: (context, index) {
                 if (index == replies.length) {
                   // Thread head.
-                  return Column(
-                    crossAxisAlignment: CrossAxisAlignment.start,
-                    children: [
-                      DayDivider(label: formatDayHeading(liveHead.createdAt)),
-                      _ThreadMessage(
-                        message: liveHead,
-                        channelNames: channelNamesMap,
-                        channelId: channelId,
-                        currentPubkey: currentPubkey,
-                        showAuthor: true,
-                        allMessages: allMsgs,
-                        isMember: isMember,
-                        isArchived: isArchived,
-                      ),
-                      Padding(
-                        padding: const EdgeInsets.symmetric(vertical: Grid.xxs),
-                        child: Row(
-                          children: [
-                            Text(
-                              '${replies.length} ${replies.length == 1 ? 'reply' : 'replies'}',
-                              style: context.textTheme.labelMedium?.copyWith(
-                                color: context.colors.onSurfaceVariant,
-                                fontWeight: FontWeight.w600,
+                  return Padding(
+                    key: ValueKey('thread-message-group-${liveHead.id}'),
+                    padding: EdgeInsets.only(bottom: index == 0 ? Grid.xs : 0),
+                    child: Column(
+                      crossAxisAlignment: CrossAxisAlignment.start,
+                      children: [
+                        DayDivider(label: formatDayHeading(liveHead.createdAt)),
+                        _ThreadMessage(
+                          message: liveHead,
+                          channelNames: channelNamesMap,
+                          channelId: channelId,
+                          currentPubkey: currentPubkey,
+                          showAuthor: true,
+                          isHighlighted: liveHead.id == initialMessageId,
+                          allMessages: allMsgs,
+                          isMember: isMember,
+                          isArchived: isArchived,
+                        ),
+                        Padding(
+                          padding: const EdgeInsets.symmetric(
+                            vertical: Grid.xxs,
+                          ),
+                          child: Row(
+                            children: [
+                              Text(
+                                '${replies.length} ${replies.length == 1 ? 'reply' : 'replies'}',
+                                style: context.textTheme.labelMedium?.copyWith(
+                                  color: context.colors.onSurfaceVariant,
+                                  fontWeight: FontWeight.w600,
+                                ),
                               ),
-                            ),
-                            const SizedBox(width: Grid.xxs),
-                            Expanded(
-                              child: Divider(
-                                color: context.colors.outlineVariant,
+                              const SizedBox(width: Grid.xxs),
+                              Expanded(
+                                child: Divider(
+                                  color: context.colors.outlineVariant,
+                                ),
                               ),
-                            ),
-                          ],
+                            ],
+                          ),
                         ),
-                      ),
-                    ],
+                      ],
+                    ),
                   );
                 }
 
@@ -226,38 +246,51 @@ class ThreadDetailPage extends HookConsumerWidget {
                     ? _buildNestedSummary(reply.id, nestedChildren)
                     : null;
 
-                return Column(
-                  crossAxisAlignment: CrossAxisAlignment.start,
-                  children: [
-                    if (showDayDivider)
-                      DayDivider(label: formatDayHeading(reply.createdAt)),
-                    _ThreadMessage(
-                      message: reply,
-                      channelNames: channelNamesMap,
-                      channelId: channelId,
-                      currentPubkey: currentPubkey,
-                      showAuthor: showAuthor,
-                      allMessages: allMsgs,
-                      isMember: isMember,
-                      isArchived: isArchived,
-                    ),
-                    if (nestedSummary != null)
-                      _NestedThreadSummaryRow(
-                        summary: nestedSummary,
-                        replyMessage: reply,
-                        allMessages: allMsgs,
+                return Padding(
+                  key: ValueKey('thread-message-group-${reply.id}'),
+                  padding: EdgeInsets.only(bottom: index == 0 ? Grid.xs : 0),
+                  child: Column(
+                    crossAxisAlignment: CrossAxisAlignment.start,
+                    children: [
+                      if (showDayDivider)
+                        DayDivider(label: formatDayHeading(reply.createdAt)),
+                      _ThreadMessage(
+                        message: reply,
+                        channelNames: channelNamesMap,
                         channelId: channelId,
                         currentPubkey: currentPubkey,
+                        showAuthor: showAuthor,
+                        isHighlighted: reply.id == initialMessageId,
+                        allMessages: allMsgs,
                         isMember: isMember,
                         isArchived: isArchived,
                       ),
-                  ],
+                      if (nestedSummary != null)
+                        _NestedThreadSummaryRow(
+                          summary: nestedSummary,
+                          replyMessage: reply,
+                          allMessages: allMsgs,
+                          channelId: channelId,
+                          currentPubkey: currentPubkey,
+                          isMember: isMember,
+                          isArchived: isArchived,
+                        ),
+                    ],
+                  ),
                 );
               },
             ),
           ),
-          if (threadTyping.isNotEmpty)
-            _ThreadTypingIndicator(entries: threadTyping),
+          AnimatedSize(
+            duration: MediaQuery.disableAnimationsOf(context)
+                ? Duration.zero
+                : const Duration(milliseconds: 180),
+            curve: Curves.easeOutCubic,
+            alignment: Alignment.bottomCenter,
+            child: threadTyping.isEmpty
+                ? const SizedBox.shrink()
+                : ChannelTypingIndicator(entries: threadTyping),
+          ),
           if (isMember && !isArchived)
             ComposeBar(
               channelId: channelId,
@@ -348,10 +381,11 @@ class _NestedThreadSummaryRow extends ConsumerWidget {
         );
       },
       child: Padding(
+        key: ValueKey('nested-thread-summary-${replyMessage.id}'),
         padding: const EdgeInsets.only(
-          left: 36 + Grid.xxs,
+          left: messageAvatarSize + messageAvatarContentGap,
           top: Grid.half,
-          bottom: Grid.half,
+          bottom: Grid.xs,
         ),
         child: Row(
           mainAxisSize: MainAxisSize.min,
@@ -377,36 +411,38 @@ class _NestedThreadSummaryRow extends ConsumerWidget {
               ),
             ),
             const SizedBox(width: Grid.xxs),
-            Text.rich(
-              TextSpan(
-                children: [
-                  TextSpan(
-                    text:
-                        '${summary.replyCount} ${summary.replyCount == 1 ? 'reply' : 'replies'}',
-                    style: context.textTheme.labelMedium?.copyWith(
-                      color: context.colors.primary,
-                      fontWeight: FontWeight.w600,
-                    ),
-                  ),
-                  if (summary.lastReplyAt case final lastReplyAt?) ...[
-                    TextSpan(
-                      text: ' · ',
-                      style: context.textTheme.labelMedium?.copyWith(
-                        color: context.colors.onSurfaceVariant.withValues(
-                          alpha: 0.5,
-                        ),
-                      ),
-                    ),
+            Flexible(
+              child: Text.rich(
+                TextSpan(
+                  children: [
                     TextSpan(
                       text:
-                          'last reply ${formatThreadSummaryLastReplyTime(lastReplyAt)}',
-                      style: context.textTheme.labelMedium?.copyWith(
-                        color: context.colors.onSurfaceVariant,
-                        fontWeight: FontWeight.w400,
+                          '${summary.replyCount} ${summary.replyCount == 1 ? 'reply' : 'replies'}',
+                      style: replyPreviewTextStyle.copyWith(
+                        color: context.colors.primary,
                       ),
                     ),
+                    if (summary.lastReplyAt case final lastReplyAt?) ...[
+                      TextSpan(
+                        text: ' · ',
+                        style: replyPreviewTextStyle.copyWith(
+                          color: context.colors.onSurfaceVariant.withValues(
+                            alpha: 0.5,
+                          ),
+                        ),
+                      ),
+                      TextSpan(
+                        text:
+                            'last reply ${formatThreadSummaryLastReplyTime(lastReplyAt)}',
+                        style: replyPreviewTextStyle.copyWith(
+                          color: context.colors.onSurfaceVariant,
+                        ),
+                      ),
+                    ],
                   ],
-                ],
+                ),
+                maxLines: 2,
+                overflow: TextOverflow.ellipsis,
               ),
             ),
           ],
@@ -422,6 +458,7 @@ class _ThreadMessage extends ConsumerWidget {
   final String channelId;
   final String? currentPubkey;
   final bool showAuthor;
+  final bool isHighlighted;
   final List<TimelineMessage>? allMessages;
   final bool isMember;
   final bool isArchived;
@@ -432,6 +469,7 @@ class _ThreadMessage extends ConsumerWidget {
     required this.channelId,
     required this.currentPubkey,
     required this.showAuthor,
+    this.isHighlighted = false,
     this.allMessages,
     this.isMember = false,
     this.isArchived = false,
@@ -444,6 +482,10 @@ class _ThreadMessage extends ConsumerWidget {
         ref.watch(userCacheProvider.select((cache) => cache[pk])) ??
         ref.read(userCacheProvider.notifier).get(pk);
     final displayName = profile?.label ?? shortPubkey(message.pubkey);
+    final canManageMessage =
+        currentPubkey?.toLowerCase() == pk ||
+        (profile?.ownerPubkey != null &&
+            profile?.ownerPubkey == currentPubkey?.toLowerCase());
 
     final userCache = ref.watch(userCacheProvider);
     final knownAgentPubkeys = ref.watch(mentionAgentPubkeysProvider(channelId));
@@ -460,178 +502,175 @@ class _ThreadMessage extends ConsumerWidget {
       }
     }
 
-    return GestureDetector(
-      behavior: HitTestBehavior.opaque,
-      onLongPress: () => showMessageActions(
-        context: context,
-        ref: ref,
-        message: message,
-        channelId: channelId,
-        canManageMessage:
-            currentPubkey?.toLowerCase() == pk ||
-            (profile?.ownerPubkey != null &&
-                profile?.ownerPubkey == currentPubkey?.toLowerCase()),
-        allMessages: allMessages,
-        currentPubkey: currentPubkey,
-        isMember: isMember,
-        isArchived: isArchived,
-      ),
-      child: Padding(
-        padding: EdgeInsets.only(top: showAuthor ? Grid.xs : Grid.quarter),
-        child: Row(
-          crossAxisAlignment: CrossAxisAlignment.start,
-          children: [
-            if (showAuthor)
-              GestureDetector(
-                onTap: () => showUserProfileSheet(context, message.pubkey),
-                child: _Avatar(profile: profile, pubkey: message.pubkey),
-              )
-            else
-              const SizedBox(width: 36),
-            const SizedBox(width: Grid.xxs),
-            Expanded(
-              child: Transform.translate(
-                offset: Offset(0, showAuthor ? -Grid.quarter : 0),
-                child: Column(
-                  crossAxisAlignment: CrossAxisAlignment.start,
-                  children: [
-                    if (showAuthor)
-                      Padding(
-                        padding: const EdgeInsets.only(bottom: Grid.quarter),
-                        child: Row(
-                          crossAxisAlignment: CrossAxisAlignment.center,
-                          children: [
-                            GestureDetector(
-                              onTap: () =>
-                                  showUserProfileSheet(context, message.pubkey),
-                              child: Text(
-                                displayName,
-                                style: context.textTheme.titleSmall?.copyWith(
-                                  fontWeight: FontWeight.w600,
-                                  color: context.colors.onSurface,
-                                ),
+    return Padding(
+      padding: EdgeInsets.only(top: showAuthor ? Grid.xs : 0),
+      child: DecoratedBox(
+        key: ValueKey('thread-message-${message.id}'),
+        decoration: BoxDecoration(
+          color: isHighlighted
+              ? context.colors.primary.withValues(alpha: 0.12)
+              : Colors.transparent,
+          borderRadius: BorderRadius.circular(Radii.md),
+        ),
+        child: Material(
+          color: Colors.transparent,
+          borderRadius: BorderRadius.circular(Radii.md),
+          // The media carousel intentionally continues through the list's
+          // trailing gutter. InkWell still clips its ink to [borderRadius],
+          // while leaving overflowing message content visible.
+          clipBehavior: Clip.none,
+          child: InkWell(
+            key: ValueKey('thread-message-row-${message.id}'),
+            borderRadius: BorderRadius.circular(Radii.md),
+            highlightColor: context.colors.primary.withValues(alpha: 0.1),
+            onLongPress: () => showMessageActions(
+              context: context,
+              ref: ref,
+              message: message,
+              channelId: channelId,
+              canManageMessage: canManageMessage,
+              allMessages: allMessages,
+              currentPubkey: currentPubkey,
+              isMember: isMember,
+              isArchived: isArchived,
+            ),
+            child: Padding(
+              padding: EdgeInsets.only(
+                top: showAuthor ? 0 : Grid.xxs,
+                bottom: showAuthor ? 0 : Grid.xxs,
+              ),
+              child: Row(
+                crossAxisAlignment: CrossAxisAlignment.start,
+                children: [
+                  if (showAuthor)
+                    GestureDetector(
+                      onTap: () =>
+                          showUserProfileSheet(context, message.pubkey),
+                      child: _Avatar(profile: profile, pubkey: message.pubkey),
+                    )
+                  else
+                    const SizedBox(width: messageAvatarSize),
+                  const SizedBox(width: messageAvatarContentGap),
+                  Expanded(
+                    child: Padding(
+                      padding: EdgeInsets.only(top: showAuthor ? Grid.half : 0),
+                      child: Column(
+                        crossAxisAlignment: CrossAxisAlignment.start,
+                        children: [
+                          if (showAuthor)
+                            Padding(
+                              padding: const EdgeInsets.only(
+                                bottom: Grid.quarter,
                               ),
-                            ),
-                            const SizedBox(width: Grid.xxs),
-                            Text(
-                              formatMessageTime(message.createdAt),
-                              style: context.textTheme.labelSmall?.copyWith(
-                                fontSize: 14,
-                                height: 22 / 14,
-                                letterSpacing:
-                                    context.textTheme.titleSmall?.letterSpacing,
-                                color: context.colors.onSurfaceVariant,
+                              child: Row(
+                                children: [
+                                  Expanded(
+                                    child: MessageAuthorMeta(
+                                      displayName: displayName,
+                                      username: messageUsernameLabel(profile),
+                                      timestamp: formatMessageTime(
+                                        message.createdAt,
+                                      ),
+                                      nameColor: context.colors.onSurface,
+                                      metadataColor:
+                                          context.colors.onSurfaceVariant,
+                                      onAuthorTap: () => showUserProfileSheet(
+                                        context,
+                                        message.pubkey,
+                                      ),
+                                      displayNameKey: ValueKey(
+                                        'thread-message-author-${message.id}',
+                                      ),
+                                      usernameKey: ValueKey(
+                                        'thread-message-username-${message.id}',
+                                      ),
+                                      timestampKey: ValueKey(
+                                        'thread-message-timestamp-${message.id}',
+                                      ),
+                                    ),
+                                  ),
+                                  if (message.edited) ...[
+                                    const SizedBox(width: Grid.half),
+                                    Text(
+                                      '(edited)',
+                                      style: context.textTheme.labelSmall
+                                          ?.copyWith(
+                                            color:
+                                                context.colors.onSurfaceVariant,
+                                            fontStyle: FontStyle.italic,
+                                          ),
+                                    ),
+                                  ],
+                                ],
                               ),
                             ),
-                            if (message.edited) ...[
-                              const SizedBox(width: Grid.half),
-                              Text(
-                                '(edited)',
-                                style: context.textTheme.labelSmall?.copyWith(
-                                  color: context.colors.onSurfaceVariant,
-                                  fontStyle: FontStyle.italic,
+                          MessageContent(
+                            content: message.content,
+                            mentionNames: mentionNames,
+                            agentMentionPubkeys: agentMentionPubkeys,
+                            channelNames: channelNames,
+                            tags: message.tags,
+                            baseStyle: messageBodyTextStyle.copyWith(
+                              color: context.colors.onSurface,
+                            ),
+                            mediaCarouselTrailingOverflow: Grid.gutter,
+                            onMediaReply: allMessages == null
+                                ? null
+                                : () {
+                                    if (!context.mounted) return;
+                                    Navigator.of(context).push(
+                                      MaterialPageRoute<void>(
+                                        builder: (_) => ThreadDetailPage(
+                                          threadHead: message,
+                                          allMessages: allMessages!,
+                                          channelId: channelId,
+                                          currentPubkey: currentPubkey,
+                                          isMember: isMember,
+                                          isArchived: isArchived,
+                                        ),
+                                      ),
+                                    );
+                                  },
+                            onMediaMore: (viewerContext, imageUrl) =>
+                                showImageActions(
+                                  context: viewerContext,
+                                  ref: ref,
+                                  message: message,
+                                  channelId: channelId,
+                                  imageUrl: imageUrl,
+                                  canManageMessage: canManageMessage,
+                                  onDeleted: () {
+                                    if (viewerContext.mounted) {
+                                      Navigator.of(viewerContext).maybePop();
+                                    }
+                                  },
                                 ),
-                              ),
-                            ],
-                          ],
-                        ),
-                      ),
-                    MessageContent(
-                      content: message.content,
-                      mentionNames: mentionNames,
-                      agentMentionPubkeys: agentMentionPubkeys,
-                      channelNames: channelNames,
-                      tags: message.tags,
-                      baseStyle: context.textTheme.bodyLarge?.copyWith(
-                        color: context.colors.onSurface,
-                      ),
-                      onChannelTap: (targetChannelId) {
-                        openChannelLink(
-                          context: context,
-                          ref: ref,
-                          channelId: targetChannelId,
-                          currentChannelId: channelId,
-                        );
-                      },
-                      onMentionTap: (pubkey) =>
-                          showUserProfileSheet(context, pubkey),
-                    ),
-                    if (message.reactions.isNotEmpty)
-                      ReactionRow(
-                        reactions: message.reactions,
-                        onToggle: (emoji) =>
-                            toggleReaction(ref, message, emoji),
+                            onChannelTap: (targetChannelId) {
+                              openChannelLink(
+                                context: context,
+                                ref: ref,
+                                channelId: targetChannelId,
+                                currentChannelId: channelId,
+                              );
+                            },
+                            onMentionTap: (pubkey) =>
+                                showUserProfileSheet(context, pubkey),
+                          ),
+                          if (message.reactions.isNotEmpty)
+                            ReactionRow(
+                              reactions: message.reactions,
+                              onToggle: (emoji) =>
+                                  toggleReaction(ref, message, emoji),
+                            ),
+                        ],
                       ),
-                  ],
-                ),
-              ),
-            ),
-          ],
-        ),
-      ),
-    );
-  }
-}
-
-class _ThreadTypingIndicator extends ConsumerWidget {
-  final List<TypingEntry> entries;
-
-  const _ThreadTypingIndicator({required this.entries});
-
-  @override
-  Widget build(BuildContext context, WidgetRef ref) {
-    final userCache = ref.watch(userCacheProvider);
-    final names = entries.map((e) {
-      final profile =
-          userCache[e.pubkey.toLowerCase()] ??
-          ref.read(userCacheProvider.notifier).get(e.pubkey.toLowerCase());
-      return profile?.label ?? shortPubkey(e.pubkey);
-    }).toList();
-    final text = switch (names.length) {
-      1 => '${names[0]} is typing...',
-      2 => '${names[0]} and ${names[1]} are typing...',
-      _ => '${names[0]} and ${names.length - 1} others are typing...',
-    };
-
-    final visibleEntries = entries.take(3).toList();
-    final avatarCount = visibleEntries.length;
-
-    return Container(
-      width: double.infinity,
-      padding: const EdgeInsets.symmetric(
-        horizontal: Grid.gutter,
-        vertical: Grid.quarter + 2,
-      ),
-      child: Row(
-        children: [
-          SizedBox(
-            width: 20.0 + (avatarCount - 1) * 12.0,
-            height: 20,
-            child: Stack(
-              children: [
-                for (var i = 0; i < avatarCount; i++)
-                  Positioned(
-                    left: i * 12.0,
-                    child: SmallAvatar(
-                      pubkey: visibleEntries[i].pubkey,
-                      userCache: userCache,
                     ),
                   ),
-              ],
-            ),
-          ),
-          const SizedBox(width: Grid.xxs),
-          Flexible(
-            child: Text(
-              text,
-              style: context.textTheme.labelSmall?.copyWith(
-                color: context.colors.outline,
-                fontStyle: FontStyle.italic,
+                ],
               ),
-              overflow: TextOverflow.ellipsis,
             ),
           ),
-        ],
+        ),
       ),
     );
   }
@@ -651,7 +690,7 @@ class _Avatar extends StatelessWidget {
 
     return AvatarImage(
       imageUrl: avatarUrl,
-      radius: 18,
+      radius: messageAvatarSize / 2,
       backgroundColor: context.colors.primaryContainer,
       fallback: Text(
         initial,
diff --git a/mobile/lib/features/channels/thread_follows/thread_follows_provider.dart b/mobile/lib/features/channels/thread_follows/thread_follows_provider.dart
new file mode 100644
index 00000000000..b3b09cf7e7c
--- /dev/null
+++ b/mobile/lib/features/channels/thread_follows/thread_follows_provider.dart
@@ -0,0 +1,83 @@
+import 'package:hooks_riverpod/hooks_riverpod.dart';
+
+import '../../../shared/relay/relay.dart';
+import '../../../shared/theme/theme_provider.dart';
+import '../read_state/read_state_time.dart';
+import 'thread_follows_storage.dart';
+
+class ThreadFollowsState {
+  final Set<String> followedRootIds;
+
+  const ThreadFollowsState({this.followedRootIds = const {}});
+
+  bool isFollowing(String rootId) => followedRootIds.contains(rootId);
+}
+
+/// Followed thread roots for the signed-in identity. Follows feed the unread
+/// pipeline (`shouldNotifyForEvent`'s `followedRootIds`), so replies in a
+/// followed thread badge the channel even without participation.
+class ThreadFollowsNotifier extends Notifier<ThreadFollowsState> {
+  List<ThreadFollowEntry> _entries = const [];
+  String? _pubkey;
+
+  @override
+  ThreadFollowsState build() {
+    final pubkey = ref.watch(myPubkeyProvider)?.trim().toLowerCase();
+    _pubkey = pubkey;
+    if (pubkey == null || pubkey.isEmpty) {
+      _entries = const [];
+      return const ThreadFollowsState();
+    }
+
+    try {
+      _entries = ThreadFollowsStorage(
+        ref.read(savedPrefsProvider),
+      ).read(pubkey);
+    } catch (_) {
+      _entries = const [];
+    }
+    return _stateFromEntries();
+  }
+
+  void followThread(String rootId) {
+    if (rootId.isEmpty || _entries.any((e) => e.rootId == rootId)) return;
+    _entries = capThreadFollowEntries([
+      ..._entries,
+      ThreadFollowEntry(rootId: rootId, followedAt: currentUnixSeconds()),
+    ]);
+    _persist();
+    state = _stateFromEntries();
+  }
+
+  void unfollowThread(String rootId) {
+    final next = [
+      for (final entry in _entries)
+        if (entry.rootId != rootId) entry,
+    ];
+    if (next.length == _entries.length) return;
+    _entries = next;
+    _persist();
+    state = _stateFromEntries();
+  }
+
+  void _persist() {
+    final pubkey = _pubkey;
+    if (pubkey == null || pubkey.isEmpty) return;
+    try {
+      ThreadFollowsStorage(
+        ref.read(savedPrefsProvider),
+      ).write(pubkey, _entries);
+    } catch (_) {
+      // In-memory state still works this session.
+    }
+  }
+
+  ThreadFollowsState _stateFromEntries() => ThreadFollowsState(
+    followedRootIds: Set.unmodifiable({for (final e in _entries) e.rootId}),
+  );
+}
+
+final threadFollowsProvider =
+    NotifierProvider<ThreadFollowsNotifier, ThreadFollowsState>(
+      ThreadFollowsNotifier.new,
+    );
diff --git a/mobile/lib/features/channels/thread_follows/thread_follows_storage.dart b/mobile/lib/features/channels/thread_follows/thread_follows_storage.dart
new file mode 100644
index 00000000000..6538af3e779
--- /dev/null
+++ b/mobile/lib/features/channels/thread_follows/thread_follows_storage.dart
@@ -0,0 +1,68 @@
+import 'dart:convert';
+
+import 'package:shared_preferences/shared_preferences.dart';
+
+/// Persistence for followed thread root IDs.
+///
+/// Mirrors the desktop store (`useThreadFollows.ts`): per-pubkey entries of
+/// `{rootId, followedAt}`, capped at the oldest-out limit. Desktop keeps this
+/// client-local (localStorage), so mobile does the same with
+/// SharedPreferences — following on one device intentionally does not sync.
+const threadFollowsMaxEntries = 500;
+
+String threadFollowsKey(String pubkey) => 'buzz-thread-follows.v1:$pubkey';
+
+class ThreadFollowEntry {
+  final String rootId;
+  final int followedAt;
+
+  const ThreadFollowEntry({required this.rootId, required this.followedAt});
+
+  Map<String, dynamic> toJson() => {'rootId': rootId, 'followedAt': followedAt};
+}
+
+class ThreadFollowsStorage {
+  final SharedPreferences _prefs;
+
+  ThreadFollowsStorage(this._prefs);
+
+  List<ThreadFollowEntry> read(String pubkey) {
+    final raw = _prefs.getString(threadFollowsKey(pubkey));
+    if (raw == null || raw.isEmpty) return const [];
+
+    try {
+      final parsed = jsonDecode(raw);
+      if (parsed is! List) return const [];
+      return [
+        for (final entry in parsed)
+          if (entry is Map &&
+              entry['rootId'] is String &&
+              entry['followedAt'] is int)
+            ThreadFollowEntry(
+              rootId: entry['rootId'] as String,
+              followedAt: entry['followedAt'] as int,
+            ),
+      ];
+    } catch (_) {
+      return const [];
+    }
+  }
+
+  void write(String pubkey, List<ThreadFollowEntry> entries) {
+    _prefs.setString(
+      threadFollowsKey(pubkey),
+      jsonEncode([for (final entry in entries) entry.toJson()]),
+    );
+  }
+}
+
+/// Cap entries at [threadFollowsMaxEntries], evicting the oldest follows
+/// first — same policy as desktop's `capEntries`.
+List<ThreadFollowEntry> capThreadFollowEntries(
+  List<ThreadFollowEntry> entries,
+) {
+  if (entries.length <= threadFollowsMaxEntries) return entries;
+  final sorted = [...entries]
+    ..sort((a, b) => a.followedAt.compareTo(b.followedAt));
+  return sorted.sublist(sorted.length - threadFollowsMaxEntries);
+}
diff --git a/mobile/lib/features/channels/timeline_message.dart b/mobile/lib/features/channels/timeline_message.dart
index 203be2dbbdf..253c9497031 100644
--- a/mobile/lib/features/channels/timeline_message.dart
+++ b/mobile/lib/features/channels/timeline_message.dart
@@ -171,6 +171,11 @@ class TimelineMessage {
     this.parentId,
     this.rootId,
   });
+
+  /// Attachment messages stay visually distinct from surrounding messages,
+  /// even when several are sent by the same author in quick succession.
+  bool get hasAttachments =>
+      tags.any((tag) => tag.isNotEmpty && tag.first == 'imeta');
 }
 
 @immutable
diff --git a/mobile/lib/features/forum/forum_post_card.dart b/mobile/lib/features/forum/forum_post_card.dart
index 7c1851ba54c..8666919a4a7 100644
--- a/mobile/lib/features/forum/forum_post_card.dart
+++ b/mobile/lib/features/forum/forum_post_card.dart
@@ -77,17 +77,22 @@ class ForumPostCard extends ConsumerWidget {
                     onTap: () => showUserProfileSheet(context, post.pubkey),
                     child: Text(
                       displayName,
-                      style: context.textTheme.labelMedium?.copyWith(
-                        fontWeight: FontWeight.w600,
-                      ),
+                      maxLines: 1,
+                      style: messageUsernameTextStyle,
                       overflow: TextOverflow.ellipsis,
                     ),
                   ),
                 ),
-                Text(
-                  formatRelativeTime(post.createdAt),
-                  style: context.textTheme.labelSmall?.copyWith(
-                    color: context.colors.onSurfaceVariant,
+                const SizedBox(width: Grid.xxs),
+                ConstrainedBox(
+                  constraints: const BoxConstraints(maxWidth: Grid.xxl),
+                  child: Text(
+                    formatRelativeTime(post.createdAt),
+                    maxLines: 1,
+                    overflow: TextOverflow.ellipsis,
+                    style: messageTimestampTextStyle.copyWith(
+                      color: context.colors.onSurfaceVariant,
+                    ),
                   ),
                 ),
                 const SizedBox(width: Grid.half),
@@ -124,6 +129,9 @@ class ForumPostCard extends ConsumerWidget {
                     content: preview,
                     mentionNames: mentionNames,
                     tags: post.tags,
+                    baseStyle: messageBodyTextStyle.copyWith(
+                      color: context.colors.onSurface,
+                    ),
                   ),
                 ),
               ),
diff --git a/mobile/lib/features/forum/forum_posts_view.dart b/mobile/lib/features/forum/forum_posts_view.dart
index 4d7482bfddc..e3eed1f96c9 100644
--- a/mobile/lib/features/forum/forum_posts_view.dart
+++ b/mobile/lib/features/forum/forum_posts_view.dart
@@ -6,6 +6,7 @@ import 'package:hooks_riverpod/hooks_riverpod.dart';
 import 'package:lucide_icons_flutter/lucide_icons.dart';
 
 import '../../shared/theme/theme.dart';
+import '../../shared/widgets/buzz_loading_indicator.dart';
 import '../../shared/widgets/frosted_app_bar.dart';
 import '../channels/channel.dart';
 import '../channels/compose_bar.dart';
@@ -61,7 +62,12 @@ class ForumPostsView extends HookConsumerWidget {
             body: postsAsync.when(
               loading: () => Padding(
                 padding: EdgeInsets.only(top: frostedAppBarHeight(context)),
-                child: const Center(child: CircularProgressIndicator()),
+                child: const Center(
+                  child: BuzzLoadingIndicator(
+                    size: 44,
+                    semanticLabel: 'Loading posts',
+                  ),
+                ),
               ),
               error: (e, _) => Padding(
                 padding: EdgeInsets.only(top: frostedAppBarHeight(context)),
diff --git a/mobile/lib/features/forum/forum_thread_page.dart b/mobile/lib/features/forum/forum_thread_page.dart
index 4a4c0d0ab83..d2e8490d618 100644
--- a/mobile/lib/features/forum/forum_thread_page.dart
+++ b/mobile/lib/features/forum/forum_thread_page.dart
@@ -8,6 +8,7 @@ import 'package:lucide_icons_flutter/lucide_icons.dart';
 
 import '../../shared/theme/theme.dart';
 import '../../shared/widgets/avatar_image.dart';
+import '../../shared/widgets/buzz_loading_indicator.dart';
 import '../../shared/widgets/frosted_app_bar.dart';
 import '../../shared/widgets/frosted_scaffold.dart';
 import '../channels/compose_bar.dart';
@@ -77,7 +78,12 @@ class ForumThreadPage extends HookConsumerWidget {
       body: threadAsync.when(
         loading: () => Padding(
           padding: EdgeInsets.only(top: frostedAppBarHeight(context)),
-          child: const Center(child: CircularProgressIndicator()),
+          child: const Center(
+            child: BuzzLoadingIndicator(
+              size: 44,
+              semanticLabel: 'Loading thread',
+            ),
+          ),
         ),
         error: (e, _) => Padding(
           padding: EdgeInsets.only(top: frostedAppBarHeight(context)),
@@ -335,22 +341,29 @@ class _OriginalPost extends ConsumerWidget {
               ),
               const SizedBox(width: Grid.xxs),
               Expanded(
-                child: Column(
-                  crossAxisAlignment: CrossAxisAlignment.start,
+                child: Row(
                   children: [
-                    GestureDetector(
-                      onTap: () => showUserProfileSheet(context, post.pubkey),
-                      child: Text(
-                        displayName,
-                        style: context.textTheme.labelMedium?.copyWith(
-                          fontWeight: FontWeight.w600,
+                    Expanded(
+                      child: GestureDetector(
+                        onTap: () => showUserProfileSheet(context, post.pubkey),
+                        child: Text(
+                          displayName,
+                          maxLines: 1,
+                          style: messageUsernameTextStyle,
+                          overflow: TextOverflow.ellipsis,
                         ),
                       ),
                     ),
-                    Text(
-                      formatRelativeTime(post.createdAt),
-                      style: context.textTheme.labelSmall?.copyWith(
-                        color: context.colors.onSurfaceVariant,
+                    const SizedBox(width: Grid.xxs),
+                    ConstrainedBox(
+                      constraints: const BoxConstraints(maxWidth: Grid.xxl),
+                      child: Text(
+                        formatRelativeTime(post.createdAt),
+                        maxLines: 1,
+                        overflow: TextOverflow.ellipsis,
+                        style: messageTimestampTextStyle.copyWith(
+                          color: context.colors.onSurfaceVariant,
+                        ),
                       ),
                     ),
                   ],
@@ -363,6 +376,9 @@ class _OriginalPost extends ConsumerWidget {
             content: post.content,
             mentionNames: mentionNames,
             tags: post.tags,
+            baseStyle: messageBodyTextStyle.copyWith(
+              color: context.colors.onSurface,
+            ),
             onMentionTap: (pubkey) => showUserProfileSheet(context, pubkey),
           ),
         ],
@@ -417,20 +433,28 @@ class _ReplyRow extends ConsumerWidget {
               Expanded(
                 child: Row(
                   children: [
-                    GestureDetector(
-                      onTap: () => showUserProfileSheet(context, reply.pubkey),
-                      child: Text(
-                        displayName,
-                        style: context.textTheme.labelMedium?.copyWith(
-                          fontWeight: FontWeight.w600,
+                    Expanded(
+                      child: GestureDetector(
+                        onTap: () =>
+                            showUserProfileSheet(context, reply.pubkey),
+                        child: Text(
+                          displayName,
+                          maxLines: 1,
+                          overflow: TextOverflow.ellipsis,
+                          style: messageUsernameTextStyle,
                         ),
                       ),
                     ),
                     const SizedBox(width: Grid.xxs),
-                    Text(
-                      formatRelativeTime(reply.createdAt),
-                      style: context.textTheme.labelSmall?.copyWith(
-                        color: context.colors.onSurfaceVariant,
+                    ConstrainedBox(
+                      constraints: const BoxConstraints(maxWidth: Grid.xxl),
+                      child: Text(
+                        formatRelativeTime(reply.createdAt),
+                        maxLines: 1,
+                        overflow: TextOverflow.ellipsis,
+                        style: messageTimestampTextStyle.copyWith(
+                          color: context.colors.onSurfaceVariant,
+                        ),
                       ),
                     ),
                   ],
@@ -458,6 +482,9 @@ class _ReplyRow extends ConsumerWidget {
               content: reply.content,
               mentionNames: mentionNames,
               tags: reply.tags,
+              baseStyle: messageBodyTextStyle.copyWith(
+                color: context.colors.onSurface,
+              ),
               onMentionTap: (pubkey) => showUserProfileSheet(context, pubkey),
             ),
           ),
diff --git a/mobile/lib/features/home/home_page.dart b/mobile/lib/features/home/home_page.dart
index 7c1e5792f9f..a40e317469f 100644
--- a/mobile/lib/features/home/home_page.dart
+++ b/mobile/lib/features/home/home_page.dart
@@ -8,6 +8,7 @@ import 'package:hooks_riverpod/hooks_riverpod.dart';
 import 'package:lucide_icons_flutter/lucide_icons.dart';
 
 import '../../shared/theme/theme.dart';
+import '../../shared/widgets/mobile_tab_footer_backdrop.dart';
 import '../activity/activity_page.dart';
 import '../channels/channels_page.dart';
 import '../search/search_page.dart';
@@ -17,12 +18,12 @@ class HomePage extends HookConsumerWidget {
 
   final WidgetBuilder settingsPageBuilder;
 
-  static const double _tabBarHeight = 56;
+  static const double _tabBarHeight = mobileTabBarHeight;
   static const double _tabBarRadius = _tabBarHeight / 2;
   static const double _tabBarInnerInset = Grid.half;
   static const double _selectedTabRadius =
       (_tabBarHeight - (_tabBarInnerInset * 2)) / 2;
-  static const double _tabBarBottomGap = Grid.twelve;
+  static const double _tabBarBottomGap = mobileTabBarBottomGap;
   static const double _tabBarHorizontalMargin = Grid.gutter;
   static const double _tabDestinationHorizontalPadding = Grid.sm;
   static const double _tabIconSize = 22;
@@ -63,6 +64,7 @@ class HomePage extends HookConsumerWidget {
     ];
 
     return Scaffold(
+      backgroundColor: Colors.transparent,
       // Keep the floating navigation and Home quick actions anchored while the
       // keyboard is visible on any tab.
       resizeToAvoidBottomInset: false,
@@ -71,6 +73,7 @@ class HomePage extends HookConsumerWidget {
         child: Stack(
           fit: StackFit.expand,
           children: [
+            Positioned.fill(child: ColoredBox(color: context.colors.surface)),
             Positioned.fill(
               child: MediaQuery(
                 data: _mediaQueryWithFloatingTabBarClearance(
@@ -80,6 +83,14 @@ class HomePage extends HookConsumerWidget {
                 child: IndexedStack(index: tabIndex.value, children: pages),
               ),
             ),
+            Align(
+              alignment: Alignment.bottomCenter,
+              child: IgnorePointer(
+                child: MobileTabFooterBackdrop(
+                  height: mobileTabFooterBackdropHeight(context),
+                ),
+              ),
+            ),
             Positioned.fill(
               child: ChannelQuickActionsLauncher(
                 visible: tabIndex.value == 0,
diff --git a/mobile/lib/features/invites/invite_join_provider.dart b/mobile/lib/features/invites/invite_join_provider.dart
index 0e5547aca56..b1d2680c93e 100644
--- a/mobile/lib/features/invites/invite_join_provider.dart
+++ b/mobile/lib/features/invites/invite_join_provider.dart
@@ -261,12 +261,17 @@ String _communityNameFromClaim(Map<String, dynamic> claim, String relayUrl) {
 }
 
 bool _requiresFreshInvite(Object error) {
-  return error.toString().contains('join_policy_required');
+  final message = error.toString();
+  return message.contains('join_policy_required') ||
+      message.contains('invite_exhausted');
 }
 
 String _friendlyInviteError(Object error) {
   final message = error.toString();
   if (message.contains('invite_expired')) return 'This invite has expired.';
+  if (message.contains('invite_exhausted')) {
+    return 'This invite has reached its use limit. Ask for a new invite.';
+  }
   if (message.contains('invite_invalid')) return 'This invite is not valid.';
   if (message.contains('join_policy_required')) {
     return 'This invite approval has expired. Re-open the invite link to try again.';
diff --git a/mobile/lib/features/invites/invite_join_sheet.dart b/mobile/lib/features/invites/invite_join_sheet.dart
index 58221158e51..a88d38ac161 100644
--- a/mobile/lib/features/invites/invite_join_sheet.dart
+++ b/mobile/lib/features/invites/invite_join_sheet.dart
@@ -3,6 +3,7 @@ import 'package:hooks_riverpod/hooks_riverpod.dart';
 import 'package:lucide_icons_flutter/lucide_icons.dart';
 
 import '../../shared/theme/theme.dart';
+import '../../shared/widgets/buzz_loading_indicator.dart';
 import '../pairing/pairing_page.dart';
 import 'invite_join_provider.dart';
 
@@ -113,10 +114,13 @@ class InviteJoinSheet extends ConsumerWidget {
                               .read(inviteJoinProvider.notifier)
                               .confirmJoin(),
                     icon: isClaiming
-                        ? const SizedBox(
+                        ? SizedBox(
                             width: 16,
                             height: 16,
-                            child: CircularProgressIndicator(strokeWidth: 2),
+                            child: BuzzLoadingIndicator(
+                              size: 16,
+                              semanticLabel: 'Joining community',
+                            ),
                           )
                         : const Icon(LucideIcons.check),
                     label: Text(isClaiming ? 'Joining…' : 'Join'),
diff --git a/mobile/lib/features/pairing/pairing_page.dart b/mobile/lib/features/pairing/pairing_page.dart
index 5d471d1f3b6..85b781052d0 100644
--- a/mobile/lib/features/pairing/pairing_page.dart
+++ b/mobile/lib/features/pairing/pairing_page.dart
@@ -7,6 +7,7 @@ import 'package:hooks_riverpod/hooks_riverpod.dart';
 import 'package:lucide_icons_flutter/lucide_icons.dart';
 
 import '../../shared/theme/theme.dart';
+import '../../shared/widgets/buzz_loading_indicator.dart';
 import '../../shared/widgets/tappable_flapping_bee.dart';
 import 'pairing_provider.dart';
 import 'pairing_qr_scanner.dart';
@@ -255,13 +256,10 @@ class _SasVerificationView extends StatelessWidget {
           Row(
             mainAxisAlignment: MainAxisAlignment.center,
             children: [
-              SizedBox(
-                width: 20,
-                height: 20,
-                child: CircularProgressIndicator(
-                  strokeWidth: 2,
-                  color: context.colors.primary,
-                ),
+              BuzzLoadingIndicator(
+                size: 24,
+                color: context.colors.primary,
+                semanticLabel: 'Connecting',
               ),
               const SizedBox(width: Grid.twelve),
               Text(
diff --git a/mobile/lib/features/pairing/pairing_page/pairing_welcome_view.dart b/mobile/lib/features/pairing/pairing_page/pairing_welcome_view.dart
index 58c089bf528..49fc185133f 100644
--- a/mobile/lib/features/pairing/pairing_page/pairing_welcome_view.dart
+++ b/mobile/lib/features/pairing/pairing_page/pairing_welcome_view.dart
@@ -87,9 +87,10 @@ class _PairingWelcomeView extends StatelessWidget {
                               ? const SizedBox(
                                   width: 20,
                                   height: 20,
-                                  child: CircularProgressIndicator(
-                                    strokeWidth: 2,
+                                  child: BuzzLoadingIndicator(
+                                    size: 20,
                                     color: _onboardingCtaLabel,
+                                    semanticLabel: 'Opening scanner',
                                   ),
                                 )
                               : const Text('Scan a QR code'),
@@ -173,12 +174,11 @@ class _PairingWelcomeView extends StatelessWidget {
                                             ? const SizedBox(
                                                 width: 20,
                                                 height: 20,
-                                                child:
-                                                    CircularProgressIndicator(
-                                                      strokeWidth: 2,
-                                                      color:
-                                                          _onboardingCtaLabel,
-                                                    ),
+                                                child: BuzzLoadingIndicator(
+                                                  size: 20,
+                                                  color: _onboardingCtaLabel,
+                                                  semanticLabel: 'Connecting',
+                                                ),
                                               )
                                             : const Text('Connect'),
                                       ),
diff --git a/mobile/lib/features/profile/user_profile.dart b/mobile/lib/features/profile/user_profile.dart
index 4e741590162..de58d955e3e 100644
--- a/mobile/lib/features/profile/user_profile.dart
+++ b/mobile/lib/features/profile/user_profile.dart
@@ -39,3 +39,10 @@ class UserProfile {
       (displayName?.isNotEmpty == true ? displayName! : pubkey)[0]
           .toUpperCase();
 }
+
+/// Optional profile handle shown beside a message author's display name.
+String? messageUsernameLabel(UserProfile? profile) {
+  final handle = profile?.nip05Handle?.trim();
+  if (handle != null && handle.isNotEmpty) return handle;
+  return null;
+}
diff --git a/mobile/lib/features/pulse/compose_note_page.dart b/mobile/lib/features/pulse/compose_note_page.dart
index 2c514d6a71b..d3df98ee894 100644
--- a/mobile/lib/features/pulse/compose_note_page.dart
+++ b/mobile/lib/features/pulse/compose_note_page.dart
@@ -4,6 +4,7 @@ import 'package:hooks_riverpod/hooks_riverpod.dart';
 
 import '../../shared/theme/theme.dart';
 import '../../shared/widgets/avatar_image.dart';
+import '../../shared/widgets/buzz_loading_indicator.dart';
 import '../../shared/widgets/frosted_app_bar.dart';
 import '../../shared/widgets/frosted_scaffold.dart';
 import '../channels/message_content.dart';
@@ -76,10 +77,15 @@ class ComposeNotePage extends HookConsumerWidget {
                 shape: const StadiumBorder(),
               ),
               child: isSending.value
-                  ? const SizedBox(
+                  ? SizedBox(
                       width: 16,
                       height: 16,
-                      child: CircularProgressIndicator(strokeWidth: 2),
+                      child: BuzzLoadingIndicator(
+                        size: 16,
+                        semanticLabel: _isReply
+                            ? 'Sending reply'
+                            : 'Publishing post',
+                      ),
                     )
                   : Text(_isReply ? 'Reply' : 'Post'),
             ),
@@ -198,20 +204,24 @@ class _ReplyContext extends ConsumerWidget {
                   children: [
                     Row(
                       children: [
-                        Flexible(
+                        Expanded(
                           child: Text(
                             displayName,
-                            style: context.textTheme.labelMedium?.copyWith(
-                              fontWeight: FontWeight.w700,
-                            ),
+                            maxLines: 1,
+                            style: messageUsernameTextStyle,
                             overflow: TextOverflow.ellipsis,
                           ),
                         ),
                         const SizedBox(width: Grid.half),
-                        Text(
-                          formatPulseRelativeTime(note.createdAt),
-                          style: context.textTheme.labelSmall?.copyWith(
-                            color: context.colors.onSurfaceVariant,
+                        ConstrainedBox(
+                          constraints: const BoxConstraints(maxWidth: Grid.xxl),
+                          child: Text(
+                            formatPulseRelativeTime(note.createdAt),
+                            maxLines: 1,
+                            overflow: TextOverflow.ellipsis,
+                            style: messageTimestampTextStyle.copyWith(
+                              color: context.colors.onSurfaceVariant,
+                            ),
                           ),
                         ),
                       ],
@@ -229,6 +239,9 @@ class _ReplyContext extends ConsumerWidget {
                           child: MessageContent(
                             content: note.content,
                             tags: note.tags,
+                            baseStyle: messageBodyTextStyle.copyWith(
+                              color: context.colors.onSurface,
+                            ),
                           ),
                         ),
                       ),
diff --git a/mobile/lib/features/pulse/note_card.dart b/mobile/lib/features/pulse/note_card.dart
index 6caf1dad6ae..d99e3ada4b4 100644
--- a/mobile/lib/features/pulse/note_card.dart
+++ b/mobile/lib/features/pulse/note_card.dart
@@ -89,33 +89,47 @@ class NoteCard extends HookConsumerWidget {
                         onTap: () => showUserProfileSheet(context, note.pubkey),
                         child: Row(
                           children: [
-                            Flexible(
+                            Expanded(
+                              child: Row(
+                                mainAxisSize: MainAxisSize.min,
+                                children: [
+                                  Flexible(
+                                    child: Text(
+                                      displayName,
+                                      maxLines: 1,
+                                      style: messageUsernameTextStyle,
+                                      overflow: TextOverflow.ellipsis,
+                                    ),
+                                  ),
+                                  if (isAgent) ...[
+                                    const SizedBox(width: Grid.half),
+                                    Icon(
+                                      LucideIcons.bot,
+                                      size: 13,
+                                      color: context.colors.primary,
+                                    ),
+                                  ],
+                                ],
+                              ),
+                            ),
+                            const SizedBox(width: Grid.xxs),
+                            ConstrainedBox(
+                              constraints: const BoxConstraints(
+                                maxWidth: Grid.xl,
+                              ),
                               child: Text(
-                                displayName,
-                                style: context.textTheme.labelMedium?.copyWith(
-                                  fontWeight: FontWeight.w700,
-                                ),
+                                formatPulseRelativeTime(note.createdAt),
+                                maxLines: 1,
                                 overflow: TextOverflow.ellipsis,
+                                style: messageTimestampTextStyle.copyWith(
+                                  color: context.colors.onSurfaceVariant,
+                                ),
                               ),
                             ),
-                            if (isAgent) ...[
-                              const SizedBox(width: Grid.half),
-                              Icon(
-                                LucideIcons.bot,
-                                size: 13,
-                                color: context.colors.primary,
-                              ),
-                            ],
                           ],
                         ),
                       ),
                     ),
-                    Text(
-                      formatPulseRelativeTime(note.createdAt),
-                      style: context.textTheme.labelSmall?.copyWith(
-                        color: context.colors.onSurfaceVariant,
-                      ),
-                    ),
                     if (canFollow) ...[
                       const SizedBox(width: Grid.half),
                       _FollowButton(
@@ -142,7 +156,13 @@ class NoteCard extends HookConsumerWidget {
                   ),
                 ],
                 const SizedBox(height: Grid.half),
-                MessageContent(content: note.content, tags: note.tags),
+                MessageContent(
+                  content: note.content,
+                  tags: note.tags,
+                  baseStyle: messageBodyTextStyle.copyWith(
+                    color: context.colors.onSurface,
+                  ),
+                ),
                 const SizedBox(height: Grid.xxs),
                 Row(
                   children: [
diff --git a/mobile/lib/features/search/recent_searches_provider.dart b/mobile/lib/features/search/recent_searches_provider.dart
new file mode 100644
index 00000000000..813672a9cc7
--- /dev/null
+++ b/mobile/lib/features/search/recent_searches_provider.dart
@@ -0,0 +1,64 @@
+import 'package:hooks_riverpod/hooks_riverpod.dart';
+
+import '../../shared/relay/relay.dart';
+import '../../shared/theme/theme_provider.dart';
+
+const _recentSearchesPrefsKey = 'recent_searches_v1';
+const _maxRecentSearches = 6;
+
+/// Device-local history of explicitly submitted searches, newest first.
+///
+/// Queries are scoped by community and account so searches from one identity
+/// cannot appear after switching to another.
+class RecentSearchesNotifier extends Notifier<List<String>> {
+  late String _prefsKey;
+
+  @override
+  List<String> build() {
+    final config = ref.watch(relayConfigProvider);
+    final pubkey = ref.watch(myPubkeyProvider) ?? 'anon';
+    _prefsKey = '$_recentSearchesPrefsKey:${config.baseUrl}:$pubkey';
+
+    final stored =
+        ref.read(savedPrefsProvider).getStringList(_prefsKey) ?? const [];
+    return List.unmodifiable(
+      stored
+          .map((query) => query.trim())
+          .where((query) => query.isNotEmpty)
+          .take(_maxRecentSearches),
+    );
+  }
+
+  /// Records [query] as the most recent search after trimming whitespace.
+  ///
+  /// Empty queries are ignored. Existing matches are deduplicated
+  /// case-insensitively, the newest spelling is retained, the history is capped
+  /// at six entries, and the result is persisted for the current community and
+  /// account.
+  void record(String query) {
+    final trimmed = query.trim();
+    if (trimmed.isEmpty) return;
+
+    final normalized = trimmed.toLowerCase();
+    final next = [
+      trimmed,
+      ...state.where((item) => item.toLowerCase() != normalized),
+    ].take(_maxRecentSearches).toList(growable: false);
+    _persist(next);
+  }
+
+  /// Clears the current community and account's history and persists it empty.
+  void clear() => _persist(const []);
+
+  void _persist(List<String> searches) {
+    state = List.unmodifiable(searches);
+    ref.read(savedPrefsProvider).setStringList(_prefsKey, searches);
+  }
+}
+
+/// Provides device-local recent searches scoped to the active community and
+/// account.
+final recentSearchesProvider =
+    NotifierProvider<RecentSearchesNotifier, List<String>>(
+      RecentSearchesNotifier.new,
+    );
diff --git a/mobile/lib/features/search/search_page.dart b/mobile/lib/features/search/search_page.dart
index 635169f0de9..b608b65aef0 100644
--- a/mobile/lib/features/search/search_page.dart
+++ b/mobile/lib/features/search/search_page.dart
@@ -5,9 +5,11 @@ import 'package:lucide_icons_flutter/lucide_icons.dart';
 
 import '../../shared/theme/theme.dart';
 import '../../shared/widgets/avatar_image.dart';
+import '../../shared/widgets/buzz_loading_indicator.dart';
 import '../../shared/widgets/filter_chip_bar.dart';
 import '../../shared/widgets/frosted_app_bar.dart';
 import '../../shared/widgets/frosted_scaffold.dart';
+import '../../shared/widgets/message_author_meta.dart';
 import '../channels/channel.dart';
 import '../channels/channel_detail_page.dart';
 import '../channels/channel_management_provider.dart';
@@ -19,20 +21,22 @@ import '../forum/forum_thread_page.dart';
 import '../profile/profile_provider.dart';
 import '../profile/user_cache_provider.dart';
 import '../profile/user_profile.dart';
+import 'recent_searches_provider.dart';
 import 'search_provider.dart';
 
 enum _SearchFilter { all, messages, channels, people }
 
 const _searchFieldMinHeight = 36.0;
 const _searchFieldVerticalPadding = Grid.xxs;
+const _searchFieldHint = 'Search messages, channels, people\u2026';
+const _searchCancelEnterDuration = Duration(milliseconds: 160);
+const _searchCancelExitDuration = Duration(milliseconds: 120);
 
 double _searchFieldHeight(BuildContext context) {
-  final style =
-      context.textTheme.bodyMedium ??
-      const TextStyle(fontSize: 14, height: 1.3);
+  const style = searchInputTextStyle;
   final scaledFontSize = MediaQuery.textScalerOf(
     context,
-  ).scale(style.fontSize ?? 14);
+  ).scale(style.fontSize ?? 15);
   final contentHeight =
       scaledFontSize * (style.height ?? 1) + _searchFieldVerticalPadding * 2;
   return contentHeight > _searchFieldMinHeight
@@ -52,10 +56,12 @@ class SearchPage extends HookConsumerWidget {
         .value;
     final activeFilter = useState(_SearchFilter.all);
     final textController = useTextEditingController();
-    final hasText = useListenableSelector(
-      textController,
-      () => textController.text.isNotEmpty,
+    final focusNode = useFocusNode();
+    final isSearchFocused = useListenableSelector(
+      focusNode,
+      () => focusNode.hasFocus,
     );
+    final reduceMotion = MediaQuery.disableAnimationsOf(context);
     final isBuzzTheme = context.appColors.topSectionGradient != null;
     final buzzSearchColor = context.theme.brightness == Brightness.dark
         ? Colors.white
@@ -71,13 +77,28 @@ class SearchPage extends HookConsumerWidget {
       fontWeight: FontWeight.w600,
     );
     final searchFieldHeight = _searchFieldHeight(context);
-    final searchHeaderBottomHeight = searchFieldHeight + Grid.twelve;
+    final searchControlHeight = searchFieldHeight > Grid.xl
+        ? searchFieldHeight
+        : Grid.xl;
+    final searchHeaderBottomHeight = searchControlHeight + Grid.twelve;
+
+    void runRecentSearch(String query) {
+      textController.value = TextEditingValue(
+        text: query,
+        selection: TextSelection.collapsed(offset: query.length),
+      );
+      focusNode.requestFocus();
+      ref.read(recentSearchesProvider.notifier).record(query);
+      ref.read(searchProvider.notifier).search(query);
+    }
 
     return FrostedScaffold(
+      backgroundColor: Colors.transparent,
       // Keep the empty state centered in the page rather than the portion left
       // above the keyboard.
       resizeToAvoidBottomInset: false,
       appBar: FrostedAppBar(
+        automaticallyImplyLeading: false,
         gradient: context.appColors.topSectionGradient,
         title: const Text('Search'),
         titleStyle: headerTitleStyle,
@@ -89,51 +110,120 @@ class SearchPage extends HookConsumerWidget {
             Grid.gutter,
             Grid.twelve,
           ),
-          child: Container(
-            key: const Key('search-field-container'),
-            height: searchFieldHeight,
-            padding: const EdgeInsets.symmetric(horizontal: Grid.half),
-            decoration: BoxDecoration(
-              color: searchSurfaceColor,
-              borderRadius: BorderRadius.circular(Radii.lg),
-            ),
-            child: TextField(
-              controller: textController,
-              decoration: InputDecoration(
-                hintText: 'Search messages, channels, people\u2026',
-                hintStyle: context.textTheme.bodyMedium?.copyWith(
-                  color: searchMutedColor,
-                ),
-                prefixIcon: Icon(
-                  LucideIcons.search,
-                  size: 16,
-                  color: searchMutedColor,
-                ),
-                prefixIconConstraints: const BoxConstraints(minWidth: 32),
-                border: InputBorder.none,
-                enabledBorder: InputBorder.none,
-                focusedBorder: InputBorder.none,
-                isDense: true,
-                contentPadding: const EdgeInsets.symmetric(
-                  vertical: _searchFieldVerticalPadding,
+          child: Row(
+            children: [
+              Expanded(
+                child: Container(
+                  key: const Key('search-field-container'),
+                  height: searchFieldHeight,
+                  padding: const EdgeInsets.symmetric(horizontal: Grid.half),
+                  decoration: BoxDecoration(
+                    color: searchSurfaceColor,
+                    borderRadius: BorderRadius.circular(Radii.lg),
+                  ),
+                  child: TextField(
+                    key: const Key('search-field'),
+                    controller: textController,
+                    focusNode: focusNode,
+                    decoration: InputDecoration(
+                      hintText: isSearchFocused ? null : _searchFieldHint,
+                      hintStyle: searchInputTextStyle.copyWith(
+                        color: searchMutedColor,
+                      ),
+                      prefixIcon: Icon(
+                        LucideIcons.search,
+                        size: 16,
+                        color: searchMutedColor,
+                      ),
+                      prefixIconConstraints: const BoxConstraints(minWidth: 32),
+                      border: InputBorder.none,
+                      enabledBorder: InputBorder.none,
+                      focusedBorder: InputBorder.none,
+                      isDense: true,
+                      contentPadding: const EdgeInsets.symmetric(
+                        vertical: _searchFieldVerticalPadding,
+                      ),
+                    ),
+                    style: searchInputTextStyle.copyWith(
+                      color: context.colors.onSurface,
+                    ),
+                    textInputAction: TextInputAction.search,
+                    onChanged: (value) =>
+                        ref.read(searchProvider.notifier).search(value),
+                    onSubmitted: (value) {
+                      final query = value.trim();
+                      if (query.isEmpty) return;
+                      ref.read(recentSearchesProvider.notifier).record(query);
+                    },
+                  ),
                 ),
               ),
-              style: context.textTheme.bodyMedium,
-              onChanged: (value) =>
-                  ref.read(searchProvider.notifier).search(value),
-            ),
+              AnimatedSwitcher(
+                duration: reduceMotion
+                    ? Duration.zero
+                    : _searchCancelEnterDuration,
+                reverseDuration: reduceMotion
+                    ? Duration.zero
+                    : _searchCancelExitDuration,
+                transitionBuilder: (child, animation) {
+                  final curvedAnimation = CurvedAnimation(
+                    parent: animation,
+                    curve: Curves.easeOutCubic,
+                    reverseCurve: Curves.easeInCubic,
+                  );
+                  return SizeTransition(
+                    sizeFactor: curvedAnimation,
+                    axis: Axis.horizontal,
+                    axisAlignment: 1,
+                    child: FadeTransition(
+                      opacity: curvedAnimation,
+                      child: SlideTransition(
+                        position: Tween<Offset>(
+                          begin: const Offset(0.35, 0),
+                          end: Offset.zero,
+                        ).animate(curvedAnimation),
+                        child: child,
+                      ),
+                    ),
+                  );
+                },
+                child: isSearchFocused
+                    ? Padding(
+                        key: const ValueKey('search-cancel-visible'),
+                        padding: const EdgeInsets.only(left: Grid.xxs),
+                        child: TextButton(
+                          key: const Key('search-cancel'),
+                          onPressed: () {
+                            textController.clear();
+                            ref.read(searchProvider.notifier).clear();
+                            focusNode.unfocus();
+                          },
+                          style: TextButton.styleFrom(
+                            foregroundColor: context.colors.primary,
+                            minimumSize: Size(0, searchControlHeight),
+                            padding: const EdgeInsets.symmetric(
+                              horizontal: Grid.half,
+                              vertical: Grid.xxs,
+                            ),
+                            tapTargetSize: MaterialTapTargetSize.shrinkWrap,
+                          ),
+                          child: Text(
+                            'Cancel',
+                            style: filterChipTextStyle.copyWith(
+                              color: context.colors.primary,
+                              fontWeight: FontWeight.w500,
+                            ),
+                          ),
+                        ),
+                      )
+                    : const SizedBox.shrink(
+                        key: ValueKey('search-cancel-hidden'),
+                      ),
+              ),
+            ],
           ),
         ),
-        actions: [
-          if (hasText)
-            IconButton(
-              icon: const Icon(LucideIcons.x, size: 20),
-              onPressed: () {
-                textController.clear();
-                ref.read(searchProvider.notifier).clear();
-              },
-            ),
-        ],
+        actions: const [],
       ),
       body: Column(
         crossAxisAlignment: CrossAxisAlignment.stretch,
@@ -162,6 +252,7 @@ class SearchPage extends HookConsumerWidget {
               state: searchState,
               filter: activeFilter.value,
               currentPubkey: currentPubkey,
+              onRecentSearchSelected: runRecentSearch,
             ),
           ),
         ],
@@ -174,16 +265,27 @@ class _SearchBody extends ConsumerWidget {
   final SearchState state;
   final _SearchFilter filter;
   final String? currentPubkey;
+  final ValueChanged<String> onRecentSearchSelected;
 
   const _SearchBody({
     required this.state,
     required this.filter,
     required this.currentPubkey,
+    required this.onRecentSearchSelected,
   });
 
   @override
   Widget build(BuildContext context, WidgetRef ref) {
     if (state.query.isEmpty) {
+      final recentSearches = ref.watch(recentSearchesProvider);
+      if (recentSearches.isNotEmpty) {
+        return _RecentSearches(
+          searches: recentSearches,
+          onSelected: onRecentSearchSelected,
+          onClear: ref.read(recentSearchesProvider.notifier).clear,
+        );
+      }
+
       return Center(
         child: Padding(
           key: const Key('search-empty-state'),
@@ -221,6 +323,8 @@ class _SearchBody extends ConsumerWidget {
         state.channelResults.isNotEmpty ||
         state.userResults.isNotEmpty ||
         state.messageResults.isNotEmpty;
+    void recordResultSelection() =>
+        ref.read(recentSearchesProvider.notifier).record(state.query);
 
     if (!state.isLoading && !hasAnyResults) {
       return Padding(
@@ -242,22 +346,132 @@ class _SearchBody extends ConsumerWidget {
     return ListView(
       key: const Key('search-results-list'),
       padding: EdgeInsets.only(
-        bottom: Grid.xl + MediaQuery.viewInsetsOf(context).bottom,
+        bottom:
+            Grid.xl +
+            MediaQuery.paddingOf(context).bottom +
+            MediaQuery.viewInsetsOf(context).bottom,
       ),
       children: [
         if (showChannels && state.channelResults.isNotEmpty)
-          _ChannelsSection(channels: state.channelResults),
+          _ChannelsSection(
+            channels: state.channelResults,
+            onResultSelected: recordResultSelection,
+          ),
         if (showPeople && state.userResults.isNotEmpty)
-          _PeopleSection(users: state.userResults),
+          _PeopleSection(
+            users: state.userResults,
+            onResultSelected: recordResultSelection,
+          ),
         if (showMessages && state.messageResults.isNotEmpty)
           _MessagesSection(
             hits: state.messageResults,
             currentPubkey: currentPubkey,
+            onResultSelected: recordResultSelection,
           ),
         if (state.isLoading)
           const Padding(
             padding: EdgeInsets.all(Grid.sm),
-            child: Center(child: CircularProgressIndicator()),
+            child: Center(
+              child: BuzzLoadingIndicator(
+                size: 36,
+                semanticLabel: 'Loading more search results',
+              ),
+            ),
+          ),
+      ],
+    );
+  }
+}
+
+class _RecentSearches extends StatelessWidget {
+  final List<String> searches;
+  final ValueChanged<String> onSelected;
+  final VoidCallback onClear;
+
+  const _RecentSearches({
+    required this.searches,
+    required this.onSelected,
+    required this.onClear,
+  });
+
+  @override
+  Widget build(BuildContext context) {
+    return ListView(
+      key: const Key('recent-searches-list'),
+      padding: EdgeInsets.only(
+        bottom:
+            Grid.xl +
+            MediaQuery.paddingOf(context).bottom +
+            MediaQuery.viewInsetsOf(context).bottom,
+      ),
+      children: [
+        Padding(
+          padding: const EdgeInsets.fromLTRB(
+            Grid.gutter,
+            Grid.xs,
+            Grid.xxs,
+            Grid.half,
+          ),
+          child: Row(
+            children: [
+              Expanded(
+                child: Text(
+                  'Recent searches',
+                  key: const Key('recent-searches-heading'),
+                  style: activityContextTextStyle.copyWith(
+                    color: context.colors.onSurfaceVariant,
+                  ),
+                ),
+              ),
+              TextButton(
+                key: const Key('clear-recent-searches'),
+                onPressed: onClear,
+                child: Text(
+                  'Clear',
+                  style: activityContextTextStyle.copyWith(
+                    color: context.colors.primary,
+                  ),
+                ),
+              ),
+            ],
+          ),
+        ),
+        for (var index = 0; index < searches.length; index++)
+          InkWell(
+            key: ValueKey('recent-search-$index'),
+            onTap: () => onSelected(searches[index]),
+            child: ConstrainedBox(
+              constraints: const BoxConstraints(minHeight: Grid.xl),
+              child: Padding(
+                padding: const EdgeInsets.symmetric(
+                  horizontal: Grid.gutter,
+                  vertical: Grid.twelve,
+                ),
+                child: Row(
+                  children: [
+                    Icon(
+                      LucideIcons.clock,
+                      size: 18,
+                      color: context.colors.onSurfaceVariant,
+                    ),
+                    const SizedBox(width: Grid.twelve),
+                    Expanded(
+                      child: Text(
+                        searches[index],
+                        style: contentListTitleTextStyle.copyWith(
+                          color: context.colors.onSurface,
+                        ),
+                      ),
+                    ),
+                    Icon(
+                      LucideIcons.chevronRight,
+                      size: 16,
+                      color: context.colors.onSurfaceVariant,
+                    ),
+                  ],
+                ),
+              ),
+            ),
           ),
       ],
     );
@@ -266,8 +480,12 @@ class _SearchBody extends ConsumerWidget {
 
 class _ChannelsSection extends StatelessWidget {
   final List<Channel> channels;
+  final VoidCallback onResultSelected;
 
-  const _ChannelsSection({required this.channels});
+  const _ChannelsSection({
+    required this.channels,
+    required this.onResultSelected,
+  });
 
   @override
   Widget build(BuildContext context) {
@@ -277,11 +495,21 @@ class _ChannelsSection extends StatelessWidget {
         _SectionLabel(label: 'Channels'),
         for (final channel in channels)
           ListTile(
-            leading: Icon(channelIcon(channel), size: 20),
-            title: Text(channel.name),
+            key: ValueKey('search-channel-row-${channel.id}'),
+            contentPadding: const EdgeInsets.symmetric(horizontal: Grid.gutter),
+            leading: Icon(
+              channelIcon(channel),
+              key: ValueKey('search-channel-leading-${channel.id}'),
+              size: 20,
+            ),
+            title: Text(
+              channel.name,
+              key: ValueKey('search-channel-title-${channel.id}'),
+              style: contentListTitleTextStyle,
+            ),
             subtitle: Text(
               '${channel.memberCount} member${channel.memberCount == 1 ? '' : 's'}',
-              style: context.textTheme.bodySmall?.copyWith(
+              style: contentListBodyTextStyle.copyWith(
                 color: context.colors.onSurfaceVariant,
               ),
             ),
@@ -304,11 +532,14 @@ class _ChannelsSection extends StatelessWidget {
                     ),
                   )
                 : null,
-            onTap: () => Navigator.of(context).push(
-              MaterialPageRoute<void>(
-                builder: (_) => ChannelDetailPage(channel: channel),
-              ),
-            ),
+            onTap: () {
+              onResultSelected();
+              Navigator.of(context).push(
+                MaterialPageRoute<void>(
+                  builder: (_) => ChannelDetailPage(channel: channel),
+                ),
+              );
+            },
           ),
       ],
     );
@@ -317,8 +548,9 @@ class _ChannelsSection extends StatelessWidget {
 
 class _PeopleSection extends ConsumerWidget {
   final List<DirectoryUser> users;
+  final VoidCallback onResultSelected;
 
-  const _PeopleSection({required this.users});
+  const _PeopleSection({required this.users, required this.onResultSelected});
 
   @override
   Widget build(BuildContext context, WidgetRef ref) {
@@ -328,19 +560,27 @@ class _PeopleSection extends ConsumerWidget {
         _SectionLabel(label: 'People'),
         for (final user in users)
           ListTile(
+            key: ValueKey('search-person-row-${user.pubkey}'),
+            contentPadding: const EdgeInsets.symmetric(horizontal: Grid.gutter),
             leading: AvatarImage(
+              key: ValueKey('search-person-leading-${user.pubkey}'),
               imageUrl: user.avatarUrl,
               radius: 20,
               fallback: Text(user.label.substring(0, 1).toUpperCase()),
             ),
-            title: Text(user.label),
+            title: Text(
+              user.label,
+              key: ValueKey('search-person-title-${user.pubkey}'),
+              style: contentListTitleTextStyle,
+            ),
             subtitle: Text(
               user.secondaryLabel,
-              style: context.textTheme.bodySmall?.copyWith(
+              style: contentListBodyTextStyle.copyWith(
                 color: context.colors.onSurfaceVariant,
               ),
             ),
             onTap: () async {
+              onResultSelected();
               final channel = await ref
                   .read(channelActionsProvider)
                   .openDm(pubkeys: [user.pubkey]);
@@ -360,8 +600,13 @@ class _PeopleSection extends ConsumerWidget {
 class _MessagesSection extends ConsumerWidget {
   final List<SearchHit> hits;
   final String? currentPubkey;
+  final VoidCallback onResultSelected;
 
-  const _MessagesSection({required this.hits, required this.currentPubkey});
+  const _MessagesSection({
+    required this.hits,
+    required this.currentPubkey,
+    required this.onResultSelected,
+  });
 
   @override
   Widget build(BuildContext context, WidgetRef ref) {
@@ -383,6 +628,7 @@ class _MessagesSection extends ConsumerWidget {
             userCache: profiles,
             channel: channels.where((c) => c.id == hit.channelId).firstOrNull,
             currentPubkey: currentPubkey,
+            onResultSelected: onResultSelected,
           ),
       ],
     );
@@ -395,6 +641,7 @@ class _MessageTile extends StatelessWidget {
   final Map<String, UserProfile> userCache;
   final Channel? channel;
   final String? currentPubkey;
+  final VoidCallback onResultSelected;
 
   const _MessageTile({
     required this.hit,
@@ -402,68 +649,99 @@ class _MessageTile extends StatelessWidget {
     required this.userCache,
     required this.channel,
     required this.currentPubkey,
+    required this.onResultSelected,
   });
 
   @override
   Widget build(BuildContext context) {
     final authorName = authorProfile?.label ?? shortPubkey(hit.pubkey);
     final timeAgo = relativeTime(hit.createdAt);
+    final channelName = hit.channelName?.trim().replaceFirst(RegExp(r'^#'), '');
+    final hasChannelName = channelName != null && channelName.isNotEmpty;
+    final isDm = channel?.isDm ?? false;
 
     return ListTile(
-      leading: SmallAvatar(pubkey: hit.pubkey, userCache: userCache),
-      title: Row(
-        children: [
-          Expanded(
-            child: Text(
-              authorName,
-              maxLines: 1,
-              overflow: TextOverflow.ellipsis,
-              style: context.textTheme.bodyMedium?.copyWith(
-                fontWeight: FontWeight.w600,
-              ),
-            ),
-          ),
-          if (hit.channelName != null) ...[
-            const SizedBox(width: Grid.half),
-            Container(
-              padding: const EdgeInsets.symmetric(
-                horizontal: Grid.half,
-                vertical: 2,
-              ),
-              decoration: BoxDecoration(
-                color: context.colors.surfaceContainerHighest,
-                borderRadius: BorderRadius.circular(Radii.sm),
-              ),
-              child: Text(
-                hit.channelName!,
-                style: context.textTheme.labelSmall?.copyWith(
-                  color: context.colors.onSurfaceVariant,
-                ),
-              ),
-            ),
-          ],
-        ],
+      key: ValueKey('search-message-row-${hit.eventId}'),
+      contentPadding: const EdgeInsets.symmetric(horizontal: Grid.gutter),
+      titleAlignment: ListTileTitleAlignment.top,
+      horizontalTitleGap: messageAvatarContentGap,
+      leading: SmallAvatar(
+        key: ValueKey('search-message-avatar-${hit.eventId}'),
+        pubkey: hit.pubkey,
+        userCache: userCache,
+        size: compactMessageAvatarSize,
+      ),
+      title: MessageAuthorMeta(
+        displayName: authorName,
+        username: messageUsernameLabel(authorProfile),
+        timestamp: timeAgo,
+        nameColor: context.colors.onSurface,
+        metadataColor: context.colors.onSurfaceVariant,
+        displayNameKey: ValueKey('search-message-author-${hit.eventId}'),
+        usernameKey: ValueKey('search-message-username-${hit.eventId}'),
+        timestampKey: ValueKey('search-message-timestamp-${hit.eventId}'),
       ),
       subtitle: Column(
         crossAxisAlignment: CrossAxisAlignment.start,
         children: [
           const SizedBox(height: 2),
+          Row(
+            key: ValueKey('search-message-context-${hit.eventId}'),
+            children: [
+              Flexible(
+                child: Text(
+                  isDm
+                      ? 'Direct message'
+                      : hasChannelName
+                      ? 'Message in'
+                      : 'Message',
+                  style: activityContextTextStyle.copyWith(
+                    color: context.colors.onSurfaceVariant,
+                  ),
+                  overflow: TextOverflow.ellipsis,
+                ),
+              ),
+              if (!isDm && hasChannelName) ...[
+                const SizedBox(width: Grid.half),
+                Flexible(
+                  child: Container(
+                    padding: const EdgeInsets.symmetric(
+                      horizontal: Grid.half + Grid.quarter,
+                      vertical: Grid.quarter / 2,
+                    ),
+                    decoration: BoxDecoration(
+                      color: context.colors.surfaceContainerHighest,
+                      borderRadius: BorderRadius.circular(Radii.xs),
+                    ),
+                    child: Text(
+                      '#$channelName',
+                      key: ValueKey('search-message-channel-${hit.eventId}'),
+                      style: activityContextTextStyle.copyWith(
+                        color: context.colors.onSurfaceVariant,
+                      ),
+                      overflow: TextOverflow.ellipsis,
+                    ),
+                  ),
+                ),
+              ],
+            ],
+          ),
+          const SizedBox(height: Grid.half),
           MessageContent(
+            key: ValueKey('search-message-body-${hit.eventId}'),
             content: hit.content,
             tags: hit.tags,
             maxLines: 2,
-            baseStyle: context.textTheme.bodyMedium,
-          ),
-          const SizedBox(height: 2),
-          Text(
-            timeAgo,
-            style: context.textTheme.labelSmall?.copyWith(
-              color: context.colors.onSurfaceVariant,
+            baseStyle: activityPreviewTextStyle.copyWith(
+              color: context.colors.onSurface,
             ),
           ),
         ],
       ),
-      onTap: () => _navigateToHit(context, hit, channel),
+      onTap: () {
+        onResultSelected();
+        _navigateToHit(context, hit, channel);
+      },
     );
   }
 
@@ -507,11 +785,10 @@ class _SectionLabel extends StatelessWidget {
         Grid.half,
       ),
       child: Text(
-        label.toUpperCase(),
-        style: context.textTheme.labelSmall?.copyWith(
+        label,
+        key: ValueKey('search-section-${label.toLowerCase()}'),
+        style: activityContextTextStyle.copyWith(
           color: context.colors.onSurfaceVariant,
-          fontWeight: FontWeight.w600,
-          letterSpacing: 0.8,
         ),
       ),
     );
diff --git a/mobile/lib/shared/deeplink/deep_link.dart b/mobile/lib/shared/deeplink/deep_link.dart
index a208048dbd5..0ef7b8e596d 100644
--- a/mobile/lib/shared/deeplink/deep_link.dart
+++ b/mobile/lib/shared/deeplink/deep_link.dart
@@ -83,6 +83,38 @@ class MessageDeepLink extends BuzzDeepLink {
       'thread: $threadRootId)';
 }
 
+/// Build a canonical `buzz://message` link for a channel message.
+///
+/// Mirrors `desktop/src/features/messages/lib/messageLink.ts` so links copied
+/// or shared from mobile round-trip through every client's parser:
+/// `buzz://message?channel=<uuid>&id=<eventId>[&thread=<rootId>]`.
+///
+/// An empty [threadRootId] is treated as "no thread" so callers can pass
+/// through a nullable thread reference without extra checks.
+String buildMessageLink({
+  required String channelId,
+  required String messageId,
+  String? threadRootId,
+}) {
+  if (channelId.isEmpty) {
+    throw ArgumentError('buildMessageLink: channelId is required');
+  }
+  if (messageId.isEmpty) {
+    throw ArgumentError('buildMessageLink: messageId is required');
+  }
+
+  final params = <String, String>{
+    'channel': channelId,
+    'id': messageId,
+    if (threadRootId != null && threadRootId.isNotEmpty) 'thread': threadRootId,
+  };
+  return Uri(
+    scheme: 'buzz',
+    host: 'message',
+    queryParameters: params,
+  ).toString();
+}
+
 /// Parse a `buzz://message?…` URI into a [MessageDeepLink].
 ///
 /// Returns `null` for non-`buzz` schemes, non-`message` hosts (e.g.
diff --git a/mobile/lib/shared/relay/media_auth.dart b/mobile/lib/shared/relay/media_auth.dart
index b21eeca36d6..3e6661e8957 100644
--- a/mobile/lib/shared/relay/media_auth.dart
+++ b/mobile/lib/shared/relay/media_auth.dart
@@ -4,6 +4,7 @@ import 'package:flutter/widgets.dart';
 import 'package:hooks_riverpod/hooks_riverpod.dart';
 import 'package:nostr/nostr.dart' as nostr;
 
+import 'relay_endpoint.dart';
 import 'relay_provider.dart';
 
 const _mediaGetAuthKind = 24242;
@@ -95,7 +96,7 @@ class MediaGetAuthService {
     if (mediaAuthority.toLowerCase() != relayAuthority.toLowerCase()) {
       return false;
     }
-    return uri.path.startsWith('/media/');
+    return isRelayMediaPath(uri.path);
   }
 
   nostr.Event _buildGetAuthEvent(String nsec) {
diff --git a/mobile/lib/shared/relay/media_upload.dart b/mobile/lib/shared/relay/media_upload.dart
index 93c53e9743c..0a6640f9aed 100644
--- a/mobile/lib/shared/relay/media_upload.dart
+++ b/mobile/lib/shared/relay/media_upload.dart
@@ -13,6 +13,7 @@ import 'package:pointycastle/digests/sha256.dart';
 import 'animated_image_sanitizer.dart';
 import 'media_auth.dart';
 import 'mp4_fast_start.dart';
+import 'relay_endpoint.dart';
 import 'relay_provider.dart';
 
 const _mediaUploadPath = '/upload';
@@ -21,6 +22,8 @@ const _mediaUploadPlatformChannelName = 'buzz/media_upload';
 const _sanitizeImageForUploadMethod = 'sanitizeImageForUpload';
 const _transcodeVideoToMp4Method = 'transcodeVideoToMp4';
 const _transcodeImageToJpegMethod = 'transcodeImageToJpeg';
+const _requiresLegacyMediaStoragePermissionMethod =
+    'requiresLegacyMediaStoragePermission';
 const _readClipboardImageMethod = 'readClipboardImage';
 const _clipboardHasImageMethod = 'clipboardHasImage';
 const _uploadAuthKind = 24242;
@@ -39,6 +42,17 @@ final _mediaUploadPlatformChannel = MethodChannel(
   _mediaUploadPlatformChannelName,
 );
 
+/// Whether saving media needs Android's pre-scoped-storage runtime permission.
+Future<bool> requiresLegacyMediaStoragePermission() async {
+  if (defaultTargetPlatform != TargetPlatform.android) {
+    return false;
+  }
+  return await _mediaUploadPlatformChannel.invokeMethod<bool>(
+        _requiresLegacyMediaStoragePermissionMethod,
+      ) ??
+      false;
+}
+
 const _allowedImageMimeTypes = {
   'image/jpeg',
   'image/png',
@@ -51,6 +65,9 @@ const _maxFileSizeBytes = 100 * 1024 * 1024; // 100MB
 const _mediaPolicyUploadMessage = "We couldn't prepare this image for upload.";
 
 typedef PickGalleryImage = Future<XFile?> Function();
+
+/// Selects multiple gallery images for upload in picker order.
+typedef PickGalleryImages = Future<List<XFile>> Function();
 typedef PickGalleryVideo = Future<XFile?> Function();
 typedef PickAttachmentFile = Future<XFile?> Function();
 typedef SanitizeImageBytes =
@@ -159,6 +176,7 @@ class MediaUploadService {
   final String _baseUrl;
   final String? _nsec;
   final PickGalleryImage _pickGalleryImage;
+  final PickGalleryImages _pickGalleryImages;
   final PickGalleryVideo _pickGalleryVideo;
   final PickAttachmentFile? _pickAttachmentFile;
   final SanitizeImageBytes _sanitizeImageBytes;
@@ -173,6 +191,7 @@ class MediaUploadService {
     required String baseUrl,
     required String? nsec,
     required PickGalleryImage pickGalleryImage,
+    PickGalleryImages? pickGalleryImages,
     required PickGalleryVideo pickGalleryVideo,
     PickAttachmentFile? pickAttachmentFile,
     SanitizeImageBytes? sanitizeImageBytes,
@@ -184,6 +203,12 @@ class MediaUploadService {
   }) : _baseUrl = baseUrl,
        _nsec = nsec,
        _pickGalleryImage = pickGalleryImage,
+       _pickGalleryImages =
+           pickGalleryImages ??
+           (() async {
+             final image = await pickGalleryImage();
+             return image == null ? const <XFile>[] : [image];
+           }),
        _pickGalleryVideo = pickGalleryVideo,
        _pickAttachmentFile = pickAttachmentFile,
        _sanitizeImageBytes = sanitizeImageBytes ?? _sanitizePickedImageBytes,
@@ -207,6 +232,9 @@ class MediaUploadService {
     return uploadImage(pickedImage);
   }
 
+  /// Opens the system picker with multi-selection enabled.
+  Future<List<XFile>> pickGalleryImages() => _pickGalleryImages();
+
   Future<BlobDescriptor> uploadImage(XFile image) async {
     final preparedImage = await _prepareUploadImage(image);
     return _uploadPreparedBytes(
@@ -230,9 +258,11 @@ class MediaUploadService {
     return uploadImage(XFile.fromData(bytes));
   }
 
-  Future<BlobDescriptor?> pickAndUploadVideo() async {
-    final pickedVideo = await _pickGalleryVideo();
-    if (pickedVideo == null) return null;
+  /// Opens the system gallery video picker.
+  Future<XFile?> pickGalleryVideo() => _pickGalleryVideo();
+
+  /// Sanitizes and uploads [pickedVideo] as an MP4 attachment.
+  Future<BlobDescriptor> uploadVideo(XFile pickedVideo) async {
     final length = await pickedVideo.length();
     if (length > _maxVideoSizeBytes) {
       throw Exception(
@@ -265,14 +295,23 @@ class MediaUploadService {
     }
   }
 
-  Future<BlobDescriptor?> pickAndUploadFile() async {
+  Future<BlobDescriptor?> pickAndUploadVideo() async {
+    final pickedVideo = await pickGalleryVideo();
+    if (pickedVideo == null) return null;
+    return uploadVideo(pickedVideo);
+  }
+
+  /// Opens the system document picker for a generic file attachment.
+  Future<XFile?> pickAttachmentFile() async {
     final pickAttachmentFile = _pickAttachmentFile;
     if (pickAttachmentFile == null) {
       throw Exception("File attachments aren't available on this device.");
     }
-    final pickedFile = await pickAttachmentFile();
-    if (pickedFile == null) return null;
+    return pickAttachmentFile();
+  }
 
+  /// Uploads [pickedFile] as a size-limited generic attachment.
+  Future<BlobDescriptor> uploadFile(XFile pickedFile) async {
     final length = await pickedFile.length();
     if (length == 0) {
       throw Exception('File is empty.');
@@ -291,6 +330,12 @@ class MediaUploadService {
     return descriptor.withFilename(_safeAttachmentFilename(pickedFile.name));
   }
 
+  Future<BlobDescriptor?> pickAndUploadFile() async {
+    final pickedFile = await pickAttachmentFile();
+    if (pickedFile == null) return null;
+    return uploadFile(pickedFile);
+  }
+
   Future<BlobDescriptor> uploadBytes(
     Uint8List bytes, {
     required String mimeType,
@@ -361,7 +406,10 @@ class MediaUploadService {
     required String sha256,
     required String path,
   }) {
-    final request = http.Request('PUT', Uri.parse(_baseUrl).resolve(path));
+    final request = http.Request(
+      'PUT',
+      Uri.parse(relayEndpoint(_baseUrl, path)),
+    );
     request.bodyBytes = bytes;
     request.headers.addAll(
       _buildUploadHeaders(mimeType: mimeType, sha256: sha256),
@@ -768,6 +816,7 @@ final mediaUploadServiceProvider = Provider<MediaUploadService>((ref) {
       source: ImageSource.gallery,
       requestFullMetadata: false,
     ),
+    pickGalleryImages: () => picker.pickMultiImage(requestFullMetadata: false),
     pickGalleryVideo: () => picker.pickVideo(source: ImageSource.gallery),
     pickAttachmentFile: file_selector.openFile,
   );
diff --git a/mobile/lib/shared/relay/nostr_models.dart b/mobile/lib/shared/relay/nostr_models.dart
index 3505483591e..820fee4ed6a 100644
--- a/mobile/lib/shared/relay/nostr_models.dart
+++ b/mobile/lib/shared/relay/nostr_models.dart
@@ -18,6 +18,7 @@ abstract final class EventKind {
   static const agentObserverFrame = 24200;
   static const huddleReaction = 24810;
   static const readState = 30078;
+  static const eventReminder = 30300;
   static const userStatus = 30315;
   static const dmVisibility = 30622;
   static const streamMessageV2 = 40002;
diff --git a/mobile/lib/shared/relay/relay_client.dart b/mobile/lib/shared/relay/relay_client.dart
index 453e11459e6..bdb0f53c3ca 100644
--- a/mobile/lib/shared/relay/relay_client.dart
+++ b/mobile/lib/shared/relay/relay_client.dart
@@ -1,5 +1,7 @@
 import 'package:http/http.dart' as http;
 
+import 'relay_endpoint.dart';
+
 /// Lightweight HTTP context for talking to the Buzz relay.
 ///
 /// In the pure-nostr architecture, all data flow happens over the relay
@@ -18,10 +20,7 @@ class RelayClient {
   http.Client get httpClient => _http;
 
   /// Fully-qualified URL for the relay's Blossom-style media upload endpoint.
-  String get mediaUploadUrl {
-    final base = Uri.parse(baseUrl);
-    return base.resolve('/upload').toString();
-  }
+  String get mediaUploadUrl => relayEndpoint(baseUrl, '/upload');
 
   void dispose() => _http.close();
 }
diff --git a/mobile/lib/shared/relay/relay_endpoint.dart b/mobile/lib/shared/relay/relay_endpoint.dart
new file mode 100644
index 00000000000..ee74f6d3b82
--- /dev/null
+++ b/mobile/lib/shared/relay/relay_endpoint.dart
@@ -0,0 +1,34 @@
+/// Joining relay HTTP endpoint URLs so they survive a base-path deployment.
+///
+/// `Uri.resolve('/events')` discards any path the base URL carries, which is
+/// correct for an origin-rooted relay but silently wrong for one served under
+/// `BUZZ_BASE_PATH` (`https://host/relay`): the request lands on `/events`
+/// instead of `/relay/events`. Since the relay's NIP-98 check reconstructs the
+/// prefixed URL, a dropped prefix surfaces as a 401 or a 404 rather than
+/// anything that names the real cause.
+library;
+
+/// Join `path` onto `baseUrl`, preserving any path prefix the base carries.
+///
+/// `path` is treated as relative to the base regardless of whether it has a
+/// leading slash, so callers can keep passing the route literals they declare
+/// (`/events`, `/media/upload`).
+///
+/// ```dart
+/// relayEndpoint('https://host', '/query');        // https://host/query
+/// relayEndpoint('https://host/relay', '/query');  // https://host/relay/query
+/// relayEndpoint('https://host/relay/', 'query');  // https://host/relay/query
+/// ```
+String relayEndpoint(String baseUrl, String path) {
+  final base = baseUrl.replaceAll(RegExp(r'/+$'), '');
+  final suffix = path.replaceAll(RegExp(r'^/+'), '');
+  return suffix.isEmpty ? base : '$base/$suffix';
+}
+
+/// Whether `urlPath` addresses the relay's media route.
+///
+/// Matches `/media/` as a full path segment anywhere in the path rather than
+/// only at the root, because a base-path deployment serves media at
+/// `<prefix>/media/<hash>`. Requiring the whole segment still rejects
+/// near-misses such as `/media-evil/<hash>`.
+bool isRelayMediaPath(String urlPath) => urlPath.contains('/media/');
diff --git a/mobile/lib/shared/relay/relay_session.dart b/mobile/lib/shared/relay/relay_session.dart
index 9c167e10b16..716bf5c4db3 100644
--- a/mobile/lib/shared/relay/relay_session.dart
+++ b/mobile/lib/shared/relay/relay_session.dart
@@ -13,6 +13,7 @@ import 'package:hooks_riverpod/hooks_riverpod.dart';
 import '../auth/auth.dart';
 import 'nostr_models.dart';
 import 'relay_client.dart';
+import 'relay_endpoint.dart';
 import 'relay_provider.dart';
 import 'relay_socket.dart';
 
@@ -133,7 +134,7 @@ class RelaySessionNotifier extends Notifier<SessionState> {
     Duration timeout = const Duration(seconds: 8),
   }) async {
     final config = ref.read(relayConfigProvider);
-    final url = Uri.parse(config.baseUrl).resolve('/query').toString();
+    final url = relayEndpoint(config.baseUrl, '/query');
     final bodyBytes = utf8.encode(
       jsonEncode(filters.map((filter) => filter.toJson()).toList()),
     );
diff --git a/mobile/lib/shared/reminders/remind_me_later_sheet.dart b/mobile/lib/shared/reminders/remind_me_later_sheet.dart
new file mode 100644
index 00000000000..8d02a57609d
--- /dev/null
+++ b/mobile/lib/shared/reminders/remind_me_later_sheet.dart
@@ -0,0 +1,122 @@
+import 'package:flutter/material.dart';
+import 'package:hooks_riverpod/hooks_riverpod.dart';
+import 'package:lucide_icons_flutter/lucide_icons.dart';
+
+import '../theme/theme.dart';
+import '../widgets/sheet_divider.dart';
+import 'reminder_service.dart';
+import 'reminder_time_presets.dart';
+
+/// Bottom sheet for "Remind me later": desktop-parity presets plus a native
+/// date/time picker, publishing the same author-private kind-30300 reminder
+/// events desktop reads.
+void showRemindMeLaterSheet({
+  required BuildContext context,
+  required WidgetRef ref,
+  required ReminderTarget target,
+}) {
+  final service = ref.read(reminderServiceProvider);
+  final messenger = ScaffoldMessenger.of(context);
+  if (service == null) {
+    messenger.showSnackBar(
+      const SnackBar(content: Text('Sign in to set reminders')),
+    );
+    return;
+  }
+
+  Future<void> submit(int notBefore) async {
+    try {
+      await service.createReminder(target: target, notBefore: notBefore);
+      messenger.showSnackBar(const SnackBar(content: Text('Reminder set')));
+    } catch (error) {
+      // Stable user-facing copy; the relay/crypto detail goes to the log.
+      debugPrint('[RemindMeLater] createReminder failed: $error');
+      messenger.showSnackBar(
+        const SnackBar(content: Text('Couldn’t set reminder. Try again.')),
+      );
+    }
+  }
+
+  showModalBottomSheet<void>(
+    context: context,
+    showDragHandle: true,
+    builder: (sheetContext) => SafeArea(
+      child: SingleChildScrollView(
+        child: Padding(
+          padding: const EdgeInsets.fromLTRB(
+            Grid.gutter,
+            0,
+            Grid.gutter,
+            Grid.xs,
+          ),
+          child: Column(
+            mainAxisSize: MainAxisSize.min,
+            crossAxisAlignment: CrossAxisAlignment.start,
+            children: [
+              Padding(
+                padding: const EdgeInsets.only(
+                  left: Grid.half,
+                  bottom: Grid.xxs,
+                ),
+                child: Text(
+                  'Remind me about this message',
+                  style: Theme.of(sheetContext).textTheme.titleSmall,
+                ),
+              ),
+              for (final preset in reminderTimePresets)
+                ListTile(
+                  leading: const Icon(LucideIcons.clock),
+                  title: Text(preset.label),
+                  onTap: () {
+                    Navigator.of(sheetContext).pop();
+                    submit(preset.getTimestamp());
+                  },
+                ),
+              const SheetDivider(),
+              ListTile(
+                leading: const Icon(LucideIcons.calendarClock),
+                title: const Text('Pick a date & time'),
+                onTap: () async {
+                  final navigator = Navigator.of(sheetContext);
+                  final timestamp = await _pickCustomDateTime(context);
+                  // Cancelled or not-in-the-future: keep the preset sheet
+                  // open so retrying doesn't mean long-pressing again.
+                  if (timestamp == null) return;
+                  if (navigator.mounted) navigator.pop();
+                  await submit(timestamp);
+                },
+              ),
+            ],
+          ),
+        ),
+      ),
+    ),
+  );
+}
+
+/// Native date + time pickers chained together. Returns a future Unix
+/// timestamp in seconds, or null when cancelled or not in the future.
+Future<int?> _pickCustomDateTime(BuildContext context) async {
+  final now = DateTime.now();
+  final date = await showDatePicker(
+    context: context,
+    initialDate: now,
+    firstDate: DateTime(now.year, now.month, now.day),
+    lastDate: now.add(const Duration(days: 365 * 2)),
+  );
+  if (date == null || !context.mounted) return null;
+
+  final time = await showTimePicker(
+    context: context,
+    initialTime: const TimeOfDay(hour: 9, minute: 0),
+  );
+  if (time == null) return null;
+
+  final timestamp = combineCustomDateTime(date, time.hour, time.minute);
+  if (timestamp == null && context.mounted) {
+    ScaffoldMessenger.of(
+      context,
+    ).showSnackBar(const SnackBar(content: Text('Pick a time in the future')));
+  }
+  return timestamp;
+}
diff --git a/mobile/lib/shared/reminders/reminder_service.dart b/mobile/lib/shared/reminders/reminder_service.dart
new file mode 100644
index 00000000000..08704541e6e
--- /dev/null
+++ b/mobile/lib/shared/reminders/reminder_service.dart
@@ -0,0 +1,149 @@
+import 'dart:convert';
+import 'dart:typed_data';
+
+import 'package:hooks_riverpod/hooks_riverpod.dart';
+import 'package:nostr/nostr.dart' as nostr;
+
+import '../crypto/ecdh.dart';
+import '../crypto/nip44.dart';
+import '../relay/relay.dart';
+
+/// The message a reminder points back to. Mirrors the desktop
+/// `ReminderTarget` shape (`desktop/src/features/reminders/lib/reminderTypes.ts`)
+/// so reminders created on mobile are readable by desktop and vice versa.
+class ReminderTarget {
+  /// Event ID of the target message.
+  final String eventId;
+
+  /// Channel ID where the message lives.
+  final String channelId;
+
+  /// Preview text of the target message (truncated).
+  final String preview;
+
+  /// Author pubkey of the target message.
+  final String authorPubkey;
+
+  const ReminderTarget({
+    required this.eventId,
+    required this.channelId,
+    required this.preview,
+    required this.authorPubkey,
+  });
+
+  Map<String, dynamic> toJson() => {
+    'eventId': eventId,
+    'channelId': channelId,
+    'preview': preview,
+    'authorPubkey': authorPubkey,
+  };
+}
+
+/// Build the NIP-ER reminder plaintext for a new pending reminder.
+///
+/// Matches the JSON desktop writes in `reminderService.ts#createReminder`:
+/// `{"target": {...}, "note": <optional>, "status": "pending"}`. `note` is
+/// omitted entirely when absent so both clients parse each other's payloads.
+String buildReminderPlaintext({required ReminderTarget target, String? note}) {
+  return jsonEncode({
+    'target': target.toJson(),
+    if (note != null && note.isNotEmpty) 'note': note,
+    'status': 'pending',
+  });
+}
+
+/// Generate a reminder `d`-tag with 128 bits of entropy (NIP-ER MUST).
+String randomReminderDTag() {
+  final bytes = secureRandomBytes(16);
+  return bytes.map((b) => b.toRadixString(16).padLeft(2, '0')).join();
+}
+
+/// Tags for a new pending reminder event: `d` plus strict-decimal
+/// `not_before`, exactly as the relay's NIP-ER validator expects.
+List<List<String>> buildReminderTags({
+  required String dTag,
+  required int notBefore,
+}) {
+  if (notBefore < 0) {
+    throw ArgumentError('notBefore must be a non-negative Unix timestamp');
+  }
+  return [
+    ['d', dTag],
+    ['not_before', '$notBefore'],
+  ];
+}
+
+/// NIP-44 self-encryption for author-private reminder payloads. Derives the
+/// conversation key to the author's own pubkey, matching the desktop's
+/// `nip44_encrypt_to_self` Tauri command.
+class ReminderCrypto {
+  final Uint8List _conversationKey;
+
+  ReminderCrypto(String nsec, String pubkey)
+    : _conversationKey = _deriveKey(nsec, pubkey);
+
+  static Uint8List _deriveKey(String nsec, String pubkey) {
+    final privkeyHex = nostr.Nip19.decode(payload: nsec).data;
+    return getConversationKey(privkeyHex, pubkey);
+  }
+
+  String encrypt(String plaintext) => nip44Encrypt(_conversationKey, plaintext);
+
+  String decrypt(String ciphertext) =>
+      nip44Decrypt(_conversationKey, ciphertext);
+}
+
+/// Creates author-private kind-30300 reminders on the relay.
+class ReminderService {
+  final SignedEventRelay _signedEventRelay;
+  final ReminderCrypto _crypto;
+
+  ReminderService({
+    required SignedEventRelay signedEventRelay,
+    required ReminderCrypto crypto,
+  }) : _signedEventRelay = signedEventRelay,
+       _crypto = crypto;
+
+  /// Encrypt, sign, and publish a new pending reminder. [notBefore] is a Unix
+  /// timestamp in seconds after which clients surface the reminder.
+  Future<void> createReminder({
+    required ReminderTarget target,
+    required int notBefore,
+    String? note,
+  }) async {
+    final plaintext = buildReminderPlaintext(target: target, note: note);
+    final ciphertext = _crypto.encrypt(plaintext);
+    await _signedEventRelay.submit(
+      kind: EventKind.eventReminder,
+      content: ciphertext,
+      tags: buildReminderTags(dTag: randomReminderDTag(), notBefore: notBefore),
+    );
+  }
+}
+
+/// Provides a [ReminderService], or null when no signing identity is
+/// available (signed out).
+final reminderServiceProvider = Provider<ReminderService?>((ref) {
+  final relayConfig = ref.watch(relayConfigProvider);
+  final pubkey = ref.watch(myPubkeyProvider);
+
+  final nsec = relayConfig.nsec?.trim();
+  if (nsec == null || nsec.isEmpty || pubkey == null || pubkey.isEmpty) {
+    return null;
+  }
+
+  final ReminderCrypto crypto;
+  try {
+    crypto = ReminderCrypto(nsec, pubkey);
+  } catch (_) {
+    return null;
+  }
+
+  return ReminderService(
+    signedEventRelay: SignedEventRelay(
+      session: ref.read(relaySessionProvider.notifier),
+      nsec: nsec,
+    ),
+    crypto: crypto,
+  );
+});
diff --git a/mobile/lib/shared/reminders/reminder_time_presets.dart b/mobile/lib/shared/reminders/reminder_time_presets.dart
new file mode 100644
index 00000000000..bf563ab6286
--- /dev/null
+++ b/mobile/lib/shared/reminders/reminder_time_presets.dart
@@ -0,0 +1,70 @@
+/// Reminder time presets shared by the "Remind me later" sheet.
+///
+/// Mirrors `desktop/src/features/reminders/lib/timePresets.ts` — same labels,
+/// same "always strictly in the future" guarantee.
+library;
+
+class ReminderTimePreset {
+  final String label;
+  final int Function() getTimestamp;
+
+  const ReminderTimePreset({required this.label, required this.getTimestamp});
+}
+
+int _nowSeconds() => DateTime.now().millisecondsSinceEpoch ~/ 1000;
+
+/// Next occurrence of [dayOffset] days from now at 9am local time. If that
+/// instant is already past, roll to the following day so the result is
+/// always in the future.
+int nextDayAt9am(int dayOffset, {DateTime? now}) {
+  final current = now ?? DateTime.now();
+  var target = DateTime(
+    current.year,
+    current.month,
+    current.day + dayOffset,
+    9,
+  );
+  if (!target.isAfter(current)) {
+    target = DateTime(target.year, target.month, target.day + 1, 9);
+  }
+  return target.millisecondsSinceEpoch ~/ 1000;
+}
+
+/// Days until next Monday (1-7), matching the desktop preset semantics.
+int daysUntilNextMonday(DateTime now) {
+  final days = (DateTime.monday - now.weekday) % 7;
+  return days == 0 ? 7 : days;
+}
+
+final List<ReminderTimePreset> reminderTimePresets = [
+  ReminderTimePreset(
+    label: 'In 30 minutes',
+    getTimestamp: () => _nowSeconds() + 30 * 60,
+  ),
+  ReminderTimePreset(
+    label: 'In 1 hour',
+    getTimestamp: () => _nowSeconds() + 60 * 60,
+  ),
+  ReminderTimePreset(
+    label: 'In 3 hours',
+    getTimestamp: () => _nowSeconds() + 3 * 60 * 60,
+  ),
+  ReminderTimePreset(
+    label: 'Tomorrow at 9am',
+    getTimestamp: () => nextDayAt9am(1),
+  ),
+  ReminderTimePreset(
+    label: 'Next Monday at 9am',
+    getTimestamp: () => nextDayAt9am(daysUntilNextMonday(DateTime.now())),
+  ),
+];
+
+/// Combine a picked date and time into a future Unix timestamp (seconds), or
+/// null when the instant is not strictly in the future — the shared guard for
+/// the custom picker so a past time never fires immediately.
+int? combineCustomDateTime(DateTime date, int hour, int minute) {
+  final target = DateTime(date.year, date.month, date.day, hour, minute);
+  final timestamp = target.millisecondsSinceEpoch ~/ 1000;
+  if (timestamp <= _nowSeconds()) return null;
+  return timestamp;
+}
diff --git a/mobile/lib/shared/theme/app_theme.dart b/mobile/lib/shared/theme/app_theme.dart
index c9ace49eee4..f8000d79e2b 100644
--- a/mobile/lib/shared/theme/app_theme.dart
+++ b/mobile/lib/shared/theme/app_theme.dart
@@ -10,11 +10,16 @@ import 'text_theme.dart';
 /// Desktop uses --radius: 0.625rem (10px) as base:
 ///   lg = 10px, md = 8px, sm = 6px
 class Radii {
+  /// Small radius for compact UI elements.
+  static const double xs = 4.0;
   static const double lg = 10.0;
   static const double md = 8.0;
   static const double sm = 6.0;
   static const double card = 12.0; // grouped settings cards
   static const double dialog = 24.0; // desktop uses rounded-3xl for dialogs
+
+  /// Fully rounds pills, circles, and other capsule shapes.
+  static const double full = 999.0;
 }
 
 class AppTheme {
diff --git a/mobile/lib/shared/theme/message_typography.dart b/mobile/lib/shared/theme/message_typography.dart
new file mode 100644
index 00000000000..10736263901
--- /dev/null
+++ b/mobile/lib/shared/theme/message_typography.dart
@@ -0,0 +1,131 @@
+import 'package:flutter/material.dart';
+
+import 'grid.dart';
+
+const _fontFamily = 'Inter';
+
+/// Avatar size for full channel and thread messages.
+const messageAvatarSize = 42.0;
+
+/// Avatar size for conversation-oriented Activity rows.
+const activityAvatarSize = messageAvatarSize;
+
+/// Avatar size for compact message-result rows.
+const compactMessageAvatarSize = messageAvatarSize;
+
+/// Horizontal space between a message avatar and its content.
+const messageAvatarContentGap = Grid.twelve;
+
+/// Primary message copy: 15sp regular on a 20sp line height.
+const messageBodyTextStyle = TextStyle(
+  fontFamily: _fontFamily,
+  fontSize: 15,
+  fontWeight: FontWeight.w400,
+  height: 20 / 15,
+  letterSpacing: 0,
+);
+
+/// Message author names: 15sp semibold on a 17sp line height.
+const messageUsernameTextStyle = TextStyle(
+  fontFamily: _fontFamily,
+  fontSize: 15,
+  fontWeight: FontWeight.w600,
+  height: 17 / 15,
+  letterSpacing: 0,
+);
+
+/// Secondary author metadata: 15sp regular on a tight 17sp line height.
+const messageMetadataTextStyle = TextStyle(
+  fontFamily: _fontFamily,
+  fontSize: 15,
+  fontWeight: FontWeight.w400,
+  height: 17 / 15,
+  letterSpacing: 0,
+);
+
+/// Message timestamps share the secondary author metadata style.
+const messageTimestampTextStyle = messageMetadataTextStyle;
+
+/// Compact reply previews: 13.1sp regular on a 17sp line height.
+const replyPreviewTextStyle = TextStyle(
+  fontFamily: _fontFamily,
+  fontSize: 13.1,
+  fontWeight: FontWeight.w400,
+  height: 17 / 13.1,
+  letterSpacing: 0,
+);
+
+/// Reaction counts: 13.1sp medium on a 17sp line height.
+const reactionCountTextStyle = TextStyle(
+  fontFamily: _fontFamily,
+  fontSize: 13.1,
+  fontWeight: FontWeight.w500,
+  height: 17 / 13.1,
+  letterSpacing: 0,
+);
+
+/// Channel and thread titles: 20sp bold on a 24sp line height.
+const channelTitleTextStyle = TextStyle(
+  fontFamily: _fontFamily,
+  fontSize: 20,
+  fontWeight: FontWeight.w700,
+  height: 24 / 20,
+  letterSpacing: 0,
+);
+
+/// Primary labels in compact content lists.
+const contentListTitleTextStyle = messageUsernameTextStyle;
+
+/// Secondary copy in compact content lists.
+const contentListBodyTextStyle = TextStyle(
+  fontFamily: _fontFamily,
+  fontSize: 13.1,
+  fontWeight: FontWeight.w400,
+  height: 17 / 13.1,
+  letterSpacing: 0,
+);
+
+/// Timestamps in compact content lists.
+const contentListTimestampTextStyle = messageMetadataTextStyle;
+
+/// Filter chip labels use the compact 15sp type ramp.
+const filterChipTextStyle = messageMetadataTextStyle;
+
+/// Search fields use the primary 15sp body treatment.
+const searchInputTextStyle = messageBodyTextStyle;
+
+/// System message actor names: 15sp semibold on a 17sp line height.
+const systemMessageHeadingTextStyle = TextStyle(
+  fontFamily: _fontFamily,
+  fontSize: 15,
+  fontWeight: FontWeight.w600,
+  height: 17 / 15,
+  letterSpacing: 0,
+);
+
+/// System message copy: 15sp regular on a 20sp line height.
+const systemMessageBodyTextStyle = TextStyle(
+  fontFamily: _fontFamily,
+  fontSize: 15,
+  fontWeight: FontWeight.w400,
+  height: 20 / 15,
+  letterSpacing: 0,
+);
+
+/// Activity sender names share the primary author style.
+const activityUsernameTextStyle = messageUsernameTextStyle;
+
+/// Activity timestamps share the secondary author metadata style.
+const activityTimestampTextStyle = messageMetadataTextStyle;
+
+/// Activity context labels: 13.1sp medium on a 17sp line height.
+const activityContextTextStyle = TextStyle(
+  fontFamily: _fontFamily,
+  fontSize: 13.1,
+  fontWeight: FontWeight.w500,
+  height: 17 / 13.1,
+  letterSpacing: 0,
+);
+
+/// Activity message previews use the primary message copy style.
+const activityPreviewTextStyle = messageBodyTextStyle;
diff --git a/mobile/lib/shared/theme/theme.dart b/mobile/lib/shared/theme/theme.dart
index 91cdf4dcc1d..862534b4f70 100644
--- a/mobile/lib/shared/theme/theme.dart
+++ b/mobile/lib/shared/theme/theme.dart
@@ -5,6 +5,7 @@ export 'app_theme.dart';
 export 'buzz_theme.dart';
 export 'color_scheme.dart';
 export 'grid.dart';
+export 'message_typography.dart';
 export 'theme_catalog.dart';
 export 'theme_extensions.dart';
 export 'theme_pairs.dart';
diff --git a/mobile/lib/shared/widgets/anchored_popover_menu.dart b/mobile/lib/shared/widgets/anchored_popover_menu.dart
new file mode 100644
index 00000000000..46b50b6b008
--- /dev/null
+++ b/mobile/lib/shared/widgets/anchored_popover_menu.dart
@@ -0,0 +1,245 @@
+import 'dart:math' as math;
+import 'dart:ui' show SemanticsRole;
+
+import 'package:flutter/material.dart';
+
+import '../theme/theme.dart';
+
+const _popoverEnterDuration = Duration(milliseconds: 150);
+const _popoverExitDuration = Duration(milliseconds: 110);
+const _popoverStartScale = 0.96;
+
+/// The horizontal edge a popover aligns to on its triggering control.
+enum AnchoredPopoverAlignment {
+  /// Aligns the popover's leading edge with the trigger's leading edge.
+  start,
+
+  /// Aligns the popover's trailing edge with the trigger's trailing edge.
+  end,
+}
+
+/// Shows an anchored, cross-platform popup menu with the Activity controls'
+/// sizing, motion, and safe-area placement.
+Future<T?> showAnchoredPopover<T>({
+  required BuildContext context,
+  required List<PopupMenuEntry<T>> items,
+  required double width,
+  required AnchoredPopoverAlignment alignment,
+  required Color color,
+  required ShapeBorder shape,
+  required double elevation,
+  required Color shadowColor,
+  Offset offset = Offset.zero,
+  EdgeInsetsGeometry menuPadding = EdgeInsets.zero,
+  Clip clipBehavior = Clip.antiAlias,
+  Key? surfaceKey,
+}) {
+  final navigator = Navigator.of(context);
+  final overlay = navigator.overlay;
+  final triggerRenderObject = context.findRenderObject();
+  final overlayRenderObject = overlay?.context.findRenderObject();
+  if (triggerRenderObject is! RenderBox || overlayRenderObject is! RenderBox) {
+    return Future<T?>.value();
+  }
+
+  final triggerRect = MatrixUtils.transformRect(
+    triggerRenderObject.getTransformTo(overlayRenderObject),
+    Offset.zero & triggerRenderObject.size,
+  );
+  final overlayRect = Offset.zero & overlayRenderObject.size;
+  final mediaQuery = MediaQuery.of(context);
+
+  return navigator.push<T>(
+    _AnchoredPopoverRoute<T>(
+      position: RelativeRect.fromRect(triggerRect, overlayRect),
+      items: items,
+      width: width,
+      alignment: alignment,
+      offset: offset,
+      color: color,
+      shape: shape,
+      elevation: elevation,
+      shadowColor: shadowColor,
+      menuPadding: menuPadding,
+      clipBehavior: clipBehavior,
+      surfaceKey: surfaceKey,
+      screenPadding: EdgeInsets.fromLTRB(
+        math.max(Grid.xxs, mediaQuery.padding.left),
+        math.max(Grid.xxs, mediaQuery.padding.top),
+        math.max(Grid.xxs, mediaQuery.padding.right),
+        math.max(Grid.xxs, mediaQuery.padding.bottom),
+      ),
+      reducedMotion: mediaQuery.disableAnimations,
+      barrierLabel: MaterialLocalizations.of(context).modalBarrierDismissLabel,
+    ),
+  );
+}
+
+class _AnchoredPopoverRoute<T> extends PopupRoute<T> {
+  final RelativeRect position;
+  final List<PopupMenuEntry<T>> items;
+  final double width;
+  final AnchoredPopoverAlignment alignment;
+  final Offset offset;
+  final Color color;
+  final ShapeBorder shape;
+  final double elevation;
+  final Color shadowColor;
+  final EdgeInsetsGeometry menuPadding;
+  final Clip clipBehavior;
+  final Key? surfaceKey;
+  final EdgeInsets screenPadding;
+  final bool reducedMotion;
+  final String _barrierLabel;
+
+  _AnchoredPopoverRoute({
+    required this.position,
+    required this.items,
+    required this.width,
+    required this.alignment,
+    required this.offset,
+    required this.color,
+    required this.shape,
+    required this.elevation,
+    required this.shadowColor,
+    required this.menuPadding,
+    required this.clipBehavior,
+    required this.surfaceKey,
+    required this.screenPadding,
+    required this.reducedMotion,
+    required String barrierLabel,
+  }) : _barrierLabel = barrierLabel;
+
+  @override
+  Color? get barrierColor => null;
+
+  @override
+  bool get barrierDismissible => true;
+
+  @override
+  String? get barrierLabel => _barrierLabel;
+
+  @override
+  Duration get transitionDuration =>
+      reducedMotion ? Duration.zero : _popoverEnterDuration;
+
+  @override
+  Duration get reverseTransitionDuration =>
+      reducedMotion ? Duration.zero : _popoverExitDuration;
+
+  @override
+  Widget buildPage(
+    BuildContext context,
+    Animation<double> animation,
+    Animation<double> secondaryAnimation,
+  ) {
+    final curvedAnimation = animation.drive(
+      CurveTween(curve: Curves.easeOutCubic),
+    );
+    final scaleAnimation = Tween<double>(
+      begin: _popoverStartScale,
+      end: 1,
+    ).animate(curvedAnimation);
+    final transformOrigin = switch (alignment) {
+      AnchoredPopoverAlignment.start => Alignment.topLeft,
+      AnchoredPopoverAlignment.end => Alignment.topRight,
+    };
+
+    return CustomSingleChildLayout(
+      delegate: _AnchoredPopoverLayoutDelegate(
+        position: position,
+        alignment: alignment,
+        offset: offset,
+        screenPadding: screenPadding,
+      ),
+      child: FadeTransition(
+        key: const ValueKey('activity-popover-fade'),
+        opacity: curvedAnimation,
+        child: ScaleTransition(
+          key: const ValueKey('activity-popover-scale'),
+          scale: scaleAnimation,
+          alignment: transformOrigin,
+          child: Material(
+            key: surfaceKey,
+            type: MaterialType.card,
+            color: color,
+            surfaceTintColor: Colors.transparent,
+            elevation: elevation,
+            shadowColor: shadowColor,
+            shape: shape,
+            clipBehavior: clipBehavior,
+            child: SizedBox(
+              width: width,
+              child: Semantics(
+                role: SemanticsRole.menu,
+                scopesRoute: true,
+                namesRoute: true,
+                explicitChildNodes: true,
+                child: SingleChildScrollView(
+                  padding: menuPadding,
+                  child: ListBody(children: items),
+                ),
+              ),
+            ),
+          ),
+        ),
+      ),
+    );
+  }
+}
+
+class _AnchoredPopoverLayoutDelegate extends SingleChildLayoutDelegate {
+  final RelativeRect position;
+  final AnchoredPopoverAlignment alignment;
+  final Offset offset;
+  final EdgeInsets screenPadding;
+
+  const _AnchoredPopoverLayoutDelegate({
+    required this.position,
+    required this.alignment,
+    required this.offset,
+    required this.screenPadding,
+  });
+
+  @override
+  BoxConstraints getConstraintsForChild(BoxConstraints constraints) {
+    return BoxConstraints.loose(
+      Size(
+        constraints.maxWidth - screenPadding.horizontal,
+        constraints.maxHeight - screenPadding.vertical,
+      ),
+    );
+  }
+
+  @override
+  Offset getPositionForChild(Size size, Size childSize) {
+    final anchorBottom = size.height - position.bottom;
+    final desiredX = switch (alignment) {
+      AnchoredPopoverAlignment.start => position.left + offset.dx,
+      AnchoredPopoverAlignment.end =>
+        size.width - position.right - childSize.width + offset.dx,
+    };
+    final minX = screenPadding.left;
+    final maxX = size.width - screenPadding.right - childSize.width;
+    final x = desiredX.clamp(minX, maxX).toDouble();
+
+    final belowY = anchorBottom + offset.dy;
+    final aboveY = position.top - childSize.height - offset.dy;
+    final maxY = size.height - screenPadding.bottom - childSize.height;
+    final desiredY =
+        belowY + childSize.height <= size.height - screenPadding.bottom
+        ? belowY
+        : aboveY;
+    final y = desiredY.clamp(screenPadding.top, maxY).toDouble();
+
+    return Offset(x, y);
+  }
+
+  @override
+  bool shouldRelayout(_AnchoredPopoverLayoutDelegate oldDelegate) {
+    return position != oldDelegate.position ||
+        alignment != oldDelegate.alignment ||
+        offset != oldDelegate.offset ||
+        screenPadding != oldDelegate.screenPadding;
+  }
+}
diff --git a/mobile/lib/shared/widgets/buzz_loading_indicator.dart b/mobile/lib/shared/widgets/buzz_loading_indicator.dart
new file mode 100644
index 00000000000..6d0471ce641
--- /dev/null
+++ b/mobile/lib/shared/widgets/buzz_loading_indicator.dart
@@ -0,0 +1,98 @@
+import 'dart:math' show pi;
+
+import 'package:flutter/material.dart';
+import 'package:flutter_hooks/flutter_hooks.dart';
+import 'package:hooks_riverpod/hooks_riverpod.dart';
+
+import '../theme/theme.dart';
+
+/// The shared mobile loading indicator, matching the desktop arc spinner.
+class BuzzLoadingIndicator extends HookConsumerWidget {
+  /// The spinner diameter.
+  final double size;
+
+  /// An optional spinner color. Defaults to the active accent color.
+  final Color? color;
+
+  /// The accessibility announcement for this loading state.
+  final String semanticLabel;
+
+  /// Creates a looping arc loading indicator.
+  const BuzzLoadingIndicator({
+    this.size = 40,
+    this.color,
+    this.semanticLabel = 'Loading',
+    super.key,
+  });
+
+  @override
+  Widget build(BuildContext context, WidgetRef ref) {
+    final reducedMotion = MediaQuery.disableAnimationsOf(context);
+    final animation = useAnimationController(
+      duration: const Duration(milliseconds: 500),
+    );
+
+    useEffect(() {
+      if (reducedMotion) {
+        animation
+          ..stop()
+          ..value = 0;
+      } else {
+        animation.repeat();
+      }
+      return animation.stop;
+    }, [animation, reducedMotion]);
+
+    final spinnerColor = color ?? context.colors.primary;
+    final strokeWidth = (size / 6).clamp(2.0, 4.0);
+
+    return Semantics(
+      liveRegion: true,
+      label: semanticLabel,
+      child: ExcludeSemantics(
+        child: RotationTransition(
+          key: const ValueKey('buzz-loading-indicator-spinner'),
+          turns: animation,
+          child: CustomPaint(
+            size: Size.square(size),
+            painter: _ArcSpinnerPainter(
+              color: spinnerColor,
+              strokeWidth: strokeWidth,
+            ),
+          ),
+        ),
+      ),
+    );
+  }
+}
+
+class _ArcSpinnerPainter extends CustomPainter {
+  final Color color;
+  final double strokeWidth;
+
+  const _ArcSpinnerPainter({required this.color, required this.strokeWidth});
+
+  @override
+  void paint(Canvas canvas, Size size) {
+    final center = size.center(Offset.zero);
+    final radius = (size.shortestSide - strokeWidth) / 2;
+    final bounds = Rect.fromCircle(center: center, radius: radius);
+    final trackPaint = Paint()
+      ..color = color.withValues(alpha: color.a * 0.1)
+      ..style = PaintingStyle.stroke
+      ..strokeWidth = strokeWidth;
+    final arcPaint = Paint()
+      ..color = color
+      ..style = PaintingStyle.stroke
+      ..strokeWidth = strokeWidth;
+
+    canvas
+      ..drawCircle(center, radius, trackPaint)
+      ..drawArc(bounds, -pi / 2, pi / 2, false, arcPaint);
+  }
+
+  @override
+  bool shouldRepaint(_ArcSpinnerPainter oldDelegate) {
+    return color != oldDelegate.color || strokeWidth != oldDelegate.strokeWidth;
+  }
+}
diff --git a/mobile/lib/shared/widgets/filter_chip_bar.dart b/mobile/lib/shared/widgets/filter_chip_bar.dart
index 294d7b9a5db..1fe55712a53 100644
--- a/mobile/lib/shared/widgets/filter_chip_bar.dart
+++ b/mobile/lib/shared/widgets/filter_chip_bar.dart
@@ -101,7 +101,7 @@ class FilterChipBar<T> extends StatelessWidget {
     final fg = isSelected
         ? context.colors.onPrimary
         : context.colors.onSurfaceVariant;
-    final labelStyle = context.textTheme.bodyLarge?.copyWith(
+    final labelStyle = filterChipTextStyle.copyWith(
       color: fg,
       fontWeight: isSelected ? FontWeight.w500 : FontWeight.w400,
     );
diff --git a/mobile/lib/shared/widgets/frosted_app_bar.dart b/mobile/lib/shared/widgets/frosted_app_bar.dart
index d8fb5330260..6a0bd2729d0 100644
--- a/mobile/lib/shared/widgets/frosted_app_bar.dart
+++ b/mobile/lib/shared/widgets/frosted_app_bar.dart
@@ -61,6 +61,9 @@ class FrostedAppBar extends StatelessWidget {
   /// can pop, a back button is shown automatically.
   final Widget? leading;
 
+  /// Whether to infer a back button from the current navigator.
+  final bool automaticallyImplyLeading;
+
   /// Widget displayed in the center/title area.
   final Widget? title;
 
@@ -95,6 +98,7 @@ class FrostedAppBar extends StatelessWidget {
   const FrostedAppBar({
     super.key,
     this.leading,
+    this.automaticallyImplyLeading = true,
     this.title,
     this.titleStyle,
     this.titleContentHeight = 0,
@@ -119,7 +123,7 @@ class FrostedAppBar extends StatelessWidget {
 
     final effectiveLeading =
         leading ??
-        (canPop
+        (automaticallyImplyLeading && canPop
             ? SizedBox(
                 width: 48,
                 height: 48,
diff --git a/mobile/lib/shared/widgets/frosted_scaffold.dart b/mobile/lib/shared/widgets/frosted_scaffold.dart
index 6b7e39fd759..fc0e2fe506c 100644
--- a/mobile/lib/shared/widgets/frosted_scaffold.dart
+++ b/mobile/lib/shared/widgets/frosted_scaffold.dart
@@ -21,17 +21,23 @@ class FrostedScaffold extends StatelessWidget {
   /// Whether the body should resize when the on-screen keyboard appears.
   final bool? resizeToAvoidBottomInset;
 
+  /// Optional scaffold background, useful when a parent supplies a shared
+  /// surface behind this page.
+  final Color? backgroundColor;
+
   const FrostedScaffold({
     super.key,
     required this.appBar,
     required this.body,
     this.floatingActionButton,
     this.resizeToAvoidBottomInset,
+    this.backgroundColor,
   });
 
   @override
   Widget build(BuildContext context) {
     return Scaffold(
+      backgroundColor: backgroundColor,
       resizeToAvoidBottomInset: resizeToAvoidBottomInset,
       floatingActionButton: floatingActionButton,
       body: Stack(children: [body, appBar]),
diff --git a/mobile/lib/shared/widgets/message_author_meta.dart b/mobile/lib/shared/widgets/message_author_meta.dart
new file mode 100644
index 00000000000..c7aff7df825
--- /dev/null
+++ b/mobile/lib/shared/widgets/message_author_meta.dart
@@ -0,0 +1,118 @@
+import 'package:flutter/material.dart';
+
+import '../theme/theme.dart';
+
+/// A consistent inline author row for message-oriented surfaces.
+class MessageAuthorMeta extends StatelessWidget {
+  /// Primary author name shown at the start of the row.
+  final String displayName;
+
+  /// Optional secondary username, hidden when blank or equal to [displayName].
+  final String? username;
+
+  /// Timestamp label shown after the author metadata.
+  final String timestamp;
+
+  /// Color applied to [displayName].
+  final Color nameColor;
+
+  /// Color applied to the username, separator, and [timestamp].
+  final Color metadataColor;
+
+  /// Optional callback invoked when [displayName] is tapped.
+  final VoidCallback? onAuthorTap;
+
+  /// Optional key assigned to the display-name text.
+  final Key? displayNameKey;
+
+  /// Optional key assigned to the username text.
+  final Key? usernameKey;
+
+  /// Optional key assigned to the timestamp text.
+  final Key? timestampKey;
+
+  /// Base text style for [displayName], with [nameColor] applied.
+  final TextStyle nameStyle;
+
+  /// Base text style for secondary metadata, with [metadataColor] applied.
+  final TextStyle metadataStyle;
+
+  /// Creates an inline author row with optional username and tap handling.
+  const MessageAuthorMeta({
+    super.key,
+    required this.displayName,
+    required this.timestamp,
+    required this.nameColor,
+    required this.metadataColor,
+    this.username,
+    this.onAuthorTap,
+    this.displayNameKey,
+    this.usernameKey,
+    this.timestampKey,
+    this.nameStyle = messageUsernameTextStyle,
+    this.metadataStyle = messageMetadataTextStyle,
+  });
+
+  @override
+  Widget build(BuildContext context) {
+    final normalizedUsername = username?.trim();
+    final showUsername =
+        normalizedUsername != null &&
+        normalizedUsername.isNotEmpty &&
+        normalizedUsername != displayName.trim();
+    final resolvedNameStyle = nameStyle.copyWith(color: nameColor);
+    final resolvedMetadataStyle = metadataStyle.copyWith(color: metadataColor);
+
+    Widget authorName = Text(
+      displayName,
+      key: displayNameKey,
+      maxLines: 1,
+      overflow: TextOverflow.ellipsis,
+      style: resolvedNameStyle,
+    );
+    if (onAuthorTap != null) {
+      authorName = GestureDetector(onTap: onAuthorTap, child: authorName);
+    }
+
+    return LayoutBuilder(
+      builder: (context, constraints) {
+        final metadataMaxWidth = constraints.hasBoundedWidth
+            ? constraints.maxWidth / (showUsername ? 3 : 2)
+            : double.infinity;
+
+        return Row(
+          crossAxisAlignment: CrossAxisAlignment.center,
+          children: [
+            Flexible(child: authorName),
+            if (showUsername) ...[
+              const SizedBox(width: Grid.half),
+              ConstrainedBox(
+                constraints: BoxConstraints(maxWidth: metadataMaxWidth),
+                child: Text(
+                  normalizedUsername,
+                  key: usernameKey,
+                  maxLines: 1,
+                  overflow: TextOverflow.ellipsis,
+                  style: resolvedMetadataStyle,
+                ),
+              ),
+            ],
+            const SizedBox(width: Grid.half),
+            Text('·', style: resolvedMetadataStyle),
+            const SizedBox(width: Grid.half),
+            ConstrainedBox(
+              constraints: BoxConstraints(maxWidth: metadataMaxWidth),
+              child: Text(
+                timestamp,
+                key: timestampKey,
+                maxLines: 1,
+                overflow: TextOverflow.ellipsis,
+                style: resolvedMetadataStyle,
+              ),
+            ),
+          ],
+        );
+      },
+    );
+  }
+}
diff --git a/mobile/lib/shared/widgets/mobile_tab_footer_backdrop.dart b/mobile/lib/shared/widgets/mobile_tab_footer_backdrop.dart
new file mode 100644
index 00000000000..687880acb19
--- /dev/null
+++ b/mobile/lib/shared/widgets/mobile_tab_footer_backdrop.dart
@@ -0,0 +1,61 @@
+import 'package:flutter/material.dart';
+
+import '../theme/theme.dart';
+
+/// Height of the floating mobile tab bar, excluding its bottom clearance.
+const mobileTabBarHeight = 56.0;
+
+/// Gap between the floating mobile tab bar and the bottom safe area.
+const mobileTabBarBottomGap = Grid.twelve;
+
+/// Returns the shared footer backdrop height, including the logical safe area.
+double mobileTabFooterBackdropHeight(BuildContext context) =>
+    mobileTabBarHeight +
+    mobileTabBarBottomGap +
+    MediaQuery.paddingOf(context).bottom +
+    Grid.xl +
+    Grid.gutter;
+
+/// Shared fade behind the floating mobile tab bar.
+class MobileTabFooterBackdrop extends StatelessWidget {
+  /// Vertical extent of the backdrop in logical pixels.
+  final double height;
+
+  /// Gradient stop positions, from the transparent top to the opaque bottom.
+  final List<double> stops;
+
+  /// Surface-color alpha values paired with [stops].
+  final List<double> opacities;
+
+  /// Creates a footer backdrop with the required [height].
+  ///
+  /// Override [stops] and [opacities] together to customize the gradient.
+  const MobileTabFooterBackdrop({
+    super.key,
+    required this.height,
+    this.stops = const [0, 0.5, 1],
+    this.opacities = const [0, 0.75, 1],
+  }) : assert(stops.length == opacities.length);
+
+  @override
+  Widget build(BuildContext context) {
+    final surface = context.colors.surface;
+    return SizedBox(
+      height: height,
+      width: double.infinity,
+      child: DecoratedBox(
+        decoration: BoxDecoration(
+          gradient: LinearGradient(
+            begin: Alignment.topCenter,
+            end: Alignment.bottomCenter,
+            stops: stops,
+            colors: [
+              for (final opacity in opacities)
+                surface.withValues(alpha: opacity),
+            ],
+          ),
+        ),
+      ),
+    );
+  }
+}
diff --git a/mobile/lib/shared/widgets/sheet_divider.dart b/mobile/lib/shared/widgets/sheet_divider.dart
new file mode 100644
index 00000000000..1bedbb3c664
--- /dev/null
+++ b/mobile/lib/shared/widgets/sheet_divider.dart
@@ -0,0 +1,17 @@
+import 'package:flutter/material.dart';
+
+import '../theme/theme.dart';
+
+/// Hairline divider between action groups in a bottom sheet, matching the
+/// `AppListSection` divider convention.
+class SheetDivider extends StatelessWidget {
+  const SheetDivider({super.key});
+
+  @override
+  Widget build(BuildContext context) {
+    return Padding(
+      padding: const EdgeInsets.symmetric(vertical: Grid.xxs),
+      child: Divider(height: 1, color: context.colors.outlineVariant),
+    );
+  }
+}
diff --git a/mobile/lib/shared/widgets/skeleton.dart b/mobile/lib/shared/widgets/skeleton.dart
new file mode 100644
index 00000000000..3fd61c1fa86
--- /dev/null
+++ b/mobile/lib/shared/widgets/skeleton.dart
@@ -0,0 +1,17 @@
+import 'dart:ui';
+
+import 'package:flutter/material.dart';
+import 'package:flutter_hooks/flutter_hooks.dart';
+
+import '../theme/theme.dart';
+
+part 'skeleton_bar.dart';
+part 'skeleton_mask.dart';
+part 'skeleton_reveal.dart';
+part 'skeleton_shimmer.dart';
+
+const _shimmerDuration = Duration(milliseconds: 2000);
+const _skeletonOpacity = 0.1;
+const _shimmerMinOpacity = 0.5;
+const _revealDuration = Duration(milliseconds: 400);
+const _revealBlur = 2.0;
diff --git a/mobile/lib/shared/widgets/skeleton_bar.dart b/mobile/lib/shared/widgets/skeleton_bar.dart
new file mode 100644
index 00000000000..ec7bb821587
--- /dev/null
+++ b/mobile/lib/shared/widgets/skeleton_bar.dart
@@ -0,0 +1,33 @@
+part of 'skeleton.dart';
+
+/// A single rounded placeholder within a [SkeletonShimmer].
+class SkeletonBar extends StatelessWidget {
+  final double width;
+  final double height;
+  final BorderRadius? borderRadius;
+
+  const SkeletonBar({
+    required this.width,
+    required this.height,
+    this.borderRadius,
+    super.key,
+  });
+
+  @override
+  Widget build(BuildContext context) {
+    return ExcludeSemantics(
+      child: SizedBox(
+        width: width,
+        height: height,
+        child: DecoratedBox(
+          decoration: BoxDecoration(
+            color: _SkeletonMask.isActive(context)
+                ? Colors.white
+                : context.colors.primary.withValues(alpha: _skeletonOpacity),
+            borderRadius: borderRadius ?? BorderRadius.circular(Radii.sm),
+          ),
+        ),
+      ),
+    );
+  }
+}
diff --git a/mobile/lib/shared/widgets/skeleton_mask.dart b/mobile/lib/shared/widgets/skeleton_mask.dart
new file mode 100644
index 00000000000..5c3b9fbec93
--- /dev/null
+++ b/mobile/lib/shared/widgets/skeleton_mask.dart
@@ -0,0 +1,11 @@
+part of 'skeleton.dart';
+
+class _SkeletonMask extends InheritedWidget {
+  const _SkeletonMask({required super.child});
+
+  static bool isActive(BuildContext context) =>
+      context.dependOnInheritedWidgetOfExactType<_SkeletonMask>() != null;
+
+  @override
+  bool updateShouldNotify(_SkeletonMask oldWidget) => false;
+}
diff --git a/mobile/lib/shared/widgets/skeleton_reveal.dart b/mobile/lib/shared/widgets/skeleton_reveal.dart
new file mode 100644
index 00000000000..cb0d523dbe9
--- /dev/null
+++ b/mobile/lib/shared/widgets/skeleton_reveal.dart
@@ -0,0 +1,103 @@
+part of 'skeleton.dart';
+
+/// Stacks a skeleton and its content in the same slot, then reveals the content.
+///
+/// Entering the loading state is intentionally instant so reconnects do not
+/// animate backwards. Leaving it cross-fades both layers while the skeleton
+/// blurs out and the content sharpens over 400ms.
+class SkeletonReveal extends HookWidget {
+  final bool loading;
+  final Widget skeleton;
+  final Widget content;
+  final bool shimmerEnabled;
+
+  const SkeletonReveal({
+    required this.loading,
+    required this.skeleton,
+    required this.content,
+    this.shimmerEnabled = true,
+    super.key,
+  });
+
+  @override
+  Widget build(BuildContext context) {
+    final reducedMotion = MediaQuery.disableAnimationsOf(context);
+    final reveal = useAnimationController(
+      duration: _revealDuration,
+      initialValue: loading ? 0 : 1,
+    );
+    final previousLoading = usePrevious(loading);
+
+    useEffect(() {
+      if (reducedMotion || previousLoading == null) {
+        reveal
+          ..stop()
+          ..value = loading ? 0 : 1;
+      } else if (loading) {
+        // Reset directly to the loading state. Only the reveal animates.
+        reveal
+          ..stop()
+          ..value = 0;
+      } else if (previousLoading) {
+        reveal.forward(from: 0);
+      }
+      return null;
+    }, [loading, reducedMotion]);
+
+    return AnimatedBuilder(
+      animation: reveal,
+      builder: (context, _) {
+        final progress = reveal.value;
+        final skeletonBlur = reducedMotion ? 0.0 : _revealBlur * progress;
+        final contentBlur = reducedMotion ? 0.0 : _revealBlur * (1 - progress);
+
+        return Stack(
+          fit: StackFit.expand,
+          children: [
+            Opacity(
+              key: const Key('skeleton-reveal-content'),
+              opacity: progress,
+              child: ImageFiltered(
+                enabled: contentBlur > 0.01,
+                imageFilter: ImageFilter.blur(
+                  sigmaX: contentBlur,
+                  sigmaY: contentBlur,
+                ),
+                child: IgnorePointer(
+                  ignoring: loading || progress < 1,
+                  child: ExcludeFocus(
+                    excluding: loading || progress < 1,
+                    child: ExcludeSemantics(
+                      excluding: loading || progress < 1,
+                      child: content,
+                    ),
+                  ),
+                ),
+              ),
+            ),
+            Opacity(
+              key: const Key('skeleton-reveal-placeholder'),
+              opacity: 1 - progress,
+              child: ImageFiltered(
+                enabled: skeletonBlur > 0.01,
+                imageFilter: ImageFilter.blur(
+                  sigmaX: skeletonBlur,
+                  sigmaY: skeletonBlur,
+                ),
+                child: IgnorePointer(
+                  child: ExcludeSemantics(
+                    excluding: !loading,
+                    child: SkeletonShimmer(
+                      enabled: loading && shimmerEnabled,
+                      child: skeleton,
+                    ),
+                  ),
+                ),
+              ),
+            ),
+          ],
+        );
+      },
+    );
+  }
+}
diff --git a/mobile/lib/shared/widgets/skeleton_shimmer.dart b/mobile/lib/shared/widgets/skeleton_shimmer.dart
new file mode 100644
index 00000000000..18e6635de57
--- /dev/null
+++ b/mobile/lib/shared/widgets/skeleton_shimmer.dart
@@ -0,0 +1,71 @@
+part of 'skeleton.dart';
+
+/// Sweeps one shared highlight across a group of skeleton elements.
+///
+/// This mirrors desktop's two-second linear shimmer. Reduced-motion users see
+/// the same element shapes without the moving highlight.
+class SkeletonShimmer extends HookWidget {
+  final Widget child;
+  final bool enabled;
+
+  const SkeletonShimmer({required this.child, this.enabled = true, super.key});
+
+  @override
+  Widget build(BuildContext context) {
+    final animation = useAnimationController(duration: _shimmerDuration);
+    final reducedMotion = MediaQuery.disableAnimationsOf(context);
+    final colors = context.colors;
+    final baseColor = colors.primary.withValues(alpha: _skeletonOpacity);
+    final highlightColor = colors.primary.withValues(
+      alpha: _skeletonOpacity * _shimmerMinOpacity,
+    );
+
+    useEffect(() {
+      if (reducedMotion || !enabled) {
+        animation
+          ..stop()
+          ..value = 0;
+      } else {
+        animation.repeat();
+      }
+      return animation.stop;
+    }, [animation, enabled, reducedMotion]);
+
+    if (reducedMotion || !enabled) {
+      return _SkeletonMask(
+        child: ColorFiltered(
+          colorFilter: ColorFilter.mode(baseColor, BlendMode.srcIn),
+          child: child,
+        ),
+      );
+    }
+
+    return _SkeletonMask(
+      child: RepaintBoundary(
+        child: AnimatedBuilder(
+          animation: animation,
+          child: child,
+          builder: (context, child) {
+            final center = -1.5 + (animation.value * 3);
+            return ShaderMask(
+              blendMode: BlendMode.srcIn,
+              shaderCallback: (bounds) => LinearGradient(
+                begin: Alignment(center - 1, 0),
+                end: Alignment(center + 1, 0),
+                colors: [
+                  baseColor,
+                  baseColor,
+                  highlightColor,
+                  baseColor,
+                  baseColor,
+                ],
+                stops: const [0, 0.34, 0.5, 0.66, 1],
+              ).createShader(bounds),
+              child: child,
+            );
+          },
+        ),
+      ),
+    );
+  }
+}
diff --git a/mobile/pubspec.lock b/mobile/pubspec.lock
index 55185fc9c64..61d7fd58e4f 100644
--- a/mobile/pubspec.lock
+++ b/mobile/pubspec.lock
@@ -1000,6 +1000,14 @@ packages:
       url: "https://pub.dev"
     source: hosted
     version: "7.0.2"
+  photo_manager:
+    dependency: "direct main"
+    description:
+      name: photo_manager
+      sha256: "4f7de6c9778993c5c54cf1fb2eaa8d5c27c0771dc24a4dfca341aa81aef13fe1"
+      url: "https://pub.dev"
+    source: hosted
+    version: "3.11.0"
   platform:
     dependency: transitive
     description:
@@ -1096,6 +1104,22 @@ packages:
       url: "https://pub.dev"
     source: hosted
     version: "0.3.8"
+  share_plus:
+    dependency: "direct main"
+    description:
+      name: share_plus
+      sha256: "34f00f9becd2743c1fb05363d624f9f70d37f7ccdcdda47450bc0b8c9d327b8c"
+      url: "https://pub.dev"
+    source: hosted
+    version: "13.3.0"
+  share_plus_platform_interface:
+    dependency: transitive
+    description:
+      name: share_plus_platform_interface
+      sha256: "365ef7379fc22507256adda3385152942ffce08935452bc972c2e52a0bebae41"
+      url: "https://pub.dev"
+    source: hosted
+    version: "7.2.0"
   shared_preferences:
     dependency: "direct main"
     description:
diff --git a/mobile/pubspec.yaml b/mobile/pubspec.yaml
index b90f50c25a9..b525926288b 100644
--- a/mobile/pubspec.yaml
+++ b/mobile/pubspec.yaml
@@ -29,6 +29,7 @@ dependencies:
   file_selector: ^1.1.0
   camera: ^0.12.0+2
   image_picker: ^1.1.2
+  photo_manager: ^3.11.0
   video_player: ^2.10.1
   package_info_plus: ^10.0.0
   app_badge_plus: ^1.2.10
@@ -36,6 +37,7 @@ dependencies:
   scrollable_positioned_list: ^0.3.8
   open_filex: ^4.7.0
   path_provider: ^2.1.6
+  share_plus: ^13.3.0
 
 dev_dependencies:
   flutter_test:
diff --git a/mobile/scripts/check-file-sizes.mjs b/mobile/scripts/check-file-sizes.mjs
index a3af9c054b9..765cd8edcfb 100644
--- a/mobile/scripts/check-file-sizes.mjs
+++ b/mobile/scripts/check-file-sizes.mjs
@@ -15,16 +15,8 @@ const rules = [
   },
 ];
 
-// TEMP — these files exceed the 1000-line limit and are queued to be split.
-// Do not add to this list; split the file instead. Remove each entry as its
-// file is broken up.
-const overrides = new Map([
-]);
-
 await runFileSizeCheck({
   projectRoot,
   rules,
-  overrides,
   label: "Mobile",
-  scriptPath: "mobile/scripts/check-file-sizes.mjs",
 });
diff --git a/mobile/test/features/activity/activity_page_test.dart b/mobile/test/features/activity/activity_page_test.dart
index f79076272b1..a0293455f24 100644
--- a/mobile/test/features/activity/activity_page_test.dart
+++ b/mobile/test/features/activity/activity_page_test.dart
@@ -1,47 +1,52 @@
 import 'dart:async';
 
-import 'package:flutter/material.dart';
-import 'package:flutter_test/flutter_test.dart';
-import 'package:hooks_riverpod/hooks_riverpod.dart';
-import 'package:hooks_riverpod/misc.dart';
 import 'package:buzz/features/activity/activity_page.dart';
 import 'package:buzz/features/activity/activity_provider.dart';
 import 'package:buzz/features/activity/feed_item.dart';
+import 'package:buzz/features/activity/inbox_item.dart';
+import 'package:buzz/features/activity/reminders_provider.dart';
 import 'package:buzz/features/channels/channel.dart';
+import 'package:buzz/features/channels/channel_detail_page.dart';
+import 'package:buzz/features/channels/message_content.dart';
 import 'package:buzz/features/channels/channels_provider.dart';
+import 'package:buzz/features/channels/read_state/read_state_provider.dart';
 import 'package:buzz/features/profile/user_cache_provider.dart';
 import 'package:buzz/features/profile/user_profile.dart';
 import 'package:buzz/shared/theme/theme.dart';
+import 'package:buzz/shared/widgets/frosted_app_bar.dart';
+import 'package:buzz/shared/widgets/avatar_image.dart';
+import 'package:flutter/material.dart';
+import 'package:flutter_test/flutter_test.dart';
+import 'package:hooks_riverpod/hooks_riverpod.dart';
+import 'package:shared_preferences/shared_preferences.dart';
 
 void main() {
-  Widget buildTestable({required List<Override> overrides}) {
-    return ProviderScope(
-      overrides: overrides,
-      child: MaterialApp(theme: AppTheme.light(), home: const ActivityPage()),
-    );
-  }
+  final now = DateTime.now().millisecondsSinceEpoch ~/ 1000;
 
   final testMention = FeedItem(
     id: 'm1',
     kind: 9,
     pubkey: 'alice_pk',
     content: 'Hey check this out',
-    createdAt: DateTime.now().millisecondsSinceEpoch ~/ 1000 - 120,
+    createdAt: now - 120,
     channelId: 'ch1',
     channelName: 'general',
     tags: const [],
     category: 'mention',
   );
 
-  final testActivity = FeedItem(
+  final testThreadReply = FeedItem(
     id: 'a1',
     kind: 9,
     pubkey: 'bob_pk',
     content: 'Deployed the fix',
-    createdAt: DateTime.now().millisecondsSinceEpoch ~/ 1000 - 3600,
+    createdAt: now - 3600,
     channelId: 'ch2',
     channelName: 'engineering',
-    tags: const [],
+    tags: const [
+      ['e', 'root1', '', 'root'],
+      ['e', 'root1', '', 'reply'],
+    ],
     category: 'activity',
   );
 
@@ -50,7 +55,7 @@ void main() {
     kind: 43004,
     pubkey: 'agent_pk',
     content: 'Job completed successfully',
-    createdAt: DateTime.now().millisecondsSinceEpoch ~/ 1000 - 60,
+    createdAt: now - 60,
     channelId: 'ch1',
     channelName: 'general',
     tags: const [],
@@ -60,7 +65,7 @@ void main() {
   final testFeed = HomeFeedResponse(
     mentions: [testMention],
     needsAction: const [],
-    activity: [testActivity],
+    activity: [testThreadReply],
     agentActivity: [testAgent],
   );
 
@@ -90,73 +95,108 @@ void main() {
   ];
 
   final testUsers = <String, UserProfile>{
-    'alice_pk': const UserProfile(pubkey: 'alice_pk', displayName: 'Alice'),
+    'alice_pk': const UserProfile(
+      pubkey: 'alice_pk',
+      displayName: 'Alice',
+      nip05Handle: 'alice@example.com',
+    ),
     'bob_pk': const UserProfile(pubkey: 'bob_pk', displayName: 'Bob'),
     'agent_pk': const UserProfile(pubkey: 'agent_pk', displayName: 'Scout'),
   };
 
-  final emptyUsers = <String, UserProfile>{};
-
-  List<Override> defaultOverrides({HomeFeedResponse? feed}) => [
-    activityProvider.overrideWith(
-      () => _FakeActivityNotifier(feed ?? testFeed),
-    ),
-    channelsProvider.overrideWith(() => _FakeChannelsNotifier(testChannels)),
-    userCacheProvider.overrideWith(() => _FakeUserCacheNotifier(testUsers)),
-  ];
+  Future<Widget> buildTestable({
+    HomeFeedResponse? feed,
+    ActivityNotifier Function()? activityNotifier,
+    Map<String, UserProfile>? users,
+    Map<String, int> readContexts = const {},
+    List<Channel>? channels,
+    TextScaler? textScaler,
+  }) async {
+    SharedPreferences.setMockInitialValues({});
+    final prefs = await SharedPreferences.getInstance();
+    return ProviderScope(
+      overrides: [
+        savedPrefsProvider.overrideWithValue(prefs),
+        activityProvider.overrideWith(
+          activityNotifier ?? () => _FakeActivityNotifier(feed ?? testFeed),
+        ),
+        channelsProvider.overrideWith(
+          () => _FakeChannelsNotifier(channels ?? testChannels),
+        ),
+        userCacheProvider.overrideWith(
+          () => _FakeUserCacheNotifier(users ?? testUsers),
+        ),
+        readStateProvider.overrideWith(
+          () => _FakeReadStateNotifier(readContexts),
+        ),
+        remindersProvider.overrideWith(() => _FakeRemindersNotifier(const [])),
+      ],
+      child: MaterialApp(
+        theme: AppTheme.light(),
+        builder: textScaler == null
+            ? null
+            : (context, child) => MediaQuery(
+                data: MediaQuery.of(context).copyWith(textScaler: textScaler),
+                child: child!,
+              ),
+        home: const ActivityPage(),
+      ),
+    );
+  }
 
   testWidgets('shows loading skeleton while feed loads', (tester) async {
     await tester.pumpWidget(
-      buildTestable(
-        overrides: [
-          activityProvider.overrideWith(() => _PendingActivityNotifier()),
-          channelsProvider.overrideWith(() => _FakeChannelsNotifier([])),
-          userCacheProvider.overrideWith(
-            () => _FakeUserCacheNotifier(emptyUsers),
-          ),
-        ],
-      ),
+      await buildTestable(activityNotifier: _PendingActivityNotifier.new),
     );
     // Single pump - don't settle, the future never completes.
     await tester.pump();
 
-    // Skeleton containers should be present (loading state).
     expect(find.byType(Container), findsWidgets);
-    // No feed content visible.
-    expect(find.text('Mention'), findsNothing);
+    expect(find.text('Hey check this out'), findsNothing);
   });
 
   testWidgets('shows empty state when feed is empty', (tester) async {
-    final emptyFeed = HomeFeedResponse(
-      mentions: [],
-      needsAction: [],
-      activity: [],
-      agentActivity: [],
-    );
-
     await tester.pumpWidget(
-      buildTestable(overrides: defaultOverrides(feed: emptyFeed)),
+      await buildTestable(
+        feed: HomeFeedResponse(
+          mentions: const [],
+          needsAction: const [],
+          activity: const [],
+          agentActivity: const [],
+        ),
+      ),
     );
     await tester.pumpAndSettle();
 
     expect(find.text('No activity yet'), findsOneWidget);
-    expect(
-      find.text('Mentions, replies, and reactions will show up here.'),
-      findsOneWidget,
-    );
+  });
+
+  testWidgets('does not imply a back button for the top-level Activity tab', (
+    tester,
+  ) async {
+    await tester.pumpWidget(await buildTestable());
+    await tester.pumpAndSettle();
+
+    final appBar = tester.widget<FrostedAppBar>(find.byType(FrostedAppBar));
+    expect(appBar.automaticallyImplyLeading, isFalse);
+    expect(find.byTooltip('Back'), findsNothing);
+  });
+
+  testWidgets('keeps bottom clearance for the floating tab bar', (
+    tester,
+  ) async {
+    await tester.pumpWidget(await buildTestable());
+    await tester.pumpAndSettle();
+
+    final safeAreas = tester.widgetList<SafeArea>(find.byType(SafeArea));
+    expect(safeAreas, hasLength(1));
+    expect(safeAreas.single.top, isFalse);
+    expect(safeAreas.single.bottom, isTrue);
   });
 
   testWidgets('shows error view with retry button', (tester) async {
     await tester.pumpWidget(
-      buildTestable(
-        overrides: [
-          activityProvider.overrideWith(() => _ErrorActivityNotifier()),
-          channelsProvider.overrideWith(() => _FakeChannelsNotifier([])),
-          userCacheProvider.overrideWith(
-            () => _FakeUserCacheNotifier(emptyUsers),
-          ),
-        ],
-      ),
+      await buildTestable(activityNotifier: _ErrorActivityNotifier.new),
     );
     await tester.pumpAndSettle();
 
@@ -164,107 +204,400 @@ void main() {
     expect(find.text('Retry'), findsOneWidget);
   });
 
-  testWidgets('shows feed items with correct content', (tester) async {
-    await tester.pumpWidget(buildTestable(overrides: defaultOverrides()));
+  testWidgets('activity popovers use fixed-layout scale and opacity motion', (
+    tester,
+  ) async {
+    await tester.pumpWidget(await buildTestable());
     await tester.pumpAndSettle();
 
-    // All three items visible in "All" filter.
-    expect(find.text('Hey check this out'), findsOneWidget);
-    expect(find.text('Deployed the fix'), findsOneWidget);
-    expect(find.text('Job completed successfully'), findsOneWidget);
+    final filterTrigger = find.byKey(const ValueKey('activity-filter-menu'));
+    expect(
+      tester.getSize(filterTrigger).height,
+      greaterThanOrEqualTo(Grid.xl),
+      reason: 'The Activity filter trigger must keep a 48dp touch target.',
+    );
 
-    // Author names resolved from user cache.
+    await tester.tap(filterTrigger);
+    await tester.pump();
+
+    final surface = find.byKey(const ValueKey('activity-filter-popover'));
+    final fade = find.byKey(const ValueKey('activity-popover-fade'));
+    final scale = find.byKey(const ValueKey('activity-popover-scale'));
+    expect(surface, findsOneWidget);
+    expect(fade, findsOneWidget);
+    expect(scale, findsOneWidget);
+
+    final initialSize = tester.getSize(surface);
+    final initialFade = tester.widget<FadeTransition>(fade);
+    final initialScale = tester.widget<ScaleTransition>(scale);
+    expect(initialSize.width, 240);
+    expect(initialFade.opacity.value, lessThan(1));
+    expect(initialScale.scale.value, greaterThanOrEqualTo(0.96));
+    expect(initialScale.scale.value, lessThan(1));
+    expect(initialScale.alignment, Alignment.topLeft);
+
+    await tester.pump(const Duration(milliseconds: 75));
+
+    final movingFade = tester.widget<FadeTransition>(fade);
+    final movingScale = tester.widget<ScaleTransition>(scale);
+    expect(movingFade.opacity.value, greaterThan(0));
+    expect(movingFade.opacity.value, lessThan(1));
+    expect(movingScale.scale.value, greaterThan(0.96));
+    expect(movingScale.scale.value, lessThan(1));
+    expect(tester.getSize(surface), initialSize);
+
+    await tester.pump(const Duration(milliseconds: 75));
+    expect(tester.widget<FadeTransition>(fade).opacity.value, 1);
+    expect(tester.widget<ScaleTransition>(scale).scale.value, 1);
+    expect(tester.getSize(surface), initialSize);
+
+    final material = tester.widget<Material>(surface);
+    final shape = material.shape! as RoundedRectangleBorder;
+    expect(shape.borderRadius, BorderRadius.circular(Radii.card));
+    expect(material.surfaceTintColor, Colors.transparent);
+    expect(material.clipBehavior, Clip.antiAlias);
+
+    final items = tester.widgetList<PopupMenuItem<InboxFilter>>(
+      find.byType(PopupMenuItem<InboxFilter>),
+    );
+    expect(items, hasLength(InboxFilter.values.length));
+    expect(
+      items.every((item) => item.height >= Grid.xl),
+      isTrue,
+      reason: 'Activity filter choices must keep 48dp touch targets.',
+    );
+
+    await tester.tap(find.descendant(of: surface, matching: find.text('All')));
+    await tester.pumpAndSettle();
+    await tester.tap(find.byKey(const ValueKey('activity-options-menu')));
+    await tester.pump();
+
+    final optionsSurface = find.byKey(
+      const ValueKey('activity-options-popover'),
+    );
+    expect(tester.getSize(optionsSurface).width, 216);
+    expect(
+      tester
+          .widget<ScaleTransition>(
+            find.byKey(const ValueKey('activity-popover-scale')),
+          )
+          .alignment,
+      Alignment.topRight,
+    );
+  });
+
+  testWidgets('rows lead with sender, contextual label, and preview', (
+    tester,
+  ) async {
+    await tester.pumpWidget(await buildTestable());
+    await tester.pumpAndSettle();
+
+    // Sender names resolved from the user cache.
     expect(find.text('Alice'), findsOneWidget);
+    expect(find.text('alice@example.com'), findsOneWidget);
     expect(find.text('Bob'), findsOneWidget);
     expect(find.text('Scout'), findsOneWidget);
 
-    // Channel names visible.
+    // Contextual labels + channel chips.
+    expect(find.text('Mentioned in'), findsOneWidget);
+    expect(find.text('Thread in'), findsOneWidget);
     expect(find.text('#general'), findsNWidgets(2)); // mention + agent
     expect(find.text('#engineering'), findsOneWidget);
+
+    // Context labels and channel pills share the compact Activity style.
+    final contextLabel = tester.widget<Text>(find.text('Mentioned in'));
+    final channelLabel = tester.widgetList<Text>(find.text('#general')).first;
+    expect(contextLabel.style?.fontSize, activityContextTextStyle.fontSize);
+    expect(contextLabel.style?.fontWeight, activityContextTextStyle.fontWeight);
+    expect(contextLabel.style?.height, activityContextTextStyle.height);
+    expect(channelLabel.style?.fontSize, activityContextTextStyle.fontSize);
+    expect(channelLabel.style?.fontWeight, activityContextTextStyle.fontWeight);
+    expect(channelLabel.style?.height, activityContextTextStyle.height);
+
+    // Message previews.
+    expect(find.textContaining('Hey check this out'), findsOneWidget);
+    expect(find.textContaining('Deployed the fix'), findsOneWidget);
+
+    // Activity rows use their conversation-oriented scale.
+    final senderText = tester.widget<Text>(find.text('Alice'));
+    final theme = Theme.of(tester.element(find.text('Alice')));
+    expect(senderText.style?.fontSize, activityUsernameTextStyle.fontSize);
+    expect(senderText.style?.fontWeight, activityUsernameTextStyle.fontWeight);
+    expect(senderText.style?.height, activityUsernameTextStyle.height);
+    expect(senderText.style?.color, theme.colorScheme.onSurface);
+    final usernameText = tester.widget<Text>(
+      find.byKey(const ValueKey('activity-username-m1')),
+    );
+    final timestampText = tester.widget<Text>(
+      find.byKey(const ValueKey('activity-timestamp-m1')),
+    );
+    expect(usernameText.style?.fontSize, messageMetadataTextStyle.fontSize);
+    expect(usernameText.style?.fontWeight, FontWeight.w400);
+    expect(usernameText.style?.height, messageMetadataTextStyle.height);
+    expect(timestampText.style?.fontSize, messageMetadataTextStyle.fontSize);
+    expect(timestampText.style?.fontWeight, FontWeight.w400);
+
+    final avatars = tester.widgetList<AvatarImage>(find.byType(AvatarImage));
+    expect(avatars, isNotEmpty);
+    expect(
+      avatars.every((avatar) => avatar.radius == activityAvatarSize / 2),
+      isTrue,
+    );
+
+    final previews = tester.widgetList<MessageContent>(
+      find.byType(MessageContent),
+    );
+    expect(previews, isNotEmpty);
+    expect(
+      previews.every(
+        (preview) =>
+            preview.baseStyle?.fontSize == activityPreviewTextStyle.fontSize &&
+            preview.baseStyle?.fontWeight ==
+                activityPreviewTextStyle.fontWeight &&
+            preview.baseStyle?.height == activityPreviewTextStyle.height &&
+            preview.baseStyle?.letterSpacing ==
+                activityPreviewTextStyle.letterSpacing &&
+            preview.baseStyle?.color == theme.colorScheme.onSurface,
+      ),
+      isTrue,
+    );
   });
 
-  testWidgets('shows filter chips with counts', (tester) async {
-    await tester.pumpWidget(buildTestable(overrides: defaultOverrides()));
+  testWidgets('multiple top-level messages in one DM render one row', (
+    tester,
+  ) async {
+    final dmChannel = Channel(
+      id: 'dm1',
+      name: 'dm',
+      channelType: 'dm',
+      visibility: 'private',
+      description: '',
+      createdBy: 'x',
+      createdAt: DateTime(2025),
+      memberCount: 2,
+      isMember: true,
+      participants: const ['Alice'],
+    );
+    FeedItem dmMessage(String id, int age) => FeedItem(
+      id: id,
+      kind: 9,
+      pubkey: 'alice_pk',
+      content: 'dm body $id',
+      createdAt: now - age,
+      channelId: 'dm1',
+      channelName: '',
+      tags: const [],
+      category: 'activity',
+    );
+
+    await tester.pumpWidget(
+      await buildTestable(
+        feed: HomeFeedResponse(
+          mentions: const [],
+          needsAction: const [],
+          activity: [dmMessage('dm-a', 300), dmMessage('dm-b', 200)],
+          agentActivity: const [],
+        ),
+        channels: [...testChannels, dmChannel],
+      ),
+    );
     await tester.pumpAndSettle();
 
-    expect(find.text('All'), findsOneWidget);
-    expect(find.text('Mentions (1)'), findsOneWidget);
-    expect(find.text('Action (0)'), findsOneWidget);
-    expect(find.text('Activity (1)'), findsOneWidget);
-    expect(find.text('Agents (1)'), findsOneWidget);
+    // One conversation row for the DM, represented by the latest message.
+    expect(find.byKey(const ValueKey('inbox-row-dm-b')), findsOneWidget);
+    expect(find.byKey(const ValueKey('inbox-row-dm-a')), findsNothing);
+    expect(find.textContaining('dm body dm-b'), findsOneWidget);
+    expect(find.textContaining('dm body dm-a'), findsNothing);
   });
 
-  testWidgets('filtering shows only matching items', (tester) async {
-    await tester.pumpWidget(buildTestable(overrides: defaultOverrides()));
+  testWidgets('unread rows show a dot; read rows do not', (tester) async {
+    await tester.pumpWidget(
+      await buildTestable(
+        // ch1 fully read; ch2 (thread) unread.
+        readContexts: {'ch1': now},
+      ),
+    );
     await tester.pumpAndSettle();
 
-    // Tap the Mentions filter.
-    await tester.tap(find.text('Mentions (1)'));
+    expect(find.byKey(const ValueKey('inbox-unread-dot-m1')), findsNothing);
+    expect(find.byKey(const ValueKey('inbox-unread-dot-ag1')), findsNothing);
+    expect(find.byKey(const ValueKey('inbox-unread-dot-a1')), findsOneWidget);
+  });
+
+  testWidgets('New boundary separates unread rows from read rows', (
+    tester,
+  ) async {
+    await tester.pumpWidget(
+      await buildTestable(
+        // Mention (2m ago) and agent (1m ago) unread; thread (1h ago) read.
+        readContexts: {'thread:root1': now, 'ch2': now},
+      ),
+    );
     await tester.pumpAndSettle();
 
-    expect(find.text('Hey check this out'), findsOneWidget);
-    expect(find.text('Deployed the fix'), findsNothing);
-    expect(find.text('Job completed successfully'), findsNothing);
+    expect(find.text('New'), findsOneWidget);
   });
 
-  testWidgets('empty filter shows per-filter empty state', (tester) async {
-    await tester.pumpWidget(buildTestable(overrides: defaultOverrides()));
+  testWidgets('filter menu switches sources and shows empty states', (
+    tester,
+  ) async {
+    await tester.pumpWidget(await buildTestable());
+    await tester.pumpAndSettle();
+
+    await tester.tap(find.byKey(const ValueKey('activity-filter-menu')));
     await tester.pumpAndSettle();
+    await tester.tap(find.text('Mentions'));
+    await tester.pumpAndSettle();
+
+    expect(find.textContaining('Hey check this out'), findsOneWidget);
+    expect(find.textContaining('Deployed the fix'), findsNothing);
+    expect(find.textContaining('Job completed successfully'), findsNothing);
 
-    // Tap Action filter (has 0 items).
-    await tester.tap(find.text('Action (0)'));
+    await tester.tap(find.byKey(const ValueKey('activity-filter-menu')));
+    await tester.pumpAndSettle();
+    await tester.tap(find.text('Needs Action'));
     await tester.pumpAndSettle();
 
     expect(find.text('Nothing needs your action'), findsOneWidget);
   });
 
-  testWidgets('shows headline for known event kinds', (tester) async {
-    await tester.pumpWidget(buildTestable(overrides: defaultOverrides()));
+  testWidgets('filter menu supports accessibility text scaling', (
+    tester,
+  ) async {
+    await tester.pumpWidget(
+      await buildTestable(textScaler: const TextScaler.linear(3)),
+    );
+    await tester.pumpAndSettle();
+
+    await tester.tap(find.byKey(const ValueKey('activity-filter-menu')));
     await tester.pumpAndSettle();
 
-    // testAgent has kind 43004 -> "Job result"
-    expect(find.text('Job result'), findsOneWidget);
-    // testMention has kind 9, category mention -> "Mention"
-    expect(find.text('Mention'), findsOneWidget);
-    // testActivity has kind 9, category activity -> "Channel update"
-    expect(find.text('Channel update'), findsOneWidget);
+    expect(
+      find.byKey(const ValueKey('activity-filter-popover')),
+      findsOneWidget,
+    );
+    expect(tester.takeException(), isNull);
   });
 
-  testWidgets('falls back to short pubkey when user not cached', (
+  testWidgets('opens a thread mention at the referenced message', (
+    tester,
+  ) async {
+    final threadMention = FeedItem(
+      id: 'reply-event',
+      kind: 9,
+      pubkey: 'alice_pk',
+      content: 'Reply in a thread',
+      createdAt: DateTime.now().millisecondsSinceEpoch ~/ 1000,
+      channelId: 'ch1',
+      channelName: 'general',
+      tags: const [
+        ['e', 'thread-root', '', 'root'],
+        ['e', 'parent-reply', '', 'reply'],
+      ],
+      category: 'mention',
+    );
+    final feed = HomeFeedResponse(
+      mentions: [threadMention],
+      needsAction: const [],
+      activity: const [],
+      agentActivity: const [],
+    );
+
+    await tester.pumpWidget(await buildTestable(feed: feed));
+    await tester.pumpAndSettle();
+
+    await tester.tap(find.byKey(const ValueKey('inbox-row-reply-event')));
+    await tester.pumpAndSettle();
+
+    final page = tester.widget<ChannelDetailPage>(
+      find.byType(ChannelDetailPage),
+    );
+    expect(page.channel.id, 'ch1');
+    expect(page.initialThreadRootId, 'parent-reply');
+    expect(page.initialMessageId, 'reply-event');
+  });
+
+  testWidgets('thread filter matches grouped thread replies', (tester) async {
+    await tester.pumpWidget(await buildTestable());
+    await tester.pumpAndSettle();
+
+    await tester.tap(find.byKey(const ValueKey('activity-filter-menu')));
+    await tester.pumpAndSettle();
+    await tester.tap(find.text('Threads'));
+    await tester.pumpAndSettle();
+
+    expect(find.textContaining('Deployed the fix'), findsOneWidget);
+    expect(find.textContaining('Hey check this out'), findsNothing);
+  });
+
+  testWidgets('reminders filter shows the reminders empty surface', (
     tester,
   ) async {
+    await tester.pumpWidget(await buildTestable());
+    await tester.pumpAndSettle();
+
+    await tester.tap(find.byKey(const ValueKey('activity-filter-menu')));
+    await tester.pumpAndSettle();
+    await tester.tap(find.text('Reminders'));
+    await tester.pumpAndSettle();
+
+    expect(find.text('No reminders'), findsOneWidget);
+  });
+
+  testWidgets('drafts filter shows the drafts empty surface', (tester) async {
+    await tester.pumpWidget(await buildTestable());
+    await tester.pumpAndSettle();
+
+    await tester.tap(find.byKey(const ValueKey('activity-filter-menu')));
+    await tester.pumpAndSettle();
+    await tester.tap(find.text('Drafts'));
+    await tester.pumpAndSettle();
+
+    expect(find.text('No drafts'), findsOneWidget);
+  });
+
+  testWidgets('unread-only toggle hides read rows', (tester) async {
+    await tester.pumpWidget(await buildTestable(readContexts: {'ch1': now}));
+    await tester.pumpAndSettle();
+
+    await tester.tap(find.byKey(const ValueKey('activity-options-menu')));
+    await tester.pumpAndSettle();
+    await tester.tap(find.text('Show unread'));
+    await tester.pumpAndSettle();
+
+    // Only the unread thread row remains.
+    expect(find.textContaining('Deployed the fix'), findsOneWidget);
+    expect(find.textContaining('Hey check this out'), findsNothing);
+    expect(find.textContaining('Job completed successfully'), findsNothing);
+  });
+
+  testWidgets('long-press mark unread reopens a read row', (tester) async {
     await tester.pumpWidget(
-      buildTestable(
-        overrides: [
-          activityProvider.overrideWith(() => _FakeActivityNotifier(testFeed)),
-          channelsProvider.overrideWith(
-            () => _FakeChannelsNotifier(testChannels),
-          ),
-          // Empty user cache - no profiles resolved.
-          userCacheProvider.overrideWith(
-            () => _FakeUserCacheNotifier(emptyUsers),
-          ),
-        ],
+      await buildTestable(
+        readContexts: {'ch1': now, 'ch2': now, 'thread:root1': now},
       ),
     );
     await tester.pumpAndSettle();
 
-    // Should show truncated pubkey instead of display name.
-    expect(find.text('alice_pk...'), findsOneWidget);
-    expect(find.text('Alice'), findsNothing);
+    expect(find.byKey(const ValueKey('inbox-unread-dot-m1')), findsNothing);
+
+    await tester.longPress(find.byKey(const ValueKey('inbox-row-m1')));
+    await tester.pumpAndSettle();
+    await tester.tap(find.text('Mark unread'));
+    await tester.pumpAndSettle();
+
+    expect(find.byKey(const ValueKey('inbox-unread-dot-m1')), findsOneWidget);
   });
 
-  testWidgets('timestamps are right-aligned consistently', (tester) async {
-    await tester.pumpWidget(buildTestable(overrides: defaultOverrides()));
+  testWidgets('falls back to short pubkey when user not cached', (
+    tester,
+  ) async {
+    await tester.pumpWidget(await buildTestable(users: const {}));
     await tester.pumpAndSettle();
 
-    // Find all time labels - they should show relative times.
-    // testMention: 120s ago -> "2m"
-    expect(find.text('2m'), findsOneWidget);
-    // testActivity: 3600s ago -> "1h"
-    expect(find.text('1h'), findsOneWidget);
-    // testAgent: 60s ago -> "1m"
-    expect(find.text('1m'), findsOneWidget);
+    // Sender label falls back to the (short) pubkey.
+    expect(find.text('alice_pk'), findsOneWidget);
+    expect(find.text('Alice'), findsNothing);
   });
 }
 
@@ -301,3 +634,33 @@ class _FakeUserCacheNotifier extends UserCacheNotifier {
   @override
   Map<String, UserProfile> build() => _users;
 }
+
+class _FakeReadStateNotifier extends ReadStateNotifier {
+  final Map<String, int> _contexts;
+  _FakeReadStateNotifier(this._contexts);
+
+  @override
+  ReadStateState build() => ReadStateState(
+    isReady: true,
+    pubkey: 'me_pk',
+    contexts: Map.unmodifiable(_contexts),
+    version: 1,
+  );
+
+  @override
+  void markContextRead(
+    String contextId,
+    int unixTimestamp, {
+    bool clearForcedMessages = false,
+  }) {
+    state = state.copyWithContext(contextId, unixTimestamp);
+  }
+}
+
+class _FakeRemindersNotifier extends RemindersNotifier {
+  final List<Reminder> _reminders;
+  _FakeRemindersNotifier(this._reminders);
+
+  @override
+  Future<List<Reminder>> build() async => _reminders;
+}
diff --git a/mobile/test/features/activity/activity_provider_test.dart b/mobile/test/features/activity/activity_provider_test.dart
new file mode 100644
index 00000000000..0d927df8601
--- /dev/null
+++ b/mobile/test/features/activity/activity_provider_test.dart
@@ -0,0 +1,108 @@
+import 'dart:async';
+
+import 'package:buzz/features/activity/activity_provider.dart';
+import 'package:buzz/features/channels/channel.dart';
+import 'package:buzz/features/channels/channels_provider.dart';
+import 'package:buzz/shared/relay/relay.dart';
+import 'package:flutter_test/flutter_test.dart';
+import 'package:hooks_riverpod/hooks_riverpod.dart';
+
+/// Records every DM history query (`#h` filter) so tests can assert whether
+/// the DM source was fetched. All queries resolve to empty lists.
+class _RecordingSessionNotifier extends RelaySessionNotifier {
+  final List<List<String>> dmQueries = [];
+
+  @override
+  SessionState build() => const SessionState(status: SessionStatus.connected);
+
+  @override
+  Future<List<NostrEvent>> fetchHistory(
+    NostrFilter filter, {
+    Duration timeout = const Duration(seconds: 8),
+  }) async {
+    final h = filter.tags['#h'];
+    if (h != null) dmQueries.add(h);
+    return const [];
+  }
+}
+
+/// Channels provider that starts loading and resolves on demand, modelling a
+/// cold start where the channel list arrives after Activity's first fetch.
+class _LateChannelsNotifier extends ChannelsNotifier {
+  final Completer<List<Channel>> _completer = Completer<List<Channel>>();
+
+  @override
+  Future<List<Channel>> build() => _completer.future;
+
+  void resolve(List<Channel> channels) => _completer.complete(channels);
+}
+
+class _FixedRelayConfigNotifier extends RelayConfigNotifier {
+  @override
+  RelayConfig build() =>
+      const RelayConfig(baseUrl: 'https://relay.example', nsec: null);
+}
+
+Channel _dmChannel(String id) => Channel(
+  id: id,
+  name: 'dm',
+  channelType: 'dm',
+  visibility: 'private',
+  description: '',
+  createdBy: 'x',
+  createdAt: DateTime(2025),
+  memberCount: 2,
+  isMember: true,
+);
+
+void main() {
+  TestWidgetsFlutterBinding.ensureInitialized();
+
+  test('refetches and includes DMs when channels resolve after first '
+      'fetch (cold start)', () async {
+    final session = _RecordingSessionNotifier();
+    final channels = _LateChannelsNotifier();
+    final container = ProviderContainer(
+      overrides: [
+        relayConfigProvider.overrideWith(_FixedRelayConfigNotifier.new),
+        myPubkeyProvider.overrideWithValue('me_pk'),
+        relaySessionProvider.overrideWith(() => session),
+        channelsProvider.overrideWith(() => channels),
+      ],
+    );
+    addTearDown(container.dispose);
+
+    // Cold start: channels still loading, so the first fetch has no DM ids.
+    await container.read(activityProvider.future);
+    expect(session.dmQueries, isEmpty);
+
+    // Channel list resolves with a DM → Activity must rebuild and query it.
+    channels.resolve([_dmChannel('dm1')]);
+    await container.read(channelsProvider.future);
+    await container.read(activityProvider.future);
+
+    expect(session.dmQueries, hasLength(1));
+    expect(session.dmQueries.single, ['dm1']);
+  });
+
+  test('does not query DMs when the resolved channel list has none', () async {
+    final session = _RecordingSessionNotifier();
+    final channels = _LateChannelsNotifier();
+    final container = ProviderContainer(
+      overrides: [
+        relayConfigProvider.overrideWith(_FixedRelayConfigNotifier.new),
+        myPubkeyProvider.overrideWithValue('me_pk'),
+        relaySessionProvider.overrideWith(() => session),
+        channelsProvider.overrideWith(() => channels),
+      ],
+    );
+    addTearDown(container.dispose);
+
+    await container.read(activityProvider.future);
+    channels.resolve(const []);
+    await container.read(channelsProvider.future);
+    await container.read(activityProvider.future);
+
+    expect(session.dmQueries, isEmpty);
+  });
+}
diff --git a/mobile/test/features/activity/compose_drafts_provider_test.dart b/mobile/test/features/activity/compose_drafts_provider_test.dart
new file mode 100644
index 00000000000..1f93dcb674e
--- /dev/null
+++ b/mobile/test/features/activity/compose_drafts_provider_test.dart
@@ -0,0 +1,190 @@
+import 'package:buzz/features/activity/compose_drafts_provider.dart';
+import 'package:buzz/shared/relay/relay.dart';
+import 'package:buzz/shared/theme/theme_provider.dart';
+import 'package:flutter_test/flutter_test.dart';
+import 'package:hooks_riverpod/hooks_riverpod.dart';
+import 'package:shared_preferences/shared_preferences.dart';
+
+class _FixedRelayConfigNotifier extends RelayConfigNotifier {
+  final RelayConfig _config;
+  _FixedRelayConfigNotifier(this._config);
+
+  @override
+  RelayConfig build() => _config;
+}
+
+void main() {
+  TestWidgetsFlutterBinding.ensureInitialized();
+
+  Future<ProviderContainer> containerWithPrefs({
+    String relayUrl = 'https://relay-a.example',
+    String? pubkey = 'pk_a',
+  }) async {
+    final prefs = await SharedPreferences.getInstance();
+    final container = ProviderContainer(
+      overrides: [
+        savedPrefsProvider.overrideWithValue(prefs),
+        relayConfigProvider.overrideWith(
+          () => _FixedRelayConfigNotifier(RelayConfig(baseUrl: relayUrl)),
+        ),
+        myPubkeyProvider.overrideWithValue(pubkey),
+      ],
+    );
+    addTearDown(container.dispose);
+    return container;
+  }
+
+  test('composeDraftKey separates channel and thread composers', () {
+    expect(composeDraftKey('ch1'), 'ch1');
+    expect(composeDraftKey('ch1', threadHeadId: 't1'), 'ch1:t1');
+  });
+
+  test('save adds a draft and textFor returns it', () async {
+    SharedPreferences.setMockInitialValues({});
+    final container = await containerWithPrefs();
+    final notifier = container.read(composeDraftsProvider.notifier);
+
+    notifier.save(key: 'ch1', channelId: 'ch1', text: 'hello there');
+
+    final drafts = container.read(composeDraftsProvider);
+    expect(drafts, hasLength(1));
+    expect(drafts.single.text, 'hello there');
+    expect(notifier.textFor('ch1'), 'hello there');
+  });
+
+  test('empty text removes the draft', () async {
+    SharedPreferences.setMockInitialValues({});
+    final container = await containerWithPrefs();
+    final notifier = container.read(composeDraftsProvider.notifier);
+
+    notifier.save(key: 'ch1', channelId: 'ch1', text: 'hello');
+    notifier.save(key: 'ch1', channelId: 'ch1', text: '   ');
+
+    expect(container.read(composeDraftsProvider), isEmpty);
+  });
+
+  test('drafts persist across container restarts', () async {
+    SharedPreferences.setMockInitialValues({});
+    final first = await containerWithPrefs();
+    first
+        .read(composeDraftsProvider.notifier)
+        .save(key: 'ch1:t1', channelId: 'ch1', threadHeadId: 't1', text: 'wip');
+
+    final second = await containerWithPrefs();
+    final restored = second.read(composeDraftsProvider);
+    expect(restored, hasLength(1));
+    expect(restored.single.channelId, 'ch1');
+    expect(restored.single.threadHeadId, 't1');
+    expect(restored.single.text, 'wip');
+  });
+
+  test('remove deletes by key', () async {
+    SharedPreferences.setMockInitialValues({});
+    final container = await containerWithPrefs();
+    final notifier = container.read(composeDraftsProvider.notifier);
+
+    notifier.save(key: 'ch1', channelId: 'ch1', text: 'hello');
+    notifier.remove('ch1');
+
+    expect(container.read(composeDraftsProvider), isEmpty);
+  });
+
+  test('malformed persisted json is ignored', () async {
+    SharedPreferences.setMockInitialValues({
+      'compose_drafts_v1:https://relay-a.example:pk_a': '{not valid',
+    });
+    final container = await containerWithPrefs();
+    expect(container.read(composeDraftsProvider), isEmpty);
+  });
+
+  test('drafts are isolated per community', () async {
+    SharedPreferences.setMockInitialValues({});
+    final communityA = await containerWithPrefs(
+      relayUrl: 'https://relay-a.example',
+    );
+    communityA
+        .read(composeDraftsProvider.notifier)
+        .save(key: 'ch1', channelId: 'ch1', text: 'secret from A');
+
+    // Same channel id in another community must not see A's draft.
+    final communityB = await containerWithPrefs(
+      relayUrl: 'https://relay-b.example',
+    );
+    expect(communityB.read(composeDraftsProvider), isEmpty);
+    expect(
+      communityB.read(composeDraftsProvider.notifier).textFor('ch1'),
+      isNull,
+    );
+
+    // A's own store is untouched.
+    final communityAAgain = await containerWithPrefs(
+      relayUrl: 'https://relay-a.example',
+    );
+    expect(
+      communityAAgain.read(composeDraftsProvider.notifier).textFor('ch1'),
+      'secret from A',
+    );
+  });
+
+  test('drafts are isolated per account pubkey', () async {
+    SharedPreferences.setMockInitialValues({});
+    final accountA = await containerWithPrefs(pubkey: 'pk_a');
+    accountA
+        .read(composeDraftsProvider.notifier)
+        .save(key: 'ch1', channelId: 'ch1', text: 'account A draft');
+
+    // Same relay, different account: a colliding channel id must not
+    // restore the other account's draft.
+    final accountB = await containerWithPrefs(pubkey: 'pk_b');
+    expect(accountB.read(composeDraftsProvider), isEmpty);
+    expect(
+      accountB.read(composeDraftsProvider.notifier).textFor('ch1'),
+      isNull,
+    );
+  });
+
+  test('in-place identity change rebuilds onto the new store', () async {
+    SharedPreferences.setMockInitialValues({});
+    final prefs = await SharedPreferences.getInstance();
+    final container = ProviderContainer(
+      overrides: [
+        savedPrefsProvider.overrideWithValue(prefs),
+        // Real derivation path: myPubkeyProvider derives from the config's
+        // nsec, so an in-place config change simulates an account/community
+        // switch without restarting the container.
+        relayConfigProvider.overrideWith(
+          () => _FixedRelayConfigNotifier(
+            const RelayConfig(baseUrl: 'https://relay-a.example'),
+          ),
+        ),
+      ],
+    );
+    addTearDown(container.dispose);
+
+    // Seed a draft for the initial identity (nsec-less config → 'anon').
+    container
+        .read(composeDraftsProvider.notifier)
+        .save(key: 'ch1', channelId: 'ch1', text: 'first identity draft');
+    expect(container.read(composeDraftsProvider), hasLength(1));
+
+    // Switch community in place: the drafts provider must rebuild against
+    // the new identity's (empty) store, not keep the old state.
+    container
+        .read(relayConfigProvider.notifier)
+        .update(baseUrl: 'https://relay-b.example');
+    expect(container.read(composeDraftsProvider), isEmpty);
+    expect(
+      container.read(composeDraftsProvider.notifier).textFor('ch1'),
+      isNull,
+    );
+
+    // Switching back restores the original identity's draft.
+    container
+        .read(relayConfigProvider.notifier)
+        .update(baseUrl: 'https://relay-a.example');
+    expect(
+      container.read(composeDraftsProvider.notifier).textFor('ch1'),
+      'first identity draft',
+    );
+  });
+}
diff --git a/mobile/test/features/activity/feed_item_test.dart b/mobile/test/features/activity/feed_item_test.dart
index db295205014..f655bf316aa 100644
--- a/mobile/test/features/activity/feed_item_test.dart
+++ b/mobile/test/features/activity/feed_item_test.dart
@@ -50,6 +50,48 @@ void main() {
     });
   });
 
+  group('FeedItem.threadHeadId', () {
+    FeedItem makeItem(List<List<String>> tags) => FeedItem(
+      id: 'reply',
+      kind: 9,
+      pubkey: 'pk',
+      content: '',
+      createdAt: 0,
+      channelId: 'channel',
+      channelName: '',
+      tags: tags,
+      category: 'mention',
+    );
+
+    test('uses the reply marker for a direct thread reply', () {
+      expect(
+        makeItem(const [
+          ['e', 'root', '', 'reply'],
+        ]).threadHeadId,
+        'root',
+      );
+    });
+
+    test('uses the direct parent marker for a nested thread reply', () {
+      expect(
+        makeItem(const [
+          ['e', 'root', '', 'root'],
+          ['e', 'parent', '', 'reply'],
+        ]).threadHeadId,
+        'parent',
+      );
+    });
+
+    test('does not treat unrelated event references as threads', () {
+      expect(
+        makeItem(const [
+          ['e', 'linked-event'],
+        ]).threadHeadId,
+        isNull,
+      );
+    });
+  });
+
   group('FeedItem.headline', () {
     FeedItem makeItem({required int kind, String category = 'activity'}) =>
         FeedItem(
diff --git a/mobile/test/features/activity/inbox_item_test.dart b/mobile/test/features/activity/inbox_item_test.dart
new file mode 100644
index 00000000000..379e85dfc52
--- /dev/null
+++ b/mobile/test/features/activity/inbox_item_test.dart
@@ -0,0 +1,285 @@
+import 'package:buzz/features/activity/feed_item.dart';
+import 'package:buzz/features/activity/inbox_item.dart';
+import 'package:flutter_test/flutter_test.dart';
+
+FeedItem item({
+  required String id,
+  int createdAt = 100,
+  String category = 'mention',
+  String pubkey = 'pk1',
+  String? channelId = 'ch1',
+  List<List<String>> tags = const [],
+  int kind = 9,
+  String content = 'hello',
+}) => FeedItem(
+  id: id,
+  kind: kind,
+  pubkey: pubkey,
+  content: content,
+  createdAt: createdAt,
+  channelId: channelId,
+  channelName: '',
+  tags: tags,
+  category: category,
+);
+
+List<List<String>> replyTags(String rootId, String parentId) => [
+  ['e', rootId, '', 'root'],
+  ['e', parentId, '', 'reply'],
+];
+
+void main() {
+  group('inboxConversationId', () {
+    test('uses root id when present', () {
+      expect(
+        inboxConversationId(replyTags('root1', 'parent1'), 'ev1'),
+        'root1',
+      );
+    });
+
+    test('falls back to parent id without a root tag', () {
+      expect(
+        inboxConversationId([
+          ['e', 'parent1', '', 'reply'],
+        ], 'ev1'),
+        'parent1',
+      );
+    });
+
+    test('falls back to the event id for top-level messages', () {
+      expect(inboxConversationId(const [], 'ev1'), 'ev1');
+    });
+  });
+
+  group('isThreadReply', () {
+    test('true for reply-tagged events', () {
+      expect(isThreadReply(replyTags('r', 'p')), isTrue);
+    });
+
+    test('false for broadcast replies', () {
+      expect(
+        isThreadReply([
+          ...replyTags('r', 'p'),
+          ['broadcast', '1'],
+        ]),
+        isFalse,
+      );
+    });
+
+    test('false for top-level messages', () {
+      expect(isThreadReply(const []), isFalse);
+    });
+  });
+
+  group('buildInboxItems', () {
+    test('groups thread events into one conversation row', () {
+      final rows = buildInboxItems([
+        item(id: 'a', createdAt: 10, tags: replyTags('root1', 'root1')),
+        item(id: 'b', createdAt: 20, tags: replyTags('root1', 'a')),
+        item(id: 'c', createdAt: 15),
+      ]);
+
+      expect(rows, hasLength(2));
+      final threadRow = rows.firstWhere((r) => r.conversationId == 'root1');
+      expect(threadRow.id, 'b'); // latest event represents the row
+      expect(threadRow.groupItems, hasLength(2));
+      expect(threadRow.latestActivityAt, 20);
+      expect(threadRow.threadRootId, 'root1');
+    });
+
+    test('sorts rows by latest activity, newest first', () {
+      final rows = buildInboxItems([
+        item(id: 'old', createdAt: 10),
+        item(id: 'new', createdAt: 99),
+      ]);
+      expect(rows.map((r) => r.id).toList(), ['new', 'old']);
+    });
+
+    test('groups ordinary top-level DM messages into one row per DM', () {
+      bool isDm(String channelId) => channelId == 'dm1';
+      final rows = buildInboxItems([
+        // Three top-level messages (no thread tags) in the same DM.
+        item(id: 'd1', createdAt: 10, channelId: 'dm1', category: 'activity'),
+        item(id: 'd2', createdAt: 20, channelId: 'dm1', category: 'activity'),
+        item(id: 'd3', createdAt: 30, channelId: 'dm1', category: 'activity'),
+        // Ordinary top-level channel posts still group per event.
+        item(id: 'c1', createdAt: 40, channelId: 'ch1'),
+        item(id: 'c2', createdAt: 50, channelId: 'ch1'),
+      ], isDmChannel: isDm);
+
+      expect(rows, hasLength(3));
+      final dmRow = rows.singleWhere((r) => r.conversationId == 'dm:dm1');
+      expect(dmRow.groupItems, hasLength(3));
+      expect(dmRow.id, 'd3'); // latest DM message represents the row
+      expect(dmRow.latestActivityAt, 30);
+    });
+
+    test('thread replies inside a DM still group by thread root', () {
+      bool isDm(String channelId) => channelId == 'dm1';
+      final rows = buildInboxItems([
+        item(id: 'top', createdAt: 10, channelId: 'dm1'),
+        item(
+          id: 'reply',
+          createdAt: 20,
+          channelId: 'dm1',
+          tags: replyTags('top', 'top'),
+        ),
+      ], isDmChannel: isDm);
+
+      expect(rows, hasLength(2));
+      expect(rows.map((r) => r.conversationId).toSet(), {'dm:dm1', 'top'});
+    });
+
+    test('categories are priority sorted and set isActionRequired', () {
+      final rows = buildInboxItems([
+        item(
+          id: 'a',
+          createdAt: 10,
+          category: 'activity',
+          tags: replyTags('root1', 'root1'),
+        ),
+        item(
+          id: 'b',
+          createdAt: 20,
+          category: 'needs_action',
+          tags: replyTags('root1', 'a'),
+        ),
+      ]);
+      expect(rows.single.categories.first, 'needs_action');
+      expect(rows.single.isActionRequired, isTrue);
+    });
+  });
+
+  group('InboxItem.deepLinkTarget', () {
+    final rows = buildInboxItems([
+      item(id: 'a', createdAt: 10, tags: replyTags('root1', 'root1')),
+      item(id: 'b', createdAt: 20, tags: replyTags('root1', 'a')),
+      item(id: 'c', createdAt: 30, tags: replyTags('root1', 'b')),
+    ]);
+
+    test('targets the oldest unread event', () {
+      expect(rows.single.deepLinkTarget(15).id, 'b');
+    });
+
+    test('targets the oldest event when nothing is read', () {
+      expect(rows.single.deepLinkTarget(5).id, 'a');
+    });
+
+    test('falls back to the latest event when all are read', () {
+      expect(rows.single.deepLinkTarget(99).id, 'c');
+    });
+
+    test('falls back to the latest event without a read marker', () {
+      expect(rows.single.deepLinkTarget(null).id, 'c');
+    });
+  });
+
+  group('matchesInboxFilter', () {
+    InboxItem rowOf(FeedItem feedItem) => buildInboxItems([feedItem]).single;
+
+    test('all matches everything', () {
+      expect(matchesInboxFilter(rowOf(item(id: 'a')), InboxFilter.all), isTrue);
+    });
+
+    test('thread filter needs a thread reply in the group', () {
+      expect(
+        matchesInboxFilter(rowOf(item(id: 'a')), InboxFilter.thread),
+        isFalse,
+      );
+      expect(
+        matchesInboxFilter(
+          rowOf(item(id: 'a', tags: replyTags('r', 'p'))),
+          InboxFilter.thread,
+        ),
+        isTrue,
+      );
+    });
+
+    test('category filters match their category', () {
+      final mention = rowOf(item(id: 'a', category: 'mention'));
+      expect(matchesInboxFilter(mention, InboxFilter.mention), isTrue);
+      expect(matchesInboxFilter(mention, InboxFilter.needsAction), isFalse);
+      expect(matchesInboxFilter(mention, InboxFilter.activity), isFalse);
+      expect(
+        matchesInboxFilter(
+          rowOf(item(id: 'b', category: 'agent_activity')),
+          InboxFilter.agentActivity,
+        ),
+        isTrue,
+      );
+    });
+
+    test('reminders and drafts are separate surfaces', () {
+      final row = rowOf(item(id: 'a'));
+      expect(matchesInboxFilter(row, InboxFilter.reminders), isFalse);
+      expect(matchesInboxFilter(row, InboxFilter.drafts), isFalse);
+    });
+  });
+
+  group('inboxTypeLabel', () {
+    InboxItem rowOf(FeedItem feedItem) => buildInboxItems([feedItem]).single;
+
+    test('DM rows lead with the sender', () {
+      final label = inboxTypeLabel(
+        rowOf(item(id: 'a', category: 'activity')),
+        channelName: null,
+        isDm: true,
+        senderLabel: 'Alice',
+      );
+      expect(label.text, 'DM from Alice');
+      expect(label.channelLabel, isNull);
+    });
+
+    test('mention rows say Mentioned in #channel', () {
+      final label = inboxTypeLabel(
+        rowOf(item(id: 'a', category: 'mention')),
+        channelName: 'general',
+        isDm: false,
+        senderLabel: 'Alice',
+      );
+      expect(label.text, 'Mentioned in');
+      expect(label.channelLabel, 'general');
+    });
+
+    test('needs action wins over thread context', () {
+      final label = inboxTypeLabel(
+        rowOf(
+          item(id: 'a', category: 'needs_action', tags: replyTags('r', 'p')),
+        ),
+        channelName: 'general',
+        isDm: false,
+        senderLabel: 'Alice',
+      );
+      expect(label.text, 'Needs action in');
+    });
+
+    test('plain thread replies say Thread in', () {
+      final label = inboxTypeLabel(
+        rowOf(item(id: 'a', category: 'activity', tags: replyTags('r', 'p'))),
+        channelName: 'general',
+        isDm: false,
+        senderLabel: 'Alice',
+      );
+      expect(label.text, 'Thread in');
+    });
+  });
+
+  group('inboxDayLabel', () {
+    final now = DateTime(2026, 7, 25, 12);
+    int at(DateTime d) => d.millisecondsSinceEpoch ~/ 1000;
+
+    test('today / yesterday / weekday / date buckets', () {
+      expect(inboxDayLabel(at(DateTime(2026, 7, 25, 9)), now: now), 'Today');
+      expect(
+        inboxDayLabel(at(DateTime(2026, 7, 24, 9)), now: now),
+        'Yesterday',
+      );
+      expect(inboxDayLabel(at(DateTime(2026, 7, 21, 9)), now: now), 'Tuesday');
+      expect(inboxDayLabel(at(DateTime(2026, 1, 2)), now: now), 'Jan 2');
+      expect(
+        inboxDayLabel(at(DateTime(2025, 12, 31)), now: now),
+        'Dec 31, 2025',
+      );
+    });
+  });
+}
diff --git a/mobile/test/features/activity/inbox_read_state_test.dart b/mobile/test/features/activity/inbox_read_state_test.dart
new file mode 100644
index 00000000000..af8f3b90912
--- /dev/null
+++ b/mobile/test/features/activity/inbox_read_state_test.dart
@@ -0,0 +1,138 @@
+import 'package:buzz/features/activity/feed_item.dart';
+import 'package:buzz/features/activity/inbox_item.dart';
+import 'package:buzz/features/activity/inbox_read_state.dart';
+import 'package:flutter_test/flutter_test.dart';
+
+FeedItem item({
+  required String id,
+  int createdAt = 100,
+  String category = 'mention',
+  String? channelId = 'ch1',
+  List<List<String>> tags = const [],
+}) => FeedItem(
+  id: id,
+  kind: 9,
+  pubkey: 'pk1',
+  content: 'hello',
+  createdAt: createdAt,
+  channelId: channelId,
+  channelName: '',
+  tags: tags,
+  category: category,
+);
+
+List<List<String>> replyTags(String rootId, String parentId) => [
+  ['e', rootId, '', 'root'],
+  ['e', parentId, '', 'reply'],
+];
+
+int? Function(String) markers(Map<String, int> map) =>
+    (contextId) => map[contextId];
+
+void main() {
+  group('resolveInboxItemReadAt', () {
+    test('channel rows use the channel marker', () {
+      final row = buildInboxItems([item(id: 'a')]).single;
+      expect(resolveInboxItemReadAt(row, markerOf: markers({'ch1': 42})), 42);
+    });
+
+    test('thread rows use max of thread and msg markers', () {
+      final row = buildInboxItems([
+        item(id: 'a', tags: replyTags('root1', 'root1')),
+      ]).single;
+      expect(
+        resolveInboxItemReadAt(
+          row,
+          markerOf: markers({'thread:root1': 10, 'msg:a': 25}),
+        ),
+        25,
+      );
+    });
+
+    test('channel-less rows have no marker', () {
+      final row = buildInboxItems([item(id: 'a', channelId: null)]).single;
+      expect(resolveInboxItemReadAt(row, markerOf: markers({})), isNull);
+    });
+  });
+
+  group('isInboxItemDone', () {
+    test('done when no grouped activity is newer than the marker', () {
+      final row = buildInboxItems([item(id: 'a', createdAt: 50)]).single;
+      expect(
+        isInboxItemDone(
+          row,
+          markerOf: markers({'ch1': 50}),
+          localUnreadOverrides: const {},
+          localDoneSet: const {},
+        ),
+        isTrue,
+      );
+      expect(
+        isInboxItemDone(
+          row,
+          markerOf: markers({'ch1': 49}),
+          localUnreadOverrides: const {},
+          localDoneSet: const {},
+        ),
+        isFalse,
+      );
+    });
+
+    test('a local unread override always wins', () {
+      final row = buildInboxItems([item(id: 'a', createdAt: 50)]).single;
+      expect(
+        isInboxItemDone(
+          row,
+          markerOf: markers({'ch1': 99}),
+          localUnreadOverrides: const {'a'},
+          localDoneSet: const {},
+        ),
+        isFalse,
+      );
+    });
+
+    test('channel-less rows fall back to the local done set', () {
+      final row = buildInboxItems([item(id: 'a', channelId: null)]).single;
+      expect(
+        isInboxItemDone(
+          row,
+          markerOf: markers({}),
+          localUnreadOverrides: const {},
+          localDoneSet: const {},
+        ),
+        isFalse,
+      );
+      expect(
+        isInboxItemDone(
+          row,
+          markerOf: markers({}),
+          localUnreadOverrides: const {},
+          localDoneSet: const {'a'},
+        ),
+        isTrue,
+      );
+    });
+  });
+
+  group('groupedChannelReadTimestamp', () {
+    test('only counts top-level events in the channel', () {
+      final row = buildInboxItems([
+        item(id: 'a', createdAt: 10, tags: replyTags('root1', 'root1')),
+        item(id: 'b', createdAt: 30, tags: replyTags('root1', 'a')),
+      ]).single;
+      // Every grouped event is a thread reply, so marking the thread read
+      // must not advance the channel marker.
+      expect(groupedChannelReadTimestamp(row), isNull);
+    });
+
+    test('returns the newest top-level timestamp', () {
+      final row = buildInboxItems([
+        item(id: 'root1', createdAt: 10),
+        item(id: 'b', createdAt: 30, tags: replyTags('root1', 'root1')),
+      ]).single;
+      final result = groupedChannelReadTimestamp(row);
+      expect(result?.channelId, 'ch1');
+      expect(result?.timestamp, 10);
+    });
+  });
+}
diff --git a/mobile/test/features/activity/reminders_provider_test.dart b/mobile/test/features/activity/reminders_provider_test.dart
new file mode 100644
index 00000000000..f622322de06
--- /dev/null
+++ b/mobile/test/features/activity/reminders_provider_test.dart
@@ -0,0 +1,127 @@
+import 'dart:convert';
+
+import 'package:buzz/features/activity/reminders_provider.dart';
+import 'package:buzz/shared/relay/relay.dart';
+import 'package:flutter_test/flutter_test.dart';
+
+NostrEvent reminderEvent({
+  List<List<String>> tags = const [],
+  String content = 'ciphertext',
+  int createdAt = 100,
+}) => NostrEvent(
+  id: 'ev1',
+  pubkey: 'pk1',
+  createdAt: createdAt,
+  kind: kindEventReminder,
+  tags: tags,
+  content: content,
+  sig: '',
+);
+
+void main() {
+  group('parseNotBefore', () {
+    test('accepts plain unix seconds', () {
+      expect(parseNotBefore('1753400000'), 1753400000);
+      expect(parseNotBefore('0'), 0);
+    });
+
+    test('rejects malformed values', () {
+      expect(parseNotBefore('01'), isNull);
+      expect(parseNotBefore('-5'), isNull);
+      expect(parseNotBefore('12.5'), isNull);
+      expect(parseNotBefore('abc'), isNull);
+      expect(parseNotBefore(''), isNull);
+    });
+  });
+
+  group('parseReminderContent', () {
+    test('parses a well-formed reminder with target', () {
+      final parsed = parseReminderContent(
+        jsonEncode({
+          'status': 'pending',
+          'note': 'follow up',
+          'target': {
+            'eventId': 'ev1',
+            'channelId': 'ch1',
+            'preview': 'hello',
+            'authorPubkey': 'pk1',
+          },
+        }),
+      );
+      expect(parsed, isNotNull);
+      expect(parsed!.status, 'pending');
+      expect(parsed.note, 'follow up');
+      expect(parsed.target?.eventId, 'ev1');
+      expect(parsed.target?.channelId, 'ch1');
+    });
+
+    test('accepts a note-only reminder', () {
+      final parsed = parseReminderContent(
+        jsonEncode({'status': 'pending', 'note': 'water plants'}),
+      );
+      expect(parsed?.note, 'water plants');
+      expect(parsed?.target, isNull);
+    });
+
+    test('fails closed on off-shape content', () {
+      expect(parseReminderContent('not json'), isNull);
+      expect(parseReminderContent('[]'), isNull);
+      expect(parseReminderContent(jsonEncode({'status': 'snoozed'})), isNull);
+      // No target and no note is meaningless.
+      expect(parseReminderContent(jsonEncode({'status': 'pending'})), isNull);
+      // Target missing required fields.
+      expect(
+        parseReminderContent(
+          jsonEncode({
+            'status': 'pending',
+            'target': {'eventId': 'ev1'},
+          }),
+        ),
+        isNull,
+      );
+    });
+  });
+
+  group('decodeReminderEvent', () {
+    final plaintext = jsonEncode({'status': 'pending', 'note': 'hi'});
+
+    test('decodes d-tag, not_before, and decrypted content', () {
+      final reminder = decodeReminderEvent(
+        reminderEvent(
+          tags: [
+            ['d', 'rem1'],
+            ['not_before', '1753400000'],
+          ],
+        ),
+        decrypt: (_) => plaintext,
+      );
+      expect(reminder, isNotNull);
+      expect(reminder!.id, 'rem1');
+      expect(reminder.notBefore, 1753400000);
+      expect(reminder.status, 'pending');
+      expect(reminder.isDue(1753400001), isTrue);
+      expect(reminder.isDue(1753399999), isFalse);
+    });
+
+    test('requires a d tag', () {
+      expect(
+        decodeReminderEvent(reminderEvent(), decrypt: (_) => plaintext),
+        isNull,
+      );
+    });
+
+    test('fails closed when decryption throws', () {
+      expect(
+        decodeReminderEvent(
+          reminderEvent(
+            tags: [
+              ['d', 'rem1'],
+            ],
+          ),
+          decrypt: (_) => throw StateError('bad ciphertext'),
+        ),
+        isNull,
+      );
+    });
+  });
+}
diff --git a/mobile/test/features/channels/camera_capture_cleanup_test.dart b/mobile/test/features/channels/camera_capture_cleanup_test.dart
index 2b5360035de..17d96b0d5b3 100644
--- a/mobile/test/features/channels/camera_capture_cleanup_test.dart
+++ b/mobile/test/features/channels/camera_capture_cleanup_test.dart
@@ -32,4 +32,23 @@ void main() {
 
     expect(await file.exists(), isFalse);
   });
+
+  test('deletes every native picker file after processing', () async {
+    final suffix = DateTime.now().microsecondsSinceEpoch;
+    final files = [
+      File('${Directory.systemTemp.path}/buzz-photo-$suffix-1.jpg'),
+      File('${Directory.systemTemp.path}/buzz-photo-$suffix-2.jpg'),
+    ];
+    for (final file in files) {
+      await file.writeAsBytes([1, 2, 3]);
+    }
+
+    await processTemporaryImages([
+      for (final file in files) XFile(file.path),
+    ], (_) async {});
+
+    for (final file in files) {
+      expect(await file.exists(), isFalse);
+    }
+  });
 }
diff --git a/mobile/test/features/channels/channel_detail_page_test.dart b/mobile/test/features/channels/channel_detail_page_test.dart
index 7d3d7d68018..127e6851e64 100644
--- a/mobile/test/features/channels/channel_detail_page_test.dart
+++ b/mobile/test/features/channels/channel_detail_page_test.dart
@@ -2,6 +2,7 @@ import 'dart:convert';
 
 import 'package:flutter/foundation.dart';
 import 'package:flutter/material.dart';
+import 'package:flutter/rendering.dart' show ScrollDirection;
 import 'package:flutter_test/flutter_test.dart';
 import 'package:hooks_riverpod/hooks_riverpod.dart';
 import 'package:lucide_icons_flutter/lucide_icons.dart';
@@ -25,10 +26,15 @@ import 'package:buzz/features/profile/user_cache_provider.dart';
 import 'package:buzz/features/profile/user_profile.dart';
 import 'package:buzz/shared/relay/relay.dart';
 import 'package:buzz/shared/theme/theme.dart';
-import 'package:buzz/shared/widgets/frosted_app_bar.dart';
+import 'package:buzz/shared/widgets/skeleton.dart';
+import 'package:shared_preferences/shared_preferences.dart';
 
 const _channelId = 'test-channel';
 
+/// Shared mock prefs for providers that read [savedPrefsProvider]
+/// (e.g. the compose bar's draft store). Initialized in [main].
+late SharedPreferences _testPrefs;
+
 final _testChannel = Channel(
   id: _channelId,
   name: 'general',
@@ -144,8 +150,11 @@ Widget _buildTestable({
   ReadStateNotifier? readStateNotifier,
   _FakeMessagesNotifier? messagesNotifier,
   String? canvasContent,
-  List<NostrEvent>? threadReplies,
+  String? initialMessageId,
+  String? initialThreadRootId,
+  Map<String, List<NostrEvent>> threadReplies = const {},
   TextScaler textScaler = TextScaler.noScaling,
+  RelaySessionNotifier? relaySessionNotifier,
 }) {
   final resolvedChannel = channel ?? _testChannel;
   final fakeChannelsNotifier =
@@ -180,23 +189,30 @@ Widget _buildTestable({
         channelActionsProvider.overrideWith(createChannelActions),
       if (readStateNotifier != null)
         readStateProvider.overrideWith(() => readStateNotifier),
-      if (threadReplies != null)
+      for (final entry in threadReplies.entries)
         threadRepliesProvider(
-          const ThreadRepliesArgs(channelId: _channelId, rootId: 'thread-root'),
-        ).overrideWith((ref) async => threadReplies),
+          ThreadRepliesArgs(channelId: _channelId, rootId: entry.key),
+        ).overrideWith((ref) async => entry.value),
       // Stub the relay client provider so preloadMembers doesn't crash.
       relayClientProvider.overrideWithValue(
         RelayClient(baseUrl: 'http://localhost:3000'),
       ),
+      if (relaySessionNotifier != null)
+        relaySessionProvider.overrideWith(() => relaySessionNotifier),
+      // Compose bar drafts persist through SharedPreferences.
+      savedPrefsProvider.overrideWithValue(_testPrefs),
     ],
     child: MaterialApp(
       theme: AppTheme.light(),
+      builder: (context, child) => MediaQuery(
+        data: MediaQuery.of(context).copyWith(textScaler: textScaler),
+        child: child!,
+      ),
       navigatorObservers: navigatorObservers,
-      home: Builder(
-        builder: (context) => MediaQuery(
-          data: MediaQuery.of(context).copyWith(textScaler: textScaler),
-          child: ChannelDetailPage(channel: resolvedChannel),
-        ),
+      home: ChannelDetailPage(
+        channel: resolvedChannel,
+        initialMessageId: initialMessageId,
+        initialThreadRootId: initialThreadRootId,
       ),
     ),
   );
@@ -229,7 +245,181 @@ double? effectiveFontSizeForText(
 }
 
 void main() {
+  setUp(() async {
+    SharedPreferences.setMockInitialValues({});
+    _testPrefs = await SharedPreferences.getInstance();
+  });
+
   group('ChannelDetailPage', () {
+    testWidgets('debounces same-slot reconnect skeletons before revealing', (
+      tester,
+    ) async {
+      final relaySession = _ReconnectingRelaySession();
+      await tester.pumpWidget(
+        _buildTestable(
+          messages: [
+            _textMsg(id: 'msg1', pubkey: 'alice', content: 'Existing message'),
+          ],
+          relaySessionNotifier: relaySession,
+          readStateNotifier: _SynchronousReadStateNotifier(
+            const ReadStateState(
+              isReady: false,
+              pubkey: 'self',
+              contexts: {},
+              version: 0,
+            ),
+          ),
+        ),
+      );
+      await tester.pump();
+
+      expect(find.text('Existing message'), findsOneWidget);
+      expect(
+        tester.widget<SkeletonReveal>(find.byType(SkeletonReveal)).loading,
+        isFalse,
+      );
+
+      await tester.pump(const Duration(milliseconds: 1999));
+      expect(
+        tester.widget<SkeletonReveal>(find.byType(SkeletonReveal)).loading,
+        isFalse,
+      );
+
+      await tester.pump(const Duration(milliseconds: 1));
+      await tester.pump();
+      final skeleton = find.byKey(
+        const Key('channel-detail-connection-skeleton'),
+      );
+      expect(skeleton, findsOneWidget);
+      expect(
+        find.descendant(of: skeleton, matching: find.byType(SkeletonBar)),
+        findsWidgets,
+      );
+      expect(find.text('Existing message'), findsOneWidget);
+      expect(find.byType(CircularProgressIndicator), findsNothing);
+      expect(
+        tester
+            .widget<Opacity>(
+              find.byKey(const Key('skeleton-reveal-placeholder')),
+            )
+            .opacity,
+        1,
+      );
+
+      relaySession.connect();
+      await tester.pump();
+      await tester.pump();
+      expect(
+        tester.widget<SkeletonReveal>(find.byType(SkeletonReveal)).loading,
+        isFalse,
+      );
+      await tester.pump(const Duration(milliseconds: 200));
+
+      expect(
+        tester
+            .widget<Opacity>(
+              find.byKey(const Key('skeleton-reveal-placeholder')),
+            )
+            .opacity,
+        closeTo(0.5, 0.01),
+      );
+      expect(
+        tester
+            .widget<Opacity>(find.byKey(const Key('skeleton-reveal-content')))
+            .opacity,
+        closeTo(0.5, 0.01),
+      );
+
+      await tester.pump(const Duration(milliseconds: 200));
+      expect(
+        tester
+            .widget<Opacity>(find.byKey(const Key('skeleton-reveal-content')))
+            .opacity,
+        1,
+      );
+    });
+
+    testWidgets('shows the first-load connection skeleton immediately', (
+      tester,
+    ) async {
+      final relaySession = _ReconnectingRelaySession();
+      await tester.pumpWidget(
+        _buildTestable(
+          messages: const [],
+          messagesNotifier: _FakeMessagesNotifier(
+            const [],
+            hasLoadedMessages: false,
+          ),
+          relaySessionNotifier: relaySession,
+        ),
+      );
+      await tester.pump();
+
+      expect(
+        tester.widget<SkeletonReveal>(find.byType(SkeletonReveal)).loading,
+        isTrue,
+      );
+      expect(
+        tester
+            .widget<Opacity>(
+              find.byKey(const Key('skeleton-reveal-placeholder')),
+            )
+            .opacity,
+        1,
+      );
+      expect(
+        tester
+            .widget<Semantics>(
+              find.byKey(const Key('channel-detail-connection-skeleton')),
+            )
+            .properties
+            .label,
+        'Reconnecting',
+      );
+    });
+
+    testWidgets('keeps forum content visible with reconnect shimmer feedback', (
+      tester,
+    ) async {
+      final relaySession = _ReconnectingRelaySession();
+      final forumChannel = Channel(
+        id: _channelId,
+        name: 'design-forum',
+        channelType: 'forum',
+        visibility: 'open',
+        description: 'Talk through design changes',
+        createdBy: 'abc123',
+        createdAt: DateTime(2025),
+        memberCount: 5,
+        isMember: true,
+      );
+
+      await tester.pumpWidget(
+        _buildTestable(
+          messages: const [],
+          channel: forumChannel,
+          relaySessionNotifier: relaySession,
+        ),
+      );
+      await tester.pump();
+
+      expect(find.byType(SkeletonReveal), findsNothing);
+      expect(find.byKey(const Key('forum-connection-skeleton')), findsNothing);
+
+      await tester.pump(const Duration(milliseconds: 1999));
+      expect(find.byKey(const Key('forum-connection-skeleton')), findsNothing);
+
+      await tester.pump(const Duration(milliseconds: 1));
+      await tester.pump();
+      final skeleton = find.byKey(const Key('forum-connection-skeleton'));
+      expect(skeleton, findsOneWidget);
+      expect(
+        find.descendant(of: skeleton, matching: find.byType(SkeletonBar)),
+        findsWidgets,
+      );
+      expect(find.byType(SkeletonReveal), findsNothing);
+    });
+
     testWidgets('defers read-state mark until after build', (tester) async {
       final readState = _SynchronousReadStateNotifier(
         const ReadStateState(
@@ -490,7 +680,11 @@ void main() {
         _buildTestable(
           messages: messages,
           users: {
-            'alice': const UserProfile(pubkey: 'alice', displayName: 'Alice'),
+            'alice': const UserProfile(
+              pubkey: 'alice',
+              displayName: 'Alice',
+              nip05Handle: 'alice@example.com',
+            ),
             'bob': const UserProfile(pubkey: 'bob', displayName: 'Bob'),
           },
         ),
@@ -500,32 +694,118 @@ void main() {
       expect(findRichText('Hello world!'), findsOneWidget);
       expect(findRichText('Hey Alice!'), findsOneWidget);
       expect(find.text('Alice'), findsOneWidget);
+      expect(find.text('alice@example.com'), findsOneWidget);
       expect(find.text('Bob'), findsOneWidget);
       final messageAvatars = find.byType(CircleAvatar);
       expect(messageAvatars, findsNWidgets(2));
       for (final avatar in messageAvatars.evaluate()) {
         expect(
           tester.getSize(find.byWidget(avatar.widget)),
-          const Size.square(36),
+          const Size.square(messageAvatarSize),
         );
       }
       final aliceName = find.text('Alice');
       final aliceText = tester.widget<Text>(aliceName);
-      final titleStyle = Theme.of(
-        tester.element(aliceName),
-      ).textTheme.titleSmall;
-      expect(aliceText.style?.fontSize, titleStyle?.fontSize);
+      expect(aliceText.style?.fontSize, messageUsernameTextStyle.fontSize);
+      expect(aliceText.style?.fontWeight, messageUsernameTextStyle.fontWeight);
+      expect(aliceText.style?.height, messageUsernameTextStyle.height);
+      final aliceUsername = tester.widget<Text>(
+        find.byKey(const ValueKey('message-username-msg1')),
+      );
+      final aliceTimestamp = tester.widget<Text>(
+        find.byKey(const ValueKey('message-timestamp-msg1')),
+      );
+      expect(aliceUsername.style?.fontSize, messageMetadataTextStyle.fontSize);
+      expect(aliceUsername.style?.fontWeight, FontWeight.w400);
+      expect(aliceUsername.style?.height, messageMetadataTextStyle.height);
+      expect(aliceTimestamp.style?.fontSize, messageMetadataTextStyle.fontSize);
+      expect(aliceTimestamp.style?.fontWeight, FontWeight.w400);
       final helloContent = findRichText('Hello world!');
       final helloText = tester.widget<RichText>(helloContent);
-      final bodyStyle = Theme.of(
-        tester.element(helloContent),
-      ).textTheme.bodyLarge;
       expect(
         effectiveFontSizeForText(helloText.text, 'Hello world!'),
-        bodyStyle?.fontSize,
+        messageBodyTextStyle.fontSize,
+      );
+      final messageList = tester.widget<ScrollablePositionedList>(
+        find.byKey(const ValueKey('channel-message-list')),
+      );
+      expect(messageList.padding!.bottom, 0);
+      final newestMessageGroup = tester.widget<Padding>(
+        find.byKey(const ValueKey('channel-message-group-msg2')),
+      );
+      expect(
+        newestMessageGroup.padding,
+        const EdgeInsets.only(bottom: Grid.xs),
+      );
+      expect(
+        find.byKey(const ValueKey('channel-jump-to-latest')),
+        findsNothing,
+      );
+      await tester.tap(find.text('Message #general'));
+      await tester.pumpAndSettle();
+      expect(
+        find.byKey(const ValueKey('channel-jump-to-latest')),
+        findsNothing,
       );
     });
 
+    testWidgets(
+      'keeps image galleries body-aligned and flush with the trailing edge',
+      (tester) async {
+        tester.view.physicalSize = const Size(400, 800);
+        tester.view.devicePixelRatio = 1;
+        addTearDown(tester.view.resetPhysicalSize);
+        addTearDown(tester.view.resetDevicePixelRatio);
+
+        const firstImage = 'https://example.com/media/first.png';
+        const secondImage = 'https://example.com/media/second.png';
+        await tester.pumpWidget(
+          _buildTestable(
+            messages: [
+              _textMsg(
+                id: 'gallery',
+                pubkey: 'alice',
+                content:
+                    'Gallery\n'
+                    '![First]($firstImage)\n'
+                    '![Second]($secondImage)',
+                extraTags: const [
+                  ['imeta', 'url $firstImage', 'm image/png'],
+                  ['imeta', 'url $secondImage', 'm image/png'],
+                ],
+              ),
+            ],
+            users: const {
+              'alice': UserProfile(pubkey: 'alice', displayName: 'Alice'),
+            },
+          ),
+        );
+        await tester.pumpAndSettle();
+
+        final carousel = find.byKey(const ValueKey('message-media-carousel'));
+        final imageCount = find.byKey(
+          const ValueKey('message-media-carousel-count'),
+        );
+        final carouselRect = tester.getRect(carousel);
+        final imageCountRect = tester.getRect(imageCount);
+
+        expect(carouselRect.left, imageCountRect.left);
+        expect(carouselRect.right, tester.view.physicalSize.width);
+        expect(carouselRect.top - imageCountRect.bottom, Grid.half + 2);
+
+        final messageMaterial = find
+            .ancestor(
+              of: find.byKey(const ValueKey('message-row-gallery')),
+              matching: find.byType(Material),
+            )
+            .first;
+        expect(
+          tester.widget<Material>(messageMaterial).clipBehavior,
+          Clip.none,
+        );
+      },
+    );
+
     testWidgets('uses larger participant avatars in reply summaries', (
       tester,
     ) async {
@@ -577,9 +857,62 @@ void main() {
           const Size.square(32),
         );
       }
+      final summaryPadding = tester.widget<Padding>(
+        find.byKey(const ValueKey('thread-summary-root')),
+      );
+      expect(
+        summaryPadding.padding,
+        const EdgeInsets.only(
+          left: messageAvatarSize + messageAvatarContentGap,
+          top: Grid.half,
+          bottom: Grid.xs,
+        ),
+      );
     });
 
-    testWidgets('can jump back to latest when newer messages are offscreen', (
+    testWidgets('constrains reply summaries at accessibility text sizes', (
+      tester,
+    ) async {
+      tester.view.physicalSize = const Size(400, 800);
+      tester.view.devicePixelRatio = 1;
+      addTearDown(tester.view.resetPhysicalSize);
+      addTearDown(tester.view.resetDevicePixelRatio);
+
+      final lastReplyAt =
+          DateTime.now().millisecondsSinceEpoch ~/ 1000 - 59 * 60;
+      await tester.pumpWidget(
+        _buildTestable(
+          messages: [
+            _textMsg(
+              id: 'root',
+              pubkey: 'alice',
+              content: 'Thread head',
+              createdAt: lastReplyAt - 300,
+            ),
+            for (var i = 0; i < 3; i++)
+              _textMsg(
+                id: 'reply-$i',
+                pubkey: 'participant-$i',
+                content: 'Reply $i',
+                createdAt: lastReplyAt - 2 + i,
+                extraTags: const [
+                  ['e', 'root', '', 'reply'],
+                ],
+              ),
+          ],
+          channel: _testChannel.copyWith(archivedAt: DateTime.now()),
+          textScaler: const TextScaler.linear(2),
+        ),
+      );
+      await tester.pumpAndSettle();
+
+      final summaryText = tester.widget<RichText>(findRichText('3 replies'));
+      expect(summaryText.maxLines, 2);
+      expect(summaryText.overflow, TextOverflow.ellipsis);
+      expect(tester.takeException(), isNull);
+    });
+
+    testWidgets('can jump back to latest after a non-drag user scroll', (
       tester,
     ) async {
       final initialMessages = [
@@ -604,9 +937,21 @@ void main() {
       );
       await tester.pumpAndSettle();
 
-      final listView = tester.widget<ScrollablePositionedList>(
-        find.byKey(const ValueKey('channel-message-list')),
-      );
+      final messageList = find.byKey(const ValueKey('channel-message-list'));
+      final messageListElement = tester.element(messageList);
+      UserScrollNotification(
+        metrics: FixedScrollMetrics(
+          minScrollExtent: 0,
+          maxScrollExtent: 100,
+          pixels: 0,
+          viewportDimension: 100,
+          axisDirection: AxisDirection.down,
+          devicePixelRatio: 1,
+        ),
+        context: messageListElement,
+        direction: ScrollDirection.reverse,
+      ).dispatch(messageListElement);
+      final listView = tester.widget<ScrollablePositionedList>(messageList);
       listView.itemScrollController!.jumpTo(index: 39);
       await tester.pumpAndSettle();
       expect(
@@ -632,6 +977,185 @@ void main() {
       expect(findRichText('Newest live update'), findsOneWidget);
     });
 
+    testWidgets(
+      'keeps follow mode off while a tall newest message stays visible',
+      (tester) async {
+        tester.view.physicalSize = const Size(400, 600);
+        tester.view.devicePixelRatio = 1;
+        addTearDown(tester.view.resetPhysicalSize);
+        addTearDown(tester.view.resetDevicePixelRatio);
+
+        final tallMessage = List.generate(
+          12,
+          (index) => 'Newest message line $index',
+        ).join('\n');
+        final initialMessages = [
+          for (var i = 0; i < 12; i++)
+            _textMsg(
+              id: 'msg$i',
+              pubkey: i.isEven ? 'alice' : 'bob',
+              content: 'Message $i',
+              createdAt: 1000 + i * 1000,
+            ),
+          _textMsg(
+            id: 'tall-newest',
+            pubkey: 'alice',
+            content: tallMessage,
+            createdAt: 20_000,
+          ),
+        ];
+        final messagesNotifier = _FakeMessagesNotifier(initialMessages);
+
+        await tester.pumpWidget(
+          _buildTestable(
+            messages: const [],
+            messagesNotifier: messagesNotifier,
+            users: const {
+              'alice': UserProfile(pubkey: 'alice', displayName: 'Alice'),
+              'bob': UserProfile(pubkey: 'bob', displayName: 'Bob'),
+            },
+          ),
+        );
+        await tester.pumpAndSettle();
+
+        final messageList = find.byKey(const ValueKey('channel-message-list'));
+        await tester.drag(messageList, const Offset(0, 120));
+        await tester.pumpAndSettle();
+
+        expect(findRichText('Newest message line 0'), findsOneWidget);
+        expect(
+          find.byKey(const ValueKey('channel-jump-to-latest')),
+          findsOneWidget,
+        );
+
+        messagesNotifier.setMessages([
+          ...initialMessages,
+          _textMsg(
+            id: 'newest-live',
+            pubkey: 'alice',
+            content: 'Newest live update',
+            createdAt: 30_000,
+          ),
+        ]);
+        await tester.pumpAndSettle();
+
+        expect(findRichText('Newest live update'), findsNothing);
+        expect(
+          find.byKey(const ValueKey('channel-jump-to-latest')),
+          findsOneWidget,
+        );
+      },
+    );
+
+    testWidgets('preserves an initial message deep-link position', (
+      tester,
+    ) async {
+      final initialMessages = [
+        for (var i = 0; i < 40; i++)
+          _textMsg(
+            id: 'msg$i',
+            pubkey: 'alice',
+            content: 'Message $i',
+            createdAt: 1000 + i,
+          ),
+      ];
+      final messagesNotifier = _FakeMessagesNotifier(initialMessages);
+
+      await tester.pumpWidget(
+        _buildTestable(
+          messages: const [],
+          messagesNotifier: messagesNotifier,
+          initialMessageId: 'msg5',
+          users: const {
+            'alice': UserProfile(pubkey: 'alice', displayName: 'Alice'),
+          },
+        ),
+      );
+      await tester.pumpAndSettle();
+
+      expect(findRichText('Message 5'), findsOneWidget);
+      expect(findRichText('Message 39'), findsNothing);
+      expect(
+        find.byKey(const ValueKey('channel-jump-to-latest')),
+        findsOneWidget,
+      );
+
+      messagesNotifier.setMessages([
+        ...initialMessages,
+        _textMsg(
+          id: 'newest',
+          pubkey: 'alice',
+          content: 'Newest live update',
+          createdAt: 2000,
+        ),
+      ]);
+      await tester.pumpAndSettle();
+
+      expect(findRichText('Message 5'), findsOneWidget);
+      expect(findRichText('Newest live update'), findsNothing);
+    });
+
+    testWidgets(
+      'keeps a deep-linked message in view when its page arrives after a '
+      'small scroll near the latest message',
+      (tester) async {
+        tester.view.physicalSize = const Size(400, 800);
+        tester.view.devicePixelRatio = 1;
+        addTearDown(tester.view.resetPhysicalSize);
+        addTearDown(tester.view.resetDevicePixelRatio);
+
+        // The deep-link target lives in an older page that has not loaded yet.
+        final messagesNotifier = _FakeMessagesNotifier([
+          for (var i = 30; i < 60; i++)
+            _textMsg(
+              id: 'msg$i',
+              pubkey: 'alice',
+              content: 'Message $i',
+              createdAt: 1000 + i * 1000,
+            ),
+        ]);
+
+        await tester.pumpWidget(
+          _buildTestable(
+            messages: const [],
+            messagesNotifier: messagesNotifier,
+            initialMessageId: 'msg3',
+            users: const {
+              'alice': UserProfile(pubkey: 'alice', displayName: 'Alice'),
+            },
+          ),
+        );
+        await tester.pumpAndSettle();
+
+        // Small scrolls that keep the newest message visible, so isAtLatest
+        // stays true while the scroll offset becomes non-zero. This lets a
+        // later programmatic jumpTo dispatch ScrollEndNotification.
+        for (final dy in const [10.0, 20.0, 30.0]) {
+          await tester.drag(
+            find.byKey(const ValueKey('channel-message-list')),
+            Offset(0, dy),
+          );
+          await tester.pumpAndSettle();
+        }
+
+        // The older page containing the deep-link target arrives.
+        messagesNotifier.setMessages([
+          for (var i = 0; i < 60; i++)
+            _textMsg(
+              id: 'msg$i',
+              pubkey: 'alice',
+              content: 'Message $i',
+              createdAt: 1000 + i * 1000,
+            ),
+        ]);
+        await tester.pumpAndSettle();
+
+        // The deep-link jump must stick rather than snapping back to newest.
+        expect(findRichText('Message 3'), findsOneWidget);
+        expect(findRichText('Message 59'), findsNothing);
+      },
+    );
+
     testWidgets('groups consecutive messages from same author', (tester) async {
       final messages = [
         _textMsg(
@@ -735,22 +1259,29 @@ void main() {
       expect(find.text('Alice'), findsOneWidget);
       final createdAction = findRichText('created this channel');
       expect(createdAction, findsOneWidget);
-      expect(tester.getSize(find.byType(CircleAvatar)), const Size.square(36));
+      expect(
+        tester.getSize(find.byType(CircleAvatar)),
+        const Size.square(messageAvatarSize),
+      );
       final nameRect = tester.getRect(find.text('Alice'));
       final nameText = tester.widget<Text>(find.text('Alice'));
-      final nameStyle = Theme.of(
-        tester.element(find.text('Alice')),
-      ).textTheme.titleSmall;
-      expect(nameText.style?.fontSize, nameStyle?.fontSize);
-      final timestampRect = tester.getRect(find.text(formatMessageTime(1000)));
-      expect(timestampRect.left - nameRect.right, Grid.xxs);
+      expect(nameText.style?.fontSize, systemMessageHeadingTextStyle.fontSize);
+      expect(
+        nameText.style?.fontWeight,
+        systemMessageHeadingTextStyle.fontWeight,
+      );
+      expect(
+        find.byKey(const ValueKey('system-message-username-alice')),
+        findsNothing,
+      );
+      final timestampRect = tester.getRect(
+        find.byKey(const ValueKey('system-message-timestamp-alice')),
+      );
+      expect(timestampRect.left, greaterThan(nameRect.right));
       final createdText = tester.widget<RichText>(createdAction);
-      final bodyStyle = Theme.of(
-        tester.element(createdAction),
-      ).textTheme.bodyLarge;
       expect(
         effectiveFontSizeForText(createdText.text, 'created this channel'),
-        bodyStyle?.fontSize,
+        systemMessageBodyTextStyle.fontSize,
       );
     });
 
@@ -774,7 +1305,10 @@ void main() {
 
       expect(find.text('Bob'), findsOneWidget);
       expect(findRichText('joined the channel'), findsOneWidget);
-      expect(tester.getSize(find.byType(CircleAvatar)), const Size.square(36));
+      expect(
+        tester.getSize(find.byType(CircleAvatar)),
+        const Size.square(messageAvatarSize),
+      );
     });
 
     testWidgets('renders member_joined (added by other) system event', (
@@ -802,17 +1336,23 @@ void main() {
       final addedAction = findRichText('was added by Alice');
       expect(addedAction, findsOneWidget);
       expect(find.text('Alice added Bob to the channel'), findsNothing);
-      expect(tester.getSize(find.byType(CircleAvatar)), const Size.square(36));
+      expect(
+        tester.getSize(find.byType(CircleAvatar)),
+        const Size.square(messageAvatarSize),
+      );
       final nameRect = tester.getRect(find.text('Bob'));
-      final timestampRect = tester.getRect(find.text(formatMessageTime(1000)));
-      expect(timestampRect.left - nameRect.right, Grid.xxs);
+      expect(
+        find.byKey(const ValueKey('system-message-username-bob')),
+        findsNothing,
+      );
+      final timestampRect = tester.getRect(
+        find.byKey(const ValueKey('system-message-timestamp-bob')),
+      );
+      expect(timestampRect.left, greaterThan(nameRect.right));
       final addedText = tester.widget<RichText>(addedAction);
-      final bodyStyle = Theme.of(
-        tester.element(addedAction),
-      ).textTheme.bodyLarge;
       expect(
         effectiveFontSizeForText(addedText.text, 'was added by Alice'),
-        bodyStyle?.fontSize,
+        systemMessageBodyTextStyle.fontSize,
       );
     });
 
@@ -923,7 +1463,10 @@ void main() {
 
       final avatarRect = tester.getRect(find.byType(CircleAvatar));
       final reactionRect = tester.getRect(find.byType(ReactionRow));
-      expect(reactionRect.left, avatarRect.left + 36 + Grid.xxs);
+      expect(
+        reactionRect.left,
+        avatarRect.left + messageAvatarSize + messageAvatarContentGap,
+      );
     });
 
     testWidgets('renders member_left system event', (tester) async {
@@ -945,6 +1488,51 @@ void main() {
       expect(find.text('Bob left the channel'), findsOneWidget);
     });
 
+    testWidgets(
+      'constrains generic system timestamps at accessibility text sizes',
+      (tester) async {
+        tester.view.physicalSize = const Size(240, 600);
+        tester.view.devicePixelRatio = 1;
+        addTearDown(tester.view.resetPhysicalSize);
+        addTearDown(tester.view.resetDevicePixelRatio);
+
+        await tester.pumpWidget(
+          _buildTestable(
+            messages: [
+              _systemMsg(
+                id: 'sys-accessible',
+                payload: {
+                  'type': 'topic_changed',
+                  'actor': 'alice',
+                  'topic': 'Release planning',
+                },
+                createdAt:
+                    DateTime(2026, 7, 28, 12, 34).millisecondsSinceEpoch ~/
+                    1000,
+              ),
+            ],
+            users: {
+              'alice': const UserProfile(pubkey: 'alice', displayName: 'Alice'),
+            },
+            textScaler: const TextScaler.linear(3),
+          ),
+        );
+        await tester.pumpAndSettle();
+
+        final timestampFinder = find.byKey(
+          const ValueKey('system-message-timestamp-sys-accessible'),
+        );
+        final timestamp = tester.widget<Text>(timestampFinder);
+        expect(timestamp.maxLines, 1);
+        expect(timestamp.overflow, TextOverflow.ellipsis);
+        expect(
+          tester.getSize(timestampFinder).width,
+          lessThanOrEqualTo(Grid.xxl),
+        );
+        expect(tester.takeException(), isNull);
+      },
+    );
+
     testWidgets('renders member_removed system event', (tester) async {
       final messages = [
         _systemMsg(
@@ -1220,6 +1808,25 @@ void main() {
       await tester.pumpAndSettle();
 
       expect(find.text('Alice is typing…'), findsOneWidget);
+
+      final indicator = tester.widget<Container>(
+        find.byKey(const ValueKey('channel-typing-indicator')),
+      );
+      final decoration = indicator.decoration! as BoxDecoration;
+      expect(
+        indicator.padding,
+        const EdgeInsets.symmetric(horizontal: Grid.xxs, vertical: Grid.xxs),
+      );
+      expect(
+        decoration.color,
+        AppTheme.light().colorScheme.surfaceContainerHighest,
+      );
+      expect(decoration.border, isA<Border>());
+      expect(
+        tester.widget<Text>(find.text('Alice is typing…')).style?.color,
+        AppTheme.light().colorScheme.primary,
+      );
+      expect(tester.widget<SmallAvatar>(find.byType(SmallAvatar)).size, 24);
     });
 
     testWidgets('shows two typers', (tester) async {
@@ -1334,50 +1941,6 @@ void main() {
       expect(find.text('secret'), findsOneWidget);
       expect(find.byIcon(LucideIcons.lock), findsOneWidget);
     });
-
-    testWidgets('grows for a scaled two-line DM title', (tester) async {
-      final dmChannel = Channel(
-        id: _channelId,
-        name: 'dm',
-        channelType: 'dm',
-        visibility: 'private',
-        description: '',
-        createdBy: 'alice',
-        createdAt: DateTime(2025),
-        memberCount: 2,
-        participants: const ['Alice'],
-        participantPubkeys: const ['alice'],
-        isMember: true,
-      );
-
-      await tester.pumpWidget(
-        _buildTestable(
-          messages: [],
-          channel: dmChannel,
-          users: const {
-            'alice': UserProfile(pubkey: 'alice', displayName: 'Alice'),
-          },
-          textScaler: const TextScaler.linear(1.25),
-        ),
-      );
-      await tester.pumpAndSettle();
-
-      final appBar = find.byType(FrostedAppBar);
-      final clip = find.descendant(of: appBar, matching: find.byType(ClipRect));
-      final title = find.descendant(of: appBar, matching: find.text('Alice'));
-      final presence = find.descendant(
-        of: appBar,
-        matching: find.text('Offline'),
-      );
-
-      expect(
-        tester.getSize(clip).height,
-        greaterThan(
-          tester.getSize(title).height + tester.getSize(presence).height,
-        ),
-      );
-      expect(tester.takeException(), isNull);
-    });
   });
 
   group('Error and loading states', () {
@@ -1398,6 +1961,7 @@ void main() {
             relayClientProvider.overrideWithValue(
               RelayClient(baseUrl: 'http://localhost:3000'),
             ),
+            savedPrefsProvider.overrideWithValue(_testPrefs),
           ],
           child: MaterialApp(
             theme: AppTheme.light(),
@@ -1460,6 +2024,69 @@ void main() {
     });
   });
 
+  group('Deep-link navigation', () {
+    testWidgets('opens a nested reply in its direct-parent thread', (
+      tester,
+    ) async {
+      final root = _textMsg(
+        id: 'root',
+        pubkey: 'alice',
+        content: 'Outer root',
+        createdAt: 1000,
+      );
+      final parent = _textMsg(
+        id: 'parent',
+        pubkey: 'bob',
+        content: 'Nested thread head',
+        createdAt: 1100,
+        extraTags: const [
+          ['e', 'root', '', 'reply'],
+        ],
+      );
+      final target = _textMsg(
+        id: 'target',
+        pubkey: 'carol',
+        content: 'Deeply nested target',
+        createdAt: 1200,
+        extraTags: const [
+          ['e', 'root', '', 'root'],
+          ['e', 'parent', '', 'reply'],
+        ],
+      );
+
+      await tester.pumpWidget(
+        _buildTestable(
+          messages: [root, parent, target],
+          initialMessageId: 'target',
+          initialThreadRootId: 'parent',
+          threadReplies: {
+            // Relay subtree filtering is keyed by thread_metadata.root_event_id,
+            // so nested replies are returned by the outer-root query.
+            'root': [parent, target],
+          },
+          users: const {
+            'alice': UserProfile(pubkey: 'alice', displayName: 'Alice'),
+            'bob': UserProfile(pubkey: 'bob', displayName: 'Bob'),
+            'carol': UserProfile(pubkey: 'carol', displayName: 'Carol'),
+          },
+        ),
+      );
+      await tester.pumpAndSettle();
+
+      final threadPage = tester.widget<ThreadDetailPage>(
+        find.byType(ThreadDetailPage),
+      );
+      expect(threadPage.threadHead.id, 'parent');
+      expect(threadPage.initialMessageId, 'target');
+
+      final highlighted = tester.widget<DecoratedBox>(
+        find.byKey(const ValueKey('thread-message-target')),
+      );
+      final decoration = highlighted.decoration as BoxDecoration;
+      expect(decoration.color, isNot(Colors.transparent));
+    });
+  });
+
   group('Channel links', () {
     testWidgets('tapping a channel link opens that channel', (tester) async {
       final randomChannel = _channel(id: 'random-channel', name: 'random');
@@ -1614,7 +2241,7 @@ void main() {
       await tester.pumpWidget(
         _buildTestable(
           messages: [rootEvent],
-          threadReplies: replies,
+          threadReplies: {'thread-root': replies},
           users: {
             'alice': const UserProfile(pubkey: 'alice', displayName: 'Alice'),
             'bob': const UserProfile(pubkey: 'bob', displayName: 'Bob'),
@@ -1641,6 +2268,14 @@ void main() {
       expect(find.byType(DayDivider), findsNWidgets(2));
       expect(find.text(formatDayHeading(rootCreatedAt)), findsOneWidget);
       expect(find.text(formatDayHeading(nextDayCreatedAt)), findsOneWidget);
+      final threadList = tester.widget<ScrollablePositionedList>(
+        find.byKey(const ValueKey('thread-message-list')),
+      );
+      expect(threadList.padding!.bottom, 0);
+      final newestThreadGroup = tester.widget<Padding>(
+        find.byKey(const ValueKey('thread-message-group-reply-next-day')),
+      );
+      expect(newestThreadGroup.padding, const EdgeInsets.only(bottom: Grid.xs));
     });
   });
 }
@@ -1659,11 +2294,18 @@ Channel _channel({required String id, required String name}) => Channel(
 
 class _FakeMessagesNotifier extends ChannelMessagesNotifier {
   List<NostrEvent> _messages;
-  _FakeMessagesNotifier(this._messages) : super(_channelId);
+  bool _hasLoadedMessages;
+
+  _FakeMessagesNotifier(this._messages, {bool hasLoadedMessages = true})
+    : _hasLoadedMessages = hasLoadedMessages,
+      super(_channelId);
 
   @override
   AsyncValue<List<NostrEvent>> build() => AsyncData(_messages);
 
+  @override
+  bool get hasLoadedMessages => _hasLoadedMessages;
+
   @override
   bool get reachedOldest => true;
 
@@ -1672,6 +2314,7 @@ class _FakeMessagesNotifier extends ChannelMessagesNotifier {
 
   void setMessages(List<NostrEvent> messages) {
     _messages = messages;
+    _hasLoadedMessages = true;
     state = AsyncData(messages);
   }
 }
@@ -1684,6 +2327,22 @@ class _ErrorMessagesNotifier extends ChannelMessagesNotifier {
       AsyncError('Connection failed', StackTrace.current);
 }
 
+class _ReconnectingRelaySession extends RelaySessionNotifier {
+  @override
+  SessionState build() =>
+      const SessionState(status: SessionStatus.reconnecting);
+
+  @override
+  Future<List<NostrEvent>> fetchHistory(
+    NostrFilter filter, {
+    Duration timeout = const Duration(seconds: 8),
+  }) async => [];
+
+  void connect() {
+    state = const SessionState(status: SessionStatus.connected);
+  }
+}
+
 class _FakeTypingNotifier extends ChannelTypingNotifier {
   final List<TypingEntry> _entries;
   _FakeTypingNotifier(this._entries) : super(_channelId);
@@ -1702,7 +2361,11 @@ class _SynchronousReadStateNotifier extends ReadStateNotifier {
   ReadStateState build() => _initialState;
 
   @override
-  void markContextRead(String contextId, int unixTimestamp) {
+  void markContextRead(
+    String contextId,
+    int unixTimestamp, {
+    bool clearForcedMessages = false,
+  }) {
     markedContexts[contextId] = unixTimestamp;
     state = state.copyWithContext(contextId, unixTimestamp);
   }
diff --git a/mobile/test/features/channels/channel_sections/channel_sections_manager_test.dart b/mobile/test/features/channels/channel_sections/channel_sections_manager_test.dart
new file mode 100644
index 00000000000..5b36ed6a4dc
--- /dev/null
+++ b/mobile/test/features/channels/channel_sections/channel_sections_manager_test.dart
@@ -0,0 +1,312 @@
+import 'dart:convert';
+
+import 'package:flutter_test/flutter_test.dart';
+import 'package:nostr/nostr.dart' as nostr;
+import 'package:shared_preferences/shared_preferences.dart';
+import 'package:buzz/features/channels/channel_sections/channel_sections_manager.dart';
+import 'package:buzz/shared/relay/relay.dart';
+
+void main() {
+  late SharedPreferences prefs;
+  late nostr.Keys keychain;
+  late ChannelSectionsCrypto crypto;
+
+  Future<void> setUpEnv() async {
+    SharedPreferences.setMockInitialValues({});
+    prefs = await SharedPreferences.getInstance();
+    keychain = nostr.Keys.generate();
+    crypto = ChannelSectionsCrypto(keychain.nsec, keychain.public);
+  }
+
+  NostrEvent sectionsEvent({
+    required List<Map<String, dynamic>> sections,
+    Map<String, String> assignments = const {},
+    required int createdAt,
+    String id = 'remote-event',
+  }) {
+    final payload = jsonEncode({
+      'version': 1,
+      'sections': sections,
+      'assignments': assignments,
+    });
+    return NostrEvent(
+      id: id,
+      pubkey: keychain.public,
+      createdAt: createdAt,
+      kind: EventKind.readState,
+      tags: const [
+        ['d', 'channel-sections'],
+        ['t', 'channel-sections'],
+      ],
+      content: crypto.encrypt(payload),
+      sig: 'sig',
+    );
+  }
+
+  ChannelSectionsManager buildManager({
+    required RelaySessionNotifier relaySession,
+    Duration startupRetryBaseDelay = const Duration(milliseconds: 5),
+  }) {
+    return ChannelSectionsManager(
+      pubkey: keychain.public,
+      prefs: prefs,
+      crypto: crypto,
+      relaySession: relaySession,
+      signedEventRelay: null,
+      remoteEnabled: true,
+      onChanged: () {},
+      startupRetryBaseDelay: startupRetryBaseDelay,
+    );
+  }
+
+  test('startup fetch rejected by relay rate limit retries until the remote '
+      'blob is adopted (cold-start regression)', () async {
+    await setUpEnv();
+    // Cold start: the relay rejects the first fetch AND the first live
+    // subscription with `rate-limited: quota exceeded` because the channel
+    // list fired dozens of REQs first. Pre-fix, both errors were swallowed
+    // and desktop-created groups never appeared until app data was cleared.
+    final relay = _RateLimitedRelaySession(
+      failuresBeforeSuccess: 2,
+      historyEvents: [
+        sectionsEvent(
+          sections: [
+            {'id': 's1', 'name': 'Desktop Group', 'order': 0},
+          ],
+          createdAt: 100,
+        ),
+      ],
+    );
+
+    final manager = buildManager(
+      relaySession: relay,
+      startupRetryBaseDelay: const Duration(milliseconds: 10),
+    );
+    await manager.initialize();
+
+    expect(
+      manager.store.sections,
+      isEmpty,
+      reason: 'first fetch lost the rate-limit race',
+    );
+
+    // Wait for the backoff retries (10ms, 20ms, …) to win the race.
+    await _waitUntil(() => manager.store.sections.isNotEmpty);
+
+    expect(manager.store.sections.single.name, 'Desktop Group');
+    expect(
+      relay.subscribeCalls,
+      greaterThan(1),
+      reason: 'live subscription must be retried too',
+    );
+    manager.dispose(flushPending: false);
+  });
+
+  test(
+    'startup retry stops after fetch and subscription both succeed',
+    () async {
+      await setUpEnv();
+      final relay = _RateLimitedRelaySession(
+        failuresBeforeSuccess: 1,
+        historyEvents: [
+          sectionsEvent(
+            sections: [
+              {'id': 's1', 'name': 'Desktop Group', 'order': 0},
+            ],
+            createdAt: 100,
+          ),
+        ],
+      );
+      final manager = buildManager(relaySession: relay);
+      await manager.initialize();
+      await _waitUntil(() => manager.store.sections.isNotEmpty);
+
+      final fetchCallsAfterSuccess = relay.fetchCalls;
+      final subscribeCallsAfterSuccess = relay.subscribeCalls;
+      await Future<void>.delayed(const Duration(milliseconds: 60));
+
+      expect(relay.fetchCalls, fetchCallsAfterSuccess);
+      expect(relay.subscribeCalls, subscribeCallsAfterSuccess);
+      manager.dispose(flushPending: false);
+    },
+  );
+
+  test('disposing the manager cancels pending startup retries', () async {
+    await setUpEnv();
+    final relay = _RateLimitedRelaySession(failuresBeforeSuccess: 1000);
+    final manager = buildManager(relaySession: relay);
+    await manager.initialize();
+    manager.dispose(flushPending: false);
+
+    final fetchCallsAtDispose = relay.fetchCalls;
+    await Future<void>.delayed(const Duration(milliseconds: 60));
+
+    expect(
+      relay.fetchCalls,
+      fetchCallsAtDispose,
+      reason: 'no retries may fire after dispose',
+    );
+  });
+
+  test('late relay CLOSED after subscribe() reported success retries and '
+      'eventually adopts remote state', () async {
+    await setUpEnv();
+    // Under cold-start load, subscribe() can time out its 500ms readiness
+    // wait and resolve successfully before the relay's rate-limit CLOSED
+    // lands. The rejection then arrives only via onClosed. Pre-fix the
+    // manager passed no onClosed, kept the dead subscription, and never
+    // retried.
+    final relay = _RateLimitedRelaySession(failuresBeforeSuccess: 0);
+    final manager = buildManager(relaySession: relay);
+    await manager.initialize();
+    expect(relay.subscribeCalls, 1);
+
+    // Late CLOSED lands after initialize() completed successfully.
+    relay.closeLiveSubscription('rate-limited: quota exceeded');
+
+    // The manager must drop the dead subscription and re-subscribe.
+    await _waitUntil(() => relay.subscribeCalls > 1);
+
+    // Remote state arriving on the NEW subscription must be adopted.
+    relay.emit(
+      sectionsEvent(
+        sections: [
+          {'id': 's1', 'name': 'Desktop Group', 'order': 0},
+        ],
+        createdAt: 100,
+      ),
+    );
+    await _waitUntil(() => manager.store.sections.isNotEmpty);
+    expect(manager.store.sections.single.name, 'Desktop Group');
+
+    // Exactly one replacement subscription — no duplicates.
+    await Future<void>.delayed(const Duration(milliseconds: 60));
+    expect(relay.subscribeCalls, 2);
+    expect(relay.activeListeners, 1);
+    manager.dispose(flushPending: false);
+  });
+
+  test('late CLOSED after dispose does not schedule retries', () async {
+    await setUpEnv();
+    final relay = _RateLimitedRelaySession(failuresBeforeSuccess: 0);
+    final manager = buildManager(relaySession: relay);
+    await manager.initialize();
+    manager.dispose(flushPending: false);
+
+    relay.closeLiveSubscription('rate-limited: quota exceeded');
+    await Future<void>.delayed(const Duration(milliseconds: 60));
+
+    expect(relay.subscribeCalls, 1, reason: 'no re-subscribe after dispose');
+  });
+
+  test('backoff resets after full recovery so later failures start from the '
+      'base delay', () async {
+    await setUpEnv();
+    // Climb the failure counter: 5 rate-limited attempts before success.
+    // With a 5ms base, attempt 5 would wait 5<<5 = 160ms if the counter
+    // were never reset.
+    final relay = _RateLimitedRelaySession(failuresBeforeSuccess: 5);
+    final manager = buildManager(relaySession: relay);
+    await manager.initialize();
+    await _waitUntil(() => relay.subscribeCalls > 5);
+
+    // Fully recovered. A later transient failure (late CLOSED) must retry
+    // from the base delay, not the climbed ceiling.
+    final subscribeCallsAfterRecovery = relay.subscribeCalls;
+    relay.closeLiveSubscription('rate-limited: quota exceeded');
+    final stopwatch = Stopwatch()..start();
+    await _waitUntil(() => relay.subscribeCalls > subscribeCallsAfterRecovery);
+    stopwatch.stop();
+
+    expect(
+      stopwatch.elapsedMilliseconds,
+      lessThan(100),
+      reason:
+          'retry after recovery must wait ~base delay (5ms), '
+          'not the pre-recovery backoff (160ms)',
+    );
+    manager.dispose(flushPending: false);
+  });
+}
+
+Future<void> _waitUntil(
+  bool Function() condition, {
+  Duration timeout = const Duration(seconds: 2),
+}) async {
+  final deadline = DateTime.now().add(timeout);
+  while (!condition()) {
+    if (DateTime.now().isAfter(deadline)) {
+      fail('condition not met within $timeout');
+    }
+    await Future<void>.delayed(const Duration(milliseconds: 10));
+  }
+}
+
+/// Rejects the first [failuresBeforeSuccess] fetch and subscribe calls with
+/// the relay's rate-limit error, then succeeds — the exact failure mode seen
+/// on Android cold start where the channel-list REQ burst exhausts the
+/// relay's per-connection quota before the sections manager gets a turn.
+class _RateLimitedRelaySession extends RelaySessionNotifier {
+  _RateLimitedRelaySession({
+    required this.failuresBeforeSuccess,
+    this.historyEvents = const [],
+  });
+
+  final int failuresBeforeSuccess;
+  final List<NostrEvent> historyEvents;
+  int fetchCalls = 0;
+  int subscribeCalls = 0;
+  final List<void Function(NostrEvent)> _listeners = [];
+  final List<void Function(String)> _closedCallbacks = [];
+
+  int get activeListeners => _listeners.length;
+
+  void emit(NostrEvent event) {
+    for (final listener in List.of(_listeners)) {
+      listener(event);
+    }
+  }
+
+  /// Simulates a relay CLOSED landing after subscribe() already resolved —
+  /// the readiness-timeout window on a loaded cold start. Drops the live
+  /// subscription (as _handleClosed does) and invokes onClosed.
+  void closeLiveSubscription(String message) {
+    if (_listeners.isEmpty) return;
+    _listeners.removeAt(0);
+    final onClosed = _closedCallbacks.removeAt(0);
+    onClosed(message);
+  }
+
+  @override
+  Future<List<NostrEvent>> fetchHistory(
+    NostrFilter filter, {
+    Duration timeout = const Duration(seconds: 8),
+  }) async {
+    fetchCalls++;
+    if (fetchCalls <= failuresBeforeSuccess) {
+      throw Exception('rate-limited: quota exceeded; retry in 2s');
+    }
+    return historyEvents;
+  }
+
+  @override
+  Future<void Function()> subscribe(
+    NostrFilter filter,
+    void Function(NostrEvent) onEvent, {
+    void Function(String message)? onClosed,
+  }) async {
+    subscribeCalls++;
+    if (subscribeCalls <= failuresBeforeSuccess) {
+      throw Exception('rate-limited: quota exceeded; retry in 1s');
+    }
+    _listeners.add(onEvent);
+    _closedCallbacks.add(onClosed ?? (_) {});
+    return () {
+      final index = _listeners.indexOf(onEvent);
+      if (index >= 0) {
+        _listeners.removeAt(index);
+        _closedCallbacks.removeAt(index);
+      }
+    };
+  }
+}
diff --git a/mobile/test/features/channels/channels_page_test.dart b/mobile/test/features/channels/channels_page_test.dart
index 08f7a4b077e..991db3b5cd6 100644
--- a/mobile/test/features/channels/channels_page_test.dart
+++ b/mobile/test/features/channels/channels_page_test.dart
@@ -1,3 +1,4 @@
+import 'dart:async';
 import 'dart:math';
 
 import 'package:flutter/material.dart';
@@ -7,6 +8,8 @@ import 'package:hooks_riverpod/misc.dart';
 import 'package:lucide_icons_flutter/lucide_icons.dart';
 import 'package:buzz/features/channels/channel.dart';
 import 'package:buzz/features/channels/channel_management_provider.dart';
+import 'package:buzz/features/channels/channel_sections/channel_sections_provider.dart';
+import 'package:buzz/features/channels/channel_sections/channel_sections_storage.dart';
 import 'package:buzz/features/channels/channels_page.dart';
 import 'package:buzz/features/channels/channels_provider.dart';
 import 'package:buzz/features/channels/read_state/read_state_provider.dart';
@@ -16,8 +19,10 @@ import 'package:buzz/features/profile/profile_provider.dart';
 import 'package:buzz/features/profile/user_profile.dart';
 import 'package:buzz/shared/auth/auth.dart';
 import 'package:buzz/shared/community/community_icon_provider.dart';
+import 'package:buzz/shared/relay/relay.dart';
 import 'package:buzz/shared/theme/theme.dart';
 import 'package:buzz/shared/widgets/avatar_image.dart';
+import 'package:buzz/shared/widgets/skeleton.dart';
 
 void main() {
   Widget buildTestable({
@@ -25,6 +30,7 @@ void main() {
     bool previewDirectory = false,
     double keyboardInset = 0,
     bool disableAnimations = false,
+    double bottomPadding = 0,
     Map<String, String?> communityIcons = const {},
     ValueChanged<String>? onCommunityIconLoad,
     TextScaler textScaler = TextScaler.noScaling,
@@ -49,6 +55,7 @@ void main() {
           data: MediaQuery.of(context).copyWith(
             disableAnimations: disableAnimations,
             textScaler: textScaler,
+            padding: EdgeInsets.only(bottom: bottomPadding),
             viewInsets: EdgeInsets.only(bottom: keyboardInset),
           ),
           child: child!,
@@ -128,6 +135,204 @@ void main() {
     expect(find.text('DMs'), findsOneWidget);
     expect(find.text('Community'), findsOneWidget);
     expect(find.byTooltip('Create or start conversation'), findsOneWidget);
+
+    for (final label in ['general', 'Alice']) {
+      final text = tester.widget<Text>(find.text(label));
+      expect(text.style?.fontSize, contentListTitleTextStyle.fontSize);
+      expect(text.style?.height, contentListTitleTextStyle.height);
+    }
+    final sectionTitle = tester.widget<Text>(find.text('Channels'));
+    expect(sectionTitle.style?.fontSize, contentListTitleTextStyle.fontSize);
+    expect(sectionTitle.style?.fontWeight, FontWeight.w600);
+  });
+
+  testWidgets('keeps the last channel above the floating tab bar', (
+    tester,
+  ) async {
+    const footerClearance = 102.0;
+    await tester.pumpWidget(
+      buildTestable(
+        bottomPadding: footerClearance,
+        overrides: [
+          channelsProvider.overrideWith(() => _FakeNotifier(testChannels)),
+        ],
+      ),
+    );
+    await tester.pumpAndSettle();
+
+    final padding = tester.widget<SliverPadding>(
+      find.descendant(
+        of: find.byType(CustomScrollView),
+        matching: find.byType(SliverPadding),
+      ),
+    );
+    expect((padding.padding as EdgeInsets).bottom, footerClearance);
+  });
+
+  testWidgets('truncates long custom section names beside the menu', (
+    tester,
+  ) async {
+    tester.view.physicalSize = const Size(320, 800);
+    tester.view.devicePixelRatio = 1;
+    addTearDown(tester.view.reset);
+    const sectionName = 'A deliberately long custom section name for testing';
+    await tester.pumpWidget(
+      buildTestable(
+        overrides: [
+          channelsProvider.overrideWith(() => _FakeNotifier(testChannels)),
+          channelSectionsProvider.overrideWith(
+            () => _FakeChannelSectionsNotifier(
+              const ChannelSectionStore(
+                sections: [
+                  ChannelSection(id: 'section-1', name: sectionName, order: 0),
+                ],
+              ),
+            ),
+          ),
+        ],
+      ),
+    );
+    await tester.pumpAndSettle();
+
+    final label = tester.widget<Text>(find.text(sectionName));
+    expect(label.maxLines, 1);
+    expect(label.overflow, TextOverflow.ellipsis);
+    expect(tester.takeException(), isNull);
+  });
+
+  testWidgets('aligns the top, section, row, and skeleton label columns', (
+    tester,
+  ) async {
+    final relaySession = _ReconnectingRelaySession();
+    await tester.pumpWidget(
+      buildTestable(
+        overrides: [
+          channelsProvider.overrideWith(() => _FakeNotifier(testChannels)),
+          relaySessionProvider.overrideWith(() => relaySession),
+        ],
+      ),
+    );
+    relaySession.connect();
+    await tester.pumpAndSettle();
+
+    final topLabelX = tester.getTopLeft(find.text('Community')).dx;
+    final sectionLabelX = tester.getTopLeft(find.text('Channels')).dx;
+    final rowLabelX = tester.getTopLeft(find.text('general')).dx;
+    expect(topLabelX, sectionLabelX);
+    expect(sectionLabelX, rowLabelX);
+
+    relaySession.setReconnecting();
+    await tester.pump();
+    await tester.pump(const Duration(seconds: 2));
+    await tester.pump();
+
+    final skeletonSectionLabelX = tester
+        .getTopLeft(
+          find.byKey(const Key('channels-skeleton-section-label')).first,
+        )
+        .dx;
+    final skeletonRowLabelX = tester
+        .getTopLeft(
+          find.byKey(const Key('channels-skeleton-row-label-0')).first,
+        )
+        .dx;
+    expect(skeletonSectionLabelX, skeletonRowLabelX);
+    expect(skeletonSectionLabelX, sectionLabelX);
+  });
+
+  testWidgets('reveals channel content from same-slot reconnect skeletons', (
+    tester,
+  ) async {
+    final relaySession = _ReconnectingRelaySession();
+    await tester.pumpWidget(
+      buildTestable(
+        overrides: [
+          channelsProvider.overrideWith(() => _FakeNotifier(testChannels)),
+          relaySessionProvider.overrideWith(() => relaySession),
+        ],
+      ),
+    );
+    await tester.pump();
+    await tester.pump(const Duration(seconds: 2));
+    await tester.pump();
+
+    final skeleton = find.byKey(const Key('channels-connection-skeleton'));
+    expect(skeleton, findsOneWidget);
+    expect(
+      find.descendant(of: skeleton, matching: find.byType(SkeletonBar)),
+      findsWidgets,
+    );
+    expect(
+      find.descendant(
+        of: skeleton,
+        matching: find.byType(CircularProgressIndicator),
+      ),
+      findsNothing,
+    );
+    expect(
+      tester
+          .widget<Opacity>(find.byKey(const Key('skeleton-reveal-placeholder')))
+          .opacity,
+      1,
+    );
+    expect(
+      tester
+          .widget<Opacity>(find.byKey(const Key('skeleton-reveal-content')))
+          .opacity,
+      0,
+    );
+
+    relaySession.connect();
+    await tester.pump();
+    await tester.pump();
+    expect(
+      tester.widget<SkeletonReveal>(find.byType(SkeletonReveal)).loading,
+      isFalse,
+    );
+    await tester.pump(const Duration(milliseconds: 200));
+
+    expect(
+      tester
+          .widget<Opacity>(find.byKey(const Key('skeleton-reveal-placeholder')))
+          .opacity,
+      closeTo(0.5, 0.01),
+    );
+    expect(
+      tester
+          .widget<Opacity>(find.byKey(const Key('skeleton-reveal-content')))
+          .opacity,
+      closeTo(0.5, 0.01),
+    );
+
+    await tester.pump(const Duration(milliseconds: 200));
+    expect(find.text('general'), findsOneWidget);
+  });
+
+  testWidgets('announces neutral loading outside connection transitions', (
+    tester,
+  ) async {
+    final relaySession = _ReconnectingRelaySession(
+      initialStatus: SessionStatus.connected,
+    );
+    await tester.pumpWidget(
+      buildTestable(
+        overrides: [
+          channelsProvider.overrideWith(() => _LoadingNotifier()),
+          relaySessionProvider.overrideWith(() => relaySession),
+        ],
+      ),
+    );
+    await tester.pump();
+
+    expect(
+      tester
+          .widget<Semantics>(
+            find.byKey(const Key('channels-connection-skeleton')),
+          )
+          .properties
+          .label,
+      'Loading',
+    );
   });
 
   testWidgets('opens the settings page supplied by the app layer', (
@@ -1237,6 +1442,16 @@ class _FakeNotifier extends ChannelsNotifier {
   get observedUnreadEventsByChannel => _observedEventsByChannel;
 }
 
+class _FakeChannelSectionsNotifier extends ChannelSectionsNotifier {
+  _FakeChannelSectionsNotifier(this._store);
+
+  final ChannelSectionStore _store;
+
+  @override
+  ChannelSectionsState build() =>
+      ChannelSectionsState(isReady: true, store: _store, version: 1);
+}
+
 class _FakeCommunityListNotifier extends CommunityListNotifier {
   _FakeCommunityListNotifier(this._communities);
 
@@ -1261,6 +1476,41 @@ class _ErrorNotifier extends ChannelsNotifier {
   Future<List<Channel>> build() => Future.error('Connection refused');
 }
 
+class _LoadingNotifier extends ChannelsNotifier {
+  @override
+  Future<List<Channel>> build() => Completer<List<Channel>>().future;
+}
+
+class _ReconnectingRelaySession extends RelaySessionNotifier {
+  final SessionStatus initialStatus;
+
+  _ReconnectingRelaySession({this.initialStatus = SessionStatus.reconnecting});
+
+  @override
+  SessionState build() => SessionState(status: initialStatus);
+
+  @override
+  Future<List<NostrEvent>> fetchHistory(
+    NostrFilter filter, {
+    Duration timeout = const Duration(seconds: 8),
+  }) async => [];
+
+  @override
+  Future<void Function()> subscribe(
+    NostrFilter filter,
+    void Function(NostrEvent) onEvent, {
+    void Function(String message)? onClosed,
+  }) async => () {};
+
+  void connect() {
+    state = const SessionState(status: SessionStatus.connected);
+  }
+
+  void setReconnecting() {
+    state = const SessionState(status: SessionStatus.reconnecting);
+  }
+}
+
 class _FakeProfileNotifier extends ProfileNotifier {
   @override
   Future<UserProfile?> build() async =>
@@ -1288,7 +1538,7 @@ class _FakeReadStateNotifier extends ReadStateNotifier {
       pubkey: state.pubkey,
       contexts: state.contexts,
       version: state.version + 1,
-      locallyForcedChannelIds: state.locallyForcedChannelIds,
+      forcedUnreadContexts: state.forcedUnreadContexts,
     );
   }
 
@@ -1299,7 +1549,11 @@ class _FakeReadStateNotifier extends ReadStateNotifier {
   }
 
   @override
-  void markContextRead(String contextId, int unixTimestamp) {
+  void markContextRead(
+    String contextId,
+    int unixTimestamp, {
+    bool clearForcedMessages = false,
+  }) {
     markedContexts[contextId] = unixTimestamp;
     state = state.copyWithContext(contextId, unixTimestamp);
   }
diff --git a/mobile/test/features/channels/compose_bar_test.dart b/mobile/test/features/channels/compose_bar_test.dart
index 44647493822..7b747adfacb 100644
--- a/mobile/test/features/channels/compose_bar_test.dart
+++ b/mobile/test/features/channels/compose_bar_test.dart
@@ -1,6 +1,7 @@
 import 'dart:async';
 import 'dart:convert';
 import 'dart:io';
+import 'dart:math' as math;
 
 import 'package:flutter/foundation.dart';
 import 'package:flutter/material.dart';
@@ -18,10 +19,12 @@ import 'package:buzz/features/channels/compose_bar.dart';
 import 'package:buzz/features/channels/channels_provider.dart';
 import 'package:buzz/features/channels/mentions/mention_candidates.dart';
 import 'package:buzz/features/channels/mentions/mention_candidates_provider.dart';
+import 'package:buzz/features/channels/photo_library.dart';
 import 'package:buzz/shared/custom_emoji/custom_emoji.dart';
 import 'package:buzz/shared/custom_emoji/custom_emoji_provider.dart';
 import 'package:buzz/shared/relay/relay.dart';
 import 'package:buzz/shared/theme/theme.dart';
+import 'package:shared_preferences/shared_preferences.dart';
 
 final _pngBytes = Uint8List.fromList([
   0x89,
@@ -126,6 +129,9 @@ List<int> _testPngChunk(String type, List<int> payload) {
 }
 
 const _mediaUploadPlatformChannel = MethodChannel('buzz/media_upload');
+const _nativeAttachmentPopoverChannel = MethodChannel(
+  'buzz/native_attachment_popover',
+);
 
 void _setMockMediaUploadPlatformHandler(
   Future<Object?> Function(MethodCall call)? handler,
@@ -134,6 +140,31 @@ void _setMockMediaUploadPlatformHandler(
       .setMockMethodCallHandler(_mediaUploadPlatformChannel, handler);
 }
 
+void _setMockNativeAttachmentPopoverHandler(
+  Future<Object?> Function(MethodCall call)? handler,
+) {
+  TestDefaultBinaryMessengerBinding.instance.defaultBinaryMessenger
+      .setMockMethodCallHandler(_nativeAttachmentPopoverChannel, handler);
+}
+
+Future<void> _sendNativeAttachmentPopoverCall(
+  WidgetTester tester,
+  String method, [
+  Object? arguments,
+]) async {
+  await tester.binding.defaultBinaryMessenger.handlePlatformMessage(
+    _nativeAttachmentPopoverChannel.name,
+    _nativeAttachmentPopoverChannel.codec.encodeMethodCall(
+      MethodCall(method, arguments),
+    ),
+    null,
+  );
+}
+
+/// Shared mock prefs for the compose bar's draft store. Initialized in
+/// [main].
+late SharedPreferences _testPrefs;
+
 Widget _buildComposeBar({
   required MediaUploadService uploadService,
   required ComposeBarOnSend onSend,
@@ -143,12 +174,16 @@ Widget _buildComposeBar({
   List<Channel> channels = const <Channel>[],
   String? currentPubkey,
   bool? supportsShowingSystemContextMenu,
+  TextScaler? textScaler,
   List<CustomEmoji> customEmoji = const <CustomEmoji>[],
+  RelayConfigNotifier Function()? relayConfig,
+  PhotoLibrary photoLibrary = const _EmptyPhotoLibrary(),
 }) {
   return ProviderScope(
     overrides: [
       customEmojiListProvider.overrideWithValue(customEmoji),
       mediaUploadServiceProvider.overrideWithValue(uploadService),
+      photoLibraryProvider.overrideWithValue(photoLibrary),
       currentPubkeyProvider.overrideWith((ref) => currentPubkey),
       channelMembersProvider(
         'channel-1',
@@ -158,17 +193,22 @@ Widget _buildComposeBar({
       relayClientProvider.overrideWithValue(
         RelayClient(baseUrl: 'http://localhost:3000'),
       ),
-      relayConfigProvider.overrideWith(() => _FakeRelayConfigNotifier()),
+      relayConfigProvider.overrideWith(
+        relayConfig ?? _FakeRelayConfigNotifier.new,
+      ),
+      savedPrefsProvider.overrideWithValue(_testPrefs),
       channelsProvider.overrideWith(() => _FakeChannelsNotifier(channels)),
     ],
     child: MaterialApp(
       theme: AppTheme.light(),
-      builder: supportsShowingSystemContextMenu == null
+      builder: supportsShowingSystemContextMenu == null && textScaler == null
           ? null
           : (context, child) => MediaQuery(
               data: MediaQuery.of(context).copyWith(
                 supportsShowingSystemContextMenu:
-                    supportsShowingSystemContextMenu,
+                    supportsShowingSystemContextMenu ??
+                    MediaQuery.of(context).supportsShowingSystemContextMenu,
+                textScaler: textScaler ?? MediaQuery.textScalerOf(context),
               ),
               child: child!,
             ),
@@ -184,6 +224,54 @@ Widget _buildComposeBar({
   );
 }
 
+Widget _buildNativePopoverOwnershipHarness({
+  required MediaUploadService uploadService,
+  required bool includeFirstComposer,
+}) {
+  return ProviderScope(
+    overrides: [
+      customEmojiListProvider.overrideWithValue(const []),
+      mediaUploadServiceProvider.overrideWithValue(uploadService),
+      photoLibraryProvider.overrideWithValue(const _EmptyPhotoLibrary()),
+      currentPubkeyProvider.overrideWith((ref) => null),
+      channelMembersProvider(
+        'channel-1',
+      ).overrideWith((ref) => Future.value(const <ChannelMember>[])),
+      agentDirectoryProvider.overrideWith(
+        (ref) async => const <AgentDirectoryEntry>[],
+      ),
+      agentOwnersProvider.overrideWith((ref) async => const <String, String>{}),
+      relayClientProvider.overrideWithValue(
+        RelayClient(baseUrl: 'http://localhost:3000'),
+      ),
+      relayConfigProvider.overrideWith(_FakeRelayConfigNotifier.new),
+      savedPrefsProvider.overrideWithValue(_testPrefs),
+      channelsProvider.overrideWith(() => _FakeChannelsNotifier(const [])),
+    ],
+    child: MaterialApp(
+      theme: AppTheme.light(),
+      home: Scaffold(
+        body: Column(
+          mainAxisAlignment: MainAxisAlignment.end,
+          children: [
+            if (includeFirstComposer)
+              ComposeBar(
+                key: const ValueKey('first-composer'),
+                channelId: 'channel-1',
+                onSend: (_, _, {mediaTags = const []}) async {},
+              ),
+            ComposeBar(
+              key: const ValueKey('second-composer'),
+              channelId: 'channel-1',
+              onSend: (_, _, {mediaTags = const []}) async {},
+            ),
+          ],
+        ),
+      ),
+    ),
+  );
+}
+
 class _FakeRelayConfigNotifier extends RelayConfigNotifier {
   @override
   RelayConfig build() => RelayConfig(
@@ -192,6 +280,44 @@ class _FakeRelayConfigNotifier extends RelayConfigNotifier {
   );
 }
 
+class _EmptyPhotoLibrary implements PhotoLibrary {
+  const _EmptyPhotoLibrary();
+
+  @override
+  Future<List<RecentPhoto>> loadRecentPhotos() async => const [];
+
+  @override
+  Future<List<XFile>> resolveSelectedPhotos(List<RecentPhoto> photos) async =>
+      const [];
+}
+
+class _FakePhotoLibrary implements PhotoLibrary {
+  final List<RecentPhoto> photos;
+
+  const _FakePhotoLibrary(this.photos);
+
+  @override
+  Future<List<RecentPhoto>> loadRecentPhotos() async => photos;
+
+  @override
+  Future<List<XFile>> resolveSelectedPhotos(List<RecentPhoto> photos) async => [
+    for (final photo in photos)
+      XFile.fromData(_pngBytes, name: '${photo.id}.png'),
+  ];
+}
+
+/// Relay config that starts from a fixed identity and can be switched
+/// in place via [RelayConfigNotifier.update] — simulates a community or
+/// account switch while widgets stay mounted.
+class _SwitchableRelayConfigNotifier extends RelayConfigNotifier {
+  final RelayConfig initial;
+
+  _SwitchableRelayConfigNotifier(this.initial);
+
+  @override
+  RelayConfig build() => initial;
+}
+
 class _RecordingRelaySocket extends RelaySocket {
   final List<Map<String, dynamic>> events;
   final void Function(List<dynamic> message) handleMessage;
@@ -241,6 +367,11 @@ class _FakeChannelsNotifier extends ChannelsNotifier {
 void main() {
   TestWidgetsFlutterBinding.ensureInitialized();
 
+  setUp(() async {
+    SharedPreferences.setMockInitialValues({});
+    _testPrefs = await SharedPreferences.getInstance();
+  });
+
   setUpAll(() {
     _setMockMediaUploadPlatformHandler((call) async {
       switch (call.method) {
@@ -261,72 +392,756 @@ void main() {
     _setMockMediaUploadPlatformHandler(null);
   });
 
-  group('ComposeBar', () {
-    testWidgets('inserts a community emoji at the cursor from the action row', (
+  group('ComposeBar', () {
+    testWidgets('mounted composer does not carry draft text across an in-place '
+        'identity switch', (tester) async {
+      final keysA = nostr.Keys.generate();
+      final keysB = nostr.Keys.generate();
+      const relayUrl = 'http://localhost:3000';
+
+      await tester.pumpWidget(
+        _buildComposeBar(
+          uploadService: _testUploadService(keysA.nsec),
+          relayConfig: () => _SwitchableRelayConfigNotifier(
+            RelayConfig(baseUrl: relayUrl, nsec: keysA.nsec),
+          ),
+          onSend:
+              (
+                content,
+                mentionPubkeys, {
+                mediaTags = const <List<String>>[],
+              }) async {},
+        ),
+      );
+
+      String? storedText(nostr.Keys keys) {
+        final raw = _testPrefs.getString(
+          'compose_drafts_v1:$relayUrl:${keys.public}',
+        );
+        if (raw == null) return null;
+        final drafts = jsonDecode(raw) as List;
+        if (drafts.isEmpty) return null;
+        return (drafts.first as Map<String, dynamic>)['text'] as String?;
+      }
+
+      // Identity A types a draft; it persists into A's namespaced store.
+      await _expandComposer(tester);
+      await tester.enterText(find.byType(TextField), 'identity A secret draft');
+      await tester.pump();
+      expect(storedText(keysA), 'identity A secret draft');
+
+      // Switch identity in place while the composer stays mounted.
+      final container = ProviderScope.containerOf(
+        tester.element(find.byType(ComposeBar)),
+      );
+      container
+          .read(relayConfigProvider.notifier)
+          .update(baseUrl: relayUrl, nsec: keysB.nsec);
+      await tester.pumpAndSettle();
+
+      // The mounted composer must not carry identity A's text forward.
+      final textField = tester.widget<TextField>(find.byType(TextField));
+      expect(textField.controller!.text, isEmpty);
+      expect(storedText(keysB), isNull);
+
+      // Identity B's edits persist only into B's store; A's is untouched.
+      await tester.enterText(find.byType(TextField), 'identity B text');
+      await tester.pump();
+      expect(storedText(keysB), 'identity B text');
+      expect(storedText(keysA), 'identity A secret draft');
+
+      // Switching back restores identity A's own draft into the composer.
+      container
+          .read(relayConfigProvider.notifier)
+          .update(baseUrl: relayUrl, nsec: keysA.nsec);
+      await tester.pumpAndSettle();
+      expect(textField.controller!.text, 'identity A secret draft');
+      expect(storedText(keysB), 'identity B text');
+    });
+
+    testWidgets('inserts a community emoji at the cursor from the action row', (
+      tester,
+    ) async {
+      await tester.pumpWidget(
+        _buildComposeBar(
+          uploadService: _testUploadService(nostr.Keys.generate().nsec),
+          customEmoji: const [
+            CustomEmoji(shortcode: 'meow', url: 'https://example.com/meow.png'),
+          ],
+          onSend:
+              (
+                content,
+                mentionPubkeys, {
+                mediaTags = const <List<String>>[],
+              }) async {},
+        ),
+      );
+
+      await _expandComposer(tester);
+      await tester.enterText(find.byType(TextField), 'hello world');
+      final textField = tester.widget<TextField>(find.byType(TextField));
+      textField.controller!.selection = const TextSelection.collapsed(
+        offset: 6,
+      );
+
+      await tester.tap(find.byIcon(LucideIcons.smilePlus));
+      await tester.pumpAndSettle();
+      await tester.tap(find.byIcon(LucideIcons.sparkles));
+      await tester.pump();
+      await tester.tap(find.byTooltip(':meow:'));
+      await tester.pumpAndSettle();
+
+      expect(textField.controller!.text, 'hello :meow:world');
+      expect(textField.controller!.selection.baseOffset, 12);
+    });
+
+    testWidgets('native All Photos picker failures show an error', (
+      tester,
+    ) async {
+      final previousPlatform = debugDefaultTargetPlatformOverride;
+      debugDefaultTargetPlatformOverride = TargetPlatform.iOS;
+      _setMockNativeAttachmentPopoverHandler((call) async {
+        return switch (call.method) {
+          'isSupported' || 'present' => true,
+          'dismiss' => null,
+          _ => null,
+        };
+      });
+      final uploadService = MediaUploadService(
+        baseUrl: 'https://relay.example',
+        nsec: nostr.Keys.generate().nsec,
+        pickGalleryImage: () async => null,
+        pickGalleryImages: () async =>
+            throw PlatformException(code: 'photo_picker_failed'),
+        pickGalleryVideo: () async => null,
+      );
+
+      try {
+        await tester.pumpWidget(
+          _buildComposeBar(
+            uploadService: uploadService,
+            onSend:
+                (
+                  content,
+                  mentionPubkeys, {
+                  mediaTags = const <List<String>>[],
+                }) async {},
+          ),
+        );
+
+        await tester.tap(find.byTooltip('Add attachment').hitTestable());
+        await tester.pumpAndSettle();
+        await _sendNativeAttachmentPopoverCall(tester, 'pickAllPhotos');
+        await _sendNativeAttachmentPopoverCall(tester, 'dismissed');
+        await tester.pumpAndSettle();
+
+        expect(find.text('Unable to open your photo library.'), findsOneWidget);
+      } finally {
+        await _sendNativeAttachmentPopoverCall(tester, 'dismissed');
+        await tester.pumpWidget(const SizedBox.shrink());
+        _setMockNativeAttachmentPopoverHandler(null);
+        debugDefaultTargetPlatformOverride = previousPlatform;
+      }
+    });
+
+    testWidgets('opening the native attachment popover keeps composer focus', (
+      tester,
+    ) async {
+      final previousPlatform = debugDefaultTargetPlatformOverride;
+      debugDefaultTargetPlatformOverride = TargetPlatform.iOS;
+      var presentCalls = 0;
+      _setMockNativeAttachmentPopoverHandler((call) async {
+        switch (call.method) {
+          case 'isSupported':
+            return true;
+          case 'present':
+            presentCalls += 1;
+            return true;
+          case 'dismiss':
+            return null;
+        }
+        return null;
+      });
+
+      try {
+        await tester.pumpWidget(
+          _buildComposeBar(
+            uploadService: _testUploadService(nostr.Keys.generate().nsec),
+            onSend:
+                (
+                  content,
+                  mentionPubkeys, {
+                  mediaTags = const <List<String>>[],
+                }) async {},
+          ),
+        );
+
+        await _expandComposer(tester);
+        await tester.enterText(find.byType(TextField), 'Hello');
+        await tester.pumpAndSettle();
+
+        final textField = tester.widget<TextField>(find.byType(TextField));
+        expect(textField.focusNode?.hasFocus, isTrue);
+
+        await tester.tap(find.byTooltip('Add attachment').hitTestable());
+        await tester.pumpAndSettle();
+
+        expect(presentCalls, 1);
+        expect(textField.focusNode?.hasFocus, isTrue);
+      } finally {
+        await _sendNativeAttachmentPopoverCall(tester, 'dismissed');
+        await tester.pumpWidget(const SizedBox.shrink());
+        _setMockNativeAttachmentPopoverHandler(null);
+        debugDefaultTargetPlatformOverride = previousPlatform;
+      }
+    });
+
+    testWidgets(
+      'unsupported iOS attachment popover unfocuses before fallback menu',
+      (tester) async {
+        final previousPlatform = debugDefaultTargetPlatformOverride;
+        debugDefaultTargetPlatformOverride = TargetPlatform.iOS;
+        _setMockNativeAttachmentPopoverHandler((call) async {
+          return switch (call.method) {
+            'isSupported' => false,
+            'dismiss' => null,
+            _ => null,
+          };
+        });
+
+        try {
+          await tester.pumpWidget(
+            _buildComposeBar(
+              uploadService: _testUploadService(nostr.Keys.generate().nsec),
+              onSend:
+                  (
+                    content,
+                    mentionPubkeys, {
+                    mediaTags = const <List<String>>[],
+                  }) async {},
+            ),
+          );
+
+          await _expandComposer(tester);
+          await tester.enterText(find.byType(TextField), 'Hello');
+          await tester.pumpAndSettle();
+
+          final textField = tester.widget<TextField>(find.byType(TextField));
+          expect(textField.focusNode?.hasFocus, isTrue);
+
+          await tester.tap(find.byTooltip('Add attachment').hitTestable());
+          await tester.pumpAndSettle();
+
+          expect(textField.focusNode?.hasFocus, isFalse);
+          expect(find.byKey(const ValueKey('attachment-menu')), findsOneWidget);
+        } finally {
+          await tester.pumpWidget(const SizedBox.shrink());
+          _setMockNativeAttachmentPopoverHandler(null);
+          debugDefaultTargetPlatformOverride = previousPlatform;
+        }
+      },
+    );
+
+    testWidgets('disposing a non-owner keeps native popover callbacks active', (
+      tester,
+    ) async {
+      final previousPlatform = debugDefaultTargetPlatformOverride;
+      debugDefaultTargetPlatformOverride = TargetPlatform.iOS;
+      var presentCalls = 0;
+      var dismissCalls = 0;
+      var pickAllPhotosCalls = 0;
+      _setMockNativeAttachmentPopoverHandler((call) async {
+        switch (call.method) {
+          case 'isSupported':
+            return true;
+          case 'present':
+            presentCalls += 1;
+            return true;
+          case 'dismiss':
+            dismissCalls += 1;
+            return null;
+        }
+        return null;
+      });
+      final uploadService = MediaUploadService(
+        baseUrl: 'https://relay.example',
+        nsec: nostr.Keys.generate().nsec,
+        pickGalleryImage: () async => null,
+        pickGalleryImages: () async {
+          pickAllPhotosCalls += 1;
+          return const [];
+        },
+        pickGalleryVideo: () async => null,
+      );
+
+      try {
+        await tester.pumpWidget(
+          _buildNativePopoverOwnershipHarness(
+            uploadService: uploadService,
+            includeFirstComposer: true,
+          ),
+        );
+
+        await tester.tap(find.byTooltip('Add attachment').hitTestable().at(1));
+        await tester.pumpAndSettle();
+        expect(presentCalls, 1);
+
+        await tester.pumpWidget(
+          _buildNativePopoverOwnershipHarness(
+            uploadService: uploadService,
+            includeFirstComposer: false,
+          ),
+        );
+        await tester.pumpAndSettle();
+        expect(dismissCalls, 0);
+
+        await _sendNativeAttachmentPopoverCall(tester, 'pickAllPhotos');
+        await tester.pumpAndSettle();
+        expect(pickAllPhotosCalls, 1);
+
+        await _sendNativeAttachmentPopoverCall(tester, 'dismissed');
+      } finally {
+        await _sendNativeAttachmentPopoverCall(tester, 'dismissed');
+        await tester.pumpWidget(const SizedBox.shrink());
+        _setMockNativeAttachmentPopoverHandler(null);
+        debugDefaultTargetPlatformOverride = previousPlatform;
+      }
+    });
+
+    testWidgets(
+      'a pending native popover does not claim another composer tap',
+      (tester) async {
+        final previousPlatform = debugDefaultTargetPlatformOverride;
+        debugDefaultTargetPlatformOverride = TargetPlatform.iOS;
+        final supportResult = Completer<bool>();
+        var supportCalls = 0;
+        var presentCalls = 0;
+        _setMockNativeAttachmentPopoverHandler((call) async {
+          switch (call.method) {
+            case 'isSupported':
+              supportCalls += 1;
+              return supportResult.future;
+            case 'present':
+              presentCalls += 1;
+              return true;
+            case 'dismiss':
+              return null;
+          }
+          return null;
+        });
+        final uploadService = MediaUploadService(
+          baseUrl: 'https://relay.example',
+          nsec: nostr.Keys.generate().nsec,
+          pickGalleryImage: () async => null,
+          pickGalleryImages: () async => const [],
+          pickGalleryVideo: () async => null,
+        );
+
+        try {
+          await tester.pumpWidget(
+            _buildNativePopoverOwnershipHarness(
+              uploadService: uploadService,
+              includeFirstComposer: true,
+            ),
+          );
+
+          await tester.tap(
+            find.byTooltip('Add attachment').hitTestable().at(0),
+          );
+          await tester.pump();
+          await tester.tap(
+            find.byTooltip('Add attachment').hitTestable().at(1),
+          );
+          await tester.pumpAndSettle();
+
+          expect(supportCalls, 1);
+          expect(presentCalls, 0);
+          expect(
+            find.descendant(
+              of: find.byKey(const ValueKey('first-composer')),
+              matching: find.byTooltip('Close attachments'),
+            ),
+            findsNothing,
+          );
+          expect(
+            find.descendant(
+              of: find.byKey(const ValueKey('second-composer')),
+              matching: find.byTooltip('Close attachments'),
+            ),
+            findsWidgets,
+          );
+
+          supportResult.complete(true);
+          await tester.pumpAndSettle();
+          expect(presentCalls, 0);
+          expect(
+            find.descendant(
+              of: find.byKey(const ValueKey('first-composer')),
+              matching: find.byTooltip('Close attachments'),
+            ),
+            findsNothing,
+          );
+        } finally {
+          if (!supportResult.isCompleted) supportResult.complete(false);
+          await _sendNativeAttachmentPopoverCall(tester, 'dismissed');
+          await tester.pumpWidget(const SizedBox.shrink());
+          _setMockNativeAttachmentPopoverHandler(null);
+          debugDefaultTargetPlatformOverride = previousPlatform;
+        }
+      },
+    );
+
+    testWidgets('a repeated owner tap keeps its pending native presentation', (
+      tester,
+    ) async {
+      final previousPlatform = debugDefaultTargetPlatformOverride;
+      debugDefaultTargetPlatformOverride = TargetPlatform.iOS;
+      final supportResult = Completer<bool>();
+      var supportCalls = 0;
+      var presentCalls = 0;
+      _setMockNativeAttachmentPopoverHandler((call) async {
+        switch (call.method) {
+          case 'isSupported':
+            supportCalls += 1;
+            return supportResult.future;
+          case 'present':
+            presentCalls += 1;
+            return true;
+          case 'dismiss':
+            return null;
+        }
+        return null;
+      });
+      final uploadService = MediaUploadService(
+        baseUrl: 'https://relay.example',
+        nsec: nostr.Keys.generate().nsec,
+        pickGalleryImage: () async => null,
+        pickGalleryImages: () async => const [],
+        pickGalleryVideo: () async => null,
+      );
+
+      try {
+        await tester.pumpWidget(
+          _buildNativePopoverOwnershipHarness(
+            uploadService: uploadService,
+            includeFirstComposer: false,
+          ),
+        );
+
+        await tester.tap(find.byTooltip('Add attachment').hitTestable());
+        await tester.pump();
+        await tester.tap(find.byTooltip('Add attachment').hitTestable());
+        await tester.pumpAndSettle();
+
+        expect(supportCalls, 1);
+        expect(presentCalls, 0);
+
+        supportResult.complete(true);
+        await tester.pumpAndSettle();
+
+        expect(presentCalls, 1);
+        expect(find.byTooltip('Close attachments'), findsNothing);
+      } finally {
+        if (!supportResult.isCompleted) supportResult.complete(false);
+        await _sendNativeAttachmentPopoverCall(tester, 'dismissed');
+        await tester.pumpWidget(const SizedBox.shrink());
+        _setMockNativeAttachmentPopoverHandler(null);
+        debugDefaultTargetPlatformOverride = previousPlatform;
+      }
+    });
+
+    testWidgets('disposing the native popover owner releases ownership', (
+      tester,
+    ) async {
+      final previousPlatform = debugDefaultTargetPlatformOverride;
+      debugDefaultTargetPlatformOverride = TargetPlatform.iOS;
+      var presentCalls = 0;
+      var dismissCalls = 0;
+      _setMockNativeAttachmentPopoverHandler((call) async {
+        switch (call.method) {
+          case 'isSupported':
+            return true;
+          case 'present':
+            presentCalls += 1;
+            return true;
+          case 'dismiss':
+            dismissCalls += 1;
+            return null;
+        }
+        return null;
+      });
+      final uploadService = MediaUploadService(
+        baseUrl: 'https://relay.example',
+        nsec: nostr.Keys.generate().nsec,
+        pickGalleryImage: () async => null,
+        pickGalleryImages: () async => const [],
+        pickGalleryVideo: () async => null,
+      );
+
+      try {
+        await tester.pumpWidget(
+          _buildNativePopoverOwnershipHarness(
+            uploadService: uploadService,
+            includeFirstComposer: true,
+          ),
+        );
+
+        await tester.tap(find.byTooltip('Add attachment').hitTestable().at(0));
+        await tester.pumpAndSettle();
+        expect(presentCalls, 1);
+
+        await tester.pumpWidget(
+          _buildNativePopoverOwnershipHarness(
+            uploadService: uploadService,
+            includeFirstComposer: false,
+          ),
+        );
+        await tester.pumpAndSettle();
+        expect(dismissCalls, 1);
+
+        await tester.tap(find.byTooltip('Add attachment').hitTestable());
+        await tester.pumpAndSettle();
+        expect(presentCalls, 2);
+      } finally {
+        await _sendNativeAttachmentPopoverCall(tester, 'dismissed');
+        await tester.pumpWidget(const SizedBox.shrink());
+        _setMockNativeAttachmentPopoverHandler(null);
+        debugDefaultTargetPlatformOverride = previousPlatform;
+      }
+    });
+
+    testWidgets('missing native dismiss bridge still releases ownership', (
+      tester,
+    ) async {
+      final previousPlatform = debugDefaultTargetPlatformOverride;
+      debugDefaultTargetPlatformOverride = TargetPlatform.iOS;
+      var presentCalls = 0;
+      _setMockNativeAttachmentPopoverHandler((call) async {
+        switch (call.method) {
+          case 'isSupported':
+            return true;
+          case 'present':
+            presentCalls += 1;
+            return true;
+          case 'dismiss':
+            throw MissingPluginException('dismiss is unavailable');
+        }
+        return null;
+      });
+      final uploadService = MediaUploadService(
+        baseUrl: 'https://relay.example',
+        nsec: nostr.Keys.generate().nsec,
+        pickGalleryImage: () async => null,
+        pickGalleryImages: () async => const [],
+        pickGalleryVideo: () async => null,
+      );
+
+      try {
+        await tester.pumpWidget(
+          _buildNativePopoverOwnershipHarness(
+            uploadService: uploadService,
+            includeFirstComposer: true,
+          ),
+        );
+
+        await tester.tap(find.byTooltip('Add attachment').hitTestable().at(0));
+        await tester.pumpAndSettle();
+        expect(presentCalls, 1);
+
+        await tester.pumpWidget(
+          _buildNativePopoverOwnershipHarness(
+            uploadService: uploadService,
+            includeFirstComposer: false,
+          ),
+        );
+        await tester.pumpAndSettle();
+
+        await tester.tap(find.byTooltip('Add attachment').hitTestable());
+        await tester.pumpAndSettle();
+        expect(presentCalls, 2);
+      } finally {
+        await _sendNativeAttachmentPopoverCall(tester, 'dismissed');
+        await tester.pumpWidget(const SizedBox.shrink());
+        _setMockNativeAttachmentPopoverHandler(null);
+        debugDefaultTargetPlatformOverride = previousPlatform;
+      }
+    });
+
+    testWidgets('uploads an image and sends markdown plus imeta tags', (
+      tester,
+    ) async {
+      final keychain = nostr.Keys.generate();
+      final nsec = keychain.nsec;
+      final uploadService = MediaUploadService(
+        baseUrl: 'https://relay.example',
+        nsec: nsec,
+        httpClient: http_testing.MockClient((request) async {
+          return http.Response(
+            jsonEncode({
+              'url': 'https://relay.example/media/test.png',
+              'sha256':
+                  '0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef',
+              'size': 16,
+              'type': 'image/png',
+              'uploaded': 1,
+              'thumb': 'https://relay.example/media/test.thumb.jpg',
+            }),
+            200,
+          );
+        }),
+        pickGalleryVideo: () async => null,
+        pickGalleryImage: () async =>
+            XFile.fromData(_pngBytes, name: 'tiny.png'),
+      );
+
+      String? sentContent;
+      List<List<String>> sentMediaTags = const [];
+      await tester.pumpWidget(
+        _buildComposeBar(
+          uploadService: uploadService,
+          onSend:
+              (
+                content,
+                mentionPubkeys, {
+                mediaTags = const <List<String>>[],
+              }) async {
+                sentContent = content;
+                sentMediaTags = mediaTags;
+              },
+        ),
+      );
+
+      await _openSystemPhotoPicker(tester);
+      await tester.pumpAndSettle();
+
+      expect(find.byTooltip('Remove attachment'), findsOneWidget);
+
+      await _expandComposer(tester);
+      await tester.tap(find.byIcon(LucideIcons.arrowUp));
+      await tester.pump();
+      await tester.pumpAndSettle();
+
+      expect(sentContent, '\n![image](https://relay.example/media/test.png)');
+      expect(sentMediaTags, hasLength(1));
+      expect(sentMediaTags.first.first, 'imeta');
+      expect(
+        sentMediaTags.first,
+        contains('url https://relay.example/media/test.png'),
+      );
+      expect(find.byTooltip('Remove attachment'), findsNothing);
+    });
+
+    testWidgets('uploads multiple system-selected photos in picker order', (
       tester,
     ) async {
+      final uploadService = MediaUploadService(
+        baseUrl: 'https://relay.example',
+        nsec: nostr.Keys.generate().nsec,
+        httpClient: http_testing.MockClient((request) async {
+          final mimeType = request.headers.entries
+              .firstWhere((entry) => entry.key.toLowerCase() == 'content-type')
+              .value;
+          final isGif = mimeType == 'image/gif';
+          return http.Response(
+            jsonEncode({
+              'url': isGif
+                  ? 'https://relay.example/media/two.gif'
+                  : 'https://relay.example/media/one.png',
+              'sha256': isGif
+                  ? '2222222222222222222222222222222222222222222222222222222222222222'
+                  : '1111111111111111111111111111111111111111111111111111111111111111',
+              'size': request.bodyBytes.length,
+              'type': mimeType,
+              'uploaded': 1,
+            }),
+            200,
+          );
+        }),
+        pickGalleryImage: () async => null,
+        pickGalleryImages: () async => [
+          XFile.fromData(_pngBytes, name: 'one.png'),
+          XFile.fromData(_gifBytes, name: 'two.gif'),
+        ],
+        pickGalleryVideo: () async => null,
+      );
+
+      String? sentContent;
+      List<List<String>> sentMediaTags = const [];
       await tester.pumpWidget(
         _buildComposeBar(
-          uploadService: _testUploadService(nostr.Keys.generate().nsec),
-          customEmoji: const [
-            CustomEmoji(shortcode: 'meow', url: 'https://example.com/meow.png'),
-          ],
+          uploadService: uploadService,
           onSend:
               (
                 content,
                 mentionPubkeys, {
                 mediaTags = const <List<String>>[],
-              }) async {},
+              }) async {
+                sentContent = content;
+                sentMediaTags = mediaTags;
+              },
         ),
       );
 
-      await _expandComposer(tester);
-      await tester.enterText(find.byType(TextField), 'hello world');
-      final textField = tester.widget<TextField>(find.byType(TextField));
-      textField.controller!.selection = const TextSelection.collapsed(
-        offset: 6,
-      );
-
-      await tester.tap(find.byIcon(LucideIcons.smilePlus));
+      await _openSystemPhotoPicker(tester);
       await tester.pumpAndSettle();
-      await tester.tap(find.byIcon(LucideIcons.sparkles));
-      await tester.pump();
-      await tester.tap(find.byTooltip(':meow:'));
+
+      expect(find.byTooltip('Remove attachment'), findsNWidgets(2));
+
+      await _expandComposer(tester);
+      await tester.tap(find.byIcon(LucideIcons.arrowUp));
       await tester.pumpAndSettle();
 
-      expect(textField.controller!.text, 'hello :meow:world');
-      expect(textField.controller!.selection.baseOffset, 12);
+      expect(
+        sentContent,
+        '\n![image](https://relay.example/media/one.png)'
+        '\n![image](https://relay.example/media/two.gif)',
+      );
+      expect(sentMediaTags, hasLength(2));
+      expect(sentMediaTags.map((tag) => tag[1]), [
+        'url https://relay.example/media/one.png',
+        'url https://relay.example/media/two.gif',
+      ]);
     });
 
-    testWidgets('uploads an image and sends markdown plus imeta tags', (
+    testWidgets('bounds concurrent system-selected photo uploads', (
       tester,
     ) async {
-      final keychain = nostr.Keys.generate();
-      final nsec = keychain.nsec;
+      final releaseFirstBatch = Completer<void>();
+      var requestsStarted = 0;
+      var activeRequests = 0;
+      var peakActiveRequests = 0;
       final uploadService = MediaUploadService(
         baseUrl: 'https://relay.example',
-        nsec: nsec,
+        nsec: nostr.Keys.generate().nsec,
         httpClient: http_testing.MockClient((request) async {
+          requestsStarted += 1;
+          final requestNumber = requestsStarted;
+          activeRequests += 1;
+          peakActiveRequests = math.max(peakActiveRequests, activeRequests);
+          if (requestNumber <= 3) {
+            await releaseFirstBatch.future;
+          }
+          activeRequests -= 1;
           return http.Response(
             jsonEncode({
-              'url': 'https://relay.example/media/test.png',
+              'url': 'https://relay.example/media/photo-$requestNumber.png',
               'sha256':
-                  '0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef',
-              'size': 16,
+                  '1111111111111111111111111111111111111111111111111111111111111111',
+              'size': request.bodyBytes.length,
               'type': 'image/png',
               'uploaded': 1,
-              'thumb': 'https://relay.example/media/test.thumb.jpg',
             }),
             200,
           );
         }),
+        pickGalleryImage: () async => null,
+        pickGalleryImages: () async => [
+          for (var index = 0; index < 5; index += 1)
+            XFile.fromData(_pngBytes, name: 'photo-$index.png'),
+        ],
         pickGalleryVideo: () async => null,
-        pickGalleryImage: () async =>
-            XFile.fromData(_pngBytes, name: 'tiny.png'),
       );
 
-      String? sentContent;
-      List<List<String>> sentMediaTags = const [];
       await tester.pumpWidget(
         _buildComposeBar(
           uploadService: uploadService,
@@ -335,10 +1150,45 @@ void main() {
                 content,
                 mentionPubkeys, {
                 mediaTags = const <List<String>>[],
-              }) async {
-                sentContent = content;
-                sentMediaTags = mediaTags;
-              },
+              }) async {},
+        ),
+      );
+
+      await _openSystemPhotoPicker(tester);
+      for (var frame = 0; frame < 20 && requestsStarted < 3; frame += 1) {
+        await tester.pump(const Duration(milliseconds: 20));
+      }
+
+      expect(requestsStarted, 3);
+      expect(peakActiveRequests, 3);
+
+      releaseFirstBatch.complete();
+      await tester.pumpAndSettle();
+
+      expect(requestsStarted, 5);
+      expect(peakActiveRequests, 3);
+      expect(find.byTooltip('Remove attachment'), findsNWidgets(5));
+    });
+
+    testWidgets('numbers recent photo selection and returns to the menu', (
+      tester,
+    ) async {
+      final photoLibrary = _FakePhotoLibrary([
+        RecentPhoto(id: 'one', thumbnailBytes: _gifBytes),
+        RecentPhoto(id: 'two', thumbnailBytes: _gifBytes),
+        RecentPhoto(id: 'three', thumbnailBytes: _gifBytes),
+      ]);
+
+      await tester.pumpWidget(
+        _buildComposeBar(
+          uploadService: _testUploadService(nostr.Keys.generate().nsec),
+          photoLibrary: photoLibrary,
+          onSend:
+              (
+                content,
+                mentionPubkeys, {
+                mediaTags = const <List<String>>[],
+              }) async {},
         ),
       );
 
@@ -346,32 +1196,268 @@ void main() {
       await tester.tap(find.text('Photos'));
       await tester.pumpAndSettle();
 
-      expect(find.byTooltip('Remove attachment'), findsOneWidget);
+      expect(
+        find.byKey(const ValueKey('photo-gallery-picker')),
+        findsOneWidget,
+      );
+      expect(find.byTooltip('Back to attachment options'), findsWidgets);
+      expect(find.text('All photos'), findsOneWidget);
 
-      await _expandComposer(tester);
-      await tester.tap(find.byIcon(LucideIcons.arrowUp));
-      await tester.pump();
+      await tester.tap(find.byKey(const ValueKey('recent-photo-two')));
+      await tester.pumpAndSettle();
+      await tester.tap(find.byKey(const ValueKey('recent-photo-one')));
       await tester.pumpAndSettle();
 
-      expect(sentContent, '\n![image](https://relay.example/media/test.png)');
-      expect(sentMediaTags, hasLength(1));
-      expect(sentMediaTags.first.first, 'imeta');
+      expect(find.text('Add 2 photos'), findsOneWidget);
       expect(
-        sentMediaTags.first,
-        contains('url https://relay.example/media/test.png'),
+        find.descendant(
+          of: find.byKey(const ValueKey('photo-selection-index-two')),
+          matching: find.text('1'),
+        ),
+        findsOneWidget,
+      );
+      expect(
+        find.descendant(
+          of: find.byKey(const ValueKey('photo-selection-index-one')),
+          matching: find.text('2'),
+        ),
+        findsOneWidget,
+      );
+
+      await tester.tap(find.byKey(const ValueKey('recent-photo-two')));
+      await tester.pumpAndSettle();
+
+      expect(find.text('Add 1 photo'), findsOneWidget);
+      expect(
+        find.descendant(
+          of: find.byKey(const ValueKey('photo-selection-index-one')),
+          matching: find.text('1'),
+        ),
+        findsOneWidget,
+      );
+
+      await tester.tap(find.byKey(const ValueKey('photo-gallery-back')));
+      await tester.pumpAndSettle();
+
+      expect(find.byKey(const ValueKey('photo-gallery-picker')), findsNothing);
+      expect(
+        find.byKey(const ValueKey('attachment-trigger-menu')).hitTestable(),
+        findsOneWidget,
+      );
+      expect(find.text('Camera'), findsOneWidget);
+      expect(find.text('Photos'), findsOneWidget);
+    });
+
+    testWidgets('attachment menu uses roomy rows and surrounding padding', (
+      tester,
+    ) async {
+      await tester.pumpWidget(
+        _buildComposeBar(
+          uploadService: _testUploadService(nostr.Keys.generate().nsec),
+          onSend:
+              (
+                content,
+                mentionPubkeys, {
+                mediaTags = const <List<String>>[],
+              }) async {},
+        ),
+      );
+
+      await _openAttachmentMenu(tester);
+
+      final menu = find.byKey(const ValueKey('attachment-menu'));
+      final rows = [
+        for (final label in ['camera', 'photos', 'video', 'files'])
+          find.byKey(ValueKey('attachment-menu-item-$label')),
+      ];
+      final menuRect = tester.getRect(menu);
+
+      expect(menuRect.size, const Size(216, 264));
+      for (final row in rows) {
+        expect(tester.getSize(row).height, 52);
+        expect(tester.getRect(row).left - menuRect.left, Grid.xs);
+        expect(menuRect.right - tester.getRect(row).right, Grid.xs);
+      }
+      for (final label in ['Camera', 'Photos', 'Video', 'Files']) {
+        final text = tester.widget<Text>(find.text(label));
+        expect(text.style?.fontSize, 20);
+      }
+      final icons = [
+        for (final label in ['camera', 'photos', 'video', 'files'])
+          find.byKey(ValueKey('attachment-menu-icon-$label')),
+      ];
+      final labels = [
+        for (final label in ['camera', 'photos', 'video', 'files'])
+          find.byKey(ValueKey('attachment-menu-label-$label')),
+      ];
+      for (final icon in icons) {
+        expect(tester.getSize(icon).width, 28);
+        expect(
+          tester
+              .widget<Icon>(
+                find.descendant(of: icon, matching: find.byType(Icon)),
+              )
+              .size,
+          24,
+        );
+      }
+      final labelLeft = tester.getRect(labels.first).left;
+      for (var index = 0; index < labels.length; index += 1) {
+        expect(tester.getRect(labels[index]).left, labelLeft);
+        expect(
+          tester.getRect(labels[index]).center.dy,
+          tester.getRect(rows[index]).center.dy,
+        );
+      }
+      expect(tester.getRect(rows.first).top - menuRect.top, Grid.xs);
+      expect(menuRect.bottom - tester.getRect(rows.last).bottom, Grid.xs);
+      for (var index = 1; index < rows.length; index += 1) {
+        expect(
+          tester.getRect(rows[index]).top -
+              tester.getRect(rows[index - 1]).bottom,
+          Grid.xxs,
+        );
+      }
+    });
+
+    testWidgets(
+      'attachment menu grows rows and scrolls for accessibility text',
+      (tester) async {
+        await tester.pumpWidget(
+          _buildComposeBar(
+            uploadService: _testUploadService(nostr.Keys.generate().nsec),
+            textScaler: const TextScaler.linear(4),
+            onSend:
+                (
+                  content,
+                  mentionPubkeys, {
+                  mediaTags = const <List<String>>[],
+                }) async {},
+          ),
+        );
+
+        await _openAttachmentMenu(tester);
+
+        final menu = find.byKey(const ValueKey('attachment-menu'));
+        final rows = [
+          for (final label in ['camera', 'photos', 'video', 'files'])
+            find.byKey(ValueKey('attachment-menu-item-$label')),
+        ];
+        final scrollView = tester.widget<ListView>(
+          find.byKey(const ValueKey('attachment-menu-scroll')),
+        );
+
+        expect(tester.getSize(menu), const Size(216, 372));
+        expect(tester.getSize(rows.first).height, greaterThan(52));
+        expect(scrollView.physics, isA<AlwaysScrollableScrollPhysics>());
+        await tester.drag(
+          find.byKey(const ValueKey('attachment-menu-scroll')),
+          const Offset(0, -300),
+        );
+        await tester.pump();
+        expect(tester.getSize(rows.last).height, greaterThan(52));
+        expect(tester.takeException(), isNull);
+      },
+    );
+
+    testWidgets('defers camera startup until the surface morph finishes', (
+      tester,
+    ) async {
+      final previousPlatform = debugDefaultTargetPlatformOverride;
+      debugDefaultTargetPlatformOverride = TargetPlatform.android;
+      try {
+        await tester.pumpWidget(
+          _buildComposeBar(
+            uploadService: _testUploadService(nostr.Keys.generate().nsec),
+            onSend:
+                (
+                  content,
+                  mentionPubkeys, {
+                  mediaTags = const <List<String>>[],
+                }) async {},
+          ),
+        );
+
+        await _openAttachmentMenu(tester);
+        await tester.tap(find.text('Camera'));
+        await tester.pump();
+
+        expect(
+          find.byKey(const ValueKey('camera-initialization-deferred')),
+          findsOneWidget,
+        );
+
+        await tester.pump(const Duration(milliseconds: 300));
+        expect(
+          find.byKey(const ValueKey('camera-initialization-deferred')),
+          findsOneWidget,
+        );
+
+        await tester.pump(const Duration(milliseconds: 20));
+        expect(
+          find.byKey(const ValueKey('camera-initialization-ready')),
+          findsOneWidget,
+        );
+      } finally {
+        debugDefaultTargetPlatformOverride = previousPlatform;
+      }
+    });
+
+    testWidgets('photo picker errors keep the action visible at large text', (
+      tester,
+    ) async {
+      final uploadService = MediaUploadService(
+        baseUrl: 'https://relay.example',
+        nsec: nostr.Keys.generate().nsec,
+        pickGalleryImage: () async => null,
+        pickGalleryImages: () async =>
+            throw PlatformException(code: 'photo_picker_failed'),
+        pickGalleryVideo: () async => null,
+      );
+
+      await tester.pumpWidget(
+        _buildComposeBar(
+          uploadService: uploadService,
+          textScaler: const TextScaler.linear(1.2),
+          photoLibrary: _FakePhotoLibrary([
+            RecentPhoto(id: 'one', thumbnailBytes: _gifBytes),
+            RecentPhoto(id: 'two', thumbnailBytes: _gifBytes),
+            RecentPhoto(id: 'three', thumbnailBytes: _gifBytes),
+            RecentPhoto(id: 'four', thumbnailBytes: _gifBytes),
+          ]),
+          onSend:
+              (
+                content,
+                mentionPubkeys, {
+                mediaTags = const <List<String>>[],
+              }) async {},
+        ),
+      );
+
+      await _openSystemPhotoPicker(tester);
+      await tester.pumpAndSettle();
+
+      expect(tester.takeException(), isNull);
+      expect(find.byKey(const ValueKey('photo-gallery-error')), findsOneWidget);
+      expect(
+        find.byKey(const ValueKey('photo-gallery-action')).hitTestable(),
+        findsOneWidget,
       );
-      expect(find.byTooltip('Remove attachment'), findsNothing);
     });
 
     testWidgets('keeps upload progress visible after the picker closes', (
       tester,
     ) async {
-      final pickedImage = Completer<XFile?>();
+      final uploadResponse = Completer<http.Response>();
       final uploadService = MediaUploadService(
         baseUrl: 'https://relay.example',
         nsec: nostr.Keys.generate().nsec,
+        httpClient: http_testing.MockClient((request) => uploadResponse.future),
         pickGalleryVideo: () async => null,
-        pickGalleryImage: () => pickedImage.future,
+        pickGalleryImage: () async => null,
+        pickGalleryImages: () async => [
+          XFile.fromData(_pngBytes, name: 'tiny.png'),
+        ],
       );
 
       await tester.pumpWidget(
@@ -386,17 +1472,28 @@ void main() {
         ),
       );
 
-      await _openAttachmentMenu(tester);
-      await tester.tap(find.text('Photos'));
+      await _openSystemPhotoPicker(tester);
       await tester.pump();
 
       expect(
         find.byKey(const ValueKey('compose-upload-progress')),
         findsOneWidget,
       );
-      expect(find.text('Uploading attachment…'), findsOneWidget);
-
-      pickedImage.complete(null);
+      expect(find.bySemanticsLabel('Uploading attachment…'), findsOneWidget);
+
+      uploadResponse.complete(
+        http.Response(
+          jsonEncode({
+            'url': 'https://relay.example/media/test.png',
+            'sha256':
+                '0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef',
+            'size': 16,
+            'type': 'image/png',
+            'uploaded': 1,
+          }),
+          200,
+        ),
+      );
       await tester.pumpAndSettle();
 
       expect(
@@ -961,8 +2058,7 @@ void main() {
         ),
       );
 
-      await _openAttachmentMenu(tester);
-      await tester.tap(find.text('Photos'));
+      await _openSystemPhotoPicker(tester);
       await tester.pumpAndSettle();
 
       final attachmentFinder = find.byKey(
@@ -1017,8 +2113,7 @@ void main() {
         ),
       );
 
-      await _openAttachmentMenu(tester);
-      await tester.tap(find.text('Photos'));
+      await _openSystemPhotoPicker(tester);
       await tester.pumpAndSettle();
 
       expect(find.textContaining('upload failed'), findsOneWidget);
@@ -1058,8 +2153,7 @@ void main() {
           ),
         );
 
-        await _openAttachmentMenu(tester);
-        await tester.tap(find.text('Photos'));
+        await _openSystemPhotoPicker(tester);
         await tester.pumpAndSettle();
 
         expect(
@@ -1107,8 +2201,7 @@ void main() {
         ),
       );
 
-      await _openAttachmentMenu(tester);
-      await tester.tap(find.text('Photos'));
+      await _openSystemPhotoPicker(tester);
       await tester.pumpAndSettle();
 
       expect(
@@ -1334,8 +2427,7 @@ void main() {
         ),
       );
 
-      await _openAttachmentMenu(tester);
-      await tester.tap(find.text('Photos'));
+      await _openSystemPhotoPicker(tester);
       await tester.pumpAndSettle();
 
       expect(
@@ -1655,6 +2747,13 @@ Future<void> _openAttachmentMenu(WidgetTester tester) async {
   await tester.pumpAndSettle();
 }
 
+Future<void> _openSystemPhotoPicker(WidgetTester tester) async {
+  await _openAttachmentMenu(tester);
+  await tester.tap(find.text('Photos'));
+  await tester.pumpAndSettle();
+  await tester.tap(find.text('All photos'));
+}
+
 Future<void> _selectAndSendAgentMention(WidgetTester tester) async {
   await _expandComposer(tester);
   await tester.enterText(find.byType(TextField), '@hel');
diff --git a/mobile/test/features/channels/message_actions_test.dart b/mobile/test/features/channels/message_actions_test.dart
new file mode 100644
index 00000000000..03d7951b054
--- /dev/null
+++ b/mobile/test/features/channels/message_actions_test.dart
@@ -0,0 +1,453 @@
+import 'package:buzz/features/channels/message_actions.dart';
+import 'package:buzz/features/channels/read_state/read_state_provider.dart';
+import 'package:buzz/features/channels/thread_follows/thread_follows_provider.dart';
+import 'package:buzz/features/channels/timeline_message.dart';
+import 'package:buzz/shared/reminders/reminder_service.dart';
+import 'package:buzz/shared/relay/relay.dart';
+import 'package:buzz/shared/theme/theme.dart';
+import 'package:flutter/material.dart';
+import 'package:flutter_test/flutter_test.dart';
+import 'package:hooks_riverpod/hooks_riverpod.dart';
+import 'package:nostr/nostr.dart' as nostr;
+import 'package:shared_preferences/shared_preferences.dart';
+
+const _channelId = 'chan-1';
+
+TimelineMessage _message({
+  String id = 'msg-1',
+  String pubkey = 'alice',
+  int createdAt = 1000,
+  bool isSystem = false,
+  String? rootId,
+}) => TimelineMessage(
+  id: id,
+  pubkey: pubkey,
+  createdAt: createdAt,
+  content: 'hello world',
+  isSystem: isSystem,
+  rootId: rootId,
+);
+
+class _FakeReadStateNotifier extends ReadStateNotifier {
+  final ReadStateState _initialState;
+  final Map<String, int> markedRead = {};
+  final List<String> markedUnread = [];
+
+  _FakeReadStateNotifier(this._initialState);
+
+  @override
+  ReadStateState build() => _initialState;
+
+  @override
+  void markContextRead(
+    String contextId,
+    int unixTimestamp, {
+    bool clearForcedMessages = false,
+  }) {
+    markedRead[contextId] = unixTimestamp;
+    var forced = {
+      for (final entry in state.forcedUnreadContexts.entries)
+        if (entry.key != contextId) entry.key: entry.value,
+    };
+    if (clearForcedMessages) {
+      forced = {
+        for (final entry in forced.entries)
+          if (entry.value != contextId) entry.key: entry.value,
+      };
+    }
+    state = _withForced(forced).copyWithContext(contextId, unixTimestamp);
+  }
+
+  @override
+  void markContextUnread(String contextId, {required String channelId}) {
+    markedUnread.add(contextId);
+    state = _withForced({...state.forcedUnreadContexts, contextId: channelId});
+  }
+
+  ReadStateState _withForced(Map<String, String> forced) => ReadStateState(
+    isReady: state.isReady,
+    pubkey: state.pubkey,
+    contexts: state.contexts,
+    version: state.version + 1,
+    forcedUnreadContexts: Map.unmodifiable(forced),
+  );
+}
+
+ReadStateState _readState(Map<String, int> contexts, {bool isReady = true}) =>
+    ReadStateState(
+      isReady: isReady,
+      pubkey: 'self',
+      contexts: contexts,
+      version: 1,
+    );
+
+Future<SharedPreferences> _mockPrefs() async {
+  SharedPreferences.setMockInitialValues({});
+  return SharedPreferences.getInstance();
+}
+
+/// A [ReminderService] whose constructor dependencies are inert until used —
+/// enough for visibility checks on the "Remind me" fast action.
+ReminderService _stubReminderService() {
+  final keys = nostr.Keys.generate();
+  return ReminderService(
+    signedEventRelay: SignedEventRelay(
+      session: RelaySessionNotifier(),
+      nsec: keys.nsec,
+    ),
+    crypto: ReminderCrypto(keys.nsec, keys.public),
+  );
+}
+
+Future<void> _pumpSheet(
+  WidgetTester tester, {
+  required TimelineMessage message,
+  required SharedPreferences prefs,
+  ReadStateNotifier Function()? readStateOverride,
+  bool canManageMessage = false,
+  List<TimelineMessage>? allMessages,
+  ReminderService? reminderService,
+}) async {
+  await tester.pumpWidget(
+    ProviderScope(
+      overrides: [
+        savedPrefsProvider.overrideWithValue(prefs),
+        myPubkeyProvider.overrideWithValue('self'),
+        readStateProvider.overrideWith(
+          readStateOverride ??
+              () => _FakeReadStateNotifier(
+                _readState(const {_channelId: 100000}),
+              ),
+        ),
+        // No signing identity → "Remind me" hidden by default; individual
+        // tests opt in by passing a stub service.
+        reminderServiceProvider.overrideWithValue(reminderService),
+      ],
+      child: MaterialApp(
+        theme: AppTheme.light(),
+        home: Scaffold(
+          body: Consumer(
+            builder: (context, ref, _) => TextButton(
+              onPressed: () => showMessageActions(
+                context: context,
+                ref: ref,
+                message: message,
+                channelId: _channelId,
+                canManageMessage: canManageMessage,
+                allMessages: allMessages,
+                currentPubkey: 'self',
+                isMember: true,
+              ),
+              child: const Text('open'),
+            ),
+          ),
+        ),
+      ),
+    ),
+  );
+  await tester.tap(find.text('open'));
+  await tester.pumpAndSettle();
+}
+
+Future<void> _pumpImageSheet(
+  WidgetTester tester, {
+  required TimelineMessage message,
+  bool canManageMessage = false,
+}) async {
+  await tester.pumpWidget(
+    ProviderScope(
+      child: MaterialApp(
+        theme: AppTheme.light(),
+        home: Scaffold(
+          body: Consumer(
+            builder: (context, ref, _) => TextButton(
+              onPressed: () => showImageActions(
+                context: context,
+                ref: ref,
+                message: message,
+                channelId: _channelId,
+                imageUrl: 'https://example.com/photo.png',
+                canManageMessage: canManageMessage,
+              ),
+              child: const Text('open image actions'),
+            ),
+          ),
+        ),
+      ),
+    ),
+  );
+  await tester.tap(find.text('open image actions'));
+  await tester.pumpAndSettle();
+}
+
+void main() {
+  group('showMessageActions', () {
+    testWidgets('shows parity actions for a regular message', (tester) async {
+      final prefs = await _mockPrefs();
+      await _pumpSheet(tester, message: _message(), prefs: prefs);
+
+      expect(find.text('Copy text'), findsOneWidget);
+      expect(find.text('Copy link'), findsOneWidget);
+      expect(find.text('Mark unread'), findsOneWidget);
+      expect(find.text('Follow thread'), findsOneWidget);
+      // No thread context → no Reply fast action.
+      expect(find.text('Reply'), findsNothing);
+      // No signing identity → no reminders; no manage rights → no edit/delete.
+      expect(find.text('Remind me'), findsNothing);
+      expect(find.text('Edit message'), findsNothing);
+      expect(find.text('Delete message'), findsNothing);
+    });
+
+    testWidgets('promotes Reply, Copy link, and Remind me to the fast-actions '
+        'row', (tester) async {
+      final prefs = await _mockPrefs();
+      await _pumpSheet(
+        tester,
+        message: _message(),
+        prefs: prefs,
+        allMessages: [_message()],
+        reminderService: _stubReminderService(),
+      );
+
+      expect(find.text('Reply'), findsOneWidget);
+      expect(find.text('Copy link'), findsOneWidget);
+      expect(find.text('Remind me'), findsOneWidget);
+      // Promoted actions no longer appear under their old list-row labels.
+      expect(find.text('Reply in thread'), findsNothing);
+      expect(find.text('Remind me later'), findsNothing);
+    });
+
+    testWidgets('hides utility actions for system messages', (tester) async {
+      final prefs = await _mockPrefs();
+      await _pumpSheet(tester, message: _message(isSystem: true), prefs: prefs);
+
+      expect(find.text('Copy text'), findsNothing);
+      expect(find.text('Copy link'), findsNothing);
+      expect(find.text('Mark unread'), findsNothing);
+      expect(find.text('Follow thread'), findsNothing);
+      expect(find.text('Reply'), findsNothing);
+      expect(find.text('Remind me'), findsNothing);
+    });
+
+    testWidgets('shows Edit/Delete only with manage rights', (tester) async {
+      final prefs = await _mockPrefs();
+      await _pumpSheet(
+        tester,
+        message: _message(),
+        prefs: prefs,
+        canManageMessage: true,
+      );
+
+      expect(find.text('Edit message'), findsOneWidget);
+      expect(find.text('Delete message'), findsOneWidget);
+    });
+
+    testWidgets('Mark read appears for unread messages and advances the '
+        'message marker', (tester) async {
+      final prefs = await _mockPrefs();
+      final notifier = _FakeReadStateNotifier(
+        _readState(const {_channelId: 500}),
+      );
+      await _pumpSheet(
+        tester,
+        message: _message(createdAt: 900),
+        prefs: prefs,
+        readStateOverride: () => notifier,
+      );
+
+      expect(find.text('Mark read'), findsOneWidget);
+      await tester.tap(find.text('Mark read'));
+      await tester.pumpAndSettle();
+
+      expect(notifier.markedRead, {'msg:msg-1': 900});
+    });
+
+    testWidgets('Mark unread forces the message unread', (tester) async {
+      final prefs = await _mockPrefs();
+      final notifier = _FakeReadStateNotifier(
+        _readState(const {_channelId: 2000}),
+      );
+      await _pumpSheet(
+        tester,
+        message: _message(createdAt: 900),
+        prefs: prefs,
+        readStateOverride: () => notifier,
+      );
+
+      expect(find.text('Mark unread'), findsOneWidget);
+      await tester.tap(find.text('Mark unread'));
+      await tester.pumpAndSettle();
+
+      // The force flag is message-scoped, mapped to its channel so tiles and
+      // badges surface it.
+      expect(notifier.markedUnread, ['msg:msg-1']);
+      expect(notifier.state.forcedUnreadContexts, {'msg:msg-1': _channelId});
+      expect(notifier.state.locallyForcedChannelIds, {_channelId});
+    });
+
+    testWidgets('Mark read after a forced unread clears the force flag so '
+        'the toggle round-trips', (tester) async {
+      final prefs = await _mockPrefs();
+      final notifier = _FakeReadStateNotifier(
+        _readState(const {_channelId: 2000}),
+      );
+      await _pumpSheet(
+        tester,
+        message: _message(createdAt: 900),
+        prefs: prefs,
+        readStateOverride: () => notifier,
+      );
+
+      // Force the message unread; the row flips to Mark read.
+      await tester.tap(find.text('Mark unread'));
+      await tester.pumpAndSettle();
+      await tester.tap(find.text('open'));
+      await tester.pumpAndSettle();
+      expect(find.text('Mark read'), findsOneWidget);
+
+      // Mark read must clear the message's own force flag — otherwise the
+      // row sticks on "Mark read".
+      await tester.tap(find.text('Mark read'));
+      await tester.pumpAndSettle();
+
+      final container = ProviderScope.containerOf(
+        tester.element(find.text('open')),
+      );
+      expect(container.read(readStateProvider).forcedUnreadContexts, isEmpty);
+
+      await tester.tap(find.text('open'));
+      await tester.pumpAndSettle();
+      expect(find.text('Mark unread'), findsOneWidget);
+      expect(find.text('Mark read'), findsNothing);
+    });
+
+    testWidgets('message-level Mark read leaves a channel-level forced '
+        'unread untouched', (tester) async {
+      final prefs = await _mockPrefs();
+      final notifier = _FakeReadStateNotifier(
+        ReadStateState(
+          isReady: true,
+          pubkey: 'self',
+          contexts: const {_channelId: 2000},
+          version: 1,
+          // Channel forced unread from the channel tile, message forced
+          // unread from this sheet.
+          forcedUnreadContexts: const {
+            _channelId: _channelId,
+            'msg:msg-1': _channelId,
+          },
+        ),
+      );
+      await _pumpSheet(
+        tester,
+        message: _message(createdAt: 900),
+        prefs: prefs,
+        readStateOverride: () => notifier,
+      );
+
+      expect(find.text('Mark read'), findsOneWidget);
+      await tester.tap(find.text('Mark read'));
+      await tester.pumpAndSettle();
+
+      // The message's flag is gone; the user's channel-level choice stays.
+      final readState = notifier.state;
+      expect(readState.forcedUnreadContexts, {_channelId: _channelId});
+      expect(readState.locallyForcedChannelIds, {_channelId});
+    });
+
+    testWidgets('hides read-state row while read state is not ready', (
+      tester,
+    ) async {
+      final prefs = await _mockPrefs();
+      await _pumpSheet(
+        tester,
+        message: _message(),
+        prefs: prefs,
+        readStateOverride: () =>
+            _FakeReadStateNotifier(_readState(const {}, isReady: false)),
+      );
+
+      expect(find.text('Mark unread'), findsNothing);
+      expect(find.text('Mark read'), findsNothing);
+    });
+
+    testWidgets('Follow thread toggles the effective root id', (tester) async {
+      final prefs = await _mockPrefs();
+      await _pumpSheet(
+        tester,
+        message: _message(rootId: 'root-9'),
+        prefs: prefs,
+      );
+
+      await tester.tap(find.text('Follow thread'));
+      await tester.pumpAndSettle();
+
+      final container = ProviderScope.containerOf(
+        tester.element(find.text('open')),
+      );
+      expect(container.read(threadFollowsProvider).followedRootIds, {'root-9'});
+
+      // Re-open: the row now offers Unfollow.
+      await tester.tap(find.text('open'));
+      await tester.pumpAndSettle();
+      expect(find.text('Unfollow thread'), findsOneWidget);
+
+      await tester.tap(find.text('Unfollow thread'));
+      await tester.pumpAndSettle();
+      expect(container.read(threadFollowsProvider).followedRootIds, isEmpty);
+    });
+  });
+
+  group('showImageActions', () {
+    testWidgets('labels the destructive action as deleting the message', (
+      tester,
+    ) async {
+      await _pumpImageSheet(
+        tester,
+        message: _message(),
+        canManageMessage: true,
+      );
+
+      expect(find.text('Delete message'), findsOneWidget);
+      expect(find.text('Delete upload'), findsNothing);
+    });
+  });
+
+  group('downloadedImageFilename', () {
+    test('preserves gif file extensions', () {
+      expect(
+        downloadedImageFilename('https://example.com/animation.gif', null),
+        'animation.gif',
+      );
+    });
+
+    test('uses gif extension for gif content types', () {
+      expect(
+        downloadedImageFilename(
+          'https://example.com/download',
+          'image/gif; charset=binary',
+        ),
+        matches(RegExp(r'^buzz-\d+\.gif$')),
+      );
+    });
+  });
+
+  group('messageLinkFor', () {
+    test('builds a canonical link with thread context', () {
+      expect(
+        messageLinkFor(
+          message: _message(rootId: 'root-1'),
+          channelId: _channelId,
+        ),
+        'buzz://message?channel=chan-1&id=msg-1&thread=root-1',
+      );
+    });
+
+    test('omits thread for top-level messages', () {
+      expect(
+        messageLinkFor(message: _message(), channelId: _channelId),
+        'buzz://message?channel=chan-1&id=msg-1',
+      );
+    });
+  });
+}
diff --git a/mobile/test/features/channels/message_content_test.dart b/mobile/test/features/channels/message_content_test.dart
index bcb46f0c371..77fab8ef094 100644
--- a/mobile/test/features/channels/message_content_test.dart
+++ b/mobile/test/features/channels/message_content_test.dart
@@ -9,12 +9,23 @@ import 'package:buzz/features/channels/media_viewer_page.dart';
 import 'package:buzz/shared/relay/relay.dart';
 import 'package:buzz/shared/theme/theme.dart';
 
-Widget _testable(Widget child, {List<Override> overrides = const []}) {
+Widget _testable(
+  Widget child, {
+  List<Override> overrides = const [],
+  bool disableAnimations = false,
+}) {
   return ProviderScope(
     overrides: overrides,
     child: MaterialApp(
       theme: AppTheme.light(),
-      home: Scaffold(body: child),
+      home: Builder(
+        builder: (context) => MediaQuery(
+          data: MediaQuery.of(
+            context,
+          ).copyWith(disableAnimations: disableAnimations),
+          child: Scaffold(body: child),
+        ),
+      ),
     ),
   );
 }
@@ -182,11 +193,22 @@ void main() {
       );
 
       expect(route, isA<PageRouteBuilder<void>>());
-      expect(route.transitionDuration, const Duration(milliseconds: 280));
+      expect(route.transitionDuration, const Duration(milliseconds: 260));
       expect(
         route.reverseTransitionDuration,
-        const Duration(milliseconds: 220),
+        const Duration(milliseconds: 170),
+      );
+    });
+
+    test('buildImageViewerRoute disables motion when requested', () {
+      final route = buildImageViewerRoute(
+        imageUrl: 'https://example.com/media/image.png',
+        heroTag: Object(),
+        disableAnimations: true,
       );
+
+      expect(route.transitionDuration, Duration.zero);
+      expect(route.reverseTransitionDuration, Duration.zero);
     });
 
     group('plain text', () {
@@ -430,6 +452,242 @@ void main() {
         );
       });
 
+      testWidgets(
+        'groups uploaded photos into a carousel and opens the full gallery',
+        (tester) async {
+          const first = 'https://example.com/media/one.png';
+          const second = 'https://example.com/media/two.png';
+          const third = 'https://example.com/media/three.png';
+          await tester.pumpWidget(
+            _testable(
+              const MessageContent(
+                content:
+                    '''
+Photos
+![image]($first)
+![image]($second)
+![image]($third)
+''',
+                tags: [
+                  ['imeta', 'url $first', 'm image/png', 'alt First photo'],
+                  ['imeta', 'url $second', 'm image/png', 'alt Second photo'],
+                  ['imeta', 'url $third', 'm image/png', 'alt Third photo'],
+                ],
+              ),
+            ),
+          );
+          await tester.pumpAndSettle();
+
+          final carousel = find.byKey(const ValueKey('message-media-carousel'));
+          expect(carousel, findsOneWidget);
+          expect(find.text('3 images'), findsOneWidget);
+
+          await tester.drag(carousel, const Offset(-600, 0));
+          await tester.pumpAndSettle();
+
+          await tester.tap(
+            find.byKey(const ValueKey('message-media-carousel-item:$second')),
+          );
+          await tester.pumpAndSettle();
+
+          expect(
+            find.byKey(const ValueKey('message-media-image-viewer')),
+            findsOneWidget,
+          );
+          expect(
+            find.byKey(const ValueKey('message-media-image-viewer-filmstrip')),
+            findsOneWidget,
+          );
+          expect(
+            find.byKey(
+              const ValueKey('message-media-image-viewer-thumbnail:1'),
+            ),
+            findsOneWidget,
+          );
+          final displayedImage = tester.widget<MediaImage>(
+            find.byKey(const ValueKey('message-media-image-viewer-image:1')),
+          );
+          expect(displayedImage.decodeWidth, isNotNull);
+          final selectedThumbnailClip = tester.widget<ClipRRect>(
+            find.byKey(
+              const ValueKey('message-media-image-viewer-thumbnail-clip:1'),
+            ),
+          );
+          final selectedThumbnailRadius =
+              selectedThumbnailClip.borderRadius as BorderRadius;
+          expect(
+            selectedThumbnailRadius.topLeft.x,
+            closeTo(Radii.sm - 2.5, 0.01),
+          );
+
+          await tester.fling(
+            find.byKey(const ValueKey('message-media-image-viewer-pages')),
+            const Offset(-700, 0),
+            1200,
+          );
+          await tester.pumpAndSettle();
+
+          final thirdThumbnail = find.byKey(
+            const ValueKey('message-media-image-viewer-thumbnail:2'),
+          );
+          final thirdSemantics = tester.widget<Semantics>(
+            find
+                .ancestor(of: thirdThumbnail, matching: find.byType(Semantics))
+                .first,
+          );
+          expect(thirdSemantics.properties.selected, isTrue);
+        },
+      );
+
+      testWidgets(
+        'keeps adjacent carousel images active and ends with a gutter',
+        (tester) async {
+          const first = 'https://example.com/media/gutter-one.png';
+          const second = 'https://example.com/media/gutter-two.png';
+          await tester.pumpWidget(
+            _testable(
+              const MessageContent(
+                content:
+                    '''
+![image]($first)
+![image]($second)
+''',
+                tags: [
+                  ['imeta', 'url $first', 'm image/png'],
+                  ['imeta', 'url $second', 'm image/png'],
+                ],
+              ),
+            ),
+          );
+          await tester.pumpAndSettle();
+
+          final carousel = find.byKey(const ValueKey('message-media-carousel'));
+          final pageViewFinder = find.descendant(
+            of: carousel,
+            matching: find.byType(PageView),
+          );
+          final pageView = tester.widget<PageView>(pageViewFinder);
+
+          expect(pageView.allowImplicitScrolling, isTrue);
+          expect(pageView.clipBehavior, Clip.none);
+
+          pageView.controller!.jumpToPage(1);
+          await tester.pumpAndSettle();
+
+          final lastCard = find.byKey(
+            const ValueKey('message-media-carousel-item:$second'),
+          );
+          expect(
+            tester.getRect(carousel).right - tester.getRect(lastCard).right,
+            Grid.gutter,
+          );
+        },
+      );
+
+      testWidgets(
+        'jumps to a selected gallery thumbnail when motion is disabled',
+        (tester) async {
+          const first = 'https://example.com/media/reduced-motion-one.png';
+          const second = 'https://example.com/media/reduced-motion-two.png';
+          await tester.pumpWidget(
+            _testable(
+              const MessageContent(
+                content:
+                    '''
+![image]($first)
+![image]($second)
+''',
+                tags: [
+                  ['imeta', 'url $first', 'm image/png'],
+                  ['imeta', 'url $second', 'm image/png'],
+                ],
+              ),
+              disableAnimations: true,
+            ),
+          );
+          await tester.pumpAndSettle();
+
+          await tester.tap(
+            find.byKey(const ValueKey('message-media-carousel-item:$first')),
+          );
+          await tester.pumpAndSettle();
+          await tester.tap(
+            find.byKey(
+              const ValueKey('message-media-image-viewer-thumbnail:1'),
+            ),
+          );
+          await tester.pumpAndSettle();
+
+          final selectedThumbnail = tester.widget<Semantics>(
+            find
+                .ancestor(
+                  of: find.byKey(
+                    const ValueKey('message-media-image-viewer-thumbnail:1'),
+                  ),
+                  matching: find.byType(Semantics),
+                )
+                .first,
+          );
+          expect(selectedThumbnail.properties.selected, isTrue);
+          expect(tester.takeException(), isNull);
+        },
+      );
+
+      testWidgets('resets carousel paging when gallery images change', (
+        tester,
+      ) async {
+        const firstGallery = [
+          'https://example.com/media/first-a.png',
+          'https://example.com/media/first-b.png',
+          'https://example.com/media/first-c.png',
+        ];
+        const secondGallery = [
+          'https://example.com/media/second-a.png',
+          'https://example.com/media/second-b.png',
+        ];
+
+        Widget gallery(List<String> urls) => _testable(
+          MessageContent(
+            content: urls.map((url) => '![image]($url)').join('\n'),
+            tags: [
+              for (final url in urls) ['imeta', 'url $url', 'm image/png'],
+            ],
+          ),
+        );
+
+        await tester.pumpWidget(gallery(firstGallery));
+        await tester.pumpAndSettle();
+        final firstCarousel = tester.widget<PageView>(
+          find.descendant(
+            of: find.byKey(const ValueKey('message-media-carousel')),
+            matching: find.byType(PageView),
+          ),
+        );
+
+        await tester.fling(
+          find.byKey(const ValueKey('message-media-carousel')),
+          const Offset(-700, 0),
+          1200,
+        );
+        await tester.pumpAndSettle();
+        expect(firstCarousel.controller!.page, greaterThan(0));
+
+        await tester.pumpWidget(gallery(secondGallery));
+        await tester.pumpAndSettle();
+        final secondCarousel = tester.widget<PageView>(
+          find.descendant(
+            of: find.byKey(const ValueKey('message-media-carousel')),
+            matching: find.byType(PageView),
+          ),
+        );
+
+        expect(
+          secondCarousel.controller,
+          isNot(same(firstCarousel.controller)),
+        );
+        expect(secondCarousel.controller!.page, 0);
+      });
+
       testWidgets(
         'disables hero on close after the fullscreen image is transformed',
         (tester) async {
@@ -484,6 +742,90 @@ void main() {
         },
       );
 
+      testWidgets('double tap resets the fullscreen image transform', (
+        tester,
+      ) async {
+        const imageUrl = 'https://example.com/media/double-tap-reset.png';
+
+        await tester.pumpWidget(
+          _testable(
+            const MessageContent(
+              content:
+                  'Look\n![image](https://example.com/media/double-tap-reset.png)',
+              tags: [
+                [
+                  'imeta',
+                  'url https://example.com/media/double-tap-reset.png',
+                  'm image/png',
+                ],
+              ],
+            ),
+          ),
+        );
+        await tester.pumpAndSettle();
+
+        final transformationController = await _openImageViewer(
+          tester,
+          imageUrl,
+        );
+        _applyImageViewerTransform(
+          transformationController,
+          dx: 32,
+          dy: 24,
+          scale: 2,
+        );
+        await tester.pump();
+
+        final gestureSurface = find.byKey(
+          const ValueKey('message-media-image-viewer-gesture:0'),
+        );
+        await tester.tap(gestureSurface);
+        await tester.pump(const Duration(milliseconds: 50));
+        await tester.tap(gestureSurface);
+        await tester.pumpAndSettle();
+
+        expect(
+          transformationController.value.storage,
+          orderedEquals(Matrix4.identity().storage),
+        );
+        expect(_isImageViewerHeroEnabled(tester), isTrue);
+      });
+
+      testWidgets('swiping down dismisses the fullscreen gallery', (
+        tester,
+      ) async {
+        const imageUrl = 'https://example.com/media/swipe-dismiss.png';
+
+        await tester.pumpWidget(
+          _testable(
+            const MessageContent(
+              content:
+                  'Look\n![image](https://example.com/media/swipe-dismiss.png)',
+              tags: [
+                [
+                  'imeta',
+                  'url https://example.com/media/swipe-dismiss.png',
+                  'm image/png',
+                ],
+              ],
+            ),
+          ),
+        );
+        await tester.pumpAndSettle();
+        await _openImageViewer(tester, imageUrl);
+
+        await tester.drag(
+          find.byKey(const ValueKey('message-media-image-viewer-gesture:0')),
+          const Offset(0, 180),
+        );
+        await tester.pumpAndSettle();
+
+        expect(
+          find.byKey(const ValueKey('message-media-image-viewer')),
+          findsNothing,
+        );
+      });
+
       testWidgets(
         'disables hero on back navigation after the fullscreen image is transformed',
         (tester) async {
diff --git a/mobile/test/features/channels/read_state/message_read_state_test.dart b/mobile/test/features/channels/read_state/message_read_state_test.dart
new file mode 100644
index 00000000000..97d1317ac79
--- /dev/null
+++ b/mobile/test/features/channels/read_state/message_read_state_test.dart
@@ -0,0 +1,151 @@
+import 'package:buzz/features/channels/read_state/message_read_state.dart';
+import 'package:buzz/features/channels/read_state/read_state_provider.dart';
+import 'package:flutter_test/flutter_test.dart';
+
+ReadStateState _state(
+  Map<String, int> contexts, {
+  Map<String, String> forced = const {},
+}) => ReadStateState(
+  isReady: true,
+  pubkey: 'pk',
+  contexts: contexts,
+  version: 1,
+  forcedUnreadContexts: forced,
+);
+
+void main() {
+  const channelId = 'chan-1';
+  const messageId = 'msg-1';
+
+  group('effectiveMessageReadAt', () {
+    test('is null with no markers', () {
+      expect(
+        effectiveMessageReadAt(
+          _state(const {}),
+          channelId: channelId,
+          messageId: messageId,
+        ),
+        isNull,
+      );
+    });
+
+    test('takes the newest of channel, message, and thread markers', () {
+      final readState = _state(const {
+        channelId: 100,
+        'msg:$messageId': 300,
+        'thread:root-1': 200,
+      });
+      expect(
+        effectiveMessageReadAt(
+          readState,
+          channelId: channelId,
+          messageId: messageId,
+          threadRootId: 'root-1',
+        ),
+        300,
+      );
+    });
+
+    test('ignores thread marker when no root is given', () {
+      final readState = _state(const {'thread:root-1': 500});
+      expect(
+        effectiveMessageReadAt(
+          readState,
+          channelId: channelId,
+          messageId: messageId,
+        ),
+        isNull,
+      );
+    });
+  });
+
+  group('isMessageUnread', () {
+    test('unread when created after all markers', () {
+      final readState = _state(const {channelId: 100});
+      expect(
+        isMessageUnread(
+          readState,
+          channelId: channelId,
+          messageId: messageId,
+          createdAt: 150,
+        ),
+        isTrue,
+      );
+    });
+
+    test('read when covered by the channel marker', () {
+      final readState = _state(const {channelId: 200});
+      expect(
+        isMessageUnread(
+          readState,
+          channelId: channelId,
+          messageId: messageId,
+          createdAt: 150,
+        ),
+        isFalse,
+      );
+    });
+
+    test('read when covered by its own msg marker', () {
+      final readState = _state(const {'msg:$messageId': 150});
+      expect(
+        isMessageUnread(
+          readState,
+          channelId: channelId,
+          messageId: messageId,
+          createdAt: 150,
+        ),
+        isFalse,
+      );
+    });
+
+    test('thread reply covered by thread marker', () {
+      final readState = _state(const {'thread:root-1': 400});
+      expect(
+        isMessageUnread(
+          readState,
+          channelId: channelId,
+          messageId: messageId,
+          createdAt: 350,
+          threadRootId: 'root-1',
+        ),
+        isFalse,
+      );
+    });
+
+    test('forced-unread message wins over markers', () {
+      final readState = _state(
+        const {channelId: 1000},
+        forced: const {'msg:$messageId': channelId},
+      );
+      expect(
+        isMessageUnread(
+          readState,
+          channelId: channelId,
+          messageId: messageId,
+          createdAt: 150,
+        ),
+        isTrue,
+      );
+    });
+
+    test('channel-level forced unread does not leak into message state', () {
+      // A channel forced unread from the channel tile is a channel-scoped
+      // choice — an already-read message inside it still shows as read, so
+      // its own Mark read/unread toggle round-trips independently.
+      final readState = _state(
+        const {channelId: 1000},
+        forced: const {channelId: channelId},
+      );
+      expect(
+        isMessageUnread(
+          readState,
+          channelId: channelId,
+          messageId: messageId,
+          createdAt: 150,
+        ),
+        isFalse,
+      );
+    });
+  });
+}
diff --git a/mobile/test/features/channels/read_state/read_state_provider_test.dart b/mobile/test/features/channels/read_state/read_state_provider_test.dart
new file mode 100644
index 00000000000..40cd063625d
--- /dev/null
+++ b/mobile/test/features/channels/read_state/read_state_provider_test.dart
@@ -0,0 +1,159 @@
+import 'package:buzz/features/channels/read_state/read_state_format.dart';
+import 'package:buzz/features/channels/read_state/read_state_provider.dart';
+import 'package:buzz/shared/community/community_provider.dart';
+import 'package:buzz/shared/relay/relay.dart';
+import 'package:buzz/shared/theme/theme_provider.dart';
+import 'package:flutter/widgets.dart';
+import 'package:flutter_test/flutter_test.dart';
+import 'package:hooks_riverpod/hooks_riverpod.dart';
+import 'package:nostr/nostr.dart' as nostr;
+import 'package:shared_preferences/shared_preferences.dart';
+
+/// Drives the production [ReadStateNotifier] (real bookkeeping, real
+/// [ReadStateManager]) against an inert fake relay session, so a defect in
+/// the forced-unread map removal or the manager-emission path fails here
+/// instead of being masked by a fake notifier.
+void main() {
+  const channelId = 'chan-1';
+  const otherChannelId = 'chan-2';
+  final msgKey = msgContextKey('msg-1');
+  final otherMsgKey = msgContextKey('msg-2');
+
+  late ProviderContainer container;
+
+  Future<ReadStateNotifier> pumpNotifier() async {
+    SharedPreferences.setMockInitialValues({});
+    final prefs = await SharedPreferences.getInstance();
+    final nsec = nostr.Keys.generate().nsec;
+
+    container = ProviderContainer(
+      overrides: [
+        savedPrefsProvider.overrideWithValue(prefs),
+        relayConfigProvider.overrideWith(() => _FakeRelayConfig(nsec)),
+        relaySessionProvider.overrideWith(_FakeRelaySession.new),
+        activeCommunityProvider.overrideWith((ref) async => null),
+        appLifecycleProvider.overrideWith(_FakeAppLifecycle.new),
+      ],
+    );
+    addTearDown(container.dispose);
+
+    final notifier = container.read(readStateProvider.notifier);
+    // Let the async activeCommunity resolution, the resulting rebuild, and
+    // the manager initialize() microtasks run.
+    await container.read(activeCommunityProvider.future);
+    for (var i = 0; i < 10 && !container.read(readStateProvider).isReady; i++) {
+      await Future<void>.delayed(Duration.zero);
+    }
+    expect(container.read(readStateProvider).isReady, isTrue);
+    return notifier;
+  }
+
+  ReadStateState state() => container.read(readStateProvider);
+
+  test('message unread → read → unread round-trips through the real '
+      'notifier', () async {
+    final notifier = await pumpNotifier();
+
+    // Force the message unread.
+    notifier.markContextUnread(msgKey, channelId: channelId);
+    expect(state().isForcedUnread(msgKey), isTrue);
+    expect(state().locallyForcedChannelIds, {channelId});
+
+    // Mark read: the force flag must drop out of the production map AND the
+    // marker must land in the manager's effective contexts.
+    notifier.markContextRead(msgKey, 1000);
+    expect(state().isForcedUnread(msgKey), isFalse);
+    expect(state().forcedUnreadContexts, isEmpty);
+    expect(state().effectiveTimestamp(msgKey), 1000);
+
+    // Force unread again: read markers are monotonic, so the flag is the
+    // only mechanism — it must win even though the marker persists.
+    notifier.markContextUnread(msgKey, channelId: channelId);
+    expect(state().isForcedUnread(msgKey), isTrue);
+    expect(state().effectiveTimestamp(msgKey), 1000);
+  });
+
+  test('explicit channel-level Mark read clears forced message entries in '
+      'that channel only', () async {
+    final notifier = await pumpNotifier();
+
+    notifier.markContextUnread(msgKey, channelId: channelId);
+    notifier.markContextUnread(otherMsgKey, channelId: otherChannelId);
+
+    // Channel tile "Mark as read" passes clearForcedMessages: true.
+    notifier.markContextRead(channelId, 2000, clearForcedMessages: true);
+
+    expect(state().isForcedUnread(msgKey), isFalse);
+    expect(state().isForcedUnread(otherMsgKey), isTrue);
+    expect(state().locallyForcedChannelIds, {otherChannelId});
+    expect(state().effectiveTimestamp(channelId), 2000);
+  });
+
+  test(
+    'automatic channel-open read preserves forced message entries',
+    () async {
+      final notifier = await pumpNotifier();
+
+      notifier.markContextUnread(msgKey, channelId: channelId);
+
+      // Channel open marks the channel read without clearForcedMessages.
+      notifier.markContextRead(channelId, 3000);
+
+      expect(state().isForcedUnread(msgKey), isTrue);
+      expect(state().locallyForcedChannelIds, {channelId});
+      expect(state().effectiveTimestamp(channelId), 3000);
+    },
+  );
+
+  test('automatic channel-open read still clears a channel-level force for '
+      'the same channel', () async {
+    final notifier = await pumpNotifier();
+
+    // Channel forced unread from the tile, message forced from the sheet.
+    notifier.markContextUnread(channelId, channelId: channelId);
+    notifier.markContextUnread(msgKey, channelId: channelId);
+
+    notifier.markContextRead(channelId, 4000);
+
+    // Opening the channel satisfies the channel-scoped force, but the
+    // deliberate message-level force survives until acted on.
+    expect(state().isForcedUnread(channelId), isFalse);
+    expect(state().isForcedUnread(msgKey), isTrue);
+    expect(state().locallyForcedChannelIds, {channelId});
+  });
+}
+
+class _FakeRelayConfig extends RelayConfigNotifier {
+  final String nsec;
+
+  _FakeRelayConfig(this.nsec);
+
+  @override
+  RelayConfig build() => RelayConfig(baseUrl: 'http://localhost:1', nsec: nsec);
+}
+
+/// Relay session that never connects and returns no history, keeping the
+/// manager fully local while exercising its real code paths.
+class _FakeRelaySession extends RelaySessionNotifier {
+  @override
+  SessionState build() =>
+      const SessionState(status: SessionStatus.disconnected);
+
+  @override
+  Future<List<NostrEvent>> fetchHistory(
+    NostrFilter filter, {
+    Duration timeout = const Duration(seconds: 8),
+  }) async => [];
+
+  @override
+  Future<void Function()> subscribe(
+    NostrFilter filter,
+    void Function(NostrEvent) onEvent, {
+    void Function(String message)? onClosed,
+  }) async => () {};
+}
+
+class _FakeAppLifecycle extends AppLifecycleNotifier {
+  @override
+  AppLifecycleState build() => AppLifecycleState.resumed;
+}
diff --git a/mobile/test/features/channels/thread_follows/thread_follows_storage_test.dart b/mobile/test/features/channels/thread_follows/thread_follows_storage_test.dart
new file mode 100644
index 00000000000..58d04c5de97
--- /dev/null
+++ b/mobile/test/features/channels/thread_follows/thread_follows_storage_test.dart
@@ -0,0 +1,60 @@
+import 'package:buzz/features/channels/thread_follows/thread_follows_storage.dart';
+import 'package:flutter_test/flutter_test.dart';
+import 'package:shared_preferences/shared_preferences.dart';
+
+Future<SharedPreferences> _prefs() async {
+  SharedPreferences.setMockInitialValues({});
+  return SharedPreferences.getInstance();
+}
+
+void main() {
+  const pubkey = 'abc123';
+
+  test('round-trips entries per pubkey', () async {
+    final storage = ThreadFollowsStorage(await _prefs());
+    storage.write(pubkey, const [
+      ThreadFollowEntry(rootId: 'root-1', followedAt: 100),
+      ThreadFollowEntry(rootId: 'root-2', followedAt: 200),
+    ]);
+
+    final entries = storage.read(pubkey);
+    expect(entries.map((e) => e.rootId), ['root-1', 'root-2']);
+    expect(entries.map((e) => e.followedAt), [100, 200]);
+    expect(storage.read('other-pubkey'), isEmpty);
+  });
+
+  test('ignores malformed stored payloads', () async {
+    SharedPreferences.setMockInitialValues({
+      threadFollowsKey(pubkey): '{"not":"a list"}',
+    });
+    final storage = ThreadFollowsStorage(await SharedPreferences.getInstance());
+    expect(storage.read(pubkey), isEmpty);
+  });
+
+  test('drops malformed entries but keeps valid ones', () async {
+    SharedPreferences.setMockInitialValues({
+      threadFollowsKey(pubkey):
+          '[{"rootId":"good","followedAt":5},{"rootId":42},"junk"]',
+    });
+    final storage = ThreadFollowsStorage(await SharedPreferences.getInstance());
+    final entries = storage.read(pubkey);
+    expect(entries, hasLength(1));
+    expect(entries.single.rootId, 'good');
+  });
+
+  test('capThreadFollowEntries evicts oldest first', () {
+    final entries = [
+      for (var i = 0; i < threadFollowsMaxEntries + 10; i++)
+        ThreadFollowEntry(rootId: 'root-$i', followedAt: i),
+    ];
+    final capped = capThreadFollowEntries(entries);
+    expect(capped, hasLength(threadFollowsMaxEntries));
+    expect(capped.first.rootId, 'root-10');
+    expect(capped.last.rootId, 'root-${threadFollowsMaxEntries + 9}');
+  });
+
+  test('capThreadFollowEntries keeps small lists untouched', () {
+    const entries = [ThreadFollowEntry(rootId: 'a', followedAt: 1)];
+    expect(capThreadFollowEntries(entries), same(entries));
+  });
+}
diff --git a/mobile/test/features/channels/unread_badge/unread_badge_provider_test.dart b/mobile/test/features/channels/unread_badge/unread_badge_provider_test.dart
index 2731e95307a..987bd96b0a4 100644
--- a/mobile/test/features/channels/unread_badge/unread_badge_provider_test.dart
+++ b/mobile/test/features/channels/unread_badge/unread_badge_provider_test.dart
@@ -55,7 +55,7 @@ void main() {
   ProviderContainer buildContainer({
     required List<Channel> channels,
     Map<String, int> readContexts = const {},
-    Set<String> locallyForcedChannelIds = const {},
+    Map<String, String> forcedUnreadContexts = const {},
     bool readStateReady = true,
     Map<String, int> highPriorityMap = const {},
     Map<String, List<ObservedUnreadEvent>>? observedEventsByChannel,
@@ -77,7 +77,7 @@ void main() {
               pubkey: 'me',
               contexts: readContexts,
               version: 1,
-              locallyForcedChannelIds: locallyForcedChannelIds,
+              forcedUnreadContexts: forcedUnreadContexts,
             ),
           ),
         ),
@@ -259,7 +259,7 @@ void main() {
       final container = buildContainer(
         channels: [makeChannel(id: 'ch-a', lastMessageAtSeconds: t20)],
         readContexts: {'ch-a': t30},
-        locallyForcedChannelIds: {'ch-a'},
+        forcedUnreadContexts: {'ch-a': 'ch-a'},
       );
       addTearDown(container.dispose);
 
diff --git a/mobile/test/features/forum/forum_widgets_test.dart b/mobile/test/features/forum/forum_widgets_test.dart
index dbed539f746..7f83a33c8d0 100644
--- a/mobile/test/features/forum/forum_widgets_test.dart
+++ b/mobile/test/features/forum/forum_widgets_test.dart
@@ -12,6 +12,7 @@ import 'package:buzz/features/profile/user_cache_provider.dart';
 import 'package:buzz/features/profile/user_profile.dart';
 import 'package:buzz/shared/relay/relay.dart';
 import 'package:buzz/shared/theme/theme.dart';
+import 'package:shared_preferences/shared_preferences.dart';
 
 const _channelId = 'forum-channel';
 
@@ -60,6 +61,7 @@ Widget _buildPostCard({
   Map<String, UserProfile> users = const {},
   VoidCallback? onTap,
   void Function(String)? onDelete,
+  TextScaler textScaler = TextScaler.noScaling,
 }) {
   return ProviderScope(
     overrides: [
@@ -67,12 +69,17 @@ Widget _buildPostCard({
     ],
     child: MaterialApp(
       theme: AppTheme.light(),
-      home: Scaffold(
-        body: ForumPostCard(
-          post: post,
-          currentPubkey: currentPubkey,
-          onTap: onTap ?? () {},
-          onDelete: onDelete,
+      home: Builder(
+        builder: (context) => MediaQuery(
+          data: MediaQuery.of(context).copyWith(textScaler: textScaler),
+          child: Scaffold(
+            body: ForumPostCard(
+              post: post,
+              currentPubkey: currentPubkey,
+              onTap: onTap ?? () {},
+              onDelete: onDelete,
+            ),
+          ),
         ),
       ),
     ),
@@ -103,6 +110,10 @@ Widget _buildPostsView({
   );
 }
 
+/// Shared mock prefs for the compose bar's draft store. Initialized in
+/// [main].
+late SharedPreferences _testPrefs;
+
 Widget _buildThreadPage({
   required ForumThreadResponse threadResponse,
   String postEventId = 'post1',
@@ -110,6 +121,7 @@ Widget _buildThreadPage({
   bool isMember = true,
   bool isArchived = false,
   Map<String, UserProfile> users = const {},
+  TextScaler textScaler = TextScaler.noScaling,
 }) {
   return ProviderScope(
     overrides: [
@@ -119,24 +131,35 @@ Widget _buildThreadPage({
         channelId: _channelId,
         eventId: postEventId,
       )).overrideWith((ref) async => threadResponse),
+      savedPrefsProvider.overrideWithValue(_testPrefs),
       relayClientProvider.overrideWithValue(
         RelayClient(baseUrl: 'http://localhost:3000'),
       ),
     ],
     child: MaterialApp(
       theme: AppTheme.light(),
-      home: ForumThreadPage(
-        channelId: _channelId,
-        postEventId: postEventId,
-        currentPubkey: currentPubkey,
-        isMember: isMember,
-        isArchived: isArchived,
+      home: Builder(
+        builder: (context) => MediaQuery(
+          data: MediaQuery.of(context).copyWith(textScaler: textScaler),
+          child: ForumThreadPage(
+            channelId: _channelId,
+            postEventId: postEventId,
+            currentPubkey: currentPubkey,
+            isMember: isMember,
+            isArchived: isArchived,
+          ),
+        ),
       ),
     ),
   );
 }
 
 void main() {
+  setUp(() async {
+    SharedPreferences.setMockInitialValues({});
+    _testPrefs = await SharedPreferences.getInstance();
+  });
+
   group('ForumPostCard', () {
     testWidgets('renders author name and content', (tester) async {
       await tester.pumpWidget(
@@ -160,6 +183,63 @@ void main() {
       expect(find.text('abcdef12\u2026'), findsOneWidget);
     });
 
+    testWidgets(
+      'constrains an older timestamp at large accessible text sizes',
+      (tester) async {
+        _setSurfaceSize(tester, const Size(240, 600));
+        addTearDown(() {
+          tester.view.resetPhysicalSize();
+          tester.view.resetDevicePixelRatio();
+        });
+
+        await tester.pumpWidget(
+          _buildPostCard(
+            post: _makePost(
+              createdAt:
+                  DateTime.utc(2025, 12, 31, 12).millisecondsSinceEpoch ~/ 1000,
+            ),
+            users: const {
+              'alice': UserProfile(
+                pubkey: 'alice',
+                displayName: 'A very long display name',
+              ),
+            },
+            textScaler: const TextScaler.linear(2),
+          ),
+        );
+        await tester.pumpAndSettle();
+
+        final timestamp = tester.widget<Text>(find.text('12/31/2025'));
+        expect(timestamp.maxLines, 1);
+        expect(timestamp.overflow, TextOverflow.ellipsis);
+        expect(tester.takeException(), isNull);
+      },
+    );
+
+    testWidgets('gives the author unused timestamp width', (tester) async {
+      _setSurfaceSize(tester, const Size(320, 600));
+      addTearDown(() {
+        tester.view.resetPhysicalSize();
+        tester.view.resetDevicePixelRatio();
+      });
+      final createdAt = DateTime.now().millisecondsSinceEpoch ~/ 1000 - 120;
+      const displayName = 'A moderately long forum author name';
+
+      await tester.pumpWidget(
+        _buildPostCard(
+          post: _makePost(createdAt: createdAt),
+          users: const {
+            'alice': UserProfile(pubkey: 'alice', displayName: displayName),
+          },
+        ),
+      );
+      await tester.pumpAndSettle();
+
+      expect(tester.getSize(find.text(displayName)).width, greaterThan(150));
+      expect(find.text('2m ago'), findsOneWidget);
+      expect(tester.takeException(), isNull);
+    });
+
     testWidgets('truncates long content', (tester) async {
       final longContent = 'A' * 300;
       await tester.pumpWidget(
@@ -484,6 +564,97 @@ void main() {
       expect(find.text('Bob'), findsOneWidget);
     });
 
+    testWidgets('constrains post and reply timestamps at large text sizes', (
+      tester,
+    ) async {
+      final oldTimestamp =
+          DateTime.utc(2025, 12, 31, 12).millisecondsSinceEpoch ~/ 1000;
+
+      await tester.pumpWidget(
+        _buildThreadPage(
+          threadResponse: ForumThreadResponse(
+            post: _makePost(createdAt: oldTimestamp),
+            replies: [
+              ThreadReply(
+                eventId: 'old-reply',
+                pubkey: 'bob',
+                content: 'An older reply',
+                kind: 45003,
+                createdAt: oldTimestamp,
+                channelId: _channelId,
+                tags: const [
+                  ['h', _channelId],
+                ],
+                depth: 1,
+              ),
+            ],
+            totalReplies: 1,
+          ),
+          users: const {
+            'alice': _aliceProfile,
+            'bob': UserProfile(
+              pubkey: 'bob',
+              displayName: 'A very long reply author name',
+            ),
+          },
+          textScaler: const TextScaler.linear(2),
+        ),
+      );
+      await tester.pumpAndSettle();
+
+      final timestamps = tester.widgetList<Text>(find.text('12/31/2025'));
+      expect(timestamps, hasLength(2));
+      for (final timestamp in timestamps) {
+        expect(timestamp.maxLines, 1);
+        expect(timestamp.overflow, TextOverflow.ellipsis);
+      }
+      expect(tester.takeException(), isNull);
+    });
+
+    testWidgets('gives thread authors unused timestamp width', (tester) async {
+      _setSurfaceSize(tester, const Size(320, 800));
+      addTearDown(() {
+        tester.view.resetPhysicalSize();
+        tester.view.resetDevicePixelRatio();
+      });
+      final createdAt = DateTime.now().millisecondsSinceEpoch ~/ 1000 - 120;
+      const postAuthor = 'A moderately long original author';
+      const replyAuthor = 'A moderately long reply author';
+
+      await tester.pumpWidget(
+        _buildThreadPage(
+          threadResponse: ForumThreadResponse(
+            post: _makePost(createdAt: createdAt),
+            replies: [
+              ThreadReply(
+                eventId: 'reply',
+                pubkey: 'bob',
+                content: 'A reply',
+                kind: 45003,
+                createdAt: createdAt,
+                channelId: _channelId,
+                tags: const [
+                  ['h', _channelId],
+                ],
+                depth: 1,
+              ),
+            ],
+            totalReplies: 1,
+          ),
+          users: const {
+            'alice': UserProfile(pubkey: 'alice', displayName: postAuthor),
+            'bob': UserProfile(pubkey: 'bob', displayName: replyAuthor),
+          },
+        ),
+      );
+      await tester.pumpAndSettle();
+
+      expect(tester.getSize(find.text(postAuthor)).width, greaterThan(150));
+      expect(tester.getSize(find.text(replyAuthor)).width, greaterThan(140));
+      expect(find.text('2m ago'), findsNWidgets(2));
+      expect(tester.takeException(), isNull);
+    });
+
     testWidgets('shows compose bar for members', (tester) async {
       await tester.pumpWidget(
         _buildThreadPage(
diff --git a/mobile/test/features/home/home_page_test.dart b/mobile/test/features/home/home_page_test.dart
index 15e13b58220..cf688ce726d 100644
--- a/mobile/test/features/home/home_page_test.dart
+++ b/mobile/test/features/home/home_page_test.dart
@@ -5,19 +5,25 @@ import 'package:flutter/material.dart';
 import 'package:flutter/services.dart';
 import 'package:flutter_test/flutter_test.dart';
 import 'package:hooks_riverpod/hooks_riverpod.dart';
+import 'package:shared_preferences/shared_preferences.dart';
 
 void main() {
+  Future<Widget> buildHome() async {
+    SharedPreferences.setMockInitialValues({});
+    final prefs = await SharedPreferences.getInstance();
+    return ProviderScope(
+      overrides: [savedPrefsProvider.overrideWithValue(prefs)],
+      child: MaterialApp(
+        theme: AppTheme.light(),
+        home: const HomePage(settingsPageBuilder: _buildSettingsPage),
+      ),
+    );
+  }
+
   testWidgets('shows icon-only navigation and an aligned quick action', (
     tester,
   ) async {
-    await tester.pumpWidget(
-      ProviderScope(
-        child: MaterialApp(
-          theme: AppTheme.light(),
-          home: const HomePage(settingsPageBuilder: _buildSettingsPage),
-        ),
-      ),
-    );
+    await tester.pumpWidget(await buildHome());
     await tester.pump();
 
     expect(find.text('Home'), findsNothing);
@@ -68,14 +74,7 @@ void main() {
           .setMockMethodCallHandler(SystemChannels.platform, null),
     );
 
-    await tester.pumpWidget(
-      ProviderScope(
-        child: MaterialApp(
-          theme: AppTheme.light(),
-          home: const HomePage(settingsPageBuilder: _buildSettingsPage),
-        ),
-      ),
-    );
+    await tester.pumpWidget(await buildHome());
     await tester.pump();
 
     await tester.tap(find.byTooltip('Home'));
@@ -99,14 +98,7 @@ void main() {
   testWidgets('scales and fades the quick action as tabs change', (
     tester,
   ) async {
-    await tester.pumpWidget(
-      ProviderScope(
-        child: MaterialApp(
-          theme: AppTheme.light(),
-          home: const HomePage(settingsPageBuilder: _buildSettingsPage),
-        ),
-      ),
-    );
+    await tester.pumpWidget(await buildHome());
     await tester.pump();
 
     double scale() => tester
diff --git a/mobile/test/features/invites/invite_join_provider_test.dart b/mobile/test/features/invites/invite_join_provider_test.dart
index e02134bb5f2..d3a2532388b 100644
--- a/mobile/test/features/invites/invite_join_provider_test.dart
+++ b/mobile/test/features/invites/invite_join_provider_test.dart
@@ -218,6 +218,49 @@ void main() {
     expect(attempts, 1);
   });
 
+  test('invite_exhausted requires a fresh invite and cannot retry', () async {
+    final keys = nostr.Keys.generate();
+    var attempts = 0;
+    final storage = CommunityStorage(secure: FakeSecureStorage());
+    final container = ProviderContainer(
+      overrides: [
+        communityStorageProvider.overrideWithValue(storage),
+        inviteKeyGeneratorProvider.overrideWithValue(() => keys),
+        inviteJoinHttpClientProvider.overrideWithValue(
+          http_testing.MockClient((request) async {
+            attempts++;
+            return http.Response(
+              jsonEncode({'error': 'invite_exhausted'}),
+              403,
+            );
+          }),
+        ),
+      ],
+    );
+    addTearDown(container.dispose);
+
+    await container
+        .read(inviteJoinProvider.notifier)
+        .prepare(
+          const InviteDeepLink(
+            relayUrl: 'wss://relay.example.com',
+            code: 'v2.exhausted-secret',
+          ),
+        );
+    await container.read(inviteJoinProvider.notifier).confirmJoin();
+
+    final state = container.read(inviteJoinProvider);
+    expect(state.status, InviteJoinStatus.error);
+    expect(state.requiresFreshInvite, isTrue);
+    expect(
+      state.errorMessage,
+      'This invite has reached its use limit. Ask for a new invite.',
+    );
+
+    await container.read(inviteJoinProvider.notifier).confirmJoin();
+    expect(attempts, 1);
+  });
+
   test('failed claim can be retried and preserves policy receipt', () async {
     final keys = nostr.Keys.generate();
     var attempts = 0;
diff --git a/mobile/test/features/pairing/pairing_page_test.dart b/mobile/test/features/pairing/pairing_page_test.dart
index adb61624d80..678be9dfe7b 100644
--- a/mobile/test/features/pairing/pairing_page_test.dart
+++ b/mobile/test/features/pairing/pairing_page_test.dart
@@ -5,6 +5,7 @@ import 'package:hooks_riverpod/hooks_riverpod.dart';
 import 'package:buzz/features/pairing/pairing_page.dart';
 import 'package:buzz/features/pairing/pairing_provider.dart';
 import 'package:buzz/shared/theme/theme.dart';
+import 'package:buzz/shared/widgets/buzz_loading_indicator.dart';
 import 'package:buzz/shared/widgets/tappable_flapping_bee.dart';
 
 import '../../helpers/widget_helpers.dart';
@@ -154,7 +155,7 @@ void main() {
       );
       await tester.pump();
 
-      expect(find.byType(CircularProgressIndicator), findsOneWidget);
+      expect(find.byType(BuzzLoadingIndicator), findsOneWidget);
       // Connect text should be replaced by spinner.
       expect(find.text('Connect'), findsNothing);
     });
diff --git a/mobile/test/features/pulse/compose_note_page_test.dart b/mobile/test/features/pulse/compose_note_page_test.dart
index 5ac84bcc8c3..e32225fe1ac 100644
--- a/mobile/test/features/pulse/compose_note_page_test.dart
+++ b/mobile/test/features/pulse/compose_note_page_test.dart
@@ -24,19 +24,31 @@ void main() {
     tags: const [],
   );
 
-  Widget buildTestable(Widget home) {
+  Widget buildTestable(
+    Widget home, {
+    TextScaler textScaler = TextScaler.noScaling,
+    String displayName = 'Alice',
+  }) {
     return ProviderScope(
       overrides: [
         userCacheProvider.overrideWith(
           () => _FakeUserCacheNotifier({
-            'alice_pk': const UserProfile(
+            'alice_pk': UserProfile(
               pubkey: 'alice_pk',
-              displayName: 'Alice',
+              displayName: displayName,
             ),
           }),
         ),
       ],
-      child: MaterialApp(theme: AppTheme.light(), home: home),
+      child: MaterialApp(
+        theme: AppTheme.light(),
+        home: Builder(
+          builder: (context) => MediaQuery(
+            data: MediaQuery.of(context).copyWith(textScaler: textScaler),
+            child: home,
+          ),
+        ),
+      ),
     );
   }
 
@@ -52,6 +64,53 @@ void main() {
     expect(find.text('Reply'), findsOneWidget); // action button label
   });
 
+  testWidgets('reply preview constrains its timestamp at large text sizes', (
+    tester,
+  ) async {
+    final oldReplyNote = UserNote(
+      id: 'old-note',
+      pubkey: 'alice_pk',
+      createdAt: DateTime.utc(2025, 9, 30, 12).millisecondsSinceEpoch ~/ 1000,
+      content: 'An older note',
+      tags: const [],
+    );
+
+    await tester.pumpWidget(
+      buildTestable(
+        ComposeNotePage(replyTo: oldReplyNote),
+        textScaler: const TextScaler.linear(2),
+      ),
+    );
+    await tester.pump();
+
+    final timestamp = tester.widget<Text>(find.text('Sep 30'));
+    expect(timestamp.maxLines, 1);
+    expect(timestamp.overflow, TextOverflow.ellipsis);
+    expect(tester.takeException(), isNull);
+  });
+
+  testWidgets('gives the reply author unused timestamp width', (tester) async {
+    tester.view.devicePixelRatio = 1;
+    tester.view.physicalSize = const Size(320, 600);
+    addTearDown(() {
+      tester.view.resetPhysicalSize();
+      tester.view.resetDevicePixelRatio();
+    });
+    const displayName = 'A moderately long Pulse reply author';
+
+    await tester.pumpWidget(
+      buildTestable(
+        ComposeNotePage(replyTo: replyNote),
+        displayName: displayName,
+      ),
+    );
+    await tester.pump();
+
+    expect(tester.getSize(find.text(displayName)).width, greaterThan(150));
+    expect(find.text('2m'), findsOneWidget);
+    expect(tester.takeException(), isNull);
+  });
+
   testWidgets('new-note mode shows no reply preview', (tester) async {
     await tester.pumpWidget(buildTestable(const ComposeNotePage()));
     await tester.pump();
diff --git a/mobile/test/features/pulse/note_card_test.dart b/mobile/test/features/pulse/note_card_test.dart
new file mode 100644
index 00000000000..73e6e8af02c
--- /dev/null
+++ b/mobile/test/features/pulse/note_card_test.dart
@@ -0,0 +1,130 @@
+import 'package:buzz/features/profile/user_cache_provider.dart';
+import 'package:buzz/features/profile/user_profile.dart';
+import 'package:buzz/features/pulse/note_card.dart';
+import 'package:buzz/features/pulse/pulse_models.dart';
+import 'package:buzz/shared/theme/theme.dart';
+import 'package:flutter/material.dart';
+import 'package:flutter_test/flutter_test.dart';
+import 'package:hooks_riverpod/hooks_riverpod.dart';
+
+class _FakeUserCacheNotifier extends UserCacheNotifier {
+  final Map<String, UserProfile> _users;
+
+  _FakeUserCacheNotifier(this._users);
+
+  @override
+  Map<String, UserProfile> build() => _users;
+}
+
+void main() {
+  testWidgets('constrains timestamp with agent and follow metadata', (
+    tester,
+  ) async {
+    tester.view.devicePixelRatio = 1;
+    tester.view.physicalSize = const Size(280, 600);
+    addTearDown(() {
+      tester.view.resetPhysicalSize();
+      tester.view.resetDevicePixelRatio();
+    });
+
+    final note = UserNote(
+      id: 'note-1',
+      pubkey: 'alice',
+      createdAt: DateTime.utc(2025, 9, 30, 12).millisecondsSinceEpoch ~/ 1000,
+      content: 'A note',
+      tags: const [],
+    );
+
+    await tester.pumpWidget(
+      ProviderScope(
+        overrides: [
+          userCacheProvider.overrideWith(
+            () => _FakeUserCacheNotifier({
+              'alice': const UserProfile(
+                pubkey: 'alice',
+                displayName: 'A very long display name',
+              ),
+            }),
+          ),
+        ],
+        child: MaterialApp(
+          theme: AppTheme.light(),
+          home: Builder(
+            builder: (context) => MediaQuery(
+              data: MediaQuery.of(
+                context,
+              ).copyWith(textScaler: const TextScaler.linear(2)),
+              child: Scaffold(
+                body: NoteCard(
+                  note: note,
+                  reaction: const PulseReactionState(
+                    count: 0,
+                    reactedByCurrentUser: false,
+                  ),
+                  isAgent: true,
+                  canFollow: true,
+                ),
+              ),
+            ),
+          ),
+        ),
+      ),
+    );
+    await tester.pumpAndSettle();
+
+    final timestamp = tester.widget<Text>(find.text('Sep 30'));
+    expect(timestamp.maxLines, 1);
+    expect(timestamp.overflow, TextOverflow.ellipsis);
+    expect(tester.takeException(), isNull);
+  });
+
+  testWidgets('gives the author unused timestamp width', (tester) async {
+    tester.view.devicePixelRatio = 1;
+    tester.view.physicalSize = const Size(320, 600);
+    addTearDown(() {
+      tester.view.resetPhysicalSize();
+      tester.view.resetDevicePixelRatio();
+    });
+    const displayName = 'A moderately long Pulse author';
+    final note = UserNote(
+      id: 'note-2',
+      pubkey: 'alice',
+      createdAt: DateTime.now().millisecondsSinceEpoch ~/ 1000 - 120,
+      content: 'A note',
+      tags: const [],
+    );
+
+    await tester.pumpWidget(
+      ProviderScope(
+        overrides: [
+          userCacheProvider.overrideWith(
+            () => _FakeUserCacheNotifier({
+              'alice': const UserProfile(
+                pubkey: 'alice',
+                displayName: displayName,
+              ),
+            }),
+          ),
+        ],
+        child: MaterialApp(
+          theme: AppTheme.light(),
+          home: Scaffold(
+            body: NoteCard(
+              note: note,
+              reaction: const PulseReactionState(
+                count: 0,
+                reactedByCurrentUser: false,
+              ),
+              canFollow: true,
+            ),
+          ),
+        ),
+      ),
+    );
+    await tester.pumpAndSettle();
+
+    expect(tester.getSize(find.text(displayName)).width, greaterThan(145));
+    expect(find.text('2m'), findsOneWidget);
+    expect(tester.takeException(), isNull);
+  });
+}
diff --git a/mobile/test/features/search/recent_searches_provider_test.dart b/mobile/test/features/search/recent_searches_provider_test.dart
new file mode 100644
index 00000000000..30f13c329c3
--- /dev/null
+++ b/mobile/test/features/search/recent_searches_provider_test.dart
@@ -0,0 +1,105 @@
+import 'package:buzz/features/search/recent_searches_provider.dart';
+import 'package:buzz/shared/relay/relay.dart';
+import 'package:buzz/shared/theme/theme_provider.dart';
+import 'package:flutter_test/flutter_test.dart';
+import 'package:hooks_riverpod/hooks_riverpod.dart';
+import 'package:shared_preferences/shared_preferences.dart';
+
+class _FixedRelayConfigNotifier extends RelayConfigNotifier {
+  final RelayConfig _config;
+
+  _FixedRelayConfigNotifier(this._config);
+
+  @override
+  RelayConfig build() => _config;
+}
+
+void main() {
+  TestWidgetsFlutterBinding.ensureInitialized();
+
+  Future<ProviderContainer> containerWithPrefs({
+    required String relayUrl,
+    required String? pubkey,
+  }) async {
+    final prefs = await SharedPreferences.getInstance();
+    final container = ProviderContainer(
+      overrides: [
+        savedPrefsProvider.overrideWithValue(prefs),
+        relayConfigProvider.overrideWith(
+          () => _FixedRelayConfigNotifier(RelayConfig(baseUrl: relayUrl)),
+        ),
+        myPubkeyProvider.overrideWithValue(pubkey),
+      ],
+    );
+    addTearDown(container.dispose);
+    return container;
+  }
+
+  test(
+    'normalizes, deduplicates, caps, and persists submitted queries',
+    () async {
+      SharedPreferences.setMockInitialValues({});
+      final first = await containerWithPrefs(
+        relayUrl: 'https://relay-a.example',
+        pubkey: 'pk-a',
+      );
+      final notifier = first.read(recentSearchesProvider.notifier);
+
+      notifier.record('  Design  ');
+      notifier.record('design');
+      notifier.record('');
+      for (var index = 0; index < 6; index++) {
+        notifier.record('query-$index');
+      }
+
+      expect(first.read(recentSearchesProvider), [
+        'query-5',
+        'query-4',
+        'query-3',
+        'query-2',
+        'query-1',
+        'query-0',
+      ]);
+
+      final restarted = await containerWithPrefs(
+        relayUrl: 'https://relay-a.example',
+        pubkey: 'pk-a',
+      );
+      expect(
+        restarted.read(recentSearchesProvider),
+        first.read(recentSearchesProvider),
+      );
+    },
+  );
+
+  test('isolates persisted history by community and account', () async {
+    SharedPreferences.setMockInitialValues({});
+    final accountA = await containerWithPrefs(
+      relayUrl: 'https://relay-a.example',
+      pubkey: 'pk-a',
+    );
+    accountA.read(recentSearchesProvider.notifier).record('private query');
+
+    final accountB = await containerWithPrefs(
+      relayUrl: 'https://relay-a.example',
+      pubkey: 'pk-b',
+    );
+    expect(accountB.read(recentSearchesProvider), isEmpty);
+    accountB.read(recentSearchesProvider.notifier).record('account b query');
+
+    final communityB = await containerWithPrefs(
+      relayUrl: 'https://relay-b.example',
+      pubkey: 'pk-a',
+    );
+    expect(communityB.read(recentSearchesProvider), isEmpty);
+    communityB
+        .read(recentSearchesProvider.notifier)
+        .record('community b query');
+
+    final accountAAgain = await containerWithPrefs(
+      relayUrl: 'https://relay-a.example',
+      pubkey: 'pk-a',
+    );
+    expect(accountAAgain.read(recentSearchesProvider), ['private query']);
+  });
+}
diff --git a/mobile/test/features/search/search_page_test.dart b/mobile/test/features/search/search_page_test.dart
index dfde69e5ece..e4a576b91d0 100644
--- a/mobile/test/features/search/search_page_test.dart
+++ b/mobile/test/features/search/search_page_test.dart
@@ -1,6 +1,12 @@
 import 'package:buzz/features/channels/channel.dart';
+import 'package:buzz/features/channels/channel_management_provider.dart';
+import 'package:buzz/features/channels/channels_provider.dart';
+import 'package:buzz/features/channels/message_content.dart';
+import 'package:buzz/features/channels/small_avatar.dart';
 import 'package:buzz/features/profile/profile_provider.dart';
+import 'package:buzz/features/profile/user_cache_provider.dart';
 import 'package:buzz/features/profile/user_profile.dart';
+import 'package:buzz/features/search/recent_searches_provider.dart';
 import 'package:buzz/features/search/search_page.dart';
 import 'package:buzz/features/search/search_provider.dart';
 import 'package:buzz/shared/theme/theme.dart';
@@ -24,6 +30,9 @@ void main() {
           searchProvider.overrideWith(
             () => _FakeSearchNotifier(const SearchState.initial()),
           ),
+          recentSearchesProvider.overrideWith(
+            () => _FakeRecentSearchesNotifier(const []),
+          ),
           profileProvider.overrideWith(() => _FakeProfileNotifier()),
         ],
         child: Builder(
@@ -55,14 +64,234 @@ void main() {
       tester.getSize(searchField).height,
       greaterThanOrEqualTo(scaledLineHeight + Grid.xxs * 2),
     );
+    final input = tester.widget<TextField>(
+      find.byKey(const Key('search-field')),
+    );
+    expect(input.style?.fontSize, searchInputTextStyle.fontSize);
+    expect(input.style?.height, searchInputTextStyle.height);
     expect(tester.getSize(message).height, greaterThan(32));
     expect(tester.takeException(), isNull);
   });
 
+  testWidgets('focus slides Cancel in beside the search field', (tester) async {
+    await tester.pumpWidget(
+      WidgetHelpers.testable(
+        overrides: [
+          searchProvider.overrideWith(
+            () => _FakeSearchNotifier(const SearchState.initial()),
+          ),
+          recentSearchesProvider.overrideWith(
+            () => _FakeRecentSearchesNotifier(const []),
+          ),
+          profileProvider.overrideWith(() => _FakeProfileNotifier()),
+        ],
+        child: const SearchPage(),
+      ),
+    );
+    await tester.pumpAndSettle();
+
+    final searchField = find.byKey(const Key('search-field'));
+    final searchFieldContainer = find.byKey(
+      const Key('search-field-container'),
+    );
+    final unfocusedWidth = tester.getSize(searchFieldContainer).width;
+    expect(find.byKey(const Key('search-cancel')), findsNothing);
+    expect(
+      tester.widget<TextField>(searchField).decoration?.hintText,
+      'Search messages, channels, people\u2026',
+    );
+    expect(
+      tester.widget<TextField>(searchField).textInputAction,
+      TextInputAction.search,
+    );
+
+    await tester.tap(searchField);
+    await tester.pump();
+
+    final cancel = find.byKey(const Key('search-cancel'));
+    expect(cancel, findsOneWidget);
+    expect(
+      tester.getSize(cancel).height,
+      greaterThanOrEqualTo(Grid.xl),
+      reason: 'Cancel must keep a 48dp touch target.',
+    );
+    expect(tester.widget<TextField>(searchField).decoration?.hintText, isNull);
+    final enteringSlide = tester.widget<SlideTransition>(
+      find.ancestor(of: cancel, matching: find.byType(SlideTransition)).first,
+    );
+    expect(enteringSlide.position.value.dx, greaterThan(0));
+
+    await tester.pump(const Duration(milliseconds: 160));
+    final focusedWidth = tester.getSize(searchFieldContainer).width;
+    expect(focusedWidth, lessThan(unfocusedWidth));
+    final settledSlide = tester.widget<SlideTransition>(
+      find.ancestor(of: cancel, matching: find.byType(SlideTransition)).first,
+    );
+    expect(settledSlide.position.value, Offset.zero);
+
+    await tester.enterText(searchField, 'design');
+    await tester.tap(cancel);
+    await tester.pump();
+    await tester.pump(const Duration(milliseconds: 60));
+    final exitingWidth = tester.getSize(searchFieldContainer).width;
+    expect(exitingWidth, greaterThan(focusedWidth));
+    expect(exitingWidth, lessThan(unfocusedWidth));
+    await tester.pumpAndSettle();
+
+    final input = tester.widget<TextField>(searchField);
+    expect(input.controller?.text, isEmpty);
+    expect(input.focusNode?.hasFocus, isFalse);
+    expect(
+      input.decoration?.hintText,
+      'Search messages, channels, people\u2026',
+    );
+    expect(find.byKey(const Key('search-cancel')), findsNothing);
+    expect(
+      tester.getSize(searchFieldContainer).width,
+      closeTo(unfocusedWidth, 0.01),
+    );
+  });
+
+  testWidgets('only submitted queries are added to recent searches', (
+    tester,
+  ) async {
+    await tester.pumpWidget(
+      WidgetHelpers.testable(
+        overrides: [
+          searchProvider.overrideWith(
+            () => _FakeSearchNotifier(const SearchState.initial()),
+          ),
+          recentSearchesProvider.overrideWith(
+            () => _FakeRecentSearchesNotifier(const []),
+          ),
+          profileProvider.overrideWith(() => _FakeProfileNotifier()),
+        ],
+        child: const SearchPage(),
+      ),
+    );
+    await tester.pumpAndSettle();
+
+    final searchField = find.byKey(const Key('search-field'));
+    await tester.tap(searchField);
+    await tester.pumpAndSettle();
+    await tester.enterText(searchField, 'draft');
+    await tester.tap(find.byKey(const Key('search-cancel')));
+    await tester.pumpAndSettle();
+    expect(find.byKey(const Key('recent-searches-list')), findsNothing);
+
+    await tester.tap(searchField);
+    await tester.pumpAndSettle();
+    await tester.enterText(searchField, 'design systems');
+    await tester.testTextInput.receiveAction(TextInputAction.search);
+    await tester.pump();
+    await tester.tap(find.byKey(const Key('search-cancel')));
+    await tester.pumpAndSettle();
+
+    expect(find.byKey(const Key('recent-searches-list')), findsOneWidget);
+    expect(find.text('design systems'), findsOneWidget);
+  });
+
+  testWidgets('recent searches can be rerun and cleared', (tester) async {
+    await tester.pumpWidget(
+      WidgetHelpers.testable(
+        overrides: [
+          searchProvider.overrideWith(
+            () => _FakeSearchNotifier(const SearchState.initial()),
+          ),
+          recentSearchesProvider.overrideWith(
+            () => _FakeRecentSearchesNotifier(const [
+              'design systems',
+              'launch plan',
+            ]),
+          ),
+          profileProvider.overrideWith(() => _FakeProfileNotifier()),
+        ],
+        child: const SearchPage(),
+      ),
+    );
+    await tester.pumpAndSettle();
+
+    expect(find.byKey(const Key('recent-searches-list')), findsOneWidget);
+    expect(find.text('Recent searches'), findsOneWidget);
+    expect(find.text('design systems'), findsOneWidget);
+    expect(find.text('launch plan'), findsOneWidget);
+    expect(
+      tester.getSize(find.byKey(const ValueKey('recent-search-0'))).height,
+      greaterThanOrEqualTo(Grid.xl),
+    );
+    expect(
+      tester.getSize(find.byKey(const ValueKey('recent-search-1'))).height,
+      greaterThanOrEqualTo(Grid.xl),
+    );
+
+    await tester.tap(find.byKey(const ValueKey('recent-search-1')));
+    await tester.pumpAndSettle();
+
+    final searchField = find.byKey(const Key('search-field'));
+    final input = tester.widget<TextField>(searchField);
+    expect(input.controller?.text, 'launch plan');
+    expect(input.focusNode?.hasFocus, isTrue);
+    expect(find.text("No results for 'launch plan'"), findsOneWidget);
+
+    await tester.tap(find.byKey(const Key('search-cancel')));
+    await tester.pumpAndSettle();
+    expect(find.byKey(const Key('recent-search-0')), findsOneWidget);
+    expect(find.text('launch plan'), findsOneWidget);
+
+    await tester.tap(find.byKey(const Key('clear-recent-searches')));
+    await tester.pumpAndSettle();
+    expect(find.byKey(const Key('recent-searches-list')), findsNothing);
+    expect(find.text('Search messages, channels, and people'), findsOneWidget);
+  });
+
+  testWidgets('keeps recent searches scrollable above the keyboard', (
+    tester,
+  ) async {
+    const keyboardInset = 300.0;
+    const footerClearance = 102.0;
+
+    await tester.pumpWidget(
+      WidgetHelpers.testable(
+        overrides: [
+          searchProvider.overrideWith(
+            () => _FakeSearchNotifier(const SearchState.initial()),
+          ),
+          recentSearchesProvider.overrideWith(
+            () => _FakeRecentSearchesNotifier(const [
+              'design systems',
+              'launch plan',
+            ]),
+          ),
+          profileProvider.overrideWith(() => _FakeProfileNotifier()),
+        ],
+        child: Builder(
+          builder: (context) => MediaQuery(
+            data: MediaQuery.of(context).copyWith(
+              padding: const EdgeInsets.only(bottom: footerClearance),
+              viewInsets: const EdgeInsets.only(bottom: keyboardInset),
+            ),
+            child: const SearchPage(),
+          ),
+        ),
+      ),
+    );
+    await tester.pumpAndSettle();
+    await tester.tap(find.byKey(const Key('search-field')));
+    await tester.pumpAndSettle();
+
+    final recentSearches = tester.widget<ListView>(
+      find.byKey(const Key('recent-searches-list')),
+    );
+    final padding = recentSearches.padding! as EdgeInsets;
+
+    expect(padding.bottom, Grid.xl + footerClearance + keyboardInset);
+  });
+
   testWidgets('keeps search results scrollable above the keyboard', (
     tester,
   ) async {
     const keyboardInset = 300.0;
+    const footerClearance = 102.0;
     final state = SearchState(
       query: 'general',
       channelResults: [
@@ -84,11 +313,15 @@ void main() {
       WidgetHelpers.testable(
         overrides: [
           searchProvider.overrideWith(() => _FakeSearchNotifier(state)),
+          recentSearchesProvider.overrideWith(
+            () => _FakeRecentSearchesNotifier(const []),
+          ),
           profileProvider.overrideWith(() => _FakeProfileNotifier()),
         ],
         child: Builder(
           builder: (context) => MediaQuery(
             data: MediaQuery.of(context).copyWith(
+              padding: const EdgeInsets.only(bottom: footerClearance),
               viewInsets: const EdgeInsets.only(bottom: keyboardInset),
             ),
             child: const SearchPage(),
@@ -103,7 +336,7 @@ void main() {
     );
     final padding = results.padding! as EdgeInsets;
 
-    expect(padding.bottom, Grid.xl + keyboardInset);
+    expect(padding.bottom, Grid.xl + footerClearance + keyboardInset);
   });
 
   testWidgets('keeps no-results feedback above the keyboard', (tester) async {
@@ -120,6 +353,9 @@ void main() {
           searchProvider.overrideWith(
             () => _FakeSearchNotifier(const SearchState(query: query)),
           ),
+          recentSearchesProvider.overrideWith(
+            () => _FakeRecentSearchesNotifier(const []),
+          ),
           profileProvider.overrideWith(() => _FakeProfileNotifier()),
         ],
         child: Builder(
@@ -144,6 +380,219 @@ void main() {
     expect(tester.getBottomLeft(message).dy, lessThan(keyboardTop));
     expect(tester.takeException(), isNull);
   });
+
+  testWidgets('uses compact content styles and keeps message time by author', (
+    tester,
+  ) async {
+    late _FakeRecentSearchesNotifier recentSearches;
+    final createdAt = DateTime.now().millisecondsSinceEpoch ~/ 1000 - 120;
+    final state = SearchState(
+      query: 'design',
+      channelResults: [
+        Channel(
+          id: 'design',
+          name: 'design',
+          channelType: 'stream',
+          visibility: 'open',
+          description: 'Design discussion',
+          createdBy: 'test',
+          createdAt: DateTime(2025),
+          memberCount: 4,
+          isMember: true,
+        ),
+      ],
+      userResults: const [
+        DirectoryUser(
+          pubkey: 'maya',
+          displayName: 'Maya',
+          nip05Handle: 'maya@example.com',
+        ),
+      ],
+      messageResults: [
+        SearchHit(
+          eventId: 'message-1',
+          content: 'The latest design is ready',
+          kind: 9,
+          pubkey: 'alice',
+          channelName: 'design',
+          createdAt: createdAt,
+          score: 1,
+        ),
+      ],
+    );
+
+    await tester.pumpWidget(
+      WidgetHelpers.testable(
+        overrides: [
+          searchProvider.overrideWith(() => _FakeSearchNotifier(state)),
+          recentSearchesProvider.overrideWith(
+            () => recentSearches = _FakeRecentSearchesNotifier(const []),
+          ),
+          profileProvider.overrideWith(() => _FakeProfileNotifier()),
+          channelsProvider.overrideWith(() => _FakeChannelsNotifier()),
+          userCacheProvider.overrideWith(
+            () => _FakeUserCacheNotifier(
+              const UserProfile(
+                pubkey: 'alice',
+                displayName: 'Alice',
+                nip05Handle: 'alice@example.com',
+              ),
+            ),
+          ),
+        ],
+        child: const SearchPage(),
+      ),
+    );
+    await tester.pumpAndSettle();
+
+    final channelTitle = tester.widget<Text>(
+      find.byKey(const ValueKey('search-channel-title-design')),
+    );
+    final personTitle = tester.widget<Text>(
+      find.byKey(const ValueKey('search-person-title-maya')),
+    );
+    for (final title in [channelTitle, personTitle]) {
+      expect(title.style?.fontSize, contentListTitleTextStyle.fontSize);
+      expect(title.style?.fontWeight, contentListTitleTextStyle.fontWeight);
+      expect(title.style?.height, contentListTitleTextStyle.height);
+    }
+    for (final label in ['channels', 'people', 'messages']) {
+      final sectionLabel = tester.widget<Text>(
+        find.byKey(ValueKey('search-section-$label')),
+      );
+      expect(
+        sectionLabel.data,
+        '${label[0].toUpperCase()}${label.substring(1)}',
+      );
+      expect(sectionLabel.style?.fontSize, activityContextTextStyle.fontSize);
+      expect(
+        sectionLabel.style?.fontWeight,
+        activityContextTextStyle.fontWeight,
+      );
+      expect(sectionLabel.style?.letterSpacing, 0);
+    }
+    for (final rowKey in [
+      'search-channel-row-design',
+      'search-person-row-maya',
+      'search-message-row-message-1',
+    ]) {
+      final row = tester.widget<ListTile>(find.byKey(ValueKey(rowKey)));
+      expect(
+        row.contentPadding,
+        const EdgeInsets.symmetric(horizontal: Grid.gutter),
+      );
+    }
+    for (final alignment in [
+      ('channels', 'search-channel-leading-design'),
+      ('people', 'search-person-leading-maya'),
+      ('messages', 'search-message-avatar-message-1'),
+    ]) {
+      expect(
+        tester
+            .getTopLeft(find.byKey(ValueKey('search-section-${alignment.$1}')))
+            .dx,
+        tester.getTopLeft(find.byKey(ValueKey(alignment.$2))).dx,
+      );
+    }
+
+    final authorFinder = find.byKey(
+      const ValueKey('search-message-author-message-1'),
+    );
+    final usernameFinder = find.byKey(
+      const ValueKey('search-message-username-message-1'),
+    );
+    final timestampFinder = find.byKey(
+      const ValueKey('search-message-timestamp-message-1'),
+    );
+    final author = tester.widget<Text>(authorFinder);
+    final username = tester.widget<Text>(usernameFinder);
+    final timestamp = tester.widget<Text>(timestampFinder);
+    expect(author.style?.fontSize, messageUsernameTextStyle.fontSize);
+    expect(author.style?.fontWeight, messageUsernameTextStyle.fontWeight);
+    expect(author.style?.height, messageUsernameTextStyle.height);
+    expect(username.data, 'alice@example.com');
+    expect(username.style?.fontSize, messageMetadataTextStyle.fontSize);
+    expect(username.style?.fontWeight, FontWeight.w400);
+    expect(username.style?.height, messageMetadataTextStyle.height);
+    expect(timestamp.style?.fontSize, messageTimestampTextStyle.fontSize);
+    expect(timestamp.style?.height, messageTimestampTextStyle.height);
+    expect(
+      (tester.getCenter(authorFinder).dy - tester.getCenter(timestampFinder).dy)
+          .abs(),
+      lessThan(1),
+    );
+    expect(
+      (tester
+                  .getTopLeft(
+                    find.byKey(
+                      const ValueKey('search-message-avatar-message-1'),
+                    ),
+                  )
+                  .dy -
+              tester.getTopLeft(authorFinder).dy)
+          .abs(),
+      lessThan(6),
+    );
+
+    final body = tester.widget<MessageContent>(
+      find.byKey(const ValueKey('search-message-body-message-1')),
+    );
+    expect(body.baseStyle?.fontSize, activityPreviewTextStyle.fontSize);
+    expect(body.baseStyle?.height, activityPreviewTextStyle.height);
+    expect(
+      tester.widget<SmallAvatar>(find.byType(SmallAvatar)).size,
+      compactMessageAvatarSize,
+    );
+    final contextLabel = tester.widget<Text>(find.text('Message in'));
+    final channelLabel = tester.widget<Text>(
+      find.byKey(const ValueKey('search-message-channel-message-1')),
+    );
+    expect(contextLabel.style?.fontSize, activityContextTextStyle.fontSize);
+    expect(contextLabel.style?.height, activityContextTextStyle.height);
+    expect(channelLabel.data, '#design');
+    expect(channelLabel.style?.fontSize, activityContextTextStyle.fontSize);
+    final channelChip = tester.widget<Container>(
+      find.byWidgetPredicate(
+        (widget) =>
+            widget is Container &&
+            widget.child is Text &&
+            (widget.child as Text).key ==
+                const ValueKey('search-message-channel-message-1'),
+      ),
+    );
+    expect(
+      (channelChip.decoration! as BoxDecoration).borderRadius,
+      BorderRadius.circular(Radii.xs),
+    );
+    expect(
+      tester
+          .getTopLeft(
+            find.byKey(const ValueKey('search-message-context-message-1')),
+          )
+          .dy,
+      greaterThan(tester.getTopLeft(authorFinder).dy),
+    );
+    expect(
+      tester
+          .getTopLeft(
+            find.byKey(const ValueKey('search-message-body-message-1')),
+          )
+          .dy,
+      greaterThan(
+        tester
+            .getBottomLeft(
+              find.byKey(const ValueKey('search-message-context-message-1')),
+            )
+            .dy,
+      ),
+    );
+
+    await tester.tap(
+      find.byKey(const ValueKey('search-message-row-message-1')),
+    );
+    await tester.pump();
+    expect(recentSearches.searches, const ['design']);
+  });
 }
 
 class _FakeSearchNotifier extends SearchNotifier {
@@ -153,6 +602,41 @@ class _FakeSearchNotifier extends SearchNotifier {
 
   @override
   SearchState build() => initialState;
+
+  @override
+  void search(String query) {
+    state = SearchState(query: query.trim());
+  }
+
+  @override
+  void clear() {
+    state = const SearchState.initial();
+  }
+}
+
+class _FakeRecentSearchesNotifier extends RecentSearchesNotifier {
+  _FakeRecentSearchesNotifier(this.initialSearches);
+
+  final List<String> initialSearches;
+  List<String> get searches => state;
+
+  @override
+  List<String> build() => initialSearches;
+
+  @override
+  void record(String query) {
+    final trimmed = query.trim();
+    if (trimmed.isEmpty) return;
+    state = [
+      trimmed,
+      ...state.where((item) => item.toLowerCase() != trimmed.toLowerCase()),
+    ];
+  }
+
+  @override
+  void clear() {
+    state = const [];
+  }
 }
 
 class _FakeProfileNotifier extends ProfileNotifier {
@@ -160,3 +644,17 @@ class _FakeProfileNotifier extends ProfileNotifier {
   Future<UserProfile?> build() async =>
       const UserProfile(pubkey: 'test', displayName: 'Test');
 }
+
+class _FakeChannelsNotifier extends ChannelsNotifier {
+  @override
+  Future<List<Channel>> build() async => const [];
+}
+
+class _FakeUserCacheNotifier extends UserCacheNotifier {
+  _FakeUserCacheNotifier(this.profile);
+
+  final UserProfile profile;
+
+  @override
+  Map<String, UserProfile> build() => {profile.pubkey: profile};
+}
diff --git a/mobile/test/shared/deeplink/deep_link_test.dart b/mobile/test/shared/deeplink/deep_link_test.dart
index 64e15f0513e..70e20663082 100644
--- a/mobile/test/shared/deeplink/deep_link_test.dart
+++ b/mobile/test/shared/deeplink/deep_link_test.dart
@@ -3,6 +3,7 @@ import 'package:flutter_test/flutter_test.dart';
 
 void main() {
   _inviteTests();
+  _buildMessageLinkTests();
 
   group('parseMessageDeepLink', () {
     test('parses channel and id', () {
@@ -231,3 +232,64 @@ void _inviteTests() {
     });
   });
 }
+
+void _buildMessageLinkTests() {
+  group('buildMessageLink', () {
+    test('builds channel + id link', () {
+      expect(
+        buildMessageLink(channelId: 'd14cd131', messageId: 'abc123'),
+        'buzz://message?channel=d14cd131&id=abc123',
+      );
+    });
+
+    test('includes thread root when present', () {
+      expect(
+        buildMessageLink(
+          channelId: 'd14cd131',
+          messageId: 'abc123',
+          threadRootId: 'root99',
+        ),
+        'buzz://message?channel=d14cd131&id=abc123&thread=root99',
+      );
+    });
+
+    test('treats empty thread root as absent', () {
+      expect(
+        buildMessageLink(
+          channelId: 'd14cd131',
+          messageId: 'abc123',
+          threadRootId: '',
+        ),
+        'buzz://message?channel=d14cd131&id=abc123',
+      );
+    });
+
+    test('round-trips through parseMessageDeepLink', () {
+      final url = buildMessageLink(
+        channelId: 'chan-1',
+        messageId: 'msg-1',
+        threadRootId: 'root-1',
+      );
+      final parsed = parseMessageDeepLink(Uri.parse(url));
+      expect(
+        parsed,
+        const MessageDeepLink(
+          channelId: 'chan-1',
+          messageId: 'msg-1',
+          threadRootId: 'root-1',
+        ),
+      );
+    });
+
+    test('throws on empty channel or id', () {
+      expect(
+        () => buildMessageLink(channelId: '', messageId: 'abc'),
+        throwsArgumentError,
+      );
+      expect(
+        () => buildMessageLink(channelId: 'chan', messageId: ''),
+        throwsArgumentError,
+      );
+    });
+  });
+}
diff --git a/mobile/test/shared/relay/relay_endpoint_test.dart b/mobile/test/shared/relay/relay_endpoint_test.dart
new file mode 100644
index 00000000000..be1ddaa0a08
--- /dev/null
+++ b/mobile/test/shared/relay/relay_endpoint_test.dart
@@ -0,0 +1,56 @@
+import 'package:buzz/shared/relay/relay_endpoint.dart';
+import 'package:flutter_test/flutter_test.dart';
+
+void main() {
+  group('relayEndpoint', () {
+    test('joins onto an origin-rooted relay unchanged', () {
+      expect(relayEndpoint('https://host', '/query'), 'https://host/query');
+      expect(
+        relayEndpoint('https://host/', '/media/upload'),
+        'https://host/media/upload',
+      );
+    });
+
+    test('preserves a base path so BUZZ_BASE_PATH deployments resolve', () {
+      expect(
+        relayEndpoint('https://host/relay', '/query'),
+        'https://host/relay/query',
+      );
+      expect(
+        relayEndpoint('https://host/relay/', 'query'),
+        'https://host/relay/query',
+      );
+      expect(
+        relayEndpoint('https://host/buzz/relay', '/media/upload'),
+        'https://host/buzz/relay/media/upload',
+      );
+    });
+
+    test('treats the path as relative regardless of leading slashes', () {
+      expect(
+        relayEndpoint('https://host/relay', 'upload'),
+        'https://host/relay/upload',
+      );
+      expect(
+        relayEndpoint('https://host/relay', '//upload'),
+        'https://host/relay/upload',
+      );
+    });
+
+    test('returns the bare base for an empty path', () {
+      expect(relayEndpoint('https://host/relay/', '/'), 'https://host/relay');
+    });
+  });
+
+  group('isRelayMediaPath', () {
+    test('accepts the media route at the root and under a prefix', () {
+      expect(isRelayMediaPath('/media/abc'), isTrue);
+      expect(isRelayMediaPath('/relay/media/abc'), isTrue);
+    });
+
+    test('rejects near-miss segments', () {
+      expect(isRelayMediaPath('/media-evil/abc'), isFalse);
+      expect(isRelayMediaPath('/other/abc'), isFalse);
+    });
+  });
+}
diff --git a/mobile/test/shared/relay/relay_session_test.dart b/mobile/test/shared/relay/relay_session_test.dart
index 6cd601f56b0..6ded6fb4495 100644
--- a/mobile/test/shared/relay/relay_session_test.dart
+++ b/mobile/test/shared/relay/relay_session_test.dart
@@ -50,7 +50,9 @@ void main() {
 
     expect(capturedRequest, isNotNull);
     expect(capturedRequest!.method, 'POST');
-    expect(capturedRequest!.url.toString(), 'https://relay.example/query');
+    // The fixture's base URL carries a path (a BUZZ_BASE_PATH deployment), so
+    // the bridge call must land under it rather than at the origin root.
+    expect(capturedRequest!.url.toString(), 'https://relay.example/base/query');
     expect(capturedRequest!.headers['Content-Type'], 'application/json');
     expect(jsonDecode(capturedRequest!.body), [filter.toJson()]);
 
@@ -70,9 +72,11 @@ void main() {
 
     expect(authEvent['kind'], 27235);
     expect(authEvent['pubkey'], keychain.public);
+    // The signed `u` tag must carry the base path as well: the relay
+    // reconstructs the prefixed URL, so a bare-origin tag would 401.
     expect(
       tags,
-      anyElement(equals(<String>['u', 'https://relay.example/query'])),
+      anyElement(equals(<String>['u', 'https://relay.example/base/query'])),
     );
     expect(tags, anyElement(equals(<String>['method', 'POST'])));
     expect(tags, anyElement(equals(<String>['payload', payloadHash])));
diff --git a/mobile/test/shared/reminders/remind_me_later_sheet_test.dart b/mobile/test/shared/reminders/remind_me_later_sheet_test.dart
new file mode 100644
index 00000000000..3a7c199ee90
--- /dev/null
+++ b/mobile/test/shared/reminders/remind_me_later_sheet_test.dart
@@ -0,0 +1,128 @@
+import 'package:buzz/shared/reminders/remind_me_later_sheet.dart';
+import 'package:buzz/shared/reminders/reminder_service.dart';
+import 'package:buzz/shared/relay/relay.dart';
+import 'package:buzz/shared/theme/theme.dart';
+import 'package:flutter/material.dart';
+import 'package:flutter_test/flutter_test.dart';
+import 'package:hooks_riverpod/hooks_riverpod.dart';
+import 'package:nostr/nostr.dart' as nostr;
+
+const _target = ReminderTarget(
+  eventId: 'msg-1',
+  channelId: 'chan-1',
+  preview: 'hello',
+  authorPubkey: 'alice',
+);
+
+/// Records createReminder calls; throws when [error] is set.
+class _RecordingReminderService extends ReminderService {
+  final Object? error;
+  final List<int> submittedNotBefore = [];
+
+  _RecordingReminderService({this.error})
+    : super(
+        signedEventRelay: SignedEventRelay(
+          session: RelaySessionNotifier(),
+          nsec: nostr.Keys.generate().nsec,
+        ),
+        crypto: _stubCrypto(),
+      );
+
+  @override
+  Future<void> createReminder({
+    required ReminderTarget target,
+    required int notBefore,
+    String? note,
+  }) async {
+    final error = this.error;
+    if (error != null) throw error;
+    submittedNotBefore.add(notBefore);
+  }
+}
+
+ReminderCrypto _stubCrypto() {
+  final keys = nostr.Keys.generate();
+  return ReminderCrypto(keys.nsec, keys.public);
+}
+
+Future<void> _pumpSheet(
+  WidgetTester tester, {
+  required ReminderService service,
+}) async {
+  await tester.pumpWidget(
+    ProviderScope(
+      overrides: [reminderServiceProvider.overrideWithValue(service)],
+      child: MaterialApp(
+        theme: AppTheme.light(),
+        home: Scaffold(
+          body: Consumer(
+            builder: (context, ref, _) => TextButton(
+              onPressed: () => showRemindMeLaterSheet(
+                context: context,
+                ref: ref,
+                target: _target,
+              ),
+              child: const Text('open'),
+            ),
+          ),
+        ),
+      ),
+    ),
+  );
+  await tester.tap(find.text('open'));
+  await tester.pumpAndSettle();
+}
+
+void main() {
+  group('showRemindMeLaterSheet', () {
+    testWidgets('cancelling the custom date picker keeps the reminder sheet '
+        'open', (tester) async {
+      final service = _RecordingReminderService();
+      await _pumpSheet(tester, service: service);
+
+      await tester.ensureVisible(find.text('Pick a date & time'));
+      await tester.pumpAndSettle();
+      await tester.tap(find.text('Pick a date & time'));
+      await tester.pumpAndSettle();
+
+      // Native date picker is up; cancel it.
+      await tester.tap(find.text('Cancel'));
+      await tester.pumpAndSettle();
+
+      // The preset sheet stays open for a retry, and nothing was submitted.
+      expect(find.text('Remind me about this message'), findsOneWidget);
+      expect(find.text('Pick a date & time'), findsOneWidget);
+      expect(service.submittedNotBefore, isEmpty);
+    });
+
+    testWidgets('preset submission failure shows stable copy without the '
+        'raw error', (tester) async {
+      final service = _RecordingReminderService(
+        error: Exception('nip44 conversation key mismatch'),
+      );
+      await _pumpSheet(tester, service: service);
+
+      await tester.tap(find.text('In 1 hour'));
+      await tester.pumpAndSettle();
+
+      expect(find.text('Couldn’t set reminder. Try again.'), findsOneWidget);
+      expect(
+        find.textContaining('nip44 conversation key mismatch'),
+        findsNothing,
+      );
+    });
+
+    testWidgets('preset submission success confirms with a snackbar', (
+      tester,
+    ) async {
+      final service = _RecordingReminderService();
+      await _pumpSheet(tester, service: service);
+
+      await tester.tap(find.text('In 1 hour'));
+      await tester.pumpAndSettle();
+
+      expect(service.submittedNotBefore, hasLength(1));
+      expect(find.text('Reminder set'), findsOneWidget);
+    });
+  });
+}
diff --git a/mobile/test/shared/reminders/reminder_service_test.dart b/mobile/test/shared/reminders/reminder_service_test.dart
new file mode 100644
index 00000000000..9751541a333
--- /dev/null
+++ b/mobile/test/shared/reminders/reminder_service_test.dart
@@ -0,0 +1,124 @@
+import 'dart:convert';
+
+import 'package:buzz/shared/reminders/reminder_service.dart';
+import 'package:buzz/shared/reminders/reminder_time_presets.dart';
+import 'package:flutter_test/flutter_test.dart';
+import 'package:nostr/nostr.dart' as nostr;
+
+void main() {
+  const target = ReminderTarget(
+    eventId: 'event-1',
+    channelId: 'channel-1',
+    preview: 'hello world',
+    authorPubkey: 'author-pk',
+  );
+
+  group('buildReminderPlaintext', () {
+    test('matches the desktop NIP-ER content shape', () {
+      final plaintext = buildReminderPlaintext(target: target, note: 'ping');
+      expect(jsonDecode(plaintext), {
+        'target': {
+          'eventId': 'event-1',
+          'channelId': 'channel-1',
+          'preview': 'hello world',
+          'authorPubkey': 'author-pk',
+        },
+        'note': 'ping',
+        'status': 'pending',
+      });
+    });
+
+    test('omits note when absent or empty', () {
+      for (final note in [null, '']) {
+        final decoded =
+            jsonDecode(buildReminderPlaintext(target: target, note: note))
+                as Map<String, dynamic>;
+        expect(decoded.containsKey('note'), isFalse);
+        expect(decoded['status'], 'pending');
+      }
+    });
+  });
+
+  group('randomReminderDTag', () {
+    test('is 32 lowercase hex chars (128 bits)', () {
+      final dTag = randomReminderDTag();
+      expect(dTag, matches(RegExp(r'^[0-9a-f]{32}$')));
+    });
+
+    test('is unique across calls', () {
+      expect(randomReminderDTag(), isNot(randomReminderDTag()));
+    });
+  });
+
+  group('buildReminderTags', () {
+    test('emits d and strict-decimal not_before tags', () {
+      expect(buildReminderTags(dTag: 'abc', notBefore: 1753000000), [
+        ['d', 'abc'],
+        ['not_before', '1753000000'],
+      ]);
+    });
+
+    test('rejects negative timestamps', () {
+      expect(
+        () => buildReminderTags(dTag: 'abc', notBefore: -1),
+        throwsArgumentError,
+      );
+    });
+  });
+
+  group('ReminderCrypto', () {
+    test('encrypts to self and decrypts back', () {
+      final keys = nostr.Keys.generate();
+      final crypto = ReminderCrypto(keys.nsec, keys.public);
+
+      const plaintext = '{"status":"pending","note":"hi"}';
+      final ciphertext = crypto.encrypt(plaintext);
+      expect(ciphertext, isNot(contains('pending')));
+      expect(crypto.decrypt(ciphertext), plaintext);
+    });
+  });
+
+  group('reminder time presets', () {
+    test('presets resolve strictly in the future', () {
+      final now = DateTime.now().millisecondsSinceEpoch ~/ 1000;
+      for (final preset in reminderTimePresets) {
+        expect(preset.getTimestamp(), greaterThan(now), reason: preset.label);
+      }
+    });
+
+    test('nextDayAt9am rolls past instants forward', () {
+      final tenAm = DateTime(2026, 7, 25, 10);
+      final next = nextDayAt9am(0, now: tenAm);
+      expect(
+        DateTime.fromMillisecondsSinceEpoch(next * 1000),
+        DateTime(2026, 7, 26, 9),
+      );
+    });
+
+    test('nextDayAt9am keeps future same-day instants', () {
+      final eightAm = DateTime(2026, 7, 25, 8);
+      final next = nextDayAt9am(0, now: eightAm);
+      expect(
+        DateTime.fromMillisecondsSinceEpoch(next * 1000),
+        DateTime(2026, 7, 25, 9),
+      );
+    });
+
+    test('daysUntilNextMonday is 1-7 and lands on Monday', () {
+      for (var day = 20; day < 27; day++) {
+        final now = DateTime(2026, 7, day);
+        final days = daysUntilNextMonday(now);
+        expect(days, inInclusiveRange(1, 7));
+        expect(now.add(Duration(days: days)).weekday, DateTime.monday);
+      }
+    });
+
+    test('combineCustomDateTime rejects past instants', () {
+      final yesterday = DateTime.now().subtract(const Duration(days: 1));
+      expect(combineCustomDateTime(yesterday, 9, 0), isNull);
+
+      final tomorrow = DateTime.now().add(const Duration(days: 1));
+      expect(combineCustomDateTime(tomorrow, 9, 0), isNotNull);
+    });
+  });
+}
diff --git a/mobile/test/shared/theme/message_typography_test.dart b/mobile/test/shared/theme/message_typography_test.dart
new file mode 100644
index 00000000000..169bcc02003
--- /dev/null
+++ b/mobile/test/shared/theme/message_typography_test.dart
@@ -0,0 +1,141 @@
+import 'package:buzz/shared/theme/theme.dart';
+import 'package:flutter/material.dart';
+import 'package:flutter_test/flutter_test.dart';
+
+void main() {
+  void expectStyle(
+    TextStyle style, {
+    required double fontSize,
+    required FontWeight fontWeight,
+    required double lineHeight,
+    required double letterSpacing,
+  }) {
+    expect(style.fontFamily, 'Inter');
+    expect(style.fontSize, fontSize);
+    expect(style.fontWeight, fontWeight);
+    expect(style.height, closeTo(lineHeight / fontSize, 0.0001));
+    expect(style.letterSpacing, letterSpacing);
+  }
+
+  test('message typography matches the shared mobile scale', () {
+    expectStyle(
+      messageBodyTextStyle,
+      fontSize: 15,
+      fontWeight: FontWeight.w400,
+      lineHeight: 20,
+      letterSpacing: 0,
+    );
+    expectStyle(
+      messageUsernameTextStyle,
+      fontSize: 15,
+      fontWeight: FontWeight.w600,
+      lineHeight: 17,
+      letterSpacing: 0,
+    );
+    expectStyle(
+      messageTimestampTextStyle,
+      fontSize: 15,
+      fontWeight: FontWeight.w400,
+      lineHeight: 17,
+      letterSpacing: 0,
+    );
+    expect(messageTimestampTextStyle, messageMetadataTextStyle);
+    expectStyle(
+      replyPreviewTextStyle,
+      fontSize: 13.1,
+      fontWeight: FontWeight.w400,
+      lineHeight: 17,
+      letterSpacing: 0,
+    );
+    expectStyle(
+      reactionCountTextStyle,
+      fontSize: 13.1,
+      fontWeight: FontWeight.w500,
+      lineHeight: 17,
+      letterSpacing: 0,
+    );
+    expectStyle(
+      channelTitleTextStyle,
+      fontSize: 20,
+      fontWeight: FontWeight.w700,
+      lineHeight: 24,
+      letterSpacing: 0,
+    );
+    expectStyle(
+      systemMessageHeadingTextStyle,
+      fontSize: 15,
+      fontWeight: FontWeight.w600,
+      lineHeight: 17,
+      letterSpacing: 0,
+    );
+    expectStyle(
+      systemMessageBodyTextStyle,
+      fontSize: 15,
+      fontWeight: FontWeight.w400,
+      lineHeight: 20,
+      letterSpacing: 0,
+    );
+  });
+
+  test('activity typography matches the conversation row scale', () {
+    expectStyle(
+      activityUsernameTextStyle,
+      fontSize: 15,
+      fontWeight: FontWeight.w600,
+      lineHeight: 17,
+      letterSpacing: 0,
+    );
+    expectStyle(
+      activityTimestampTextStyle,
+      fontSize: 15,
+      fontWeight: FontWeight.w400,
+      lineHeight: 17,
+      letterSpacing: 0,
+    );
+    expectStyle(
+      activityContextTextStyle,
+      fontSize: 13.1,
+      fontWeight: FontWeight.w500,
+      lineHeight: 17,
+      letterSpacing: 0,
+    );
+    expectStyle(
+      activityPreviewTextStyle,
+      fontSize: 15,
+      fontWeight: FontWeight.w400,
+      lineHeight: 20,
+      letterSpacing: 0,
+    );
+  });
+
+  test('content list typography matches the compact list scale', () {
+    expectStyle(
+      contentListTitleTextStyle,
+      fontSize: 15,
+      fontWeight: FontWeight.w600,
+      lineHeight: 17,
+      letterSpacing: 0,
+    );
+    expectStyle(
+      contentListBodyTextStyle,
+      fontSize: 13.1,
+      fontWeight: FontWeight.w400,
+      lineHeight: 17,
+      letterSpacing: 0,
+    );
+    expectStyle(
+      contentListTimestampTextStyle,
+      fontSize: 15,
+      fontWeight: FontWeight.w400,
+      lineHeight: 17,
+      letterSpacing: 0,
+    );
+  });
+
+  test('message and activity avatars use their surface sizes', () {
+    expect(messageAvatarSize, 42);
+    expect(activityAvatarSize, 42);
+    expect(compactMessageAvatarSize, 42);
+    expect(messageAvatarContentGap, Grid.twelve);
+  });
+}
diff --git a/mobile/test/shared/widgets/buzz_loading_indicator_test.dart b/mobile/test/shared/widgets/buzz_loading_indicator_test.dart
new file mode 100644
index 00000000000..936c3bc3972
--- /dev/null
+++ b/mobile/test/shared/widgets/buzz_loading_indicator_test.dart
@@ -0,0 +1,50 @@
+import 'package:flutter/material.dart';
+import 'package:flutter_test/flutter_test.dart';
+import 'package:hooks_riverpod/hooks_riverpod.dart';
+import 'package:buzz/shared/theme/theme.dart';
+import 'package:buzz/shared/widgets/buzz_loading_indicator.dart';
+
+Widget _testable({required bool disableAnimations}) {
+  return ProviderScope(
+    child: MaterialApp(
+      theme: AppTheme.light(),
+      home: MediaQuery(
+        data: const MediaQueryData().copyWith(
+          disableAnimations: disableAnimations,
+        ),
+        child: const Scaffold(
+          body: BuzzLoadingIndicator(semanticLabel: 'Loading photos'),
+        ),
+      ),
+    ),
+  );
+}
+
+void main() {
+  testWidgets('animates the shared arc spinner', (tester) async {
+    final semantics = tester.ensureSemantics();
+
+    await tester.pumpWidget(_testable(disableAnimations: false));
+    await tester.pump(const Duration(milliseconds: 70));
+
+    final spinner = tester.widget<RotationTransition>(
+      find.byKey(const ValueKey('buzz-loading-indicator-spinner')),
+    );
+    expect(spinner.turns.value, greaterThan(0));
+    expect(find.bySemanticsLabel('Loading photos'), findsOneWidget);
+    semantics.dispose();
+  });
+
+  testWidgets('holds a static pose when reduced motion is enabled', (
+    tester,
+  ) async {
+    await tester.pumpWidget(_testable(disableAnimations: true));
+    await tester.pump(const Duration(milliseconds: 70));
+
+    final spinner = tester.widget<RotationTransition>(
+      find.byKey(const ValueKey('buzz-loading-indicator-spinner')),
+    );
+    expect(spinner.turns.value, 0);
+    expect(tester.binding.hasScheduledFrame, isFalse);
+  });
+}
diff --git a/mobile/test/shared/widgets/filter_chip_bar_test.dart b/mobile/test/shared/widgets/filter_chip_bar_test.dart
index 09a2f04531c..6f651624b6e 100644
--- a/mobile/test/shared/widgets/filter_chip_bar_test.dart
+++ b/mobile/test/shared/widgets/filter_chip_bar_test.dart
@@ -35,6 +35,14 @@ void main() {
     );
     final resolved = chipTheme.color?.resolve({WidgetState.selected});
     expect(resolved, accent);
+    final selectedLabel = tester.widget<Text>(find.text('Everyone'));
+    final unselectedLabel = tester.widget<Text>(find.text('Following'));
+    expect(selectedLabel.style?.fontSize, filterChipTextStyle.fontSize);
+    expect(selectedLabel.style?.height, filterChipTextStyle.height);
+    expect(selectedLabel.style?.fontWeight, FontWeight.w500);
+    expect(unselectedLabel.style?.fontSize, filterChipTextStyle.fontSize);
+    expect(unselectedLabel.style?.height, filterChipTextStyle.height);
+    expect(unselectedLabel.style?.fontWeight, FontWeight.w400);
   });
 
   testWidgets('expanded chips preserve large accessible text scaling', (
diff --git a/mobile/test/shared/widgets/message_author_meta_test.dart b/mobile/test/shared/widgets/message_author_meta_test.dart
new file mode 100644
index 00000000000..3b55946d47c
--- /dev/null
+++ b/mobile/test/shared/widgets/message_author_meta_test.dart
@@ -0,0 +1,117 @@
+import 'package:buzz/shared/theme/theme.dart';
+import 'package:buzz/shared/widgets/message_author_meta.dart';
+import 'package:flutter/material.dart';
+import 'package:flutter_test/flutter_test.dart';
+
+void main() {
+  testWidgets('keeps the separator and timestamp next to a short name', (
+    tester,
+  ) async {
+    const displayNameKey = Key('author-display-name');
+    const timestampKey = Key('author-timestamp');
+
+    await tester.pumpWidget(
+      MaterialApp(
+        theme: AppTheme.light(),
+        home: const Scaffold(
+          body: SizedBox(
+            width: 300,
+            child: MessageAuthorMeta(
+              displayName: 'Alice',
+              timestamp: '2m',
+              displayNameKey: displayNameKey,
+              timestampKey: timestampKey,
+              nameColor: Colors.black,
+              metadataColor: Colors.grey,
+            ),
+          ),
+        ),
+      ),
+    );
+    await tester.pumpAndSettle();
+
+    final displayNameRect = tester.getRect(find.byKey(displayNameKey));
+    final separatorRect = tester.getRect(find.text('·'));
+    final timestampRect = tester.getRect(find.byKey(timestampKey));
+
+    expect(separatorRect.left - displayNameRect.right, Grid.half);
+    expect(timestampRect.left - separatorRect.right, Grid.half);
+    expect(tester.takeException(), isNull);
+  });
+
+  testWidgets('reallocates unused metadata width to the display name', (
+    tester,
+  ) async {
+    const displayNameKey = Key('author-display-name');
+    const timestampKey = Key('author-timestamp');
+
+    await tester.pumpWidget(
+      MaterialApp(
+        theme: AppTheme.light(),
+        home: const Scaffold(
+          body: SizedBox(
+            width: 300,
+            child: MessageAuthorMeta(
+              displayName: 'A display name that needs the available width',
+              username: 'al',
+              timestamp: '2m',
+              displayNameKey: displayNameKey,
+              timestampKey: timestampKey,
+              nameColor: Colors.black,
+              metadataColor: Colors.grey,
+            ),
+          ),
+        ),
+      ),
+    );
+    await tester.pumpAndSettle();
+
+    final row = find.byType(MessageAuthorMeta);
+    final displayName = find.byKey(displayNameKey);
+    final timestamp = find.byKey(timestampKey);
+
+    expect(
+      tester.getSize(displayName).width,
+      greaterThan(tester.getSize(row).width / 2),
+    );
+    expect(
+      tester.getTopRight(timestamp).dx,
+      closeTo(tester.getTopRight(row).dx, 0.01),
+    );
+    expect(tester.takeException(), isNull);
+  });
+
+  testWidgets('constrains long metadata at large accessible text sizes', (
+    tester,
+  ) async {
+    const timestampKey = Key('author-timestamp');
+
+    await tester.pumpWidget(
+      MaterialApp(
+        theme: AppTheme.light(),
+        home: const MediaQuery(
+          data: MediaQueryData(textScaler: TextScaler.linear(2)),
+          child: Scaffold(
+            body: SizedBox(
+              width: 220,
+              child: MessageAuthorMeta(
+                displayName: 'A very long display name',
+                username: 'a-very-long-username',
+                timestamp: 'Mar 15, 2025',
+                timestampKey: timestampKey,
+                nameColor: Colors.black,
+                metadataColor: Colors.grey,
+              ),
+            ),
+          ),
+        ),
+      ),
+    );
+    await tester.pumpAndSettle();
+
+    final timestamp = tester.widget<Text>(find.byKey(timestampKey));
+    expect(timestamp.maxLines, 1);
+    expect(timestamp.overflow, TextOverflow.ellipsis);
+    expect(tester.takeException(), isNull);
+  });
+}
diff --git a/mobile/test/shared/widgets/mobile_tab_footer_backdrop_test.dart b/mobile/test/shared/widgets/mobile_tab_footer_backdrop_test.dart
new file mode 100644
index 00000000000..9e54177d61f
--- /dev/null
+++ b/mobile/test/shared/widgets/mobile_tab_footer_backdrop_test.dart
@@ -0,0 +1,23 @@
+import 'package:buzz/shared/widgets/mobile_tab_footer_backdrop.dart';
+import 'package:flutter/material.dart';
+import 'package:flutter_test/flutter_test.dart';
+
+void main() {
+  testWidgets('uses the logical bottom safe-area inset', (tester) async {
+    double? height;
+
+    await tester.pumpWidget(
+      MediaQuery(
+        data: const MediaQueryData(padding: EdgeInsets.only(bottom: 34)),
+        child: Builder(
+          builder: (context) {
+            height = mobileTabFooterBackdropHeight(context);
+            return const SizedBox();
+          },
+        ),
+      ),
+    );
+
+    expect(height, 170);
+  });
+}
diff --git a/mobile/test/shared/widgets/skeleton_test.dart b/mobile/test/shared/widgets/skeleton_test.dart
new file mode 100644
index 00000000000..5b2d25bd63c
--- /dev/null
+++ b/mobile/test/shared/widgets/skeleton_test.dart
@@ -0,0 +1,186 @@
+import 'package:buzz/shared/theme/theme.dart';
+import 'package:buzz/shared/widgets/skeleton.dart';
+import 'package:flutter/material.dart';
+import 'package:flutter/rendering.dart';
+import 'package:flutter_test/flutter_test.dart';
+
+void main() {
+  Widget buildShimmerTestable({
+    bool disableAnimations = false,
+    bool enabled = true,
+  }) {
+    return MaterialApp(
+      theme: AppTheme.light(),
+      builder: (context, child) => MediaQuery(
+        data: MediaQuery.of(
+          context,
+        ).copyWith(disableAnimations: disableAnimations),
+        child: child!,
+      ),
+      home: Scaffold(
+        body: SkeletonShimmer(
+          enabled: enabled,
+          child: const SkeletonBar(width: 120, height: 16),
+        ),
+      ),
+    );
+  }
+
+  Widget buildRevealTestable({
+    required ValueNotifier<bool> loading,
+    bool disableAnimations = false,
+  }) {
+    return MaterialApp(
+      theme: AppTheme.light(),
+      builder: (context, child) => MediaQuery(
+        data: MediaQuery.of(
+          context,
+        ).copyWith(disableAnimations: disableAnimations),
+        child: child!,
+      ),
+      home: Scaffold(
+        body: ValueListenableBuilder(
+          valueListenable: loading,
+          builder: (context, isLoading, _) => SkeletonReveal(
+            loading: isLoading,
+            skeleton: const SkeletonBar(width: 120, height: 16),
+            content: const Text('Loaded content'),
+          ),
+        ),
+      ),
+    );
+  }
+
+  double layerOpacity(WidgetTester tester, String key) =>
+      tester.widget<Opacity>(find.byKey(Key(key))).opacity;
+
+  bool contentFocusExcluded(WidgetTester tester) => tester
+      .widget<ExcludeFocus>(
+        find.descendant(
+          of: find.byKey(const Key('skeleton-reveal-content')),
+          matching: find.byType(ExcludeFocus),
+        ),
+      )
+      .excluding;
+
+  testWidgets('sweeps a highlight across skeleton elements while loading', (
+    tester,
+  ) async {
+    await tester.pumpWidget(buildShimmerTestable());
+
+    final shimmer = find.byType(SkeletonShimmer);
+    expect(find.byType(SkeletonBar), findsOneWidget);
+    expect(
+      find.descendant(of: shimmer, matching: find.byType(ShaderMask)),
+      findsOneWidget,
+    );
+
+    final boundary = tester.renderObject<RenderRepaintBoundary>(
+      find
+          .descendant(of: shimmer, matching: find.byType(RepaintBoundary))
+          .first,
+    );
+    final beforeBytes = await tester.runAsync(() async {
+      final image = await boundary.toImage();
+      return image.toByteData();
+    });
+
+    await tester.pump(const Duration(milliseconds: 1000));
+    final afterBytes = await tester.runAsync(() async {
+      final image = await boundary.toImage();
+      return image.toByteData();
+    });
+
+    expect(
+      beforeBytes!.buffer.asUint8List(),
+      isNot(equals(afterBytes!.buffer.asUint8List())),
+    );
+  });
+
+  testWidgets('keeps skeleton elements static for reduced motion', (
+    tester,
+  ) async {
+    await tester.pumpWidget(buildShimmerTestable(disableAnimations: true));
+
+    final shimmer = find.byType(SkeletonShimmer);
+    expect(find.byType(SkeletonBar), findsOneWidget);
+    expect(
+      find.descendant(of: shimmer, matching: find.byType(ShaderMask)),
+      findsNothing,
+    );
+  });
+
+  testWidgets('keeps skeleton elements static when shimmer is disabled', (
+    tester,
+  ) async {
+    await tester.pumpWidget(buildShimmerTestable(enabled: false));
+
+    final shimmer = find.byType(SkeletonShimmer);
+    expect(find.byType(SkeletonBar), findsOneWidget);
+    expect(
+      find.descendant(of: shimmer, matching: find.byType(ShaderMask)),
+      findsNothing,
+    );
+  });
+
+  testWidgets('reveals content in the same slot with a 400ms cross-fade', (
+    tester,
+  ) async {
+    final loading = ValueNotifier(true);
+    await tester.pumpWidget(buildRevealTestable(loading: loading));
+
+    expect(layerOpacity(tester, 'skeleton-reveal-placeholder'), 1);
+    expect(layerOpacity(tester, 'skeleton-reveal-content'), 0);
+    expect(contentFocusExcluded(tester), isTrue);
+
+    loading.value = false;
+    await tester.pump();
+    await tester.pump(const Duration(milliseconds: 200));
+
+    expect(
+      layerOpacity(tester, 'skeleton-reveal-placeholder'),
+      closeTo(0.5, 0.01),
+    );
+    expect(layerOpacity(tester, 'skeleton-reveal-content'), closeTo(0.5, 0.01));
+    expect(contentFocusExcluded(tester), isTrue);
+
+    await tester.pump(const Duration(milliseconds: 200));
+
+    expect(layerOpacity(tester, 'skeleton-reveal-placeholder'), 0);
+    expect(layerOpacity(tester, 'skeleton-reveal-content'), 1);
+    expect(contentFocusExcluded(tester), isFalse);
+    expect(find.text('Loaded content'), findsOneWidget);
+  });
+
+  testWidgets('resets to the skeleton without animating backwards', (
+    tester,
+  ) async {
+    final loading = ValueNotifier(false);
+    await tester.pumpWidget(buildRevealTestable(loading: loading));
+    expect(layerOpacity(tester, 'skeleton-reveal-content'), 1);
+
+    loading.value = true;
+    await tester.pump();
+
+    expect(layerOpacity(tester, 'skeleton-reveal-placeholder'), 1);
+    expect(layerOpacity(tester, 'skeleton-reveal-content'), 0);
+  });
+
+  testWidgets('reveals immediately for reduced motion', (tester) async {
+    final loading = ValueNotifier(true);
+    await tester.pumpWidget(
+      buildRevealTestable(loading: loading, disableAnimations: true),
+    );
+    final reveal = find.byType(SkeletonReveal);
+    expect(
+      find.descendant(of: reveal, matching: find.byType(ShaderMask)),
+      findsNothing,
+    );
+
+    loading.value = false;
+    await tester.pump();
+
+    expect(layerOpacity(tester, 'skeleton-reveal-placeholder'), 0);
+    expect(layerOpacity(tester, 'skeleton-reveal-content'), 1);
+  });
+}
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index a8cb02efd4f..9ed8280c28b 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -6,6 +6,7 @@ settings:
 
 overrides:
   '@radix-ui/react-dismissable-layer': 1.1.19
+  linkify-it: ^5.0.2
 
 patchedDependencies:
   isomorphic-git: e9b414a60d4cf1d8aa18f7a779483984e821989967c235662566e94ef0238d3f
@@ -30,10 +31,10 @@ importers:
         version: 6.0.3(vite@8.0.16(@types/node@25.6.0)(jiti@2.7.0)(yaml@2.9.0))
       react:
         specifier: ^19.1.0
-        version: 19.2.7
+        version: 19.2.8
       react-dom:
         specifier: ^19.1.0
-        version: 19.2.7(react@19.2.7)
+        version: 19.2.8(react@19.2.8)
       vite:
         specifier: ^8.0.0
         version: 8.0.16(@types/node@25.6.0)(jiti@2.7.0)(yaml@2.9.0)
@@ -46,7 +47,7 @@ importers:
         version: 6.9.1
       '@testing-library/react':
         specifier: ^16.3.2
-        version: 16.3.2(@testing-library/dom@10.4.1)(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+        version: 16.3.2(@testing-library/dom@10.4.1)(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
       '@types/react':
         specifier: ^19.1.8
         version: 19.2.17
@@ -67,19 +68,19 @@ importers:
     dependencies:
       '@dnd-kit/core':
         specifier: ^6.3.1
-        version: 6.3.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+        version: 6.3.1(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
       '@dnd-kit/sortable':
         specifier: ^10.0.0
-        version: 10.0.0(@dnd-kit/core@6.3.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react@19.2.7)
+        version: 10.0.0(@dnd-kit/core@6.3.1(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(react@19.2.8)
       '@dnd-kit/utilities':
         specifier: ^3.2.2
-        version: 3.2.2(react@19.2.7)
+        version: 3.2.2(react@19.2.8)
       '@emoji-mart/data':
         specifier: ^1.2.1
         version: 1.2.1
       '@emoji-mart/react':
         specifier: ^1.1.1
-        version: 1.1.1(emoji-mart@5.6.0)(react@19.2.7)
+        version: 1.1.1(emoji-mart@5.6.0)(react@19.2.8)
       '@fontsource-variable/inter':
         specifier: ^5.2.8
         version: 5.2.8
@@ -88,55 +89,55 @@ importers:
         version: 0.10.35
       '@radix-ui/react-alert-dialog':
         specifier: ^1.1.15
-        version: 1.1.23(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+        version: 1.1.23(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
       '@radix-ui/react-avatar':
         specifier: ^1.1.11
-        version: 1.1.12(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+        version: 1.1.12(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
       '@radix-ui/react-checkbox':
         specifier: ^1.3.3
-        version: 1.3.11(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+        version: 1.3.11(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
       '@radix-ui/react-context-menu':
         specifier: ^2.2.16
-        version: 2.2.16(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+        version: 2.2.16(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
       '@radix-ui/react-dialog':
         specifier: ^1.1.15
-        version: 1.1.23(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+        version: 1.1.23(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
       '@radix-ui/react-dropdown-menu':
         specifier: ^2.1.16
-        version: 2.1.24(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+        version: 2.1.24(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
       '@radix-ui/react-focus-scope':
         specifier: ^1.1.8
-        version: 1.1.16(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+        version: 1.1.16(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
       '@radix-ui/react-popover':
         specifier: ^1.1.15
-        version: 1.1.23(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+        version: 1.1.23(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
       '@radix-ui/react-separator':
         specifier: ^1.1.8
-        version: 1.1.15(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+        version: 1.1.15(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
       '@radix-ui/react-slot':
         specifier: ^1.2.4
-        version: 1.3.3(@types/react@19.2.17)(react@19.2.7)
+        version: 1.3.3(@types/react@19.2.17)(react@19.2.8)
       '@radix-ui/react-switch':
         specifier: ^1.2.6
-        version: 1.2.6(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+        version: 1.2.6(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
       '@radix-ui/react-tabs':
         specifier: ^1.1.13
-        version: 1.1.21(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+        version: 1.1.21(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
       '@radix-ui/react-toggle':
         specifier: ^1.1.10
-        version: 1.1.18(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+        version: 1.1.18(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
       '@radix-ui/react-tooltip':
         specifier: ^1.2.8
-        version: 1.2.16(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+        version: 1.2.16(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
       '@tanstack/react-query':
         specifier: ^5.90.21
-        version: 5.100.14(react@19.2.7)
+        version: 5.100.14(react@19.2.8)
       '@tanstack/react-router':
         specifier: ^1.168.10
-        version: 1.170.7(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+        version: 1.170.7(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
       '@tanstack/react-virtual':
         specifier: ^3.14.2
-        version: 3.14.8(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+        version: 3.14.8(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
       '@tauri-apps/api':
         specifier: ~2.11
         version: 2.11.0
@@ -166,7 +167,7 @@ importers:
         version: 3.22.5
       '@tiptap/react':
         specifier: ^3.22.3
-        version: 3.22.5(@floating-ui/dom@1.8.0)(@tiptap/core@3.22.5(@tiptap/pm@3.22.5))(@tiptap/pm@3.22.5)(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+        version: 3.22.5(@floating-ui/dom@1.8.0)(@tiptap/core@3.22.5(@tiptap/pm@3.22.5))(@tiptap/pm@3.22.5)(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
       '@tiptap/starter-kit':
         specifier: ^3.22.3
         version: 3.22.5
@@ -178,7 +179,7 @@ importers:
         version: 2.1.1
       embla-carousel-react:
         specifier: ^8.6.0
-        version: 8.6.0(react@19.2.7)
+        version: 8.6.0(react@19.2.8)
       emoji-mart:
         specifier: ^5.6.0
         version: 5.6.0
@@ -187,28 +188,28 @@ importers:
         version: 3.3.0
       lucide-react:
         specifier: ^1.0.0
-        version: 1.16.0(react@19.2.7)
+        version: 1.16.0(react@19.2.8)
       motion:
         specifier: ^12.38.0
-        version: 12.40.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+        version: 12.40.0(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
       qrcode:
         specifier: ^1.5.4
         version: 1.5.4
       qrcode.react:
         specifier: ^4.2.0
-        version: 4.2.0(react@19.2.7)
+        version: 4.2.0(react@19.2.8)
       react:
         specifier: ^19.1.0
-        version: 19.2.7
+        version: 19.2.8
       react-diff-view:
         specifier: ^3.3.2
-        version: 3.3.3(react@19.2.7)
+        version: 3.3.3(react@19.2.8)
       react-dom:
         specifier: ^19.1.0
-        version: 19.2.7(react@19.2.7)
+        version: 19.2.8(react@19.2.8)
       react-markdown:
         specifier: ^10.1.0
-        version: 10.1.0(@types/react@19.2.17)(react@19.2.7)
+        version: 10.1.0(@types/react@19.2.17)(react@19.2.8)
       remark-breaks:
         specifier: ^4.0.0
         version: 4.0.0
@@ -220,7 +221,7 @@ importers:
         version: 4.1.0
       sonner:
         specifier: ^2.0.7
-        version: 2.0.7(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+        version: 2.0.7(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
       tailwind-merge:
         specifier: ^3.5.0
         version: 3.6.0
@@ -232,7 +233,7 @@ importers:
         version: 2.1.0
       virtua:
         specifier: 0.49.3
-        version: 0.49.3(patch_hash=30a7a92b94800ec37be8d36546ea98c04a05dcd0637f9fac27a06f016ba2eff4)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+        version: 0.49.3(patch_hash=30a7a92b94800ec37be8d36546ea98c04a05dcd0637f9fac27a06f016ba2eff4)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
       yaml:
         specifier: ^2.8.3
         version: 2.9.0
@@ -251,7 +252,7 @@ importers:
         version: 4.3.0
       '@tanstack/router-plugin':
         specifier: ^1.167.12
-        version: 1.168.10(@tanstack/react-router@1.170.7(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(vite@8.0.16(@types/node@25.6.0)(jiti@2.7.0)(yaml@2.9.0))
+        version: 1.168.10(@tanstack/react-router@1.170.7(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(vite@8.0.16(@types/node@25.6.0)(jiti@2.7.0)(yaml@2.9.0))
       '@tanstack/virtual-file-routes':
         specifier: ^1.161.7
         version: 1.162.0
@@ -296,19 +297,19 @@ importers:
         version: 4.6.2
       '@radix-ui/react-slot':
         specifier: ^1.2.4
-        version: 1.3.3(@types/react@19.2.17)(react@19.2.7)
+        version: 1.3.3(@types/react@19.2.17)(react@19.2.8)
       '@radix-ui/react-tooltip':
         specifier: ^1.2.8
-        version: 1.2.16(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+        version: 1.2.16(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
       '@tailwindcss/typography':
         specifier: ^0.5.19
         version: 0.5.20(tailwindcss@4.3.0)
       '@tanstack/react-query':
         specifier: ^5.90.21
-        version: 5.100.14(react@19.2.7)
+        version: 5.100.14(react@19.2.8)
       '@tanstack/react-router':
         specifier: ^1.168.10
-        version: 1.170.7(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+        version: 1.170.7(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
       buffer:
         specifier: ^6.0.3
         version: 6.0.3
@@ -323,25 +324,25 @@ importers:
         version: 1.38.7(patch_hash=e9b414a60d4cf1d8aa18f7a779483984e821989967c235662566e94ef0238d3f)
       lucide-react:
         specifier: ^1.0.0
-        version: 1.16.0(react@19.2.7)
+        version: 1.16.0(react@19.2.8)
       nostr-tools:
         specifier: ^2.23.3
         version: 2.23.12(typescript@6.0.3)
       react:
         specifier: ^19.1.0
-        version: 19.2.7
+        version: 19.2.8
       react-dom:
         specifier: ^19.1.0
-        version: 19.2.7(react@19.2.7)
+        version: 19.2.8(react@19.2.8)
       react-markdown:
         specifier: ^10.1.0
-        version: 10.1.0(@types/react@19.2.17)(react@19.2.7)
+        version: 10.1.0(@types/react@19.2.17)(react@19.2.8)
       remark-gfm:
         specifier: ^4.0.1
         version: 4.0.1
       sonner:
         specifier: ^2.0.7
-        version: 2.0.7(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+        version: 2.0.7(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
       tailwind-merge:
         specifier: ^3.5.0
         version: 3.6.0
@@ -354,7 +355,7 @@ importers:
         version: 4.3.0
       '@tanstack/router-plugin':
         specifier: ^1.167.12
-        version: 1.168.10(@tanstack/react-router@1.170.7(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(vite@8.0.16(@types/node@25.6.0)(jiti@2.7.0)(yaml@2.9.0))
+        version: 1.168.10(@tanstack/react-router@1.170.7(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(vite@8.0.16(@types/node@25.6.0)(jiti@2.7.0)(yaml@2.9.0))
       '@tanstack/virtual-file-routes':
         specifier: ^1.161.7
         version: 1.162.0
@@ -2756,8 +2757,8 @@ packages:
     resolution: {integrity: sha512-NXYBzinNrblfraPGyrbPoD19C1h9lfI/1mzgWYvXUTe414Gz/X1FD2XBZSZM7rRTrMA8JL3OtAaGifrIKhQ5yQ==}
     engines: {node: '>= 12.0.0'}
 
-  linkify-it@5.0.0:
-    resolution: {integrity: sha512-5aHCbzQRADcdP+ATqnDuhhJ/MRIqDkZX5pyjFHRRysS8vZ5AbqGEoFIb6pYHPZ+L/OC2Lc+xT8uHVVR5CAK/wQ==}
+  linkify-it@5.0.2:
+    resolution: {integrity: sha512-ONTm2jCMAVZjgQa/Fy1kScXsuOoF5NPTsoFBdE1KVIZ2vAh/r9+Bqo+0jINCBYnavTPQZz38QzFTme79ENoN3Q==}
 
   linkifyjs@4.3.2:
     resolution: {integrity: sha512-NT1CJtq3hHIreOianA8aSXn6Cw0JzYOuDQbOrSPe7gqFnCpKP++MQe3ODgO3oh2GJFORkAAdqredOa60z63GbA==}
@@ -3167,10 +3168,10 @@ packages:
     peerDependencies:
       react: '>=16.14.0'
 
-  react-dom@19.2.7:
-    resolution: {integrity: sha512-t0BRVXvbiE/o20Hfw669rLbMCDWtYZLvmJigy2f0MxsXF+71pxhR3xOkspmsO8h3ZlNzyibAmtCa3l4lYKk6gQ==}
+  react-dom@19.2.8:
+    resolution: {integrity: sha512-rVprimfGBG3DR+Tq0IQG2DT5PxKth1WIGDmj5yPmlzr4YBe7uyE+Du4oVqTDXZSHGGGXRtTJEGSSePyQCMBglQ==}
     peerDependencies:
-      react: ^19.2.7
+      react: ^19.2.8
 
   react-is@17.0.2:
     resolution: {integrity: sha512-w2GsyukL62IJnlaff/nRegPQR94C/XXamvMWmSHRJ4y7Ts/4ocGRmTHvOs8PSE6pB3dWOrD/nueuU5sduBsQ4w==}
@@ -3211,8 +3212,8 @@ packages:
       '@types/react':
         optional: true
 
-  react@19.2.7:
-    resolution: {integrity: sha512-HNe9WslTbXmFK8o8cmwgAeJFSBvt1bPdHCVKtaaV+WlAN36mpT4hcRpwbf3fY56ar2oIXzsBpOAiIRHAdY0OlQ==}
+  react@19.2.8:
+    resolution: {integrity: sha512-PWaYA1L/q9u2u7xYQi+Y3L3Yfnie7XyLeaJICV1MGD6LprsBxcAqGjYyr0eY3p+QdsA+x/Irkt4Qif8D63+Sbw==}
     engines: {node: '>=0.10.0'}
 
   readable-stream@4.7.0:
@@ -3916,29 +3917,29 @@ snapshots:
 
   '@csstools/css-tokenizer@4.0.0': {}
 
-  '@dnd-kit/accessibility@3.1.1(react@19.2.7)':
+  '@dnd-kit/accessibility@3.1.1(react@19.2.8)':
     dependencies:
-      react: 19.2.7
+      react: 19.2.8
       tslib: 2.8.1
 
-  '@dnd-kit/core@6.3.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@dnd-kit/core@6.3.1(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
-      '@dnd-kit/accessibility': 3.1.1(react@19.2.7)
-      '@dnd-kit/utilities': 3.2.2(react@19.2.7)
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      '@dnd-kit/accessibility': 3.1.1(react@19.2.8)
+      '@dnd-kit/utilities': 3.2.2(react@19.2.8)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
       tslib: 2.8.1
 
-  '@dnd-kit/sortable@10.0.0(@dnd-kit/core@6.3.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react@19.2.7)':
+  '@dnd-kit/sortable@10.0.0(@dnd-kit/core@6.3.1(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(react@19.2.8)':
     dependencies:
-      '@dnd-kit/core': 6.3.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@dnd-kit/utilities': 3.2.2(react@19.2.7)
-      react: 19.2.7
+      '@dnd-kit/core': 6.3.1(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@dnd-kit/utilities': 3.2.2(react@19.2.8)
+      react: 19.2.8
       tslib: 2.8.1
 
-  '@dnd-kit/utilities@3.2.2(react@19.2.7)':
+  '@dnd-kit/utilities@3.2.2(react@19.2.8)':
     dependencies:
-      react: 19.2.7
+      react: 19.2.8
       tslib: 2.8.1
 
   '@emnapi/core@1.10.0':
@@ -3959,10 +3960,10 @@ snapshots:
 
   '@emoji-mart/data@1.2.1': {}
 
-  '@emoji-mart/react@1.1.1(emoji-mart@5.6.0)(react@19.2.7)':
+  '@emoji-mart/react@1.1.1(emoji-mart@5.6.0)(react@19.2.8)':
     dependencies:
       emoji-mart: 5.6.0
-      react: 19.2.7
+      react: 19.2.8
 
   '@exodus/bytes@1.15.1(@noble/hashes@2.2.0)':
     optionalDependencies:
@@ -3977,11 +3978,11 @@ snapshots:
       '@floating-ui/core': 1.8.0
       '@floating-ui/utils': 0.2.12
 
-  '@floating-ui/react-dom@2.1.9(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@floating-ui/react-dom@2.1.9(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
       '@floating-ui/dom': 1.8.0
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
 
   '@floating-ui/utils@0.2.12': {}
 
@@ -4044,674 +4045,674 @@ snapshots:
 
   '@radix-ui/primitive@1.1.7': {}
 
-  '@radix-ui/react-alert-dialog@1.1.23(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@radix-ui/react-alert-dialog@1.1.23(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
       '@radix-ui/primitive': 1.1.7
-      '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-context': 1.2.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-dialog': 1.1.23(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-primitive': 2.1.10(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.2.17)(react@19.2.8)
+      '@radix-ui/react-context': 1.2.2(@types/react@19.2.17)(react@19.2.8)
+      '@radix-ui/react-dialog': 1.1.23(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-primitive': 2.1.10(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
     optionalDependencies:
       '@types/react': 19.2.17
       '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  '@radix-ui/react-arrow@1.1.15(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@radix-ui/react-arrow@1.1.15(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
-      '@radix-ui/react-primitive': 2.1.10(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      '@radix-ui/react-primitive': 2.1.10(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
     optionalDependencies:
       '@types/react': 19.2.17
       '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  '@radix-ui/react-arrow@1.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@radix-ui/react-arrow@1.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
     optionalDependencies:
       '@types/react': 19.2.17
       '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  '@radix-ui/react-avatar@1.1.12(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@radix-ui/react-avatar@1.1.12(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
-      '@radix-ui/react-context': 1.1.4(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-primitive': 2.1.5(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-use-callback-ref': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-use-is-hydrated': 0.1.1(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-use-layout-effect': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      '@radix-ui/react-context': 1.1.4(@types/react@19.2.17)(react@19.2.8)
+      '@radix-ui/react-primitive': 2.1.5(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-use-callback-ref': 1.1.2(@types/react@19.2.17)(react@19.2.8)
+      '@radix-ui/react-use-is-hydrated': 0.1.1(@types/react@19.2.17)(react@19.2.8)
+      '@radix-ui/react-use-layout-effect': 1.1.2(@types/react@19.2.17)(react@19.2.8)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
     optionalDependencies:
       '@types/react': 19.2.17
       '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  '@radix-ui/react-checkbox@1.3.11(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@radix-ui/react-checkbox@1.3.11(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
       '@radix-ui/primitive': 1.1.7
-      '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-context': 1.2.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-presence': 1.1.10(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-primitive': 2.1.10(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-use-controllable-state': 1.2.6(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-use-size': 1.1.4(@types/react@19.2.17)(react@19.2.7)
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.2.17)(react@19.2.8)
+      '@radix-ui/react-context': 1.2.2(@types/react@19.2.17)(react@19.2.8)
+      '@radix-ui/react-presence': 1.1.10(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-primitive': 2.1.10(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-use-controllable-state': 1.2.6(@types/react@19.2.17)(react@19.2.8)
+      '@radix-ui/react-use-size': 1.1.4(@types/react@19.2.17)(react@19.2.8)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
     optionalDependencies:
       '@types/react': 19.2.17
       '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  '@radix-ui/react-collection@1.1.15(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@radix-ui/react-collection@1.1.15(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
-      '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-context': 1.2.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-primitive': 2.1.10(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-slot': 1.3.3(@types/react@19.2.17)(react@19.2.7)
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.2.17)(react@19.2.8)
+      '@radix-ui/react-context': 1.2.2(@types/react@19.2.17)(react@19.2.8)
+      '@radix-ui/react-primitive': 2.1.10(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-slot': 1.3.3(@types/react@19.2.17)(react@19.2.8)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
     optionalDependencies:
       '@types/react': 19.2.17
       '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  '@radix-ui/react-collection@1.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@radix-ui/react-collection@1.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-context': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-slot': 1.2.3(@types/react@19.2.17)(react@19.2.7)
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.17)(react@19.2.8)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.17)(react@19.2.8)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-slot': 1.2.3(@types/react@19.2.17)(react@19.2.8)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
     optionalDependencies:
       '@types/react': 19.2.17
       '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  '@radix-ui/react-compose-refs@1.1.2(@types/react@19.2.17)(react@19.2.7)':
+  '@radix-ui/react-compose-refs@1.1.2(@types/react@19.2.17)(react@19.2.8)':
     dependencies:
-      react: 19.2.7
+      react: 19.2.8
     optionalDependencies:
       '@types/react': 19.2.17
 
-  '@radix-ui/react-compose-refs@1.1.3(@types/react@19.2.17)(react@19.2.7)':
+  '@radix-ui/react-compose-refs@1.1.3(@types/react@19.2.17)(react@19.2.8)':
     dependencies:
-      react: 19.2.7
+      react: 19.2.8
     optionalDependencies:
       '@types/react': 19.2.17
 
-  '@radix-ui/react-compose-refs@1.1.5(@types/react@19.2.17)(react@19.2.7)':
+  '@radix-ui/react-compose-refs@1.1.5(@types/react@19.2.17)(react@19.2.8)':
     dependencies:
-      react: 19.2.7
+      react: 19.2.8
     optionalDependencies:
       '@types/react': 19.2.17
 
-  '@radix-ui/react-context-menu@2.2.16(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@radix-ui/react-context-menu@2.2.16(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
       '@radix-ui/primitive': 1.1.3
-      '@radix-ui/react-context': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-menu': 2.1.16(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.17)(react@19.2.7)
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.17)(react@19.2.8)
+      '@radix-ui/react-menu': 2.1.16(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.17)(react@19.2.8)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.17)(react@19.2.8)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
     optionalDependencies:
       '@types/react': 19.2.17
       '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  '@radix-ui/react-context@1.1.2(@types/react@19.2.17)(react@19.2.7)':
+  '@radix-ui/react-context@1.1.2(@types/react@19.2.17)(react@19.2.8)':
     dependencies:
-      react: 19.2.7
+      react: 19.2.8
     optionalDependencies:
       '@types/react': 19.2.17
 
-  '@radix-ui/react-context@1.1.4(@types/react@19.2.17)(react@19.2.7)':
+  '@radix-ui/react-context@1.1.4(@types/react@19.2.17)(react@19.2.8)':
     dependencies:
-      react: 19.2.7
+      react: 19.2.8
     optionalDependencies:
       '@types/react': 19.2.17
 
-  '@radix-ui/react-context@1.2.2(@types/react@19.2.17)(react@19.2.7)':
+  '@radix-ui/react-context@1.2.2(@types/react@19.2.17)(react@19.2.8)':
     dependencies:
-      react: 19.2.7
+      react: 19.2.8
     optionalDependencies:
       '@types/react': 19.2.17
 
-  '@radix-ui/react-dialog@1.1.23(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@radix-ui/react-dialog@1.1.23(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
       '@radix-ui/primitive': 1.1.7
-      '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-context': 1.2.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-dismissable-layer': 1.1.19(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-focus-guards': 1.1.6(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-focus-scope': 1.1.16(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-id': 1.1.4(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-portal': 1.1.17(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-presence': 1.1.10(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-primitive': 2.1.10(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-slot': 1.3.3(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-use-controllable-state': 1.2.6(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-use-layout-effect': 1.1.4(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.2.17)(react@19.2.8)
+      '@radix-ui/react-context': 1.2.2(@types/react@19.2.17)(react@19.2.8)
+      '@radix-ui/react-dismissable-layer': 1.1.19(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-focus-guards': 1.1.6(@types/react@19.2.17)(react@19.2.8)
+      '@radix-ui/react-focus-scope': 1.1.16(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-id': 1.1.4(@types/react@19.2.17)(react@19.2.8)
+      '@radix-ui/react-portal': 1.1.17(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-presence': 1.1.10(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-primitive': 2.1.10(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-slot': 1.3.3(@types/react@19.2.17)(react@19.2.8)
+      '@radix-ui/react-use-controllable-state': 1.2.6(@types/react@19.2.17)(react@19.2.8)
+      '@radix-ui/react-use-layout-effect': 1.1.4(@types/react@19.2.17)(react@19.2.8)
       aria-hidden: 1.2.6
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
-      react-remove-scroll: 2.7.2(@types/react@19.2.17)(react@19.2.7)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
+      react-remove-scroll: 2.7.2(@types/react@19.2.17)(react@19.2.8)
     optionalDependencies:
       '@types/react': 19.2.17
       '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  '@radix-ui/react-direction@1.1.1(@types/react@19.2.17)(react@19.2.7)':
+  '@radix-ui/react-direction@1.1.1(@types/react@19.2.17)(react@19.2.8)':
     dependencies:
-      react: 19.2.7
+      react: 19.2.8
     optionalDependencies:
       '@types/react': 19.2.17
 
-  '@radix-ui/react-direction@1.1.4(@types/react@19.2.17)(react@19.2.7)':
+  '@radix-ui/react-direction@1.1.4(@types/react@19.2.17)(react@19.2.8)':
     dependencies:
-      react: 19.2.7
+      react: 19.2.8
     optionalDependencies:
       '@types/react': 19.2.17
 
-  '@radix-ui/react-dismissable-layer@1.1.19(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@radix-ui/react-dismissable-layer@1.1.19(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
       '@radix-ui/primitive': 1.1.7
-      '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-primitive': 2.1.10(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-use-callback-ref': 1.1.4(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-use-effect-event': 0.0.5(@types/react@19.2.17)(react@19.2.7)
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.2.17)(react@19.2.8)
+      '@radix-ui/react-primitive': 2.1.10(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-use-callback-ref': 1.1.4(@types/react@19.2.17)(react@19.2.8)
+      '@radix-ui/react-use-effect-event': 0.0.5(@types/react@19.2.17)(react@19.2.8)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
     optionalDependencies:
       '@types/react': 19.2.17
       '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  '@radix-ui/react-dropdown-menu@2.1.24(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@radix-ui/react-dropdown-menu@2.1.24(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
       '@radix-ui/primitive': 1.1.7
-      '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-context': 1.2.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-id': 1.1.4(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-menu': 2.1.24(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-primitive': 2.1.10(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-use-controllable-state': 1.2.6(@types/react@19.2.17)(react@19.2.7)
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.2.17)(react@19.2.8)
+      '@radix-ui/react-context': 1.2.2(@types/react@19.2.17)(react@19.2.8)
+      '@radix-ui/react-id': 1.1.4(@types/react@19.2.17)(react@19.2.8)
+      '@radix-ui/react-menu': 2.1.24(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-primitive': 2.1.10(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-use-controllable-state': 1.2.6(@types/react@19.2.17)(react@19.2.8)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
     optionalDependencies:
       '@types/react': 19.2.17
       '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  '@radix-ui/react-focus-guards@1.1.3(@types/react@19.2.17)(react@19.2.7)':
+  '@radix-ui/react-focus-guards@1.1.3(@types/react@19.2.17)(react@19.2.8)':
     dependencies:
-      react: 19.2.7
+      react: 19.2.8
     optionalDependencies:
       '@types/react': 19.2.17
 
-  '@radix-ui/react-focus-guards@1.1.6(@types/react@19.2.17)(react@19.2.7)':
+  '@radix-ui/react-focus-guards@1.1.6(@types/react@19.2.17)(react@19.2.8)':
     dependencies:
-      react: 19.2.7
+      react: 19.2.8
     optionalDependencies:
       '@types/react': 19.2.17
 
-  '@radix-ui/react-focus-scope@1.1.16(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@radix-ui/react-focus-scope@1.1.16(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
-      '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-primitive': 2.1.10(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-use-callback-ref': 1.1.4(@types/react@19.2.17)(react@19.2.7)
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.2.17)(react@19.2.8)
+      '@radix-ui/react-primitive': 2.1.10(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-use-callback-ref': 1.1.4(@types/react@19.2.17)(react@19.2.8)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
     optionalDependencies:
       '@types/react': 19.2.17
       '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  '@radix-ui/react-focus-scope@1.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@radix-ui/react-focus-scope@1.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.17)(react@19.2.7)
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.17)(react@19.2.8)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.17)(react@19.2.8)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
     optionalDependencies:
       '@types/react': 19.2.17
       '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  '@radix-ui/react-id@1.1.1(@types/react@19.2.17)(react@19.2.7)':
+  '@radix-ui/react-id@1.1.1(@types/react@19.2.17)(react@19.2.8)':
     dependencies:
-      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.17)(react@19.2.7)
-      react: 19.2.7
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.17)(react@19.2.8)
+      react: 19.2.8
     optionalDependencies:
       '@types/react': 19.2.17
 
-  '@radix-ui/react-id@1.1.4(@types/react@19.2.17)(react@19.2.7)':
+  '@radix-ui/react-id@1.1.4(@types/react@19.2.17)(react@19.2.8)':
     dependencies:
-      '@radix-ui/react-use-layout-effect': 1.1.4(@types/react@19.2.17)(react@19.2.7)
-      react: 19.2.7
+      '@radix-ui/react-use-layout-effect': 1.1.4(@types/react@19.2.17)(react@19.2.8)
+      react: 19.2.8
     optionalDependencies:
       '@types/react': 19.2.17
 
-  '@radix-ui/react-menu@2.1.16(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@radix-ui/react-menu@2.1.16(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
       '@radix-ui/primitive': 1.1.3
-      '@radix-ui/react-collection': 1.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-context': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-direction': 1.1.1(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-dismissable-layer': 1.1.19(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-focus-guards': 1.1.3(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-focus-scope': 1.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-id': 1.1.1(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-popper': 1.2.8(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-portal': 1.1.9(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-roving-focus': 1.1.11(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-slot': 1.2.3(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-collection': 1.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.17)(react@19.2.8)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.17)(react@19.2.8)
+      '@radix-ui/react-direction': 1.1.1(@types/react@19.2.17)(react@19.2.8)
+      '@radix-ui/react-dismissable-layer': 1.1.19(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-focus-guards': 1.1.3(@types/react@19.2.17)(react@19.2.8)
+      '@radix-ui/react-focus-scope': 1.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-id': 1.1.1(@types/react@19.2.17)(react@19.2.8)
+      '@radix-ui/react-popper': 1.2.8(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-portal': 1.1.9(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-roving-focus': 1.1.11(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-slot': 1.2.3(@types/react@19.2.17)(react@19.2.8)
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.17)(react@19.2.8)
       aria-hidden: 1.2.6
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
-      react-remove-scroll: 2.7.2(@types/react@19.2.17)(react@19.2.7)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
+      react-remove-scroll: 2.7.2(@types/react@19.2.17)(react@19.2.8)
     optionalDependencies:
       '@types/react': 19.2.17
       '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  '@radix-ui/react-menu@2.1.24(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@radix-ui/react-menu@2.1.24(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
       '@radix-ui/primitive': 1.1.7
-      '@radix-ui/react-collection': 1.1.15(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-context': 1.2.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-direction': 1.1.4(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-dismissable-layer': 1.1.19(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-focus-guards': 1.1.6(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-focus-scope': 1.1.16(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-id': 1.1.4(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-popper': 1.3.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-portal': 1.1.17(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-presence': 1.1.10(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-primitive': 2.1.10(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-roving-focus': 1.1.19(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-slot': 1.3.3(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-use-callback-ref': 1.1.4(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-collection': 1.1.15(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.2.17)(react@19.2.8)
+      '@radix-ui/react-context': 1.2.2(@types/react@19.2.17)(react@19.2.8)
+      '@radix-ui/react-direction': 1.1.4(@types/react@19.2.17)(react@19.2.8)
+      '@radix-ui/react-dismissable-layer': 1.1.19(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-focus-guards': 1.1.6(@types/react@19.2.17)(react@19.2.8)
+      '@radix-ui/react-focus-scope': 1.1.16(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-id': 1.1.4(@types/react@19.2.17)(react@19.2.8)
+      '@radix-ui/react-popper': 1.3.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-portal': 1.1.17(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-presence': 1.1.10(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-primitive': 2.1.10(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-roving-focus': 1.1.19(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-slot': 1.3.3(@types/react@19.2.17)(react@19.2.8)
+      '@radix-ui/react-use-callback-ref': 1.1.4(@types/react@19.2.17)(react@19.2.8)
       aria-hidden: 1.2.6
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
-      react-remove-scroll: 2.7.2(@types/react@19.2.17)(react@19.2.7)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
+      react-remove-scroll: 2.7.2(@types/react@19.2.17)(react@19.2.8)
     optionalDependencies:
       '@types/react': 19.2.17
       '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  '@radix-ui/react-popover@1.1.23(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@radix-ui/react-popover@1.1.23(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
       '@radix-ui/primitive': 1.1.7
-      '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-context': 1.2.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-dismissable-layer': 1.1.19(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-focus-guards': 1.1.6(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-focus-scope': 1.1.16(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-id': 1.1.4(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-popper': 1.3.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-portal': 1.1.17(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-presence': 1.1.10(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-primitive': 2.1.10(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-slot': 1.3.3(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-use-controllable-state': 1.2.6(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.2.17)(react@19.2.8)
+      '@radix-ui/react-context': 1.2.2(@types/react@19.2.17)(react@19.2.8)
+      '@radix-ui/react-dismissable-layer': 1.1.19(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-focus-guards': 1.1.6(@types/react@19.2.17)(react@19.2.8)
+      '@radix-ui/react-focus-scope': 1.1.16(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-id': 1.1.4(@types/react@19.2.17)(react@19.2.8)
+      '@radix-ui/react-popper': 1.3.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-portal': 1.1.17(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-presence': 1.1.10(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-primitive': 2.1.10(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-slot': 1.3.3(@types/react@19.2.17)(react@19.2.8)
+      '@radix-ui/react-use-controllable-state': 1.2.6(@types/react@19.2.17)(react@19.2.8)
       aria-hidden: 1.2.6
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
-      react-remove-scroll: 2.7.2(@types/react@19.2.17)(react@19.2.7)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
+      react-remove-scroll: 2.7.2(@types/react@19.2.17)(react@19.2.8)
     optionalDependencies:
       '@types/react': 19.2.17
       '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  '@radix-ui/react-popper@1.2.8(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
-    dependencies:
-      '@floating-ui/react-dom': 2.1.9(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-arrow': 1.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-context': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-use-rect': 1.1.1(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-use-size': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+  '@radix-ui/react-popper@1.2.8(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
+    dependencies:
+      '@floating-ui/react-dom': 2.1.9(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-arrow': 1.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.17)(react@19.2.8)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.17)(react@19.2.8)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.17)(react@19.2.8)
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.17)(react@19.2.8)
+      '@radix-ui/react-use-rect': 1.1.1(@types/react@19.2.17)(react@19.2.8)
+      '@radix-ui/react-use-size': 1.1.1(@types/react@19.2.17)(react@19.2.8)
       '@radix-ui/rect': 1.1.1
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
     optionalDependencies:
       '@types/react': 19.2.17
       '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  '@radix-ui/react-popper@1.3.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
-    dependencies:
-      '@floating-ui/react-dom': 2.1.9(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-arrow': 1.1.15(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-context': 1.2.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-primitive': 2.1.10(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-use-callback-ref': 1.1.4(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-use-layout-effect': 1.1.4(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-use-rect': 1.1.4(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-use-size': 1.1.4(@types/react@19.2.17)(react@19.2.7)
+  '@radix-ui/react-popper@1.3.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
+    dependencies:
+      '@floating-ui/react-dom': 2.1.9(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-arrow': 1.1.15(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.2.17)(react@19.2.8)
+      '@radix-ui/react-context': 1.2.2(@types/react@19.2.17)(react@19.2.8)
+      '@radix-ui/react-primitive': 2.1.10(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-use-callback-ref': 1.1.4(@types/react@19.2.17)(react@19.2.8)
+      '@radix-ui/react-use-layout-effect': 1.1.4(@types/react@19.2.17)(react@19.2.8)
+      '@radix-ui/react-use-rect': 1.1.4(@types/react@19.2.17)(react@19.2.8)
+      '@radix-ui/react-use-size': 1.1.4(@types/react@19.2.17)(react@19.2.8)
       '@radix-ui/rect': 1.1.3
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
     optionalDependencies:
       '@types/react': 19.2.17
       '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  '@radix-ui/react-portal@1.1.17(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@radix-ui/react-portal@1.1.17(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
-      '@radix-ui/react-primitive': 2.1.10(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-use-layout-effect': 1.1.4(@types/react@19.2.17)(react@19.2.7)
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      '@radix-ui/react-primitive': 2.1.10(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-use-layout-effect': 1.1.4(@types/react@19.2.17)(react@19.2.8)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
     optionalDependencies:
       '@types/react': 19.2.17
       '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  '@radix-ui/react-portal@1.1.9(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@radix-ui/react-portal@1.1.9(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.17)(react@19.2.7)
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.17)(react@19.2.8)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
     optionalDependencies:
       '@types/react': 19.2.17
       '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  '@radix-ui/react-presence@1.1.10(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@radix-ui/react-presence@1.1.10(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
-      '@radix-ui/react-use-layout-effect': 1.1.4(@types/react@19.2.17)(react@19.2.7)
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      '@radix-ui/react-use-layout-effect': 1.1.4(@types/react@19.2.17)(react@19.2.8)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
     optionalDependencies:
       '@types/react': 19.2.17
       '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  '@radix-ui/react-presence@1.1.5(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@radix-ui/react-presence@1.1.5(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.17)(react@19.2.7)
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.17)(react@19.2.8)
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.17)(react@19.2.8)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
     optionalDependencies:
       '@types/react': 19.2.17
       '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  '@radix-ui/react-primitive@2.1.10(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@radix-ui/react-primitive@2.1.10(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
-      '@radix-ui/react-slot': 1.3.3(@types/react@19.2.17)(react@19.2.7)
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      '@radix-ui/react-slot': 1.3.3(@types/react@19.2.17)(react@19.2.8)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
     optionalDependencies:
       '@types/react': 19.2.17
       '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  '@radix-ui/react-primitive@2.1.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@radix-ui/react-primitive@2.1.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
-      '@radix-ui/react-slot': 1.2.3(@types/react@19.2.17)(react@19.2.7)
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      '@radix-ui/react-slot': 1.2.3(@types/react@19.2.17)(react@19.2.8)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
     optionalDependencies:
       '@types/react': 19.2.17
       '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  '@radix-ui/react-primitive@2.1.5(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@radix-ui/react-primitive@2.1.5(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
-      '@radix-ui/react-slot': 1.2.5(@types/react@19.2.17)(react@19.2.7)
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      '@radix-ui/react-slot': 1.2.5(@types/react@19.2.17)(react@19.2.8)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
     optionalDependencies:
       '@types/react': 19.2.17
       '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  '@radix-ui/react-roving-focus@1.1.11(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@radix-ui/react-roving-focus@1.1.11(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
       '@radix-ui/primitive': 1.1.3
-      '@radix-ui/react-collection': 1.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-context': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-direction': 1.1.1(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-id': 1.1.1(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.17)(react@19.2.7)
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      '@radix-ui/react-collection': 1.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.17)(react@19.2.8)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.17)(react@19.2.8)
+      '@radix-ui/react-direction': 1.1.1(@types/react@19.2.17)(react@19.2.8)
+      '@radix-ui/react-id': 1.1.1(@types/react@19.2.17)(react@19.2.8)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.17)(react@19.2.8)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.17)(react@19.2.8)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
     optionalDependencies:
       '@types/react': 19.2.17
       '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  '@radix-ui/react-roving-focus@1.1.19(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@radix-ui/react-roving-focus@1.1.19(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
       '@radix-ui/primitive': 1.1.7
-      '@radix-ui/react-collection': 1.1.15(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-context': 1.2.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-direction': 1.1.4(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-id': 1.1.4(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-primitive': 2.1.10(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-use-callback-ref': 1.1.4(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-use-controllable-state': 1.2.6(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-use-is-hydrated': 0.1.3(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-use-layout-effect': 1.1.4(@types/react@19.2.17)(react@19.2.7)
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      '@radix-ui/react-collection': 1.1.15(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.2.17)(react@19.2.8)
+      '@radix-ui/react-context': 1.2.2(@types/react@19.2.17)(react@19.2.8)
+      '@radix-ui/react-direction': 1.1.4(@types/react@19.2.17)(react@19.2.8)
+      '@radix-ui/react-id': 1.1.4(@types/react@19.2.17)(react@19.2.8)
+      '@radix-ui/react-primitive': 2.1.10(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-use-callback-ref': 1.1.4(@types/react@19.2.17)(react@19.2.8)
+      '@radix-ui/react-use-controllable-state': 1.2.6(@types/react@19.2.17)(react@19.2.8)
+      '@radix-ui/react-use-is-hydrated': 0.1.3(@types/react@19.2.17)(react@19.2.8)
+      '@radix-ui/react-use-layout-effect': 1.1.4(@types/react@19.2.17)(react@19.2.8)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
     optionalDependencies:
       '@types/react': 19.2.17
       '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  '@radix-ui/react-separator@1.1.15(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@radix-ui/react-separator@1.1.15(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
-      '@radix-ui/react-primitive': 2.1.10(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      '@radix-ui/react-primitive': 2.1.10(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
     optionalDependencies:
       '@types/react': 19.2.17
       '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  '@radix-ui/react-slot@1.2.3(@types/react@19.2.17)(react@19.2.7)':
+  '@radix-ui/react-slot@1.2.3(@types/react@19.2.17)(react@19.2.8)':
     dependencies:
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      react: 19.2.7
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.17)(react@19.2.8)
+      react: 19.2.8
     optionalDependencies:
       '@types/react': 19.2.17
 
-  '@radix-ui/react-slot@1.2.5(@types/react@19.2.17)(react@19.2.7)':
+  '@radix-ui/react-slot@1.2.5(@types/react@19.2.17)(react@19.2.8)':
     dependencies:
-      '@radix-ui/react-compose-refs': 1.1.3(@types/react@19.2.17)(react@19.2.7)
-      react: 19.2.7
+      '@radix-ui/react-compose-refs': 1.1.3(@types/react@19.2.17)(react@19.2.8)
+      react: 19.2.8
     optionalDependencies:
       '@types/react': 19.2.17
 
-  '@radix-ui/react-slot@1.3.3(@types/react@19.2.17)(react@19.2.7)':
+  '@radix-ui/react-slot@1.3.3(@types/react@19.2.17)(react@19.2.8)':
     dependencies:
-      '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.2.17)(react@19.2.7)
-      react: 19.2.7
+      '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.2.17)(react@19.2.8)
+      react: 19.2.8
     optionalDependencies:
       '@types/react': 19.2.17
 
-  '@radix-ui/react-switch@1.2.6(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@radix-ui/react-switch@1.2.6(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
       '@radix-ui/primitive': 1.1.3
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-context': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-use-previous': 1.1.1(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-use-size': 1.1.1(@types/react@19.2.17)(react@19.2.7)
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.17)(react@19.2.8)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.17)(react@19.2.8)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.17)(react@19.2.8)
+      '@radix-ui/react-use-previous': 1.1.1(@types/react@19.2.17)(react@19.2.8)
+      '@radix-ui/react-use-size': 1.1.1(@types/react@19.2.17)(react@19.2.8)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
     optionalDependencies:
       '@types/react': 19.2.17
       '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  '@radix-ui/react-tabs@1.1.21(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@radix-ui/react-tabs@1.1.21(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
       '@radix-ui/primitive': 1.1.7
-      '@radix-ui/react-context': 1.2.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-direction': 1.1.4(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-id': 1.1.4(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-presence': 1.1.10(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-primitive': 2.1.10(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-roving-focus': 1.1.19(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-use-controllable-state': 1.2.6(@types/react@19.2.17)(react@19.2.7)
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      '@radix-ui/react-context': 1.2.2(@types/react@19.2.17)(react@19.2.8)
+      '@radix-ui/react-direction': 1.1.4(@types/react@19.2.17)(react@19.2.8)
+      '@radix-ui/react-id': 1.1.4(@types/react@19.2.17)(react@19.2.8)
+      '@radix-ui/react-presence': 1.1.10(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-primitive': 2.1.10(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-roving-focus': 1.1.19(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-use-controllable-state': 1.2.6(@types/react@19.2.17)(react@19.2.8)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
     optionalDependencies:
       '@types/react': 19.2.17
       '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  '@radix-ui/react-toggle@1.1.18(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@radix-ui/react-toggle@1.1.18(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
       '@radix-ui/primitive': 1.1.7
-      '@radix-ui/react-primitive': 2.1.10(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-use-controllable-state': 1.2.6(@types/react@19.2.17)(react@19.2.7)
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      '@radix-ui/react-primitive': 2.1.10(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-use-controllable-state': 1.2.6(@types/react@19.2.17)(react@19.2.8)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
     optionalDependencies:
       '@types/react': 19.2.17
       '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  '@radix-ui/react-tooltip@1.2.16(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@radix-ui/react-tooltip@1.2.16(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
       '@radix-ui/primitive': 1.1.7
-      '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-context': 1.2.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-dismissable-layer': 1.1.19(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-id': 1.1.4(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-popper': 1.3.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-portal': 1.1.17(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-presence': 1.1.10(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-primitive': 2.1.10(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-slot': 1.3.3(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-use-controllable-state': 1.2.6(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-use-layout-effect': 1.1.4(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-visually-hidden': 1.2.11(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.2.17)(react@19.2.8)
+      '@radix-ui/react-context': 1.2.2(@types/react@19.2.17)(react@19.2.8)
+      '@radix-ui/react-dismissable-layer': 1.1.19(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-id': 1.1.4(@types/react@19.2.17)(react@19.2.8)
+      '@radix-ui/react-popper': 1.3.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-portal': 1.1.17(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-presence': 1.1.10(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-primitive': 2.1.10(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-slot': 1.3.3(@types/react@19.2.17)(react@19.2.8)
+      '@radix-ui/react-use-controllable-state': 1.2.6(@types/react@19.2.17)(react@19.2.8)
+      '@radix-ui/react-use-layout-effect': 1.1.4(@types/react@19.2.17)(react@19.2.8)
+      '@radix-ui/react-visually-hidden': 1.2.11(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
     optionalDependencies:
       '@types/react': 19.2.17
       '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  '@radix-ui/react-use-callback-ref@1.1.1(@types/react@19.2.17)(react@19.2.7)':
+  '@radix-ui/react-use-callback-ref@1.1.1(@types/react@19.2.17)(react@19.2.8)':
     dependencies:
-      react: 19.2.7
+      react: 19.2.8
     optionalDependencies:
       '@types/react': 19.2.17
 
-  '@radix-ui/react-use-callback-ref@1.1.2(@types/react@19.2.17)(react@19.2.7)':
+  '@radix-ui/react-use-callback-ref@1.1.2(@types/react@19.2.17)(react@19.2.8)':
     dependencies:
-      react: 19.2.7
+      react: 19.2.8
     optionalDependencies:
       '@types/react': 19.2.17
 
-  '@radix-ui/react-use-callback-ref@1.1.4(@types/react@19.2.17)(react@19.2.7)':
+  '@radix-ui/react-use-callback-ref@1.1.4(@types/react@19.2.17)(react@19.2.8)':
     dependencies:
-      react: 19.2.7
+      react: 19.2.8
     optionalDependencies:
       '@types/react': 19.2.17
 
-  '@radix-ui/react-use-controllable-state@1.2.2(@types/react@19.2.17)(react@19.2.7)':
+  '@radix-ui/react-use-controllable-state@1.2.2(@types/react@19.2.17)(react@19.2.8)':
     dependencies:
-      '@radix-ui/react-use-effect-event': 0.0.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.17)(react@19.2.7)
-      react: 19.2.7
+      '@radix-ui/react-use-effect-event': 0.0.2(@types/react@19.2.17)(react@19.2.8)
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.17)(react@19.2.8)
+      react: 19.2.8
     optionalDependencies:
       '@types/react': 19.2.17
 
-  '@radix-ui/react-use-controllable-state@1.2.6(@types/react@19.2.17)(react@19.2.7)':
+  '@radix-ui/react-use-controllable-state@1.2.6(@types/react@19.2.17)(react@19.2.8)':
     dependencies:
       '@radix-ui/primitive': 1.1.7
-      '@radix-ui/react-use-effect-event': 0.0.5(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-use-layout-effect': 1.1.4(@types/react@19.2.17)(react@19.2.7)
-      react: 19.2.7
+      '@radix-ui/react-use-effect-event': 0.0.5(@types/react@19.2.17)(react@19.2.8)
+      '@radix-ui/react-use-layout-effect': 1.1.4(@types/react@19.2.17)(react@19.2.8)
+      react: 19.2.8
     optionalDependencies:
       '@types/react': 19.2.17
 
-  '@radix-ui/react-use-effect-event@0.0.2(@types/react@19.2.17)(react@19.2.7)':
+  '@radix-ui/react-use-effect-event@0.0.2(@types/react@19.2.17)(react@19.2.8)':
     dependencies:
-      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.17)(react@19.2.7)
-      react: 19.2.7
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.17)(react@19.2.8)
+      react: 19.2.8
     optionalDependencies:
       '@types/react': 19.2.17
 
-  '@radix-ui/react-use-effect-event@0.0.5(@types/react@19.2.17)(react@19.2.7)':
+  '@radix-ui/react-use-effect-event@0.0.5(@types/react@19.2.17)(react@19.2.8)':
     dependencies:
-      '@radix-ui/react-use-layout-effect': 1.1.4(@types/react@19.2.17)(react@19.2.7)
-      react: 19.2.7
+      '@radix-ui/react-use-layout-effect': 1.1.4(@types/react@19.2.17)(react@19.2.8)
+      react: 19.2.8
     optionalDependencies:
       '@types/react': 19.2.17
 
-  '@radix-ui/react-use-is-hydrated@0.1.1(@types/react@19.2.17)(react@19.2.7)':
+  '@radix-ui/react-use-is-hydrated@0.1.1(@types/react@19.2.17)(react@19.2.8)':
     dependencies:
-      react: 19.2.7
+      react: 19.2.8
     optionalDependencies:
       '@types/react': 19.2.17
 
-  '@radix-ui/react-use-is-hydrated@0.1.3(@types/react@19.2.17)(react@19.2.7)':
+  '@radix-ui/react-use-is-hydrated@0.1.3(@types/react@19.2.17)(react@19.2.8)':
     dependencies:
-      react: 19.2.7
+      react: 19.2.8
     optionalDependencies:
       '@types/react': 19.2.17
 
-  '@radix-ui/react-use-layout-effect@1.1.1(@types/react@19.2.17)(react@19.2.7)':
+  '@radix-ui/react-use-layout-effect@1.1.1(@types/react@19.2.17)(react@19.2.8)':
     dependencies:
-      react: 19.2.7
+      react: 19.2.8
     optionalDependencies:
       '@types/react': 19.2.17
 
-  '@radix-ui/react-use-layout-effect@1.1.2(@types/react@19.2.17)(react@19.2.7)':
+  '@radix-ui/react-use-layout-effect@1.1.2(@types/react@19.2.17)(react@19.2.8)':
     dependencies:
-      react: 19.2.7
+      react: 19.2.8
     optionalDependencies:
       '@types/react': 19.2.17
 
-  '@radix-ui/react-use-layout-effect@1.1.4(@types/react@19.2.17)(react@19.2.7)':
+  '@radix-ui/react-use-layout-effect@1.1.4(@types/react@19.2.17)(react@19.2.8)':
     dependencies:
-      react: 19.2.7
+      react: 19.2.8
     optionalDependencies:
       '@types/react': 19.2.17
 
-  '@radix-ui/react-use-previous@1.1.1(@types/react@19.2.17)(react@19.2.7)':
+  '@radix-ui/react-use-previous@1.1.1(@types/react@19.2.17)(react@19.2.8)':
     dependencies:
-      react: 19.2.7
+      react: 19.2.8
     optionalDependencies:
       '@types/react': 19.2.17
 
-  '@radix-ui/react-use-rect@1.1.1(@types/react@19.2.17)(react@19.2.7)':
+  '@radix-ui/react-use-rect@1.1.1(@types/react@19.2.17)(react@19.2.8)':
     dependencies:
       '@radix-ui/rect': 1.1.1
-      react: 19.2.7
+      react: 19.2.8
     optionalDependencies:
       '@types/react': 19.2.17
 
-  '@radix-ui/react-use-rect@1.1.4(@types/react@19.2.17)(react@19.2.7)':
+  '@radix-ui/react-use-rect@1.1.4(@types/react@19.2.17)(react@19.2.8)':
     dependencies:
       '@radix-ui/rect': 1.1.3
-      react: 19.2.7
+      react: 19.2.8
     optionalDependencies:
       '@types/react': 19.2.17
 
-  '@radix-ui/react-use-size@1.1.1(@types/react@19.2.17)(react@19.2.7)':
+  '@radix-ui/react-use-size@1.1.1(@types/react@19.2.17)(react@19.2.8)':
     dependencies:
-      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.17)(react@19.2.7)
-      react: 19.2.7
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.17)(react@19.2.8)
+      react: 19.2.8
     optionalDependencies:
       '@types/react': 19.2.17
 
-  '@radix-ui/react-use-size@1.1.4(@types/react@19.2.17)(react@19.2.7)':
+  '@radix-ui/react-use-size@1.1.4(@types/react@19.2.17)(react@19.2.8)':
     dependencies:
-      '@radix-ui/react-use-layout-effect': 1.1.4(@types/react@19.2.17)(react@19.2.7)
-      react: 19.2.7
+      '@radix-ui/react-use-layout-effect': 1.1.4(@types/react@19.2.17)(react@19.2.8)
+      react: 19.2.8
     optionalDependencies:
       '@types/react': 19.2.17
 
-  '@radix-ui/react-visually-hidden@1.2.11(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@radix-ui/react-visually-hidden@1.2.11(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
-      '@radix-ui/react-primitive': 2.1.10(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      '@radix-ui/react-primitive': 2.1.10(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
     optionalDependencies:
       '@types/react': 19.2.17
       '@types/react-dom': 19.2.3(@types/react@19.2.17)
@@ -4904,32 +4905,32 @@ snapshots:
 
   '@tanstack/query-core@5.100.14': {}
 
-  '@tanstack/react-query@5.100.14(react@19.2.7)':
+  '@tanstack/react-query@5.100.14(react@19.2.8)':
     dependencies:
       '@tanstack/query-core': 5.100.14
-      react: 19.2.7
+      react: 19.2.8
 
-  '@tanstack/react-router@1.170.7(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@tanstack/react-router@1.170.7(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
       '@tanstack/history': 1.162.0
-      '@tanstack/react-store': 0.9.3(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@tanstack/react-store': 0.9.3(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
       '@tanstack/router-core': 1.171.5
       isbot: 5.1.40
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
 
-  '@tanstack/react-store@0.9.3(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@tanstack/react-store@0.9.3(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
       '@tanstack/store': 0.9.3
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
-      use-sync-external-store: 1.6.0(react@19.2.7)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
+      use-sync-external-store: 1.6.0(react@19.2.8)
 
-  '@tanstack/react-virtual@3.14.8(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@tanstack/react-virtual@3.14.8(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
       '@tanstack/virtual-core': 3.17.6
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
 
   '@tanstack/router-core@1.171.5':
     dependencies:
@@ -4951,7 +4952,7 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  '@tanstack/router-plugin@1.168.10(@tanstack/react-router@1.170.7(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(vite@8.0.16(@types/node@25.6.0)(jiti@2.7.0)(yaml@2.9.0))':
+  '@tanstack/router-plugin@1.168.10(@tanstack/react-router@1.170.7(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(vite@8.0.16(@types/node@25.6.0)(jiti@2.7.0)(yaml@2.9.0))':
     dependencies:
       '@babel/core': 7.29.0
       '@babel/plugin-syntax-jsx': 7.28.6(@babel/core@7.29.0)
@@ -4967,7 +4968,7 @@ snapshots:
       unplugin: 3.0.0
       zod: 4.4.3
     optionalDependencies:
-      '@tanstack/react-router': 1.170.7(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@tanstack/react-router': 1.170.7(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
       vite: 8.0.16(@types/node@25.6.0)(jiti@2.7.0)(yaml@2.9.0)
     transitivePeerDependencies:
       - supports-color
@@ -5077,12 +5078,12 @@ snapshots:
       picocolors: 1.1.1
       redent: 3.0.0
 
-  '@testing-library/react@16.3.2(@testing-library/dom@10.4.1)(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@testing-library/react@16.3.2(@testing-library/dom@10.4.1)(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
       '@babel/runtime': 7.29.7
       '@testing-library/dom': 10.4.1
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
     optionalDependencies:
       '@types/react': 19.2.17
       '@types/react-dom': 19.2.3(@types/react@19.2.17)
@@ -5218,7 +5219,7 @@ snapshots:
       prosemirror-transform: 1.12.0
       prosemirror-view: 1.41.8
 
-  '@tiptap/react@3.22.5(@floating-ui/dom@1.8.0)(@tiptap/core@3.22.5(@tiptap/pm@3.22.5))(@tiptap/pm@3.22.5)(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@tiptap/react@3.22.5(@floating-ui/dom@1.8.0)(@tiptap/core@3.22.5(@tiptap/pm@3.22.5))(@tiptap/pm@3.22.5)(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
       '@tiptap/core': 3.22.5(@tiptap/pm@3.22.5)
       '@tiptap/pm': 3.22.5
@@ -5226,9 +5227,9 @@ snapshots:
       '@types/react-dom': 19.2.3(@types/react@19.2.17)
       '@types/use-sync-external-store': 0.0.6
       fast-equals: 5.4.0
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
-      use-sync-external-store: 1.6.0(react@19.2.7)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
+      use-sync-external-store: 1.6.0(react@19.2.8)
     optionalDependencies:
       '@tiptap/extension-bubble-menu': 3.22.5(@tiptap/core@3.22.5(@tiptap/pm@3.22.5))(@tiptap/pm@3.22.5)
       '@tiptap/extension-floating-menu': 3.22.5(@floating-ui/dom@1.8.0)(@tiptap/core@3.22.5(@tiptap/pm@3.22.5))(@tiptap/pm@3.22.5)
@@ -5594,11 +5595,11 @@ snapshots:
 
   electron-to-chromium@1.5.361: {}
 
-  embla-carousel-react@8.6.0(react@19.2.7):
+  embla-carousel-react@8.6.0(react@19.2.8):
     dependencies:
       embla-carousel: 8.6.0
       embla-carousel-reactive-utils: 8.6.0(embla-carousel@8.6.0)
-      react: 19.2.7
+      react: 19.2.8
 
   embla-carousel-reactive-utils@8.6.0(embla-carousel@8.6.0):
     dependencies:
@@ -5668,14 +5669,14 @@ snapshots:
     dependencies:
       is-callable: 1.2.7
 
-  framer-motion@12.40.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7):
+  framer-motion@12.40.0(react-dom@19.2.8(react@19.2.8))(react@19.2.8):
     dependencies:
       motion-dom: 12.40.0
       motion-utils: 12.39.0
       tslib: 2.8.1
     optionalDependencies:
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
 
   fsevents@2.3.2:
     optional: true
@@ -5939,7 +5940,7 @@ snapshots:
       lightningcss-win32-arm64-msvc: 1.32.0
       lightningcss-win32-x64-msvc: 1.32.0
 
-  linkify-it@5.0.0:
+  linkify-it@5.0.2:
     dependencies:
       uc.micro: 2.1.0
 
@@ -5963,9 +5964,9 @@ snapshots:
     dependencies:
       yallist: 3.1.1
 
-  lucide-react@1.16.0(react@19.2.7):
+  lucide-react@1.16.0(react@19.2.8):
     dependencies:
-      react: 19.2.7
+      react: 19.2.8
 
   lz-string@1.5.0: {}
 
@@ -5979,7 +5980,7 @@ snapshots:
     dependencies:
       argparse: 2.0.1
       entities: 4.5.0
-      linkify-it: 5.0.0
+      linkify-it: 5.0.2
       mdurl: 2.0.0
       punycode.js: 2.3.1
       uc.micro: 2.1.0
@@ -6357,13 +6358,13 @@ snapshots:
 
   motion-utils@12.39.0: {}
 
-  motion@12.40.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7):
+  motion@12.40.0(react-dom@19.2.8(react@19.2.8))(react@19.2.8):
     dependencies:
-      framer-motion: 12.40.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      framer-motion: 12.40.0(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
       tslib: 2.8.1
     optionalDependencies:
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
 
   ms@2.1.3: {}
 
@@ -6553,9 +6554,9 @@ snapshots:
 
   punycode@2.3.1: {}
 
-  qrcode.react@4.2.0(react@19.2.7):
+  qrcode.react@4.2.0(react@19.2.8):
     dependencies:
-      react: 19.2.7
+      react: 19.2.8
 
   qrcode@1.5.4:
     dependencies:
@@ -6563,24 +6564,24 @@ snapshots:
       pngjs: 5.0.0
       yargs: 15.4.1
 
-  react-diff-view@3.3.3(react@19.2.7):
+  react-diff-view@3.3.3(react@19.2.8):
     dependencies:
       classnames: 2.5.1
       diff-match-patch: 1.0.5
       gitdiff-parser: 0.3.1
       lodash: 4.18.1
-      react: 19.2.7
+      react: 19.2.8
       shallow-equal: 3.1.0
       warning: 4.0.3
 
-  react-dom@19.2.7(react@19.2.7):
+  react-dom@19.2.8(react@19.2.8):
     dependencies:
-      react: 19.2.7
+      react: 19.2.8
       scheduler: 0.27.0
 
   react-is@17.0.2: {}
 
-  react-markdown@10.1.0(@types/react@19.2.17)(react@19.2.7):
+  react-markdown@10.1.0(@types/react@19.2.17)(react@19.2.8):
     dependencies:
       '@types/hast': 3.0.4
       '@types/mdast': 4.0.4
@@ -6589,7 +6590,7 @@ snapshots:
       hast-util-to-jsx-runtime: 2.3.6
       html-url-attributes: 3.0.1
       mdast-util-to-hast: 13.2.1
-      react: 19.2.7
+      react: 19.2.8
       remark-parse: 11.0.0
       remark-rehype: 11.1.2
       unified: 11.0.5
@@ -6598,34 +6599,34 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  react-remove-scroll-bar@2.3.8(@types/react@19.2.17)(react@19.2.7):
+  react-remove-scroll-bar@2.3.8(@types/react@19.2.17)(react@19.2.8):
     dependencies:
-      react: 19.2.7
-      react-style-singleton: 2.2.3(@types/react@19.2.17)(react@19.2.7)
+      react: 19.2.8
+      react-style-singleton: 2.2.3(@types/react@19.2.17)(react@19.2.8)
       tslib: 2.8.1
     optionalDependencies:
       '@types/react': 19.2.17
 
-  react-remove-scroll@2.7.2(@types/react@19.2.17)(react@19.2.7):
+  react-remove-scroll@2.7.2(@types/react@19.2.17)(react@19.2.8):
     dependencies:
-      react: 19.2.7
-      react-remove-scroll-bar: 2.3.8(@types/react@19.2.17)(react@19.2.7)
-      react-style-singleton: 2.2.3(@types/react@19.2.17)(react@19.2.7)
+      react: 19.2.8
+      react-remove-scroll-bar: 2.3.8(@types/react@19.2.17)(react@19.2.8)
+      react-style-singleton: 2.2.3(@types/react@19.2.17)(react@19.2.8)
       tslib: 2.8.1
-      use-callback-ref: 1.3.3(@types/react@19.2.17)(react@19.2.7)
-      use-sidecar: 1.1.3(@types/react@19.2.17)(react@19.2.7)
+      use-callback-ref: 1.3.3(@types/react@19.2.17)(react@19.2.8)
+      use-sidecar: 1.1.3(@types/react@19.2.17)(react@19.2.8)
     optionalDependencies:
       '@types/react': 19.2.17
 
-  react-style-singleton@2.2.3(@types/react@19.2.17)(react@19.2.7):
+  react-style-singleton@2.2.3(@types/react@19.2.17)(react@19.2.8):
     dependencies:
       get-nonce: 1.0.1
-      react: 19.2.7
+      react: 19.2.8
       tslib: 2.8.1
     optionalDependencies:
       '@types/react': 19.2.17
 
-  react@19.2.7: {}
+  react@19.2.8: {}
 
   readable-stream@4.7.0:
     dependencies:
@@ -6777,10 +6778,10 @@ snapshots:
       once: 1.4.0
       simple-concat: 1.0.1
 
-  sonner@2.0.7(react-dom@19.2.7(react@19.2.7))(react@19.2.7):
+  sonner@2.0.7(react-dom@19.2.8(react@19.2.8))(react@19.2.8):
     dependencies:
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
 
   source-map-js@1.2.1: {}
 
@@ -6942,24 +6943,24 @@ snapshots:
     dependencies:
       pako: 1.0.11
 
-  use-callback-ref@1.3.3(@types/react@19.2.17)(react@19.2.7):
+  use-callback-ref@1.3.3(@types/react@19.2.17)(react@19.2.8):
     dependencies:
-      react: 19.2.7
+      react: 19.2.8
       tslib: 2.8.1
     optionalDependencies:
       '@types/react': 19.2.17
 
-  use-sidecar@1.1.3(@types/react@19.2.17)(react@19.2.7):
+  use-sidecar@1.1.3(@types/react@19.2.17)(react@19.2.8):
     dependencies:
       detect-node-es: 1.1.0
-      react: 19.2.7
+      react: 19.2.8
       tslib: 2.8.1
     optionalDependencies:
       '@types/react': 19.2.17
 
-  use-sync-external-store@1.6.0(react@19.2.7):
+  use-sync-external-store@1.6.0(react@19.2.8):
     dependencies:
-      react: 19.2.7
+      react: 19.2.8
 
   util-deprecate@1.0.2: {}
 
@@ -6973,10 +6974,10 @@ snapshots:
       '@types/unist': 3.0.3
       vfile-message: 4.0.3
 
-  virtua@0.49.3(patch_hash=30a7a92b94800ec37be8d36546ea98c04a05dcd0637f9fac27a06f016ba2eff4)(react-dom@19.2.7(react@19.2.7))(react@19.2.7):
+  virtua@0.49.3(patch_hash=30a7a92b94800ec37be8d36546ea98c04a05dcd0637f9fac27a06f016ba2eff4)(react-dom@19.2.8(react@19.2.8))(react@19.2.8):
     optionalDependencies:
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
 
   vite@8.0.16(@types/node@25.6.0)(jiti@2.7.0)(yaml@2.9.0):
     dependencies:
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 632a23bc2b9..be122c50ced 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -12,6 +12,12 @@ overrides:
   # <body> when the dialog closed, freezing the app (#1482, reminder dialog).
   # Removable once every @radix-ui dep converges on one version naturally.
   "@radix-ui/react-dismissable-layer": 1.1.19
+  # linkify-it 5.0.0 (pulled in via markdown-it / tiptap-markdown) is affected
+  # by GHSA-22p9-wv53-3rq4 and GHSA-v245-v573-v5vm: crafted link/mailto-heavy
+  # text drives quadratic parsing and can freeze the renderer thread. Fixed in
+  # 5.0.1 / 5.0.2 respectively; pin >=5.0.2 to cover both. Removable once
+  # markdown-it resolves linkify-it >=5.0.2 on its own.
+  linkify-it: "^5.0.2"
 patchedDependencies:
   isomorphic-git: patches/isomorphic-git.patch
   virtua@0.49.3: patches/virtua@0.49.3.patch
diff --git a/preview-features.json b/preview-features.json
index ad8090d5ada..388f1c39b04 100644
--- a/preview-features.json
+++ b/preview-features.json
@@ -5,41 +5,31 @@
       "id": "workflows",
       "name": "Workflows",
       "description": "YAML-defined automations with approval gates",
-      "platforms": [
-        "desktop"
-      ]
+      "platforms": ["desktop"]
     },
     {
       "id": "projects",
       "name": "Projects",
       "description": "Git repository browser and collaboration",
-      "platforms": [
-        "desktop"
-      ]
+      "platforms": ["desktop"]
     },
     {
       "id": "pulse",
       "name": "Pulse",
       "description": "Activity feed with notes, social posts, and agent activity",
-      "platforms": [
-        "desktop"
-      ]
+      "platforms": ["desktop"]
     },
     {
       "id": "forum",
       "name": "Forum Channels",
       "description": "Forum-style threaded channels for long-form discussions",
-      "platforms": [
-        "desktop"
-      ]
+      "platforms": ["desktop"]
     },
     {
       "id": "agentManagedProfiles",
       "name": "Agent-managed profiles",
       "description": "Let agents manage their own relay name and avatar instead of restoring the desktop copy",
-      "platforms": [
-        "desktop"
-      ]
+      "platforms": ["desktop"]
     }
   ]
 }
diff --git a/schema/schema.sql b/schema/schema.sql
index 1fd13941beb..f5f32cc3e35 100644
--- a/schema/schema.sql
+++ b/schema/schema.sql
@@ -572,6 +572,43 @@ CREATE TABLE relay_members (
 
 CREATE INDEX idx_relay_members_role ON relay_members (community_id, role);
 
+-- ── Join policy acceptances ──────────────────────────────────────────────────
+-- Durable evidence of the policy version accepted when an invite claim grants
+-- relay membership. The composite foreign key keeps evidence bound to a live
+-- member in the same community and removes it with that membership.
+
+CREATE TABLE join_policy_acceptances (
+    community_id UUID NOT NULL,
+    pubkey TEXT NOT NULL,
+    policy_version TEXT NOT NULL CHECK (length(policy_version) = 64),
+    accepted_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+    PRIMARY KEY (community_id, pubkey, policy_version),
+    FOREIGN KEY (community_id, pubkey)
+        REFERENCES relay_members (community_id, pubkey) ON DELETE CASCADE
+);
+
+-- ── Relay invites (use-limited invite links) ──────────────────────────────────
+-- Conformance: durable invite records for atomic redemption, community-scoped.
+-- Stores only SHA-256(code) as 32-byte BYTEA; never the reusable bearer code.
+-- PK and UNIQUE both lead with community_id. max_uses NULL = unlimited.
+
+CREATE TABLE relay_invites (
+    community_id  UUID        NOT NULL REFERENCES communities(id),
+    id           UUID        NOT NULL DEFAULT gen_random_uuid(),
+    token_hash   BYTEA       NOT NULL CHECK (length(token_hash) = 32),
+    role         TEXT        NOT NULL DEFAULT 'member' CHECK (role = 'member'),
+    max_uses     INTEGER     CHECK (max_uses BETWEEN 1 AND 10000),
+    use_count    INTEGER     NOT NULL DEFAULT 0 CHECK (use_count >= 0),
+    expires_at   TIMESTAMPTZ NOT NULL,
+    created_by   TEXT        NOT NULL,
+    created_at   TIMESTAMPTZ NOT NULL DEFAULT now(),
+    PRIMARY KEY (community_id, id),
+    UNIQUE (community_id, token_hash),
+    CHECK (max_uses IS NULL OR use_count <= max_uses)
+);
+
+CREATE INDEX relay_invites_expires_at_idx ON relay_invites (expires_at);
+
 -- ── Archived identities (NIP-IA) ──────────────────────────────────────────────
 -- Conformance: archive cannot hide a key in another community. PK scoped.
 
diff --git a/scripts/check-file-sizes-core.mjs b/scripts/check-file-sizes-core.mjs
index 196630ee7e1..1365424628d 100644
--- a/scripts/check-file-sizes-core.mjs
+++ b/scripts/check-file-sizes-core.mjs
@@ -1,105 +1,174 @@
+import { execFileSync } from "node:child_process";
 import { promises as fs } from "node:fs";
 import path from "node:path";
 
-/**
- * Shared file-size check used by the desktop and web workspaces.
- *
- * Each app supplies its own `rules` (which roots/extensions to scan) and an
- * optional `overrides` map of TEMP per-file ceilings. Everything else — the
- * walk, the line count, the violation report, the non-zero exit — lives here so
- * the two apps can never drift.
- */
-
-async function walkFiles(directory) {
-  const entries = await fs.readdir(directory, { withFileTypes: true });
-  const files = await Promise.all(
-    entries.map(async (entry) => {
-      const fullPath = path.join(directory, entry.name);
-      if (entry.isDirectory()) {
-        return walkFiles(fullPath);
-      }
-
-      return [fullPath];
-    }),
-  );
-
-  return files.flat();
+function git(args, cwd, options = {}) {
+  return execFileSync("git", args, {
+    cwd,
+    encoding: "utf8",
+    maxBuffer: 10 * 1024 * 1024,
+    ...options,
+  });
 }
 
-function findRule(rules, relativePath) {
-  return rules.find((rule) => {
-    const normalizedRoot = `${rule.root}${path.sep}`;
-    return relativePath.startsWith(normalizedRoot);
-  });
+function toPosixPath(relativePath) {
+  return relativePath.split(path.sep).join("/");
 }
 
-function countLines(content) {
+export function countLines(content) {
   if (content.length === 0) {
     return 0;
   }
-
   return content.split(/\r?\n/).length;
 }
 
-/**
- * @param {object} options
- * @param {string} options.projectRoot Absolute path the rule roots resolve against.
- * @param {Array<{root: string, extensions: Set<string>, maxLines: number}>} options.rules
- * @param {string} options.label Human label for the failure header (e.g. "Desktop").
- * @param {Map<string, number>} [options.overrides] TEMP per-file ceilings, keyed by path relative to projectRoot.
- * @param {string} options.scriptPath Path mentioned in the failure hint where overrides live.
- */
-export async function runFileSizeCheck({
-  projectRoot,
-  rules,
-  label,
-  overrides = new Map(),
-  scriptPath,
-}) {
-  const candidateFiles = (
-    await Promise.all(
-      rules.map((rule) => {
-        const dir = path.join(projectRoot, rule.root);
-        return fs
-          .access(dir)
-          .then(() => walkFiles(dir))
-          .catch(() => []);
-      }),
-    )
-  ).flat();
+export function allowedLineCount(baseLines, maxLines) {
+  return baseLines == null || baseLines <= maxLines ? maxLines : baseLines;
+}
 
-  const violations = [];
+export function evaluateFileSize({ baseLines, candidateLines, maxLines }) {
+  const limit = allowedLineCount(baseLines, maxLines);
+  return { limit, violates: candidateLines > limit };
+}
 
-  for (const filePath of candidateFiles) {
-    const relativePath = path.relative(projectRoot, filePath);
-    const rule = findRule(rules, relativePath);
-    if (!rule) {
-      continue;
-    }
+function findRule(rules, relativePath) {
+  return rules.find((rule) => relativePath.startsWith(`${rule.root}/`));
+}
+
+export function resolveBaseRef(repoRoot, env = process.env) {
+  if (env.CHECK_FILE_SIZES_BASE) {
+    return env.CHECK_FILE_SIZES_BASE;
+  }
+
+  if (env.GITHUB_ACTIONS === "true") {
+    return "HEAD^1";
+  }
+
+  try {
+    const mergeBase = git(
+      ["merge-base", "origin/main", "HEAD"],
+      repoRoot,
+    ).trim();
+    const head = git(["rev-parse", "HEAD"], repoRoot).trim();
+    return mergeBase === head ? "HEAD" : mergeBase;
+  } catch (error) {
+    throw new Error(
+      "Could not resolve the file-size base from origin/main. Fetch origin/main or set CHECK_FILE_SIZES_BASE to an explicit commit.",
+      { cause: error },
+    );
+  }
+}
 
-    const extension = path.extname(relativePath);
-    if (!rule.extensions.has(extension)) {
-      continue;
+export function parseChangedFiles(output) {
+  const fields = output.split("\0");
+  const changes = [];
+
+  for (let index = 0; index < fields.length - 1; ) {
+    const status = fields[index++];
+    if (status.startsWith("R") || status.startsWith("C")) {
+      changes.push({
+        status: status[0],
+        oldPath: fields[index++],
+        path: fields[index++],
+      });
+    } else {
+      changes.push({ status: status[0], path: fields[index++] });
     }
+  }
+
+  return changes;
+}
+
+function changedProjectFiles({ repoRoot, projectRelative, baseRef }) {
+  const output = git(
+    ["diff", "--name-status", "-z", "-M", baseRef, "--", projectRelative],
+    repoRoot,
+  );
+  const changes = parseChangedFiles(output);
+  const trackedPaths = new Set(changes.map((change) => change.path));
+  const untracked = git(
+    ["ls-files", "--others", "--exclude-standard", "-z", "--", projectRelative],
+    repoRoot,
+  )
+    .split("\0")
+    .filter(Boolean);
 
-    const limit = overrides.get(relativePath) ?? rule.maxLines;
-    const content = await fs.readFile(filePath, "utf8");
-    const lineCount = countLines(content);
-    if (lineCount > limit) {
-      violations.push({ limit, lineCount, relativePath });
+  for (const filePath of untracked) {
+    if (!trackedPaths.has(filePath)) {
+      changes.push({ status: "A", path: filePath });
     }
   }
+  return changes;
+}
+
+function readBaseFile(repoRoot, baseRef, filePath) {
+  return git(["show", `${baseRef}:${filePath}`], repoRoot, {
+    encoding: null,
+  }).toString("utf8");
+}
+
+export async function runFileSizeCheck({ projectRoot, rules, label }) {
+  // Every governed project is a direct child of the repository root. Derive
+  // these paths without Git so hook-provided repository environment variables
+  // cannot collapse the project pathspec to an empty string.
+  const repoRoot = path.dirname(projectRoot);
+  const projectRelative = toPosixPath(path.basename(projectRoot));
+  const baseRef = resolveBaseRef(repoRoot);
+
+  // Fail clearly instead of silently turning a missing/shallow base into a pass.
+  git(["cat-file", "-e", `${baseRef}^{commit}`], repoRoot);
 
-  if (violations.length > 0) {
-    console.error(`${label} file size check failed:`);
-    for (const violation of violations) {
-      console.error(
-        `- ${violation.relativePath}: ${violation.lineCount} lines (limit ${violation.limit})`,
-      );
+  const violations = [];
+  for (const change of changedProjectFiles({
+    repoRoot,
+    projectRelative,
+    baseRef,
+  })) {
+    if (change.status === "D") continue;
+
+    const relativePath = toPosixPath(
+      path.relative(projectRelative, change.path),
+    );
+    const rule = findRule(rules, relativePath);
+    if (!rule || !rule.extensions.has(path.extname(relativePath))) continue;
+
+    const candidatePath = path.join(repoRoot, change.path);
+    const candidateLines = countLines(await fs.readFile(candidatePath, "utf8"));
+    const basePath = change.oldPath ?? change.path;
+    const baseContent =
+      change.status === "A" ? null : readBaseFile(repoRoot, baseRef, basePath);
+    const baseLines = baseContent == null ? null : countLines(baseContent);
+    const result = evaluateFileSize({
+      baseLines,
+      candidateLines,
+      maxLines: rule.maxLines,
+    });
+
+    if (result.violates) {
+      violations.push({
+        relativePath,
+        baseLines,
+        candidateLines,
+        limit: result.limit,
+      });
     }
+  }
+
+  if (violations.length === 0) return;
+
+  console.error(`${label} file size ratchet failed (base ${baseRef}):`);
+  for (const violation of violations) {
+    const before = violation.baseLines == null ? "new" : violation.baseLines;
+    const delta =
+      violation.baseLines == null
+        ? ""
+        : ` (${violation.candidateLines - violation.baseLines >= 0 ? "+" : ""}${violation.candidateLines - violation.baseLines})`;
     console.error(
-      `Split the file or add a narrowly scoped exception in \`${scriptPath}\`.`,
+      `- ${violation.relativePath}: ${before} -> ${violation.candidateLines}${delta} lines (allowed ${violation.limit})`,
     );
-    process.exit(1);
   }
+  console.error(
+    "Keep new files at or below the limit; files already over it may not grow.",
+  );
+  process.exitCode = 1;
 }
diff --git a/scripts/check-file-sizes-core.test.mjs b/scripts/check-file-sizes-core.test.mjs
new file mode 100644
index 00000000000..14dfe4b8daa
--- /dev/null
+++ b/scripts/check-file-sizes-core.test.mjs
@@ -0,0 +1,109 @@
+import assert from "node:assert/strict";
+import { execFileSync } from "node:child_process";
+import { mkdtempSync } from "node:fs";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import test from "node:test";
+import {
+  allowedLineCount,
+  countLines,
+  evaluateFileSize,
+  parseChangedFiles,
+  resolveBaseRef,
+} from "./check-file-sizes-core.mjs";
+
+function git(repo, ...args) {
+  return execFileSync("git", args, { cwd: repo, encoding: "utf8" }).trim();
+}
+
+test("local base resolution uses the branch merge-base and fails without origin/main", () => {
+  const repo = mkdtempSync(path.join(tmpdir(), "file-size-base-"));
+  git(repo, "init", "-b", "main");
+  git(repo, "config", "user.name", "Test");
+  git(repo, "config", "user.email", "test@example.com");
+  git(repo, "commit", "--allow-empty", "-m", "base");
+  git(repo, "remote", "add", "origin", repo);
+  git(repo, "fetch", "origin", "main:refs/remotes/origin/main");
+  const base = git(repo, "rev-parse", "HEAD");
+  git(repo, "switch", "-c", "feature");
+  git(repo, "commit", "--allow-empty", "-m", "first branch commit");
+  git(repo, "commit", "--allow-empty", "-m", "second branch commit");
+
+  assert.equal(resolveBaseRef(repo, {}), base);
+  git(repo, "update-ref", "-d", "refs/remotes/origin/main");
+  assert.throws(
+    () => resolveBaseRef(repo, {}),
+    /Fetch origin\/main or set CHECK_FILE_SIZES_BASE/,
+  );
+});
+
+test("counts empty, LF, and CRLF content with the existing semantics", () => {
+  assert.equal(countLines(""), 0);
+  assert.equal(countLines("one\n"), 2);
+  assert.equal(countLines("one\r\ntwo"), 2);
+});
+
+test("new files use the configured ceiling", () => {
+  assert.equal(allowedLineCount(null, 1000), 1000);
+  assert.deepEqual(
+    evaluateFileSize({ baseLines: null, candidateLines: 1000, maxLines: 1000 }),
+    {
+      limit: 1000,
+      violates: false,
+    },
+  );
+  assert.equal(
+    evaluateFileSize({ baseLines: null, candidateLines: 1001, maxLines: 1000 })
+      .violates,
+    true,
+  );
+});
+
+test("a compliant file may not cross the ceiling", () => {
+  assert.equal(
+    evaluateFileSize({ baseLines: 996, candidateLines: 1000, maxLines: 1000 })
+      .violates,
+    false,
+  );
+  assert.equal(
+    evaluateFileSize({ baseLines: 996, candidateLines: 1003, maxLines: 1000 })
+      .violates,
+    true,
+  );
+});
+
+test("parses modifications, deletions, and renames from Git's NUL format", () => {
+  assert.deepEqual(
+    parseChangedFiles(
+      "M\0desktop/src/a.ts\0D\0desktop/src/b.ts\0R100\0desktop/src/old.ts\0desktop/src/new.ts\0",
+    ),
+    [
+      { status: "M", path: "desktop/src/a.ts" },
+      { status: "D", path: "desktop/src/b.ts" },
+      {
+        status: "R",
+        oldPath: "desktop/src/old.ts",
+        path: "desktop/src/new.ts",
+      },
+    ],
+  );
+});
+
+test("an inherited oversized file may hold or shrink but not grow", () => {
+  assert.equal(allowedLineCount(1026, 1000), 1026);
+  assert.equal(
+    evaluateFileSize({ baseLines: 1026, candidateLines: 1026, maxLines: 1000 })
+      .violates,
+    false,
+  );
+  assert.equal(
+    evaluateFileSize({ baseLines: 1026, candidateLines: 1001, maxLines: 1000 })
+      .violates,
+    false,
+  );
+  assert.equal(
+    evaluateFileSize({ baseLines: 1026, candidateLines: 1027, maxLines: 1000 })
+      .violates,
+    true,
+  );
+});
diff --git a/scripts/check-px-text-core.mjs b/scripts/check-px-text-core.mjs
index b488fe262db..3f98aa54089 100644
--- a/scripts/check-px-text-core.mjs
+++ b/scripts/check-px-text-core.mjs
@@ -75,10 +75,14 @@ export async function runPxTextCheck({
   const violations = [];
 
   for (const filePath of candidateFiles) {
-    const relativePath = path.relative(projectRoot, filePath);
-    const rule = rules.find((r) =>
-      relativePath.startsWith(`${r.root}${path.sep}`),
-    );
+    // `rules[].root` and the `overrides` keys are authored with `/`, but
+    // path.relative yields `\` on Windows — so every comparison against them
+    // has to happen in posix form or it silently matches nothing.
+    const relativePath = path
+      .relative(projectRoot, filePath)
+      .split(path.sep)
+      .join("/");
+    const rule = rules.find((r) => relativePath.startsWith(`${r.root}/`));
     if (!rule) {
       continue;
     }
diff --git a/scripts/e2e-git-perms.sh b/scripts/e2e-git-perms.sh
index 105c1d547e8..f6a6a93063e 100755
--- a/scripts/e2e-git-perms.sh
+++ b/scripts/e2e-git-perms.sh
@@ -507,13 +507,26 @@ else
     fail "Bot2 push failed (bot should be promoted to member)"
 fi
 
-# ── Test: Non-member push denied ──────────────────────────────────────────────
+# ── Test: Non-member read denied (SEC-005) + non-member push denied ──────────
 
-log "Guest: attempting push (should be denied)..."
+log "Guest: attempting clone (should be denied — SEC-005 read gate)..."
 GUEST_DIR="$WORK_DIR/guest"
 
-git_clone "$GUEST_PRIVKEY" "${RELAY_HTTP}/git/${OWNER_PUBKEY}/${REPO_NAME}" "$GUEST_DIR" \
-    || fail "Guest clone failed (read access should work)"
+if git_clone "$GUEST_PRIVKEY" "${RELAY_HTTP}/git/${OWNER_PUBKEY}/${REPO_NAME}" "$GUEST_DIR"; then
+    fail "Guest clone succeeded (non-member reads should be denied — SEC-005)"
+fi
+success "Guest clone denied (not a channel member) — SEC-005 read gate"
+
+# Members can still read: bot1/bot2 cloned successfully above, and the
+# owner-verification clone below re-confirms member read access post-gate.
+
+log "Guest: attempting push (should be denied)..."
+# The guest cannot clone anymore, so stage the push from a copy of bot1's
+# member clone, credentialed as the guest. (SEC-005 denies the push at the
+# receive-pack advertisement, before any ref negotiation, so the copy being
+# behind the remote does not matter.)
+rm -rf "$GUEST_DIR"
+cp -R "$BOT1_DIR" "$GUEST_DIR"
 
 echo "<!-- unauthorized -->" >> "$GUEST_DIR/index.html"
 git -C "$GUEST_DIR" add -A
@@ -523,8 +536,11 @@ git -C "$GUEST_DIR" -c user.name="Guest" -c user.email="guest@evil.test" \
 PUSH_OUTPUT=$(git_push "$GUEST_PRIVKEY" "$GUEST_DIR" 2>&1) && \
     fail "Guest push succeeded (should have been denied!)"
 
-# Verify the denial is permission-related, not a network error
-if echo "$PUSH_OUTPUT" | grep -qi "denied\|forbidden\|not authorized\|403\|permission"; then
+# Verify the denial is permission-related, not a network error. With the
+# SEC-005 read gate the denial surfaces at the receive-pack advertisement
+# as a generic "repository not found" (membership must not be probeable);
+# hook-level denials phrase it as denied/forbidden.
+if echo "$PUSH_OUTPUT" | grep -qi "denied\|forbidden\|not authorized\|403\|permission\|not found\|404"; then
     success "Guest push denied (not a channel member) — reason confirmed in output"
 else
     warn "Guest push failed but denial reason not found in output: $PUSH_OUTPUT"
@@ -884,12 +900,15 @@ fi
 # ATTACK: A malicious repo could set core.hooksPath in its .git/config to point
 # to /dev/null or a no-op script. This only affects client-side hooks — the
 # server's pre-receive hook is invoked by git-receive-pack on the SERVER, not
-# the client. This test confirms the server hook still fires.
+# the client. This test confirms server-side authorization still fires.
+# (Clone as bot1 — the SEC-005 read gate denies guest clones — then push as
+# the guest: the unauthorized push must be denied regardless of client config,
+# whether at the read gate or the server hook.)
 
 log "Hook integrity: client core.hooksPath cannot bypass server hook..."
 HOOKSPATH_DIR="$WORK_DIR/hookspath-test"
 
-NOSTR_PRIVATE_KEY="$GUEST_PRIVKEY" GIT_TERMINAL_PROMPT=0 \
+NOSTR_PRIVATE_KEY="$BOT1_PRIVKEY" GIT_TERMINAL_PROMPT=0 \
     git clone \
     -c credential.helper="" \
     -c credential.useHttpPath=true \
diff --git a/web/scripts/check-file-sizes.mjs b/web/scripts/check-file-sizes.mjs
index 093dc3c2d71..810a2b7ae72 100644
--- a/web/scripts/check-file-sizes.mjs
+++ b/web/scripts/check-file-sizes.mjs
@@ -29,5 +29,4 @@ await runFileSizeCheck({
   projectRoot,
   rules,
   label: "Web",
-  scriptPath: "web/scripts/check-file-sizes.mjs",
 });
diff --git a/web/src/features/invite/ui/InvitePage.tsx b/web/src/features/invite/ui/InvitePage.tsx
index 6de8d038759..0033e6cad5c 100644
--- a/web/src/features/invite/ui/InvitePage.tsx
+++ b/web/src/features/invite/ui/InvitePage.tsx
@@ -24,6 +24,20 @@ type JoinPolicy = {
 
 type PolicyDocument = { title: string; markdown: string };
 
+/** Convert relay invite sentinels into user-facing recovery guidance. */
+function inviteClaimErrorMessage(message: string): string {
+  if (message.includes("invite_exhausted")) {
+    return "This invite has reached its use limit. Ask for a new invite.";
+  }
+  if (message.includes("invite_expired")) {
+    return "This invite has expired. Ask for a new invite.";
+  }
+  if (message.includes("invite_invalid")) {
+    return "This invite is invalid. Check the link or ask for a new invite.";
+  }
+  return message;
+}
+
 /** Landing page for a community invite link (`/invite/<code>`). */
 export function InvitePage({ code }: { code: string }) {
   const relay = relayWsUrl();
@@ -110,9 +124,9 @@ export function InvitePage({ code }: { code: string }) {
       await claimInviteInBrowser(code, receipt);
       window.location.assign("/");
     } catch (error) {
-      setBrowserJoinError(
-        error instanceof Error ? error.message : "Could not claim this invite.",
-      );
+      const message =
+        error instanceof Error ? error.message : "Could not claim this invite.";
+      setBrowserJoinError(inviteClaimErrorMessage(message));
     } finally {
       setJoiningBrowser(false);
     }